06_境外及港澳台调查报告_part05.md

06_境外及港澳台调查报告 · 整合分片 part05

本片含 46 份报告。

FD06448 ｜ 2012_美国_Bayer CropScience Pesticide Waste 储罐 爆炸 - Bayer CropScience Pesticide Waste Tank Explosion__最终报告_2_2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因：燃气/爆炸 ｜ 来源格式：pdf

DETAILS Distribution, posting, or copying of this PDF is strictly prohibited without written permission of the National Academies Press. (Request Permission) Unless otherwise indicated, all materials in this PDF are copyrighted by the National Academy of Sciences. Copyright © National Academy of Sciences. All rights reserved. THE NATIONAL ACADEMIES PRESS Visit the National Academies Press at NAP.edu and login or register to get: – Access to free PDF downloads of thousands of scientific reports – 10% off the price of print titles – Email or social media notifications of new titles related to your interests – Special offers and discounts   GET THIS BOOK FIND RELATED TITLES This PDF is available at SHARE CONTRIBUTORS     SUGGESTED CITATION http://nap.edu/13385 The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience (2012)

218 pages | 6 x 9 | HARDBACK

ISBN 978-0-309-38723-1 | DOI 10.17226/13385 Committee on Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience; Board on Chemical Sciences and Technology; Division on Earth and Life Studies; National Research Council National Research Council 2012. The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience. Washington, DC: The National Academies Press. https://doi.org/10.17226/13385.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Committee on Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience Board on Chemical Sciences and Technology Division on Earth and Life Studies THE NATIONAL ACADEMIES PRESS Washington, D.C. www.nap.edu

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE NATIONAL ACADEMIES PRESS   500 Fifth Street, NW   Washington, DC 20001 NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The members of the committee responsible for the report were chosen for their special competences and with regard for appropriate balance. This study was supported by the Chemical Safety and Hazard Investigation Board under Award No: TPD-CSB-1O-C-OOO1. Any opinions, findings, conclusions, or recommendations expressed in this publication are those of the authors and do not necessarily reflect the views of the organizations or agencies that provided support for the project. International Standard Book Number 13:  978-0-309-25543-1 International Standard Book Number 10:  0-309-25543-0 Cover image: Bayer CropScience. Additional copies of this report are available from the National Academies Press, 500 Fifth Street, NW, Keck 360, Washington, DC 20001; (800) 624-6242 or (202) 334-3313; http:// www.nap.edu. Copyright 2012 by the National Academy of Sciences. All rights reserved. Printed in the United States of America.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a man- date that requires it to advise the federal government on scientific and technical matters. Dr. Ralph J. Cicerone is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achievements of engineers. Dr. Charles M. Vest is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate professions in the examina- tion of policy matters pertaining to the health of the public. The Institute acts under the responsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Harvey V. Fineberg is president of the Institute of Medicine. The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy’s purposes of furthering knowledge and advising the federal government. Functioning in accordance with general policies determined by the Academy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered jointly by both Academies and the Institute of Medicine. Dr. Ralph J. Cicerone and Dr. Charles M. Vest are chair and vice chair, respectively, of the National Research Council. www.national-academies.org

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. COMMITTEE ON INHERENTLY SAFER CHEMICAL PROCESSES: THE USE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Elsa Reichmanis (Chair), Georgia Institute of Technology Paul Amyotte, Dalhousie University Peter Beak, University of Illinois at Urbana-Champaign Michael L. P. Elliott, Georgia Institute of Technology Wayne B. Gray, Clark University Dennis C. Hendershot, Independent Consultant Andrea Kidd Taylor, Morgan State University Michael K. Lindell, Texas A&M University Jacqueline MacDonald Gibson, University of North Carolina at Chapel Hill Jeffery J. Siirola, Eastman Chemical Company (retired) John Sorensen, Oak Ridge National Laboratory (resigned from committee on 2/28/2011) National Research Council Staff Kathryn Hughes, Study Director Dorothy Zolandz, Director Jeffrey Jacobs, Director, Water Science and Technology Board Ericka McGowan, Program Officer (until April 2011) Sheena Siddiqui, Senior Program Associate Amanda Cline, Administrative Assistant Rachel Yancey, Senior Program Assistant v

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. vi BOARD ON CHEMICAL SCIENCES AND TECHNOLOGY Pablo Debenedetti (Co-Chair), Princeton University C. Dale Poulter (Co-Chair), University of Utah, Salt Lake City Zhenan Bao, Stanford University Robert G. Bergman, University of California, Berkeley Henry E. Bryndza, E. I. du Pont de Nemours & Company Emily Carter, Princeton University David Christianson, University of Pennsylvania Mary Jane Hagenson, Chevron Phillips Chemical Company LLC Carol J. Henry, The George Washington University Jill Hruby, Sandia National Laboratories Michael Kerby, ExxonMobil Chemical Charles E. Kolb, Aerodyne Research, Inc. Josef Michl, University of Colorado, Boulder Sander G. Mills, Merck, Sharp, & Dohme Corporation David Morse, Corning Inc. Robert E. Roberts, Institute for Defense Analyses Darlene J. Solomon, Agilent Technologies Jean Tom, Bristol-Myers Squibb David Walt, Tufts University National Research Council Staff Dorothy Zolandz, Director Kathryn Hughes, Program Officer Tina M. Masciangioli, Senior Program Officer Douglas Friedman, Program Officer Amanda Cline, Administrative Assistant Sheena Siddiqui, Senior Program Associate Rachel Yancey, Senior Program Assistant

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. vii The Committee on Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) At Bayer CropScience would like to thank the many technical, chemical, and engineering experts who contributed to the integrity of this report through the submission of informative materials and attendance of committee meetings. The committee would like to acknowledge Amy McCormick and Lucy Sciallo-Tyler of the U.S. Chemical Safety and Hazard Investigation Board; Steven Smythe, Patrick Ragan, Connie Stewart, Cindi Lester, Walter Martin, and the staff of the Bayer CropScience facility in Institute, West Virginia; Scott Berger, Center for Chemical Process Safety; Randall Sawyer, Contra Costa County; George Famini and George Emmett, Department of Homeland Security Analysis Center; John Carberry, Carberry EnviroTech; Matthew Blackwood and Larry Zuspan, Kanawha Putman Emergency Planning Committee; Craig Mattheisson, U.S. Environmental Protection Agency; and Warren Woomer of Charleston, South Carolina. We would also like to thank West Virginia State University in Institute, West Virginia for hosting the committee members and National Research Council staff for an open public comment session. Our thanks to all those who participated in the comment periods and who contributed information in support of the com- mittee’s data-gathering efforts. Acknowledgments

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. This report has been reviewed in draft form by persons chosen for their diverse perspectives and technical expertise in accordance with procedures approved by the National Research Council’s Report Review Committee. The purpose of this independent review is to provide candid and critical comments that will assist the institution in making the published report as sound as possible and to ensure that it meets institutional standards of objectivity, evidence, and responsiveness to the study charge. The review comments and draft manuscript remain confidential to protect the integrity of the deliberative process. We wish to thank the following for their review of this report: Daniel A. Crowl, Michigan Technological University Chau-Chyun Chen, AspenTech Martin Sherwin, W.R. Grace & Company, Retired John Sawyer, MATRIC Research Michael Wright, United Steel, Paper and Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service Workers International Union (United Steelworkers) Scott Farrow, UMBC Gail Bingham, RESOLVE Ned Heindel, Lehigh University Michael R. Hoffman, California Institute of Technology Pam Nixon, West Virginia Department of Environmental Protection May Berenbaum, University of Illinois at Urbana-Champaign John H. Sorensen, Oak Ridge National Laboratory (retired) ix Acknowledgment of Reviewers

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. x PREFACE Although the reviewers listed above provided many constructive comments and suggestions, they were not asked to endorse the conclusions or recom- mendations, nor did they see the final draft of the report before its release. The review of this report was overseen by David Bonner, Stematix, Inc. and W. Carl ­Lineberger, University of Colorado at Boulder. Appointed by the National Research Council, they were responsible for making certain that an independent examination of this report was carried out in accordance with institutional proce- dures and that all review comments were carefully considered. Responsibility for the final content of this report rests entirely with the authors and the institution. ACKNOWLEDGMENTS

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. xi Contents Summary 1 Technical Summary 13 1 Introduction 21 2 Bhopal and Chemical Process Safety 31 3 Industrial Production and Use of MIC at Bayer CropScience 43 4 The Concepts of Inherently Safer Processes and Assessment 59 5 MIC and Pesticide Production at the Institute Plant: Alternatives Assessment 83 6 A Framework for Decision Making 113 7 Process Safety Management at Bayer CropScience 131 8 Post-incident Retrospective Process Assessment 141 Appendixes A Statement of Task 155 B Carbamate Pesticide and Methyl Isocyanate Timeline 157 C Emergency Response and Emergency Preparedness 173 D Policy Context of Inherently Safer Processes 179 E Meeting Agendas 191 F Biographies of Committee Members 195 G Acronyms 201

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. The use of hazardous chemicals such as methyl isocyanate can be a significant concern to the residents of communities adjacent to chemical facilities, but is often an integral, necessary part of the chemical manufac- turing process. In order to ensure that chemical manufacturing takes place in a manner that is safe for workers, members of the local community, and the environment, the philosophy of inherently safer processing can be used to identify opportunities to eliminate or reduce the hazards associated with chemical processing. However, the concepts of inherently safer process analysis have not yet been adopted in all chemical manufacturing plants. This report presents a possible framework to help plant managers choose between alternative processing options—considering factors such as environ- mental impact and product yield as well as safety—to develop a chemical manufacturing system. In 2008, an explosion at the Bayer CropScience chemical production plant in Institute, West Virginia, resulted in the deaths of two employees, a fire within the produc­tion unit, and extensive damage to nearby structures. The accident drew renewed attention to the fact that the Bayer facility manufactured and stored methyl isocyanate, or MIC—a volatile, highly toxic chemical (see Box 1) used in the production of carbamate pesticides and the agent responsible for thou­sands of deaths in Bhopal, India, in 1984. In the Institute incident, debris from the blast hit the shield surrounding a MIC storage tank, and although the container was not damaged, an investigation by the U.S. Chemical Safety and Hazard Investigation Board found that the debris could have struck a relief valve vent pipe and caused the release of MIC to the atmosphere. The Board’s investigation also highlighted 1 Summary

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 2 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE a number of weaknesses in the Bayer facility’s emergency response systems. In light of these concerns, the Board requested the National Research Council con- vene a committee of independent experts to write a report that examines the use and storage of MIC at the Bayer facility, and to evaluate the analyses on alterna- tive production methods for MIC and carbamate pesticides performed by Bayer and the previous owners of the facility. Following the 2008 accident, Bayer halted MIC production while complet- ing safety modifications, such as reducing onsite inventory of MIC and build- ing underground storage facilities. Then, in 2011—with the National Research ­Council study already underway—the Environmental Protection Agency cancelled registration of aldicarb, a carbamate pesticide known commercially as TEMIK that is produced using MIC. Shortly afterwards, Bayer announced that production of certain carbamate pesticides was no longer economically viable for the company and would cease at the end of 2012. In the meantime, Bayer intended to finalize modifications to the MIC plant at Institute and restart manufacturing of aldicarb, carbaryl (another carbamate pesticide known commercially as SEVIN), and the interme­diatematerials required for their production (including MIC) in mid 2012. In February 2011, amid concerns about the safety of restarting MIC process- ing at the Institute, West Virginia plant, a group of local residents filed suit against Bayer. On March 18, 2011, Bayer announced that it no longer intended to restart production of MIC. In a press release, the company stated that “uncertainty over delays has led the company to the conclusion that a restart of production can no longer be expected in time for the 2011 growing season” (see Box 2). In response to these developments, the National Research Council report’s authoring committee felt it necessary to change their approach to addressing the tasks they had been given. In particular, it became apparent that a full review of technologies for carbamate pesticide manufacture was less relevant, as the pesticides would no longer be produced at the Institute plant. In addition, it BOX 1 What Is MIC?

MIC (methyl isocyanate) is a volatile, colorless liquid that is extremely flammable, and potentially explosive when mixed with air. MIC reacts with water, giving off heat and producing methylamine and carbon dioxide. The liquid and vapor are toxic when inhaled, ingested, or exposed to the eyes or skin. The release of a cloud of MIC gas caused the Bhopal disaster in 1984, killing close to 3,800 people who lived near the Union Carbide India ­Limited plant in Bhopal, India.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. SUMMARY 3 became clear that a full analysis of manufacturing and energy costs would require greater time and resources than were available for the study. Instead, the com- mittee focused on a limited number of possible alternative production processes, presenting trade-offs with particular atten­tion to safety considerations. Because deciding between alternative processes requires consideration and weighing of a number of different factors, including safety, one possible framework for evaluat- ing these complex decisions is presented. MAKING THE USE OF HAZARDOUS CHEMICALS SAFER Within the chemical engineering community, the use of process safety ­management—a methodology for controlling hazards across a facility or orga- nization to reduce the frequency or consequences of an accident—is a standard practice required by the Occupational Safety and Health Administration. The goal of process safety is a systematic approach to safety that involves the pro- active identification, evaluation, mitigation, or prevention of chemical releases that might occur as a result of failures in the process, procedures, or equipment. Process Safety Management ensures that facilities consider multiple options for achieving a safe process, and carefully weigh the possible outcomes of each decision, and the Process Safety Management Standard, promulgated by the Occupational Safety and Health Administration in 1992, lists 14 mandatory elements—­ranging from employee training to process hazard analysis—to build- ing a chemical processing system. One approach for considering each of the options for safer processing is to consider a hierarchy of hazard control. The hierarchy contains four tiers: inher- ent, passive, active, and procedural, described below. Considering these possible hazard control methods in turn can help identify options for process design or modifications to improve process safety. Inherent: The inherent approach to hazard control is to minimize or elimi- nate the hazard, for example by replacing a flammable solvent with water to elim- BOX 2 MIC Storage and Use in the United States

The Bayer CropScience facility in Institute, West Virginia was the only site in the U.S. that stored large quantities of MIC. The chemical is generated during chemical manufacturing at another chemical facility in Texas, but at this facility the chemical is used up in the next stages of the reaction moments after being produced. MIC is still produced at several other chemical facilities worldwide.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 4 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE inate a fire hazard, rather than accepting the existence of hazards and designing safety systems to control them (see Box 3). There are four strategies to consider when making any chemical process inherently safer: • Substitute—Use materials, chemistry, or processes that are less hazardous. • Minimize—Use the smallest quantity of hazardous materials feasible for the process, reduce the size of equipment operating under hazardous conditions such as high temperature or pressure. • Moderate—Reduce hazards by dilution, refrigeration, or process alterna- tives which operate at less hazardous conditions reduce the potential impact of an accident by siting hazardous facilities in locations far from people or other property. • Simplify—Eliminate unnecessary complexity, and design “user-friendly” plants. Passive: Passive safety systems are those that control hazards with process or equipment design features without additional, active functioning of any device. For example, a containment dike around a hazardous material storage tank is a passive system to restrict a chemical spill to a limited area. Active: Active safety systems control hazards through systems that monitor and maintain specific conditions, or are triggered by a specific event. Examples of active systems include a sprinkler system that is triggered by smoke or heat. Procedural: Procedural safety systems control hazards through personnel education and manage­ment. Such systems include standard operating procedures, safety rules and procedures, operator training, emergency response procedures, and management systems. Only the inherent tier of process safety management invites consideration of the elimination or minimization of a given hazard; the other tiers are focused on control of an existing hazard. Although a valuable tool, consideration of inher- ently safer processes is not currently a required component of the Occupational Safety and Health Administration’s Process Safety Management Standard. See Box 4 for the alternative production methods considered by Bayer. Each possible approach presents its own costs and benefits. For example, a non-MIC- based process for production of aldicarb (option 2) means that there is no risk of worker exposure to MIC. However, some non-MIC-based processes could result in lower purity in the aldicarb, which could negatively affect the characteristics of the final commercial product. Just-in-time production of gaseous MIC product (which falls under option 3) would eliminate the risk of catastrophic release of that material within the community, but it would require a significant re-design

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. SUMMARY 5 of the facility and would, in its current form, result in a final product with lower purity than the existing process. In evaluating the alternatives, considering costs and benefits such as risk, cost, quality of final product, and community perception, no one method out- performed all others in every category. The process ultimately chosen by Bayer poses higher risks to the surrounding community due to the volume of MIC stored at the facility, but it also considerably decreases the amount of wastewater gener- ated by the process, thereby reducing health risks to the community from damage to local surface water quality (see Box 5). IMPLEMENTING INHERENTLY SAFER PROCESS ASSESSMENTS Inherently safer process assessments can be valuable components of process safety management that can help a facility consider the full range of options in process design. However, inherently safer process assessments will not always result in a clear, well-defined, and feasible path forward. Although one pro- cess alternative may be inherently safer with respect to one hazard—toxicity of by-products, for example—the process may present other hazards, such as an increased risk of fire or more severe environmental impacts. Choosing between options for process design involves considering a series of tradeoffs and develop- ing appropriate combinations of inherent, passive, active, and procedural safety systems to manage all hazards. Some hazards will be best managed using inherent BOX 3 Emergency Preparedness and Inherently Safer Processes

Inherently safer processes can help reduce demands on emergency services. Specifically, applying the inherently safer principle of substitu­ tion reduces vulnerability if a chemical release occurred; minimization reduces the quantity of chemical available for release; and moderation decreases the temperature and pressure of release.

However, the implementation of inherently safer processes can some­ times transfer risk to new sites. For example, reducing the storage of hazardous chemicals at a chemical facility may make it necessary to increase the number of shipments of chemicals to the site to meet pro­ cess requirements, with the potential to increase the risk of a chemical release along the transportation route. While the emergency services in a community that houses a chemical processing facility would likely be prepared for the possibility of a chemical release, sites along the transportation route would likely have fewer resources to support an emergency response.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 6 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE methods, but others will inevitably remain and be effectively managed with other process safety management systems. Although the philosophy of inherently safer processes applies at all stages of processing, the available options and the feasibility of implementing them can change over the course of a technology’s life cycle. For this reason, it is easiest to implement inherently safer process design before process technologies have been chosen, facilities built, or customers have made commitments based on products with particular characteristics. As a product moves through its life cycle, these and other factors may limit options, make changes more difficult, or involve more people and organizations in the change. In order to build an inherently safer system, each stage of the process life cycle should be considered: Selection of basic technology: Identify inherently safer options for chemi- cal synthesis. Implementation of selected technology: How will the chosen process chemistry be imple­mented? Can hazardous operating conditions be minimized? Can impurities and by-products be avoided to eliminate purification steps? Plant design: Considerations include plant proximity to the surrounding population, in-plant occupied areas, sensitive environmental areas, and the gen- eral layout of equipment on the plant site. Detailed equipment design: Minimize the inventory of hazardous material in specific pieces of process equipment. Consider the impact of equipment layout on the length and size of piping containing hazardous materials. Consider human factors in the design of equipment to minimize the potential for incorrect opera- tion and human error. Operation: Use inherently safer processing principles in ongoing process safety management activities such as management of change, inci­dent investiga- tion, pre-startup safety reviews, operating procedures, and training to identify new opportunities for inherently safer processes. Challenges in Measuring Inherent Safety There are tools to measure the degree of inherent safety of a given process or processing alternative, but there is no current consensus on the most reliable metrics. Some metrics consider the likelihood of different hazards such as fire, explosion, or toxicity using penalty factors assigned based on the severity of the hazard to calculate an overall hazard index. However, the origin and justification of this relative scale is unclear, and these indexes are not designed to be adjusted

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. SUMMARY 7 readily in order to reflect the variation in preferences among attributes or will- ingness to tolerate risk that different constituencies may exhibit. For example, a company owner may be willing to tolerate a small risk of a spill that could have health effects in the community if the alternative involved a much higher risk of a fire that would seriously damage the facility, whereas members of the commu­nity may not accept such a tradeoff, and employees of the firm (who place some value on keeping the facility intact in order to retain their jobs) might fall somewhere in between the owner and the community. Choosing Between Alternative Processes: A Framework for Decision Making Choosing between multiple process alternatives with conflicting trade-offs is a concern faced by any chemical processing facility. When no option is clearly favorable to the others, the question arises as to what decision-making framework a company could use to consider the trade-offs of process choices from an inher- ently safer perspective. Employing Decision in Inherent Safety Assessments As currently performed, a potential concern with using inherently safer pro- cess analysis is that it may become focused too narrowly, and as a consequence, may overlook certain outcomes. Even when multiple outcomes are recognized, they may be inappropri­ately weighted. For example, existing indexes for assess- ing inherently safer processes cannot capture the preferences of all decision ­makers, and the many trade-offs, uncertainties, and risk tolerances are hidden from view as implicit assumptions rather than explicit chosen parameters. One possible method for incorporating these preferences is to draw upon multi-criteria decision analyses, which use mathemat­ical constructs to assess and evaluate stakeholder input to play a role in developing weighted compari­sons between options. One example of decision theory analysis is multi-attribute utility (MAU) theory. This is not a new idea to the chemical community—in 1995, the Center for Chemical Process Safety (CCPS) published a book that suggested this and other decision aids could be used to support process safety assessments. However, though employed regularly in other sectors, these decision aids have yet to take hold in the chemical process industry. Key obstacles to their use include lack of familiarity with the tools among chemical process industry decision makers and the fear that the methods are either too simplistic or too costly to use. Nonethe- less, the report’s authoring committee found that decision analysis techniques could prove valuable for strengthening the integration of safety concerns into decision-­making in the chemical process industry. The use of these techniques could benefit not only the communities at risk from safety breaches, but also the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 8 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE BOX 4 Alternative Methods for Producing MIC and Carbamate Pesticides

The report’s authoring committee reviewed Bayer’s assessment of alternative processes for the manufacture of MIC and carbamate pesti­ cides and considered the alternatives and trade-offs. The alternative processes Bayer considered fall into the following broad categories:

1. Continue with the current process
2. Adopt an alternative process that does not involve MIC
3. Use an alternative process for MIC production that would consume

MIC immediately, and therefore onsite storage of MIC would not be required

1. Reduce the volume of stored MIC, and the risks associated with

transporting MIC from site to site, by re-arranging process equipment BOX 5 Inherently Safer Process Assessments at Bayer CropScience

Because the view of what constitutes an inherently safer process ­varies among professionals, the chemical industry lacks a common under­standing and set of practice protocols for identifying safer pro­ cesses. In its presentations to the report’s authoring committee, Bayer stated that inherently safer processing is an integral part of its process safety management strategy. However, the committee found that inherent safety considerations were not explicitly stated in Bayer’s process safety management records. Bayer performed hazard and safety assessments and made business decisions which resulted in MIC inventory reduction, elimination of aboveground MIC storage, and adoption of various passive, active, and procedural safety measures. However, these assessments did not explicitly incorporate the principles of minimization, substitution, mod­ eration, and simplification that are the basis of inherently safer processes.

Without an emphasis on incorporating inherently safer processes into process safety management, it is unlikely that these concepts would ­become part of corporate memory, and therefore they could be for­ gotten or ignored over time. It would be beneficial for Bayer to formally incorporate inherently safer process assessments into the company’s process safety management system and training, and to record such assessments as part of its audit review processes.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. SUMMARY 9 industries themselves, as decision-making techniques can help with the identi­ fication of profitable safety solutions that otherwise could be overlooked. A formal plan from the Chemical Safety Board or other appropriate entity for incorporating decision theory frameworks into inherently safer process assess- ments could help chemical facilities adopt inherently safer processes. A working group including experts in chemical engineering, inherently safer process design, decision sciences, and negotia­tion could identify obstacles and identify options for tailoring methods from the decision sciences to process safety assessments. POST-INCIDENT PROCESS ASSESSMENT Incident investigation is one of the mandatory elements of the Occupational Safety and Health Administration’s process safety management stan­dard. Com- prehensive protocols and advice are available for conducting investigations of chemical process incidents. These guidelines emphasize the need for a process safety management system to be simultaneously retrospective and prospective, with incident investigation providing the vital bridge between the lessons of the past and safer designs and operation in the future. Incorporating the principles of inherently safer processes into incident inves- tigations can help prevent future potential incidents that may have similar causes. Over time, findings from inherently safer process assessments performed in the wake of accidents may identify trends in process design that could be used to improve future systems. Findings from an investigation may also be of use when refining the models that support existing inherently safer process assessments. A post-accident inherently safer process assessment may also help identify unantici- pated hazards within a process, which could help inform the redesign or rebuild of the facility.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 10 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE BOX 6 Summary of Findings, Conclusions, and a Recommendation Process Safety Management and Inherently Safer Process Assessments at Bayer CropScience

Although claimed to be an integral PSM component, inherent safety considerations are incorporated into Bayer’s PSM efforts in an implicit manner that is dependent on the knowledge base of the individual facili­ tating the particular activity (e.g., process hazard analysis or PHA).

Bayer and its predecessors did seek to reduce risks associated with MIC, and those efforts did incorporate some aspects of risk reduction associated with ISP principles. However, Bayer did not make statements or provide documentation indicating that it had engaged in a systematic effort to incorporate ISP into the decision-making process.

Bayer and its predecessors evaluated trade-offs among the alterna­ tives, but while this analysis provides a very useful starting point for a comparison of technologies, it excludes factors that may be impor­ tant in the decision, from the perspective of both the company and the community.

Bayer CropScience did perform Process Safety assessments, how­ ever, Bayer and the legacy companies did not perform systematic and complete ISP assessments on the processes for manufacturing MIC or the carbamate pesticides at the Institute site. Bayer and the pre­ vious owners performed hazard and safety assessments and made business decisions that resulted in MIC inventory reduction, elimination of aboveground MIC storage, and adoption of various passive, active, and procedural safety measures. However, these assessments did not incorporate in an explicit and structured manner, the principles of mini­ mization, substitution, moderation, and simplification. The legacy owners identified possible alternative methods that could have resulted in a re­ duction in MIC production and inventory, but determined that limitations of technology, product purity, cost, and other issues prohibited their implementation.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. SUMMARY 11 Inherently Safer Process Assessments and Decision Making

Inherently safer process assessments can be a valuable component of process safety management. However, the view of what constitutes an inherently safer process varies among professionals, so the chemical industry lacks a common understanding and set of practice protocols for identifying safer processes.

Consistent application of ISP strategies by a company has the po­ tential to decrease the required scope of organizational emergency pre­ paredness programs by reducing the size of the vulnerable zones around its facilities. Such reductions are achieved by reducing the toxicity of the chemicals being used or produced, the quantity of the chemicals being stored, and the conditions under which they are being stored.

As currently performed, a potential concern with using ISP analysis is that it may become focused too narrowly, and as a consequence, may overlook certain outcomes. Even when multiple outcomes are recog­ nized, they may be inappropriately weighted.

The committee recommends that the Chemical Safety Board or other appropriate entity convene a working group to chart a plan for incorpo­ rating decision theory frameworks into ISP assessments. The working group should include experts in chemical engineering, ISP design, deci­ sion sciences, negotiations, and other relevant disciplines. The working group should identify obstacles to employing methods from the decision sciences in process safety assessments. It should identify options for tailoring these methods to the chemical process industry and incentives that would encourage their use. The Use of Inherently Safer Process Assessments in Post-Incident Investigations

The principles of ISP assessment can be used to good effect in con­ ducting an incident investigation when the objective is the prevention of potential incidents having similar fundamental, underlying (root) causes.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Technical Summary In 2008, an explosion and fire at a chemical production plant owned by Bayer CropScience (Bayer) in Institute, West Virginia resulted in the deaths of two employees and renewed attention to the onsite manufacture and storage of methyl isocyanate (MIC). MIC is a highly toxic inhalation hazard, and a large release of the chemical in Bhopal, India in 1984 resulted in the immediate deaths of over 3,000 people. In Institute, MIC was manufactured and stored onsite begin- ning in 1966 for use in the production of carbamate pesticides. These pesticides, including aldicarb (Temik) and carbaryl (Sevin), have been or are used for both agricultural and residential control of pest insects. Although no part of the MIC production or storage processes at the Institute facility played a role in the 2008 incident, the U.S. Chemical Safety and Hazard Investigation Board (CSB) found during its investigation that debris from the explosion hit the shield surrounding an aboveground storage container of MIC. The Board determined that, had the debris followed a different path, a relief valve vent pipe on the tank could have been damaged, which could have resulted in a release of MIC to the atmosphere. The investigation also highlighted a number of weaknesses in the Bayer facility’s emergency response systems and restart pro- cedures within the affected production unit. In light of these concerns, Congress directed the CSB to consult with the National Academy of Sciences for a study to examine the use and storage of MIC at the Bayer CropScience facility. The statement of task was finalized after a public comment period held by the CSB, and it can be found in Appendix A. In brief, the task was divided into three parts: (1) review current industry practice for the use and storage of MIC, including consideration of the key lessons of the Bhopal incident; (2) review current technologies for producing 13

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 14 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE carbamate pesticides; and (3) examine the use and storage of MIC at the Bayer CropScience facility in Institute, West Virginia. The third part of the task was the most complex, containing the following subparts: 3.1. Identify possible approaches for eliminating or reducing the use of MIC in the Bayer carbamate pesticide manufacturing processes; 3.2. Estimate the projected costs of alternative approaches identified above; 3.3. Evaluate the projected benefits of alternative approaches identified above; 3.4. Compare this analysis to the inherently safer process assessments con- ducted by Bayer and previous owners of the Institute site; and 3.5. Comment, if possible, on whether and how inherently safer process (ISP) assessments can be utilized during post-incident investigations. STUDY CONTEXT Data gathering and report preparation were performed during a period of legal activity and community concern related to the facility and its production of MIC. When the study began in September 2010, the CSB investigation was not yet complete, and Bayer had begun efforts to reduce onsite inventory of MIC, and a new underground storage facility was being built for MIC in light of that reduction. In August 2010, Bayer announced that, because of the U.S. Environmental Protection Agency’s decision to cancel registration of aldicarb, the company would cease production of aldicarb by late 2014. This decision was followed up in January 2011 by a decision to shut down production of MIC by 2012 and cease production of aldicarb and two other pesticides, methomyl and carbaryl. At the time, Bayer intended to restart production of MIC in February 2011, after the plant modifications were complete, to continue production until the 2012 end date. However, also in February, a group of local residents filed suit against the company citing concerns about the restart process and MIC storage and manufacture onsite. This resulted in a court order to halt the restart process pending an evidentiary hearing, although preparations in anticipation of restart were allowed to continue. The court process continued through the month of February, and on March 18, stating that, “uncertainty over delays has led the com- pany to the conclusion that a restart of production can no longer be expected in time for the 2011 growing season”,1 Bayer announced that it no longer intended to restart production of MIC or aldicarb. In addressing the statement of task, the committee began by considering how to address Task 3 and determining the data-gathering required. In addressing Task 3, the committee quickly determined that a detailed, full analysis of all alter- 1  Bayer. 2011. Bayer CropScience Announces Decision Not to Resume MIC Production. Bayer Press Release: March 18, 2001 [online]. Available: www.bayercropscience.com/bcsweb/crop protection.nsf/id/84634C20BB57C2D3C125785700503244.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. TECHNICAL SUMMARY 15 native chemistries available for the production of aldicarb and carbaryl, including their manufacturing and energy costs, would require significantly greater invest- ments than were available for the study. The investment required to fully analyze any one alternative is typically a multi-million dollar expenditure, and further, costs are highly dependent on the facility design, and accurate financial analysis requires specialized tools and information that is often unavailable to the public. In addition, in light of the de-registration of aldicarb and subsequent cessation of MIC, aldicarb, and carbaryl production at the Institute plant, the value of a full literature review for the chemical manufacturing community was reduced as the information available from such a review would have no longer have a potential use for the facility. With these limitations in mind, the committee chose to focus on a select set of possible alternative production processes for aldicarb and carbaryl. These ­chosen alternatives had been evaluated by Bayer and the facility’s legacy ­owners, and as a result, information about the chemistry and possible manufacturing processes were available for each. This approach reduced further the value that a literature review, which would be limited in its scope to information about manufacturing processes available in the open literature. As a result of these various factors, the committee chose to focus its efforts primarily on Task 3 and addressed Task 2 only in the context of the chosen alternative production processes. In this report, the selected alternatives and associated trade-offs are pre- sented, with particular attention to safety considerations. In addition, the context in which these trade-offs must be evaluated (financial, regulatory, etc.) is dis- cussed. Finally, because deciding between alternative processes requires con- sideration and weighing of a number of different factors, including safety, one possible framework for evaluating these complex decisions is presented. Within this summary, the committee’s findings, conclusions, and recommendation have been highlighted in bold text. They have also been aggregated in Box 6 at the end of the summary chapter. INHERENTLY SAFER PROCESS ASSESSMENTS AND PROCESS SAFETY MANAGEMENT Within the chemical engineering community, the use of process safety man- agement (PSM) systems is considered standard practice. PSM is a methodology composed of a number of different elements that, when evaluated as a whole, support organizational safety culture and practices. Although the “elements” or components of any given PSM system may vary somewhat between countries and organizations, the fundamental structures remain similar. Within the United States, Occupational Safety and Health Administration (OSHA) administers the Process Safety Management Standard, which has fourteen mandatory elements relating to, among other things, training, documentation, incident investigation, compliance audits, and process hazard analysis. Although companies are required

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 16 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE to address those 14 elements, they are not limited to them. PSM is most effective at supporting a safe environment when it is contained within an overall organiza- tional structure that encourages a culture of safety among its employees. Within the element of process hazard analysis, employers are required to, “identify, evaluate, and control the hazards involved in the process” (29 CFR § 1910.119). To accomplish control of hazards, companies can consider a hierarchy of hazard control with the tiers of inherent, passive, active, and procedural con- trols. Only the inherent tier invites consideration of elimination or minimization of a given hazard; all other tiers are focused on control of an existing hazard. It is important to remember, however, that making a system inherently safer through, for example, substitution may result in a shift from one hazard or risk to another, and the full impact of any change on the overall hazard analysis should be considered as part of the decision-making process. The context in which an inherently safer process assessment is performed is important as this can affect the way that a given risk or hazard is weighted against another in the analysis. Although a valuable tool, consideration of ISPs is not a required component of OSHA’s PSM Standard. INHERENTLY SAFER PROCESS ASSESSMENTS AT BAYER CROPSCIENCE To address the task, a great deal of information was received from Bayer regarding the use and storage of MIC at the facility under their management and the management of the legacy companies, particularly Union Carbide and Rhône Poulenc. This information was examined in order to assess whether ISP assessment or its principles of substitute, minimize, moderate, and simplify were mentioned or evaluated within the analysis of different processes and synthetic routes. In addition, the role that ISP or its principles play in the PSM systems of Bayer and the legacy companies was evaluated. Although materials relating to the alternatives and their evaluation were provided to the committee for review in good faith, the documentation was rather disjointed and discontinuous, with doc- uments ranging from undated handwritten notes without attribution to in-depth type-written analyses of findings. The assessments presented here are drawn from these documents and from the academic and patent literature, and information gaps within the historic documents could result in gaps within these assessments. In the course of the study, Bayer presented the company’s approach to PSM, stating that ISP is an integral part of its PSM analysis. However, although claimed to be an integral PSM component, inherent safety considerations are incor- porated into Bayer’s PSM efforts in an implicit manner that is dependent on the knowledge base of the individual facilitating the particular activity (e.g., process hazard analysis or PHA). Although an implicit system of ISP incorpora- tion does not mean an absence of a commitment to inherent safety, it does mean that the commitment is not visible to the extent that might be considered desirable.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. TECHNICAL SUMMARY 17 A risk of this implicit approach is that the ISP components and principles do not become part of corporate memory, and this can lead to missed opportunities for incorporation of ISPs and design into the production facility. Over the course of the study, the committee reviewed documentation describ- ing the history of the plant and alternative assessments performed by Bayer and the legacy owners of the facility. The committee finds Bayer and its prede- cessors did seek to reduce risks associated with MIC, and those efforts did incorporate some aspects of risk reduction associated with ISP principles. However, Bayer did not make statements or provide documentation indicat- ing that it had engaged in a systematic effort to incorporate ISP into the decision-making process. Several decisions regarding process safety were made over the years by the owners of the Institute plant. Most of these decisions involved adding additional safety protections to existing processes, rather than changes to the underlying process. Bayer and its predecessors evaluated trade-offs among the alterna- tives, but while analysis provides a very useful starting point for a compari- son of technologies, it excludes factors that may be important in the decision, from the perspective of both the company and the community. The committee concludes that Bayer CropScience did perform process safety assessments; however, Bayer and the legacy companies did not per- form systematic and complete ISP assessments on the process for manufac- turing MIC or the processes used to manufacture pesticides at the Institute site. Bayer and the previous owners performed hazard and safety assess- ments and made business decisions that resulted in MIC inventory reduction, elimination of aboveground MIC storage, and adoption of various passive, active, and procedural safety measures. However, these assessments did not incorporate in an explicit and structured manner, the principles of minimiza- tion, substitution, moderation, and simplification. The legacy owners identi- fied possible alternative methods that could have resulted in a reduction in MIC production and inventory, but determined that limitations of technol- ogy, product purity, cost, and other issues prohibited their implementation. INHERENTLY SAFER PROCESS ASSESSMENTS Within the statement of task, the NRC was specifically asked to compare its analysis of alternative approaches for eliminating or reducing MIC “to the inher- ently safer process assessments conducted by Bayer and previous owners of the Institute site.” This required consideration of the industry’s current understanding of ISPs and assessments as well as the approaches used by Bayer and the legacy companies. Drawing upon the expertise within the committee membership as well as that of the publications from the Center for Chemical Process Safety, the Department of Homeland Security, and other material available in the literature, the following findings, conclusions, and recommendation were developed.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 18 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Inherently safer process assessments can be a valuable component of process safety management. However, the view of what constitutes an ISP varies among professionals, so the chemical industry lacks a common under- standing and set of practice protocols for identifying safer processes. Experts in ISP agree on the components that define ISP, but that understanding has not yet become common among the rest of the professional community. Although the general concept of ISP has made it into the community, the specifics are not well known outside of the expert group. One particular barrier for use of ISP assess- ments that has been noted by expert chemical engineers is a lack of effective methods for analyzing risk-based trade-offs. ISP assessments can be challenging because of the interconnected nature of chemical manufacturing processes, e.g., care must, taken that a risk reduction in one process element does not result in an unexpected risk transfer to a different element. One possible approach for addressing this issue is the use of multi-attribute or -criteria decision analysis, which is described briefly in the next section. Note that ISP analysis has the potential to reduce the impact of incidents by addressing some common concerns in emergency preparedness and response. In many cases, for example, emergency response units will spend the majority of their training on appropriate response to the most common incident rather than the most catastrophic incident. This is not unexpected in light of funding con- straints and the difficulties posed in coordinating the multitier, multiorganization response required for training for large-scale incidents or releases. However, it is just these large-scale incidents that pose the greatest risk to emergency respond- ers. Consistent application of ISP strategies by a company has the potential to decrease the required scope of organizational emergency preparedness programs by reducing the size of the vulnerable zones around its facilities. Such reductions are achieved by reducing the toxicity of the chemicals being used or produced, the quantity of the chemicals being stored, and the condi- tions under which they are being stored. PRODUCTION OF MIC AND CARBAMATE PESTICIDES: ALTERNATIVES ASSESSMENT Four possible categories of alternatives for the manufacture of carbamate pesticides were considered: (1) continuing with the existing process, (2) adopt- ing an alternative chemical process not involving MIC, (3) using an alternative process for MIC production that would consume MIC immediately and thus not require storage, and (4) reducing the volume of stored MIC and the risks of transporting MIC from one facility within the site to another by rearrang- ing process equipment. Note that the task was not to determine the best course of action but to consider and compare these alternatives and the trade-offs posed by each option with respect to costs and benefits to the company and community.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. TECHNICAL SUMMARY 19 Each possible approach presents its own costs and benefits. For example, a non-MIC-based process for production of aldicarb means that there is no risk of worker exposure to MIC. However, that same non-MIC-based process could result in lower purity of the final material, which could result in greater risk of worker exposure to hazardous dust. Just-in-time production of MIC through a gaseous product would eliminate the risk of catastrophic release of that material within the community, but it would require a significant redesign of the facility and would, in its current form, result in a final product with lower purity than the existing process. In evaluating all of the alternatives, it became clear that no one method outperformed all others in every category of cost and benefit. The above paragraph highlights some of the technical costs and benefits, but when evaluating alternative approaches, nontechnical considerations should also be considered. One example of this is the perception of the choice by the sur- rounding community. The facility in Institute, West Virginia, as is true for many chemical manufacturing facilities, exists in close proximity to the surrounding community. In such situations, it is important to recognize the influence that local communities can have on corporate decision making, whether welcomed by the company or not. For example, the suit filed by some members of the local com- munity against Bayer played a role in the company’s decision to cease MIC and aldicarb production before the anticipated 2012 stop date. This is an example of how the perception of risk posed by the facility by the members of a surrounding community can affect whether a material or process is readily accepted, and the nature of the relationship between the community and the company may influence that risk perception. At a basic level, a neutral or positive relationship between a facility and its community allows for open discussion about risks and responses. It allows for a sense of trust that the experts on site are operating with care and consideration. A negative relationship can influence the community perception of risk, lead to distrust, and create an environment of defensiveness and lack of engagement on important issues relevant to everyone involved. The process ultimately chosen for the Institute site by the facility’s owners, although posing higher risks to the surrounding community due to the volume of MIC stored, decreases the amount of wastewater produced as compared with other methods and thus decreases potential damage to local surface waters. Deciding between multiple process alternatives with conflicting trade-offs is a concern faced by any company. It is clear that the development of a method that companies could use to weigh all of the trade-offs involved when consider- ing process choice from an inherently safer design perspective would be a useful tool for evaluating these concerns. A potential concern with using ISP analy- sis is that it may become focused too narrowly, and as a consequence, may overlook certain outcomes. Even when multiple outcomes are recognized, they may be inappropriately weighted. Both of these problems can result in a choice that does not reflect the optimal conclusion or the decision makers’ preferences.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 20 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE To assist the chemistry community in addressing the last of these findings, which as mentioned above has been noted as a barrier to performing inherently safer process assessments, the committee highlighted a method of decision analy- sis, multi-attribute utility (MAU) theory. This method was considered as an option for addressing appropriate weightings of multiple outcomes of an ISP analysis or assessment and to assist with placement of the findings of that analysis within the context of a full analysis of all costs and benefits associated with a process. MAU theory provides one possible framework for incorporating input and relative weightings from multiple perspectives and stakeholders, and as such, could be an aid for decision making. As a result, the committee recommends that the U.S. Chemical Safety Board and Hazard Investigation Board or other appropri- ate entity convene a working group to chart a plan for incorporating decision theory frameworks into ISP assessments. The working group should include experts in chemical engineering, ISP design, decision sciences, negotiations, and other relevant disciplines. The working group should identify obstacles to employing methods from the decision sciences in process safety assess- ments. It should identify options for tailoring these methods to the chemical process industry and incentives that would encourage their use. INCIDENT INVESTIGATION AND EMERGENCY RESPONSE In examining the potential utility of ISP assessments to incident investiga- tion, it becomes clear that the principles of ISP assessment can be used to good effect in conducting an incident investigation when the objective is the pre- vention of potential incidents having similar fundamental, underlying (root) causes. It is possible that over time, findings from ISP assessments performed in the wake of an accident could identify trends in process design that could be used to improve future systems. Findings from an investigation may be of use when refining the models that support existing ISP assessments. A post-incident ISP assessment may help identify unanticipated hazards within a given process that could inform the rebuild or redesign of the facility.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 1 Introduction In August 2008, an explosion of a pressurized vessel, known as a residue treater, at the Bayer CropScience (Bayer) facility in Institute, West Virginia resulted in the deaths of two plant employees, a fire within the production unit, and extensive damage to nearby structures.1 Of particular relevance to this report, one of the structures hit by debris from the explosion was an aboveground 6,700-gallon storage tank of methyl isocyanate (MIC) protected by a steel “blast mat”. The tank was located approximately 70 feet from the site of the explosion and, at the time, contained approximately 6.8 tons of liquid MIC, a volatile, toxic chemical. The proximity of this tank to the explosion caused concern, given that a release of over 40 tons of MIC from a chemical facility in Bhopal, India in 1984 resulted in the immediate death of more than 3,000 people in the vicinity and additional mortality and morbidity of 100,000-200,000 individuals. (See Chapter 2 for more information.) During an investigation of the 2008 explosion in West Virginia by the U.S. Chemical Safety and Hazard Investigation Board (CSB), the proximity of the tank to the explosion and the protections surrounding it were given careful consider- ation. Although the MIC tank at the Bayer facility was protected from the heat and debris of the blast by the steel protective shield, the CSB determined from its investigation that “had the residue treater traveled unimpeded in the direction of the day tank and struck the shield structure just above the top of the MIC 1  A full discussion of the accident and its subsequent investigation by the United States Chemi- cal Safety and Hazard Investigation Board (CSB) can be found in the Board’s January 2011 report number 2008-08-I-WV, “Investigation Report: Pesticide Chemical Runaway Reaction Pressure Vessel Explosion (Two Killed, Eight Injured)”. 21

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 22 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE day tank, the shield structure might have impacted the relief valve vent pipe. A puncture or tear in the vent pipe or MIC day tank head would have released MIC vapor into the atmosphere above the day tank.” (CSB, 2011) In 2009, while the investigation was still underway, John Bresland, Chairman of the CSB, stated in testimony before Congress, Although the MIC tank and the blast mat escaped serious damage on August 28, there is reason for concern. This was potentially a serious near miss, the ­results of which might have been catastrophic for workers, responders, and the public. . . . There are hypothetical scenarios where the MIC storage tank could have been compromised during the August 28 explosion, either by powerful projectiles or by a collision with the residue treater vessel, had it traveled in that direction. Any release of MIC into the atmosphere is cause for great concern.” (Bresland, 2009) As a result of this information and additional testimony provided at the hear- ing, the Chairman of the House Committee on Energy and Commerce, requested that the CSB (Waxman et al., 2009):

1. ”Conduct an investigation to determine options for Bayer to reduce or

eliminate the use or storage of MIC at its West Virginia facility by switching to alternative chemicals or processes and the estimated cost of these alternatives;

1. Determine whether Bayer has adequately examined the feasibility of

switching to alternative chemicals or processes;

1. Provide in its final report specific recommendations for Bayer and its state

and federal regulators on how to reduce the dangers posed by onsite storage of MIC; and

1. Brief our staff on the Board’s findings and recommendations at the end

of its investigation.” As a result of this request, the 111th Congress provided funds to the CSB “for a study by the National Academy of Sciences [NAS] to examine the use and storage of methyl isocyanate including the feasibility of implementing alternative chemicals or processes and an examination of the cost of alternatives at the Bayer CropScience facility in Institute, West Virginia” (H.R. Rep.No.111-316, 111st Cong., 1st Sess. [2009]). This report presents the findings and conclusions of the NRC study committee convened to perform this examination. STATEMENT OF TASK On August 26, 2009, Bayer announced in a press release (Bayer ­CropScience, 2009) that it would “reduce methyl isocyanate (MIC) storage by 80 percent” at the facility and eliminate aboveground storage of MIC. The company stated that it would cease production of MIC-based products within a year, and that it would

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INTRODUCTION 23 “continue to evaluate the feasibility of further measures, which may also include the use of alternative process technologies.” MIC production and primary storage occurred at the East Carbamoylation Center along with the manufacture of car- baryl and aldicarb. The aboveground MIC storage and production of methomyl, thiodicarb, carbosulfan, and carbofuran were in the West Carbamoylation Center. Everyday, MIC was transferred from the primary storage facility to the above­ ground day-use storage tank. By ceasing production of methomyl and ­carbofuran, Bayer was able to remove the need for the aboveground tank. This change allowed for reduction in storage capacity. In addition, a new MIC underground storage facility would be built in the East Carbamoylation Center to accommodate the change in production quantity. In April 2010, in response to the mandate from Congress and acknowledging the 80 percent reduction plan, the CSB issued a draft statement of task for the National Academies in the Federal Register and solicited public comment on the language. The National Academies began its work in early September 2010 under the finalized statement of task, which can be read in Box 1.1 and Appendix A. This report contains the consensus findings, conclusions, and recommendation developed in response to this task. DEVELOPMENTS IN WEST VIRGINIA A number of significant changes occurred at the Bayer facility during the course of the study. A timeline of the events can be found in Figure 1.1, and additional details are provided below. On August 16, 2010, prior to the National Research Council (NRC) begin- ning its work, Bayer announced that, as part of an agreement with the U.S. Environmental Protection Agency, it would voluntarily cancel the registration of aldicarb (Temik) for use in or on the remaining crops for which the pesticide was being used, including potatoes, citrus, cotton, and peanuts. As part of the phase- out agreement, farmers would be allowed to continue to use aldicarb on potatoes and citrus until the end of 2011. For all other crops, production would end by December 2014, distribution and sale of aldicarb would end by December 2016, and growers’ stocks should be exhausted by August 2018. Citing this agreement and global restructuring of its parent company, on January 11, 2011 Bayer announced that “the production of certain carbamates is no longer economically viable for Bayer CropScience.” (Bayer CropScience, 2011b) The company’s intention was to finalize the modifi- cations to the MIC plant at Institute; restart manufacturing of aldicarb, carbaryl, and the intermediate materials required for their production, including MIC; and continue manufacturing those materials until mid-2012. On January 20, 2011, the CSB released its report on the 2008 accident. Key findings from the investigation identified weaknesses in the following areas: the process hazard analysis, the pre-startup safety review, the startup procedures for

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 24 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE BOX 1.1 Statement of Task for the Committee on the Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience

The National Research Council will produce a detailed written report, conclusions, and recommendations where appropriate on the following subjects:

Review the current industry practice for the use and storage of methyl isocyanate (MIC) in manufacturing processes, including a sum­ mary of key lessons and conclusions arising from the 1984 Bhopal ­accident and resulting changes adopted by industrial users of MIC.

Review current and emerging technologies for producing carba­ mate pesticides, including carbaryl, aldicarb, and related compounds. The review should include:

1. 1. Synthetic methods and patent literature

1. 2. Manufacturing approaches used worldwide for these materials

1. 3. Manufacturing costs for different synthetic routes

1. 4. Environmental and energy costs and trade-offs for alternative

approaches

1. 5. Any specific fixed-facility accident or transportation risks asso­

ciated with alternative approaches

1. 6. Regulatory outlook for the pesticides including their expected

lifetime on the market

• Examine the use and storage of MIC at the Bayer CropScience

facility in Institute, West Virginia: 3.1. Identify possible approaches for eliminating or reducing the use of MIC in the Bayer carbamate pesticide manufacturing pro­ cesses, through, for example, substitution of less hazardous interme­ diates, intensifying existing manufacturing processes, or consuming MIC simultaneously with its production.

1. 2. Estimate the projected costs of alternative approaches identi­

fied above.

1. 3. Evaluate the projected benefits of alternative approaches

identified above, including any cost savings, reduced compliance costs, liability reductions, reduced emergency preparedness costs, and ­reduced likelihood or severity of a worst-case MIC release or other release affecting the surrounding community.

1. 4. Compare this analysis to the inherently safer process assess­

ments conducted by Bayer and previous owners of the Institute site.

1. 5. Comment, if possible, on whether and how inherently safer pro­

cess assessments can be utilized during post-incident investigations.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

25 FIGURE 1.1  Timeline of events. SOURCE: NRC Staff/Committee Generated

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 26 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE the methomyl unit, the MIC day tank shield structure design, emergency planning and response, environmental monitoring, and regulatory oversight of the facility (CSB, 2011). The report provided an overview of the alternative MIC technolo- gies considered by Bayer and the plant’s previous owners. The CSB also noted in the report that the board was considering the impact of Bayer’s announcement to cease production of MIC on the NAS study. In the end, no changes were made to the NAS study or its statement of task as a result of the announcement. Bayer intended to restart production of MIC to support production of ­aldicarb in February 2011. On February 8, 2011, local residents filed suit against Bayer in order to halt the restart of production until certain criteria were met, which resulted in a temporary restraining order to halt the process to restart production of MIC at the Institute facility and scheduled an evidentiary hearing for February 25, 2011 (Case 2:11-cv-00087 Document 16). On February 12, Bayer requested clarification and cancellation of the judge’s order, citing a need to continue pre-startup work related to its “MIC Safety Enhancement Project.” The request noted activities such as completion of opera- tor training and drafting of standard operating procedures for the new systems as well as completion of activities to support compliance with recommendations made by the CSB and other federal and local organizations (Case 2:11-cv-00087 Document 24). The judge indicated that the company could continue its work on the safety system, but he also noted that, “The court finds it remarkable that the defendant has yet to complete a wide array of safety measures, in light of the announcement in open court that but for the [temporary restraining order], MIC would have been produced within seven days at the Institute facility. Indeed, the defendant’s counsel indicated that Bayer was ‘in the process of startup right now,’ and that Bayer was ‘commissioning equipment’” (Case 2:11-cv-00087 Document 26). As part of the court proceedings, M. Sam Mannan, a chemical engineering professor from Texas A&M University and recognized expert in chemical process safety, was appointed by the court as an independent expert to review the MIC production process at Bayer CropScience. Professor Mannan was accepted by both the plaintiffs and the defendants in the suit. Mannan’s report was delivered to the court on March 14. On the basis of his assessment of the facility and on evaluation of two possible release scenarios (a condenser tube springing a 5-mm leak and deliberate sabotage), Professor Mannan concluded that “the probabilis- tic risk of the MIC process is very low.” (Case 2:11-cv-00087 Document 92-4). Finally, on March 18, 2011, Bayer CropScience announced that it would not restart the production of MIC. In a press release, the company stated that, “uncertainty over delays has led the company to the conclusion that a restart of production can no longer be expected in time for the 2011 growing season” (Bayer CropScience, 2011a), and this resulted in a dismissal of the case. These events were occurring as the committee was holding its data-gathering sessions.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INTRODUCTION 27 • Meeting 1: February 9-10, 2011, in Washington, DC. • Meeting 2: March 20-22, 2011, at West Virginia State University in Insti- tute, West Virginia. Included public comment period and a visit to the Bayer facility. • Meeting 3: May 24-25, 2011, in Washington, DC. • Meeting 4: August 8-9, 2011, in Woods Hole, Massachusetts. In addressing the statement of task, the committee began by considering how to address Task 3 and determining the data-gathering required. While it initially seemed that information from the literature review in Task 2 could be useful in addressing Task 3, the committee quickly determined that a detailed, full analysis of all alternative chemistries available for the production of aldicarb and ­carbaryl, including their manufacturing and energy costs, would require sig- nificantly greater investments than were available for the study. The investment required to fully analyze any one alternative is typically a multi-million dollar expenditure, and further, costs are highly dependent on the facility design, and accurate financial analysis requires specialized tools and information that is often unavailable to the public. In addition, in light of the de-registration of aldicarb and subsequent cessation of MIC, aldicarb, and carbaryl production at the Institute plant, the value of a full literature review for the chemical manufacturing com- munity was reduced as the information available from such a review would no longer have a potential use for the facility. With these limitations in mind, the committee chose to focus on a select set of possible alternative production processes for aldicarb and carbaryl. These ­chosen alternatives had been evaluated by Bayer and the facility’s legacy ­owners, and as a result, information about the chemistry and possible manufacturing processes were available for each. This approach reduced further the value of a literature review, which would be limited in its scope to information about manufacturing processes available in the open literature. As a result of these various factors, the committee chose to focus its efforts primarily on Task 3 and addressed Task 2 only in the context of the chosen alternative production processes. In this report, the selected alternatives and associated trade-offs are pre- sented, with particular attention to safety considerations. In addition, the con- text in which these trade-offs must be evaluated (financial, regulatory, etc.) is discussed. Finally, as deciding between alternative processes requires consider- ation and weighing of a number of different factors, including safety, one pos- sible framework for evaluating these complex decisions is presented. Note that much of the information to perform the analysis of trade-offs was drawn from documentation provided by Bayer CropScience from the company’s archives and those of the previous owners of the facility. As many of these processes were in active use until very recently, much of the information was previously considered proprietary.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 28 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE STRUCTURE OF THE REPORT This report consists of eight chapters. Chapter 2 provides an overview of the incidents in Bhopal, India, which is called for in Task 1. Chapter 3 provides an overview of carbamate pesticides and their history in Institute, West Virginia and includes important information about changes in the plant design related to production of the pesticides and their precursors. Chapter 4 contains an introduction to Inherently Safer Processes (ISP) and ISP assessment and describes the role such concepts and assessment can play in process safety management. This background information is necessary context for the analysis provided for the remaining chapters. Chapter 5 addresses Tasks 3.1-3.3 by presenting an assessment of alternative methods for production of MIC, aldicarb, and carbaryl. The chapter also discusses the many factors that influence decision making in chemical manufacturing. This last point led the committee to consider a broader framework in which alterna- tives and trade-offs could be considered in corporate decision making. One pos- sible framework for decision making is discussed in Chapter 6. Chapter 7 compares the process analyses performed at the Institute facility by Bayer CropScience and the legacy owners as specifically called for in Task 3.4. Chapter 8 addresses Task 3.5 and considers the use of ISP assessments in post-incident investigations. After reading the findings from the CSB report, visiting the plant and talking with Bayer CropScience personnel, and listening to testimony from the public comment periods, it became clear that consideration of the context in which any ISP or process hazard assessment is performed is essential to allow for a complete analysis. To address this need, the discussions in Chapters 5 and 7 also touch on the role that an organizational safety culture plays in creating a safe operating environment and the broader context in which chemical plants operate, including local communities and policy concerns. REFERENCES Bayer CropScience. 2009. Bayer Crop Science Announces Investment of $25 Million for Institute Site. Bayer News Release: August 26, 2009 [online]. Available: http://www.bayerus.com/News/ NewsDetail.aspx?ID=586330BF-C83B-4EF3-93DBFF791373C7D7. Accessed: Feb. 14, 2012. Bayer CropScience. 2011a. Bayer CropScience to Reduce Operations in Institute, West Virginia, and Close Woodbine, Georgia, Site. News: January 11, 2011 [online]. Available: http://www.bayer cropscience.com/bcsweb/cropprotection.nsf/id/EN_20110111?open&l=EN&ccm=500020. Ac- cessed: Sept. 29, 2011. Bayer CropScience. 2011b. Bayer CropScience Announces Decision Not to Resume. News: March, 18, 2011 [online]. Available: http://www.press.bayer.com/baynews/baynews.nsf/id/Bayer-Crop Science-announces-decision-not-to-resume-MIC-production. Accessed: Sept. 29, 2011.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INTRODUCTION 29 Bresland, J. S. 2009. Testimony of John S. Bresland, Chairman and Chief Executive Officer, U.S. Chemical Safety Board, Before the House of Representatives Committee on Energy and Com- merce, Subcommittee on Oversight and Investigations, Hearing on Secrecy in the Response to the Fatal Bayer Chemical Plant Explosion, 111th Congress, April 21, 2009 [online]. Available: http://www.csb.gov/assets/document/BreslandBayerCombinedTestimony.pdf. Accessed: Feb. 14, 2011. CSB (Chemical Safety Board). 2011. Investigation Report: Pesticide Chemical Runaway Reaction Pressure Vessel Explosion, Bayer CropScience, LP, Institute West Virginia, August 28, 2008. U.S. Chemical Safety and Hazard Investigation Board, Washington, DC [online]. Available: http://www.csb.gov/assets/document/Bayer_Report_Final.pdf. Accessed: Sept. 29, 2011. Waxman, H. A., J. D. Rockefeller, B. Stupak, and E. J Markey. 2009. Letter to John Bresland, Chairman and Chief Executive Officer, U.S. Chemical Safety and Hazard Investigation Board, Washington, DC, from Henry A. Waxman, Chairman, House Committee on Energy and Com- merce, John D. Rockefeller, Chairman, Senate Committee on Commerce, Science and Transpor- tation, Bart Stupak, Chairman House Committee on Energy and Commerce Subcommittee on Oversight and Investigations, and Edward J. Markey, Chairman, House Committee on Energy and Commerce Subcommittee on Energy and the Environment, Washington, DC, May 4, 2009 [online]. Available: http://democrats.energycommerce.house.gov/Press_111/20090504/bayer. pdf. Accessed: June 26, 2012.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 2 Bhopal and Chemical Process Safety INTRODUCTION No discussion of inherent safety processes (ISPs), process safety manage- ment (PSM), and methyl isocyanate (MIC) is complete without a discussion of the history and legacy of the Bhopal incident and the lessons learned. In what has been described by many as the “world’s worst industrial disaster”, over 40 tons of MIC was released at a Union Carbide India Limited (UCIL) plant in Bhopal, India on December 2, 1984 (Dhara and Dhara, 2002; Broughton, 2005). Much has been written on the disaster, and this report does not endeavor to repeat or evaluate that work but rather to provide an overview of the event and a discussion of the key lessons of process safety learned from the disaster as necessary con- text for the report. Chapter 3 discusses the use of MIC at the Bayer CropScience ­facility in Institute, West Virginia. METHYL ISOCYANATE The UCIL facility in Bhopal, India was a manufacturing facility for carba- mate pesticides that had a design similar to the plant in Institute, West Virginia, and it had been manufacturing MIC on site since 1980. As an intermediate step to the production of these pesticides, the facility stored a large quantity of MIC on site, although it was not actively manufacturing the material at the time of the incident. MIC itself is a volatile, colorless liquid with a pungent odor. It is extremely flammable, potentially explosive when mixed with air, and reacts exo- thermically with water to form methylamine and carbon dioxide. The liquid and vapor are toxic when inhaled, ingested, and if eyes or skin are exposed. Its vapor 31

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 32 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE pressure is high at 54 kPa at 20oC, its boiling point is 39oC, and the vapor ­density is greater than that of air, meaning that the liquid volatilizes readily and the vapor will stay near ground level. When stored, the liquid is kept between –10°C and 0°C in order to maintain a low vapor pressure and to prevent ­exothermic self-polymerization. THE BHOPAL DISASTER On the night of the incident, December 2, 1984, at 11:00 p.m. local time, while many of the Bhopal residents were asleep, it was reported that a plant operator noticed a small MIC gas leak and increased gas pressure inside a stor- age tank. This leak and pressure were due to water that had entered the storage vessel. At the time, critical refrigeration for the storage system had been moved to another area in the plant, and without refrigeration to slow the reaction of MIC with water, the temperature and pressure rapidly rose within the storage vessel. As the temperature rose, the MIC began to self-polymerize, adding to the heat and pressure. The vapor was first routed to a scrubber for the vent gas that should have neutralized at least some portion of the vapor, but this unit was not active.1 The vapor should then have passed to a flare tower to be destroyed, but the tower was out of service for maintenance because of pipe corrosion. Shortly after midnight, a safety valve opened, sending a MIC gas plume into the air (Broughton, 2005). An emergency water curtain intended to react with the MIC in case of such a release was not designed to manage a release of that scale and was also suffering from corrosion, which likely reduced its efficacy. More than 40 tons of MIC was released into the impoverished commu- nity that surrounded the facility. As the plume traveled through the area, the severe acute irritant effects caused residents living nearby to become disoriented and anxious. In their attempt to escape from the chemical, residents ran out of their homes directly into the gas cloud, which resulted in increased exposure to the chemical. Reportedly, close to 3,800 residents were killed immediately. ­Thousands more, with estimates of up to 100,000-200,000 people in and sur- rounding that community, have experienced significant morbidity and mortality, including being partially or totally disabled, and experiencing premature death (Andersson et al., 1990; Beckett, 1998; Hood, 2004; Broughton, 2005; Mishra et al., 2009). From reports on the event, it is clear that the Bhopal facility was operating with reduced safety standards and equipment. Specifically, the unavailability of the refrigeration, scrubber, flare tower, and water curtain, led Broughton (2005) to conclude that the Bhopal facility operated with “safety equipment and proce- 1  The caustic in the scrubber was warm the next morning, indicating that some of the MIC could have actually reacted with the system despite being offline, but it was not sufficient to control the release.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. BHOPAL AND CHEMICAL PROCESS SAFETY 33 dures well below the safety standards found at its sister plant in Institute, West Virginia”; and “the local government, although aware of some of the safety prob- lems”, was reluctant to enforce stronger safety and air pollution standards for fear of losing a large employer. Multiple reports on the incident (ICFTU-ICEF, 1985; Shrivastava, 1987; Broughton, 2005; Mannan, 2005) have identified root causes for the disaster that are tied to human and management factors in addition to the technical factors described above. Specific concerns include a lack of responsive- ness to safety concerns identified during inspections, poor management of change in response to new procedures, reduced staffing on site and high turnover among employees, and deficiencies in equipment maintenance and operation, including emergency equipment and procedures. RISKS ASSOCIATED WITH MIC The health risks of MIC exposure involve injuries to the ocular, respira- tory, gastrointestinal, reproductive, and nervous systems (Beckett, 1998; Dhara and Dhara, 2002; Broughton, 2005). Autopsies performed on 300 victims of the disaster showed lesions that were severely necrotized on the upper respiratory tract lining, the lung capillaries, alveoli, and bronchioles. In addition, the autopsies revealed edematous and enlarged lungs, hemorrhages, bronchopneumonia, and acute bronchiolitis (Dhara, 2000; Broughton, 2005). The acute health effects, par- ticularly those reported and observed in residents 0 to 6 months after the Bhopal disaster, were primarily injuries from the intensely irritating effect of MIC on the cornea and included severe ocular burning, persistent watery eyes, pain, ulcers, and photophobia. Lesions related to respiratory tract toxicity were seen in both the upper and lower respiratory tracts, and included chest pain and pulmonary distress, pneumonitis, pulmonary edema, and pneumothorax. Gastrointestinal problems included persistent diarrhea and persistent abdominal pain (Dhara and Dhara, 2002; Broughton, 2005). Genetic health effects included increased ­chromosomal abnormalities. Acute psychological health effects included ­neuroses, anxiety, and adjustment reactions; and acute neurobehavioral effects reported and observed were impaired audio and visual memory, psychomotor coordination, reasoning and spatial coordination (Broughton, 2005). Chronic and long-term health risks of MIC exposure, particularly 1 to 25 years after the Bhopal incident, also involved injuries to the ocular, respi- ratory, and other organ systems, including reports of long-term injuries to the reproductive and nervous systems. In published reviews and clinical studies of the health effects from exposure to MIC during the early and late recovery periods of the Bhopal incident, scientists reported persistent watering of the eyes, eyelid infections, corneal opacities, chronic conjunctivitis, tear secretion deficiency, and cataracts (Andersson et al., 1990; Dhara and Dhara, 2002; Broughton, 2005; Mishra et al., 2009). Decreased lung function, restrictive and obstructive airway disease, chest pain, dyspnea, wheezing, and allergic bronchoalveolitis were also

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 34 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE identified as the chronic and long-term respiratory health symptoms related to MIC exposure (Andersson et al., 1990; Beckett, 1998; Dhara and Dhara, 2002; Broughton, 2005; Mishra et al., 2009). Long-term reproductive health risks include increased spontaneous abortions, increased perinatal and neonatal mortality, menstrual cycle alterations, decreased placental weights, and increased chromosomal alterations (Beckett et al., 1998, Dhara and Dhara 2002, Mishra et al., 2009). Neurological symptoms include depression, impaired associative learning, motor speed and precision, and muscle aches (Dhara and Dhara, 2002; Mishra et al., 2009). LESSONS FROM BHOPAL Process Safety Management Although equipment failures increased the severity of the Bhopal disaster, these failures and the poor emergency response to the incident are indicative of serious flaws in the management of the facility, and these flaws are considered a root cause of the incident. These factors will not be discussed in detail here as they have been the topic of many previous papers and reports (for example, Bowander et al., 1985; Shrivastava, 1987), but the recognition of these organizational and human factors concerns has contributed to the response of the chemical commu- nity described here. The incident served as a catalyst for the chemical industry, government, chemical engineers, professional organizations, and various stake- holders to develop and adopt stronger and improved standards and practices for chemical process safety. As described by one process safety expert: “A significant impact of Bhopal was to make everybody—corporate management, government, communities—aware of the potential magnitude of a chemical accident” (West et al., 2004). It is in this context that the widespread use and acceptance of the concept, “process safety,” and later, chemical process safety, was embraced and adopted as a standard practice in the industry. The heightened awareness resulted in new regulations for process safety; best-practices initiatives, such as ­Responsible Care;2 and an increased concern about the potential to export the risk as well as the benefits of technology to developing countries as the chemical industry expanded around the globe. The goal of process safety is to develop a systematic and comprehensive approach to safety that involves the proactive iden- tification, evaluation, and mitigation or prevention of chemical releases that might occur as a result of failures in the process, procedures, or equipment (Kletz, 1998). In 1990, two major developments in U.S. process safety occurred: the publication of a proposed standard from the Occupational Safety and Health 2  Responsible Care is a global program initiated by the Canadian Chemical Producers’ Associa- tion in 1985 as a voluntary, industry-driven program to support improvements in health, safety, and environmental practices in the chemical industry.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. BHOPAL AND CHEMICAL PROCESS SAFETY 35 Administration (OSHA), titled “Process Safety Management of Highly Haz- ardous Chemicals,” and the passage by the U.S. Congress of the Clean Air Act Amendments (CAAA) of 1990. The CAAA provided regulatory oversight of process safety in the chemical industry to OSHA and the U.S. Environmental Protection Agency (EPA). In particular, CAAA identified 14 minimum elements that the OSHA Process Safety Management Standard must require of employers (see Box 2.1). The final PSM standard was promulgated in 1992 by OSHA and is enforced by that office in coordination with EPA. The standard emphasizes the management of hazards through a comprehensive program that integrates management technologies, practices, and procedures and includes 14 mandatory elements that correlate to the CAAA requirements (see Box 2.2). Under CAAA, EPA has responsibilities relating to the prevention of accidental release, inven- tories of chemicals, and development of risk management plans (RMP), among other things. EPA, as directed by the CAAA, established its risk management program rule requiring companies that use toxic and flammable substances to develop and submit an RMP that must be revised and resubmitted every 5 years. A third major provision of the CAAA was the creation and establishment of the U.S. Chemical Safety and Hazard Investigation Board (CSB), an independent federal agency patterned after the National Transportation and Safety Board, to investigate major chemical accidents at fixed facilities (P.L. 101-549§ 304, 104 Stat. 2576 [1990]). The Bhopal disaster also resulted in changes from within the chemical engi- neering and chemical industry communities. The American Institute of Chemical Engineers (AIChE) launched a major initiative in February 1985 to improve and bring attention to the practices of process safety (Bollinger et al., 1996). AIChE focused on becoming a resource for information about process safety, providing training and education, advancing the state of the art in process safety, and pro- moting process safety as a key industry value. An AIChE task force was formed in March 1985, and its members proposed initial objectives to establish guidelines for hazard evaluation procedures; guidelines for bulk storage, handling, and trans- portation of toxic and/or reactive materials; and good plant operating procedures and training. As a result of these objectives, the AIChE Council officially approved the establishment of the Center for Chemical Process Safety (CCPS). The CCPS was fully established as a separate organization from AIChE in September 1985, with a director, part-time staff consultants in the industry, and close to 40 charter corporate members. In 1989, CCPS outlined 12 elements of process safety man- agement in its book Guidelines for Technical Management of Process Safety, and these have been serving as the foundation for process safety programs, standards and regulations throughout the chemical industry in the United States, and around the world (Mannan, 2005). These elements are listed in Box 2.3. In the chemical process industry, managing risks through the use and imple- mentation of these program elements of process safety management and the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 36 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE BOX 2.1 CAAA Process Safety Management Standard Requirements (P.L. 101-549§ 304, 104 Stat. 2576 [1990])   1. Develop and maintain written safety information identifying work­ place chemical and process hazards, equipment used in the pro­ cesses, and technology used in the processes;   2. Perform a workplace hazard assessment, including, as appro­ priate, identification of potential sources of accidental releases, identification of any previous release within the facility that had a potential for catastrophic consequences in the workplace, estima­ tion of workplace effects of a range of releases, and estimation of the health and safety effects of such a range on employees;   3. Consult with employees and their representatives on the develop­ ment and conduct of hazard assessments and the development of chemical accident prevention plans and provide access to these and other records required under the standard;   4. Establish a system to respond to the workplace hazard assessment findings, which shall address prevention, mitigation, and emergency responses;   5. Review periodically the workplace hazard assessment and ­response system;   6. Develop and implement written operating procedures for the chem­ ical processes, including procedures for each operating phase, operating limitations, and safety and health considerations; mandated requirements of OSHA and EPA generally assumes that the chemical hazard risk already exists and is accepted. The assumption is that once the risk is accepted, it does not go away. Unless the management system is actively moni- toring company operations and taking proactive approaches to correct potential problems, the opportunity for an unwanted event to occur will manifest. The “best practice” methods for managing risks are found in the elements and components of PSM, which are widely accepted and used worldwide. Community Right-to-Know Another important regulatory impact of the Bhopal disaster was the passage of the Emergency Planning and Community Right-to-Know Act (EPCRA, also

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. BHOPAL AND CHEMICAL PROCESS SAFETY 37   7. Provide written safety and operating information for employees and employee training in operating procedures, by emphasizing hazards and safe practices that must be developed and made available;   8. Ensure contractors and contract employees are provided with appro­priate information and training;   9. Train and educate employees and contractors in emergency ­response procedures in a manner as comprehensive and effective as that required by the regulation promulgated pursuant to section 126(d) of the Superfund Amendments and Reauthorization Act;

Establish a quality assurance program to ensure that initial ­process-related equipment, maintenance materials, and spare parts are fabricated and installed consistent with design specifications;

Establish maintenance systems for critical process-related equip­ ment, including written procedures, employee training, appropriate inspections, and testing of such equipment to ensure ongoing mechanical integrity;

Conduct pre-startup safety reviews of all newly installed or modi­ fied equipment;

Establish and implement written procedures managing change to process chemicals, technology, equipment and facilities; and

Investigate every incident that results in or could have resulted in a major accident in the workplace, with any findings to be reviewed by operating personnel and modifications made, if appropriate. SOURCE: OSHA, 2000. known as SARA Title III because it is Title III of the Superfund Amendments and Reauthorization Act of 1986). This bill came about as a result of both the Bhopal disaster in 1984 and a release of aldicarb oxime that occurred at the Union Carbide plant in Institute, WV in 1985. The release in Institute resulted in the hospitalization of approximately 100 individuals, and occurred shortly after the re-start of production following a hiatus in response to the Bhopal release. EPCRA, managed by EPA, defines the community right-to-know obligations of government, industry, and Tribal authorities with respect to emergency response planning and hazardous and toxic chemicals in the area. The Act has three subtitles: Emergency Planning and Notification, Reporting Requirements, and General Provisions. Some important elements of the Act follow:

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 38 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE BOX 2.2 Elements of OSHA’s Process Safety Management Standard • Process safety information. Employers must complete a compilation of written process safety information before conducting any process haz­ ard analysis required by the standard. Process safety information must include information on the hazards of the highly hazardous chemicals used or produced by the process, information on the technology of the process, and information on the equipment in the process. • Process hazard analysis. Employers must perform an initial process hazard analysis (hazard evaluation) on all processes covered by this standard. The process hazard analysis methodology selected must be appropriate to the complexity of the process and must identify, evaluate, and control the hazards involved in the process. • Operating procedures. Employers must develop and implement writ­ ten operating procedures, consistent with the process safety information, that provide clear instructions for safely conducting activities involved in each covered process. Activities to be covered include initial startup, ­normal operations, temporary operations, emergency shutdown, emer­ gency operations, normal shutdown, and startup following a turnaround, or after an emergency shutdown. • Employee participation. Employers must develop a written plan of action to implement the employee participation required by PSM. Under PSM, employers must consult with employees and their representatives on the conduct and development of process hazard analyses and on the development of the other elements of process management, and they must provide to employees and their representatives access to process hazard analyses and to all other information required to be developed by the standard. • Training. Each employee presently involved in operating a process or a newly assigned process must be trained in an overview of the process and in its operating procedures. The training must include emphasis on the specific safety and health hazards of the process, emergency opera­ tions including shutdown, and other safe work practices that apply to the employee’s job tasks. • Contractors. Contract employers involved in maintenance, repair, turnaround, major renovation or specialty work, on or near covered pro­ cesses are required to train their employees to safely perform their jobs. The contract employers must document that employees received and understood training, and assure that contract employees know about potential process hazards and the work-site employer’s emergency ac­ tion plan, assure that employees follow safety rules of the facility, and

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. BHOPAL AND CHEMICAL PROCESS SAFETY 39 advise the work-site employer of hazards that contract work itself poses or hazards identified by contract employees.

The facility employer must obtain and evaluate information regarding the contract employer’s safety performance and programs. The employer also must inform contract employers of the known potential fire, explo­ sion, or toxic release hazards related to the contractor’s work and the process; explain to contract employers the applicable provisions of the emergency action plan; develop and implement safe work practices to control the presence, entrance, and exit of contract employers and contract employees in covered process areas; evaluate periodically the performance of contract employers in fulfilling their obligations; and main­ tain a contract employee injury and illness log related to the contractor’s work in the process areas. • Pre-startup safety review. A safety review is mandatory for new facili­ ties and significantly modified work sites to confirm that the construction and equipment of a process are in accordance with design specifications; to ensure that adequate safety, operating, maintenance and emergency procedures are in place; and to ensure that process operator training has been completed. Also, for new facilities, a process hazard analysis must be performed and recommendations resolved and implemented before startup. Modified facilities must meet management-of-change requirement. • Mechanical integrity. Employers must establish and implement written procedures to maintain the ongoing integrity of process equip­ ment, including pressure vessels, piping systems, relief and vent sys­ tems, emergency shutdown systems, controls, and pumps. Employees ­involved in maintaining the ongoing integrity of process equipment must be trained in an overview of that process and its hazards and trained in the procedures applicable to the employee’s job tasks. • Hot work. Hot work permits must be issued for hot work operations conducted on or near a covered process. • Management of change. Employers must establish and implement written procedures to manage changes (except for “replacements in kind”) to process chemicals, technology, equipment, and procedures, and change to facilities that affect a covered process. Employees and contract employees who operate a process and maintenance must be trained in the change prior to startup of the process or the affected part of the process. • Incident investigation. PSM requires the investigation of each inci­ dent that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical in the workplace. The investiga­ tion must be initiated as promptly as possible, but not later than 48 hours continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 40 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE following the incident. The investigation must be by a team consisting of at least one person knowledgeable in the process involved, including a contract employee if the incident involved the work of a contractor, and other persons with appropriate knowledge and experience to investigate and analyze the incident thoroughly. • Emergency planning and response. Requires employers to develop and implement an emergency action plan. The emergency action plan must include procedures for handling small releases. • Compliance audits. Employers must certify that they have evalu­ ated compliance with the provisions of PSM at least every three years to verify that the procedures and practices developed under the standard are adequate and are being followed. The compliance audit must be con­ ducted by at least one person knowledgeable in the process and a report of the findings of the audit must be developed and documented noting deficiencies that have been corrected. The two most recent compliance audit reports must be kept on file. • Trade secrets. Employers must make available all information neces­ sary to comply with PSM to those persons responsible for compiling the process safety information, those developing the process hazard analy­ sis, those responsible for developing the operating procedures, and those performing incident investigations, emergency planning and response, and compliance audits, without regard to the possible trade secret status of such information. The employer may require from those persons to enter into confidentiality agreements not to disclose the information. SOURCE: Adapted from OSHA (2000). BOX 2.2 Continued • the creation of local and state emergency planning committees (LEPC and SERC, respectively), • the requirement for plant operators to notify local and state officials in the event of a significant release of toxic materials, • the requirement for plant operators to report inventories of all onsite chemi- cals for which an MSDS exists to state and local officials and local fire departments, • the requirement for plant operators to submit a Toxic Release Inventory Form annually, and • the protection of “trade secrets” contingent on approval by the EPA. EPCRA, Responsible Care, and the continuing evolution of PSM systems

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. BHOPAL AND CHEMICAL PROCESS SAFETY 41 are manifestations of another, less-well-defined legacy from Bhopal: the change in community and industry perceptions of hazardous and toxic materials and the risks they pose to personnel onsite and the local population surrounding chemical facilities. The effects of the MIC release in 1984 are still felt in Bhopal, India, and by the Dow Chemical Company, which purchased the facility from Union Carbide in 2001. Within Institute, WV, it would be naive to not recognize the impact the Bhopal release had, and continues to have, on the area, and it is clear that the release and its aftermath have affected local community relationships with the current and former owners of the facility. The nature of the relationships between a chemical company and its sur- rounding community and onsite personnel can and do influence the range of busi- ness decisions that a company can make. This relationship is discussed in greater detail in Chapters 6 and 7 in the context of external factors that affect decision- making. To emphasize the importance of these relationships, the committee notes here that in 1985, the DuPont facility in LaPorte, TX actually began onsite production, although not storage, of MIC. In describing the implementation of this process, Mr. John Carberry stated that its success was due in part to the site manager’s “long standing, strong, broad community and governmental relations” and because the company recognized that it needed to, “[m]anage community and governmental relations to insure a smooth acceptance of the new process” (Carberry, 2011). To address this need, DuPont pro-actively involved the com- munity in discussions about the change in procedures at multiple points during the decision-making process. This engagement with the community was credited with creating a relationship where objections could be voiced and addressed without community protest. BOX 2.3 12 Elements of Process Safety Management Defined by CCPS   1. Accountability: Objectives and Goals   2. Process Knowledge and Documentation   3. Process Safety Review Procedures for Capital Projects   4. Process Risk Management   5. Management of Change   6. Process and Equipment Integrity   7. Human Factors   8. Training and Performance   9. Incident Investigation

Company Standards, Codes and Regulations

Audits and Corrective Actions

Enhancement of Process Safety Knowledge

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 42 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE REFERENCES Andersson, N., M. K. Ajwani, S. Mahashabde, M. K. Tiwari, M. K. Muir, V. Mehra, K. Ashiru, and C. D. Mackenzie. 1990. Delayed eye and other consequences from exposure to methyl isocyanate: 93% follow-up of exposed and unexposed cohorts in Bhopal. Br. J. Ind. Med. 47(8):553-558. Beckett, W. S. 1998. Persistent respiratory effects in survivors of the Bhopal disaster. Thorax 53(suppl. 2):S43-S46. Bollinger, R. E., D. G. Clark, R. M. Dowell, R. M. Ewbank, D. C. Henershot, W. K. Lutz, S. I. Meszaros, D. E. Park, and E. D. Wixom. 1996. Inherently Safer Chemical Processes: A Life Cycle Approach. New York: Center for Chemical Process Safety of American Institute of Chemical Engineers. Bowander, B., J. X. Kasperson, and R. E. Kasperson. 1985. “Avoiding Future Bhopals.” Environment. 27:6-13; 21-27. Broughton, E. 2005. The Bhopal disaster and its aftermath: A review. Environ. Health 4(1):6. Carberry, J. 2011.Transition to Just-in-time Production of MIC, February 9, 2011, Washington, DC. Dhara, V. R. 2000. Health effects of the Bhopal gas leak: A review. Pp. 15-67 in The Bhopal Gas Leak: Lessons from Studying the Impact of a Disaster in a Developing Nation. Ph.D. Disserta- tion, University of Massachusetts [online]. Available: https://webdrive.service.emory.edu/users/ vdhara/healtheffects/dissertation/ch2.pdf. Accessed: Sept. 27, 2011. Dhara, V. R., and R. Dhara. 2002. The Union Carbide disaster in Bhopal: A review of health effects. Arch. Environ. Health 57(5):391-404. FABIG (The Fire and Blast Information Group). 2009. Major Accidents: Bhopal [online]. Available: http://www.fabig.com/NR/rdonlyres/803AA0DA-87BF-4A60-AAD0-71D0842F3775/2603/ Bhopal.pdf. Accessed: Sept. 27, 2011. Fortun, K. 2001. P. 259 in Advocacy After Bhopal: Environmentalism, Disaster, New Global Orders. Chicago: University of Chicago Press. Hood, E. 2004. Lessons learned? Chemical plant safety since Bhopal. Environ. Health Perspect. 112(6):A352-A359. ICFTU-ICEF. 1985. The Report of the ICFTU-ICEF Mission to Study the Causes and Effects of the Methyl Isocyanate Gas Leak at the Union Carbide Pesticide Plant in Bhopal, India, on December 2-3-1984. Available: http://bhopal.bard.edu/resources/research.php?action=getfile&id=445521. Accessed: April 16, 2012. Kletz, T. A. 1998. Process Plants: A Handbook for Inherently Safer Design. Philadelphia, PA: Taylor & Francis. Mannan, S. (ed.). 2005. Lee’s Loss Prevention in the Process Industries, 3rd Edition. Oxford, UK: Elsevier Butterworth-Heinemann . Mishra, P. K., R. M. Smarth, N. Pathak, S. K. Jain, S. Banerjee, and K. K. Maudar. 2009. Bhopal gas tragedy: Review of clinical and experimental findings after 25 years. Int. J. Occup. Med. Environ. Health 22(3):193-202. OSHA (Occupational Safety and Health Administration). 2000. Process Safety Management. OSHA

1. U.S. Department of Labor, Occupational Safety and Health Administration, Washington,

DC [online]. Available: http://www.osha.gov/Publications/osha3132.html. Accessed: Feb. 14, 2012. Public Law 101-549, title III, Sec. 304, Nov. 15, 1990, 104 Stat. 2576. Shrivastava, P. 1987. P. 184 in Bhopal: Anatomy of a Crisis. Cambridge, MA: Ballinger Publishing. West, A. S., D. Hendershot, J. F. Murphy, and R. Willey. 2004. Bhopal’s Impact on the Chemical Industry, Process Safety Progress 23(4):229-230.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 3 Industrial Production and Use of MIC at Bayer CropScience The statement of task calls for an examination of the use and storage of methyl isocyanate (MIC) at the Bayer CropScience facility in Institute, West Virginia. This chapter provides an overview of the history of the plant, with a particular focus on processes relating to MIC and the pesticides it is used to synthesize. Alternative methods of producing these materials are presented in Chapter 5. HISTORY AND CHARACTERISTICS OF THE SITE The 460-acre, multitenant Institute Manufacturing Industrial Park is located 9 miles west of Charleston, West Virginia. The facility is on the Kanawha River to the south, abuts Route 25 and Interstate 64 to the north, and the West Virginia State University to the east. Transportation to and from the site is provided by barge, rail (located adjacent to the river), and truck. West Virginia State University is the oldest extant institution in the immedi- ate vicinity. Established in 1891 as a land grant college, the university enrolls 3,145 students on a 91-acre campus adjacent to the Institute industrial park (U.S. News, 2010). (See Figure 3.1) Originally home to the Wertz Field Airport, the site was converted to a synthetic rubber production plant by the U.S. Government Defense Corporation during World War II. Originally designed, built, and managed by the ­Carbide and Carbon Chemicals Corporation (a subsidiary of Union Carbide) and the U.S. ­Rubber Company, the facility has had a number of owners. Union ­Carbide Corporation (UCC) purchased the chemical manufacturing operations plant in 1947, which it used to produce a variety of chemicals including butanol, olefins, plasticizers, and acetic acid. The plant also produced some fungicides, although 43

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 44 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE FIGURE 3.1  Google™ Earth satellite images of the facility at Institute, West Virginia and the surrounding area (accessed April 14, 2012). (a) The region around Institute, West Virginia (b) the Bayer CropScience facility and local area. SOURCE: Google Earth satellite image: ©Google 2012.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 45 this was initially a small portion of the plant’s operations. In the 1960s, UCC expanded operations, including construction of facilities to produce ­carbamates and to allow for production of new synthetic intermediates for other companies (Woomer, 2000). Rhône-Poulenc purchased UCC’s agricultural division, including the Institute site, in 1986. In 2000, Aventis (formed by a merger of Rhône-Poulenc and AgrEvo) took over management of the facility. Finally, Bayer CropScience acquired the facility in 2002 (CSB, 2011). Bayer CropScience is a global provider of insecticides, herbicides, and fungicides. Independently operated within Bayer, AG, Bayer CropScience is headquartered in Germany. The company employs about 20,700 workers in over 120 countries (Bayer ­CropScience, 2011c). The U.S. headquarters are in Research Triangle Park, North Carolina. In 2008, the facility hosted seven tenants. Bayer CropScience owned and operated 9 of the 16 production units on the site. Two production units, owned by Adisseo and FMC Corporation, were also operated by Bayer. The remaining units were owned and operated by Dow Chemical, Catalyst Refiners, Reagent Chemical, and Praxair, respectively. Bayer employed approximately 85 percent of the 645 workers employed at the facility (CSB, 2011). HISTORY OF CARBAMATE INSECTICIDE MANUFACTURING The focus of production at the Bayer plant in 2008 was on carbamate pes- ticides, which have been shown to be effective against a variety of pests. The general structure of carbamate pesticides is R1NHCOOR2, where R represents alkyl or aryl groups. The facility in Institute manufactured a number of different carbamates over the years. The processes for manufacturing these materials have changed over time, some of which have implications for process safety. What follows here is a description of some of the major changes at the facility, and Appendix B contains a detailed timeline of modifications. The major carbamate products are summarized in Table 3.1. Carbamate pesticide production in Institute began in the 1960s with carbaryl. Carbaryl is a broad-spectrum pesticide and is used in a variety of commercial and residential settings for control of pests such as beetles, crickets, fleas, ticks, and moths (U.S. EPA, 2004). Production of MIC also began during that decade, although at that time it was only manufactured for use at other facilities and for sale to other companies rather than for use onsite. That changed in 1976 with the production of aldicarb in Institute. Aldicarb had previously been produced in Woodbine, Georgia, and although final formulation and packaging of the material continued at that site, synthesis of the pesticide was moved to Institute. While sharing basic carbamate chemistry with carbaryl, for reasons that are discussed in Chapter 5, production of aldicarb was carried out by a chemical pathway using phosgene and MIC. Aldicarb is primarily used to control nematodes and sucking insects in crops such as cotton, beans, and peanuts (U.S. EPA, 2010). The method for production of carbaryl was changed in 1978 from one that used naphthyl-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 46 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 3.1  Trade Names and Structures of Pesticides Manufactured at the Bayer CropScience Facility Pesticide Trade Name Structure Carbaryl Sevin Aldicarb Temik Thiodicarb Larvin, CropStar Carbofuran Furadan Carbosulfan Marshal Methomyl CH3 S N CH3 O NH O CH3 chloroformate (NCF) as a starting material to one that used MIC. That year also saw the startup of a second, larger MIC unit to provide for the growing demand for aldicarb and changes to carbaryl production.1 In the early 1980s, carbamate 1  At that time, the facility shipped MIC around the world to customers in France, India, Brazil, and the United States, and to accommodate international demand, Union Carbide built a MIC unit in Bhopal in the late 1970s, with startup in 1980.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 47 insecticide manufacturing was expanded to include methomyl (an intermediate feedstock sold internationally) and thiodicarb (an agricultural insecticide and ovicide used against cotton bollworms and budworms made from methomyl) (U.S. EPA, 1998), both of which required MIC for production. The MIC and phosgene production units, along with the units that were used to manufacture aldicarb and carbaryl, were all co-located in the East ­Carbamoylation Complex (ECC). Production units for methomyl and thiodicarb were located in the West Carbamoylation Complex (WCC). The ECC and WCC are highlighted in Figure 3.2. Liquid MIC was stored in underground refrigerated pressure vessels in the ECC where it was manufactured. It was later used as a chemical feedstock there or at the WCC to which it was transferred at night and stored for later use. On December 3, 1984, in response to the release in Bhopal, the MIC ­facility in Institute was shut down for several months while Union Carbide installed $5 million worth of safety equipment and enhancements (Los Angeles Times, 1985), which included increased MIC destruction capacity. However, the Institute site itself suffered an accident on August 11, 1985, FIGURE 3.2  The Bayer CropScience facility. The circle on the left marks the methomyl production unit, where the aboveground storage tank was located, in the West Carbamo- ylation Complex. The circle on the right marks the methyl isocyanate production unit in the East Carbamoylation Complex. SOURCE: Smythe, 2011.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 48 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE when 4,000 pounds of aldicarb oxime and methylene chloride were released, resulting in 136 people being sent to 5 local hospitals. No fatalities were reported, though 29 individuals were held for observation for one or more days (Houston Chronicle, 1985; Baron et al., 1988). Following Bhopal, shipments of MIC from Institute to U.S. customers were curtailed. Two of these customers were FMC, a manufacturer of the carba- mate pesticides carbofuran and carbosulfan and DuPont. In 1986, FMC built production units for carbosulfan and carbofuran in the WCC (Woomer, 2000). DuPont developed a process for manufacturing MIC as a feedstock that was almost instantaneously reacted into final product, thereby eliminating the need to purchase or store MIC. That same year, 1986, Rhône-Poulenc bought Union ­Carbide’s Agricultural Products Division. In 1993 a $50 million Institute modification project carried out various changes to the facility related to MIC, phosgene, and chlorine safety (Ward, 1994). As part of that project, MIC capacity was reduced by more than 80 percent to 22 million pounds per year. This change was largely justified as a consequence of DuPont and other customers no longer requiring the product, which had previ- ously been stored in batches of 240,000 pounds. Additional details about these changes can be found in Chapter 5. In 1999, Rhône-Poulenc purchased the carbofuran and carbosulfan manu- facturing facilities owned by FMC and established the Carbamate Excellence Center at Institute, and a new carbamate process, the oxamyl process, was added. In December of that year, Rhône-Poulenc SA merged with Hoechst AG to form Aventis. The Institute site became the largest site in North America for Aventis CropScience (Woomer, 2000). In 2001, EPA performed a series of inspections at the facility and identified a set of violations of environmental laws (EPA, 2009). Also in 2001, the facility was purchased by Bayer, thus moving the Institute plant to its current ownership, Bayer CropScience. As the legal successor to Aventis, Bayer settled with EPA regarding the 2001 violations in February 2009 with an agreement to pay a $112,500 penalty and to spend over $900,000 on supplemen- tal environmental projects. As part of the settlement, Bayer CropScience neither admitted nor denied the allegations. By 2008 the Institute plant was the only facility in the United States that manufactured, stored, and consumed large quantities of MIC. Liquid MIC was stored in underground refrigerated pressure vessels in the ECC, where it was manufactured before being used—either as a chemical feedstock there or at the WCC to which it was transferred at night and additionally stored. Each pressure vessel was insulated and had double-wall construction, with leak detection in the annulus between the inner and outer wall. The transfer from the ECC to the WCC occurred through a 2,500-foot, insulated, aboveground piping system to an aboveground “day tank” located on the southwest corner of the WCC. The stain- less steel tank, with a maximum capacity of 6,700 gallons, held approximately 37,000 pounds of MIC at its normal 75 percent operating capacity. A number of

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 49 safety features were incorporated into the day-tank design. The tank was filled once per day, and the pipes connecting the ECC to the WCC were purged after the transfer. The MIC was chilled, with methyl isobutyl ketone (MIBK) used as the chiller fluid because, unlike the water-ethylene glycol mixtures typically used in chillers, MIBK does not react with MIC and therefore poses less risk in case of a chiller leak. Fire suppressants were installed to prevent thermal reactions. Air monitors were in place to detect MIC leaks. Finally, the tank and top piping connections were surrounded with a blast blanket to prevent debris from striking the tank and to provide a thermal shield in case of fire (CSB, 2011). Each of the pesticides being manufactured onsite at Institute used different production processes: aldicarb was produced in a batch reactor, carbaryl in a continuous fixed-bed reactor, methomyl in a continuous plug flow reactor, and carbofuran used a solventless process. All of these processes were designed to use liquid MIC. The pesticides had different seasonal patterns of production, and there was considerable variation in the facility’s MIC consumption over time—between 5,000 and 100,000 pounds per day over the course of their history. To regulate car- bamate production and minimize startup/shutdown issues for MIC production, the facility maintained an inventory of up to 200,000 pounds of MIC—­approximately 10 days of normal production or 3 days of high production (Martin, 2011). On August 28, 2008, an uncontrolled chemical reaction inside a methomyl unit residue treater in the WCC caused the vessel to explode violently, causing the deaths of two employees. See the next chapter section (History of Emergency Preparedness and Accidents) for more information. As a result of the accident and the damage to the WCC, production of methomyl, MIC, and the carbamate-based pesticides ceased, pending investigation and evaluation of the production unit. In March 2009, EPA made a decision to ban the use of carbofuran pesticides (74 Fed.Reg.11,551 [2009]) leading to the decision by Bayer CropScience to stop production at Institute of all but two of the carbamate pesticides: aldicarb and carbaryl. Dropping the other products led to substantial reductions in the need for MIC, and so 2009 MIC production was only 9 million pounds, with planned 2010 production of 11.5 million pounds (Martin, 2011). In August 2009, Bayer announced a $25 million investment program “for further enhancing operational safety” (Bayer CropScience, 2009) at the facility, and as part of this program, the carbamate pesticide production would cease in the WCC approximately a year after the announcement. This would remove the need for the aboveground storage tank and for the transfer of MIC from the ECC to the WCC. Production would be limited to aldicarb and carbaryl, both of which were produced in the ECC. As part of the modification plan the decision was made to reduce by 80 per- cent the maximum amount of MIC being kept in storage on the Institute site, with additional passive and active safety systems on MIC production to mini- mize risks. Additional details will be provided in Chapter 5, but briefly, the MIC-production changes included building a new storage unit for the MIC with

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 50 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE underground tanks; incorporation of a steam-ammonia curtain in the building’s perimeter to assist in controlling leaks, should they occur; and other passive and active safety controls. In 2010 Bayer reached an agreement with EPA to voluntarily cancel its registration of aldicarb, with production of the pesticide to end in 2014 and distribution and sales to end in 2016 (EPA, 2010; Ward, 2010). Citing this agree- ment and global restructuring of its parent company, on January 11, 2011 Bayer announced that “the production of certain carbamates is no longer economically viable.” (Bayer CropScience, 2011b) The company’s intention at that time was to continue to make modifications to the MIC plant at Institute; restart manufactur- ing of aldicarb, carbaryl, and the intermediate materials required for their produc- tion, including MIC; and continue manufacturing those materials until mid-2012. In February 2011 a group of Kanawha Valley residents filed suit to stop Bayer CropScience from restarting its production of MIC at the Institute plant until EPA and OSHA completed comprehensive plant inspections. A prelimi- nary injunction was granted, halting Bayer’s planned restart of MIC production (Ward, 2011). On March 18, 2011, Bayer CropScience announced that it would not restart the production of MIC. In a press release, the company stated that, “uncertainty over delays has led the company to the conclusion that a restart of production can no longer be expected in time for the 2011 growing season.” In light of this decision, the company said it would proceed with decommission- ing the MIC and carbamate production units at Institute, as well as closing the Woodbine facility, which had continued to finalize the aldicarb formulation and packaging since 1976 (Bayer CropScience, 2011a). HISTORY OF EMERGENCY PREPAREDNESS AND ACCIDENTS The Kanawha River Valley is the home of an extensive network of chemical and other manufacturing facilities and represents one of the highest concentra- tions of such industries in the United States. In 1954, these industries established the Kanawha Valley Emergency Planning Committee (KVEPC) following an explosion of an acrolein tank car. An explosion of an ethylene oxide distillation column in 1955 damaged parts of the Institute facility and led to a major safety review by the management (Woomer, 2000). After that, such safety reviews were conducted internally to the plant and its management until the Bhopal accident. Following Bhopal, public concern in the Kanawha Valley about chemical acci- dents increased, and with passage of the Emergency Planning and Community Right-to-Know Act (EPCRA, see Chapter 2), the Kanawha/Putnam Local Emer- gency Planning Committee (KPEPC) was established in 1987 (KPEPC, 2011). At the same time, local public concern about MIC led to the establishment of the organization People Concerned About MIC (PCMIC, 2011). In 1992, the KPEPC initiated the Kanawha Valley Hazard Assessment ­Project, which examined “worst-case” scenarios for all chemical plants in the ­valley. The

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 51 compilation of scenarios were presented during a June 3-4, 1994 workshop held in Charleston, West Virginia under the title “Safety Street: ­Managing Our Risk Together (Worst Case Scenario Presentations).” This was the first time such an activity had been held in the area, and according to the organizers, it was well received by the community (OECD, 1997). The materials identified a release from the MIC unit as one of worst-case scenarios associated with the Rhône- Poulenc-owned facility; the other two noted chemicals associated with the facility were phosgene and chlorine, the latter being used in the production of phosgene. The risk management plan from Rhône-Poulenc identified the worst case as the full release of 253,600 pounds of MIC from the ECC belowground storage tank. According to the analysis, such a release would exceed ERPG-2 (emergency response planning guidelines) levels out to a distance of 28 miles (at concentra- tion of 0.5 ppm) and ERPG-3 levels out to a distance of 9 miles (5 ppm) (Fortun, 2001, pp. 66-67). ERPG-2 levels indicate the “maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to 1 hour without experiencing or developing irreversible or serious health effects or symptoms which could impair an individual’s ability to take protective action”2, while ERPG-3 levels indicate the “maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to 1 hour with- out experiencing or developing life-threatening health effects”.3 This constitutes the largest scenario vulnerability zone of any chemical used in the ­valley at the ERPG-2 level and nearly largest vulnerability zone at the ERPG-3 level. At the time of the 1992 analysis, Rhône-Poulenc had just completed a 1.5- year study called Project Michelle (1989-1990) (as cited in Ward, 1994) which focused on improving the safety of thee MIC processes, including considering whether to put a “bubble” over the entire MIC unit to contain any leaks. Rhône- Poulenc had numerous active (and some passive) systems in place to reduce the risk associated with the MIC unit. These included:

1. Process design. An emergency dump tank for safe transfer of MIC from

a leaking vessel, a scrubber to destroy MIC in the storage tank, a flare tower to destroy MIC from process vents, backup control room instruments, automatic MIC isolation valves to stop leaks, diking and spill collection sumps, a fire deluge system, MIC leak detection alarms, safety relief valves to protect vessels from overpressure, a diesel generator for backup power, sealless pumps for managing liquid MIC, fire protection for pipe rack transfer lines, and an independent nitro- gen supply to prevent cross contamination.

1. Equipment design. A double-walled underground storage tank, special

pressure vessels, blast material protection for the aboveground MIC storage 2  AIHA Definition 3  AIHA Definition

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 52 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE facilities, stainless steel construction, barriers to protect pipelines over roads, and double-walled pipelines with leak detection analyzers on critical transfer lines.

1. Safety reviews and procedures. Process hazard analysis completed

every 5 years, ongoing safety reviews for design changes, operational reviews completed for all process changes, and safety review teams that included safety experts, engineers, union operators, and union maintenance personnel. It also established procedures and training inspection, emergency response and incident investigation systems (Fortun, 2001, p. 67). Between 1989 and 1993, although the facility had no EPA-reportable releases (threshold of 10 pounds), it did report 13 leaks of between 1 and 10 pounds, and 30 leaks of less than 1 pound to the local emergency authorities. In 1993, Rhône-Poulenc was fined by OSHA for alleged safety violations that occurred during a non-MIC-related explosion and fire within the methomyl manufacturing unit, which was located near the aboveground MIC storage unit. The incident claimed the life of one plant worker and injured two others. OSHA investigators concluded that the company tried to boost pesticide production without regard for safety (Ward, 1994). The Institute Community Liaison Committee (CLC) commissioned a review of the incident investigation by PrimaTech, Inc. in 1993 (PrimaTech, Inc., 1993). This incident caused considerable concern within the community, and the president of West Virginia State College,4 Hazo Carter, wrote to the plant man- ager stating, As president of West Virginia State College, I am quite concerned about the safety of the more than 5,000 students, faculty, staff, and community residents due to recent accidents and frequent spills at the Institute Rhône-Poulenc plant. I was especially concerned to read that a tank holding 30,000 pounds of methyl isocyanate [MIC] gas was within 250 feet of the explosion and fire. The severity of this situation makes it imperative that every precaution be taken to prevent accidents from happening and that immediate notification be given to us if such accidents should occur in the future. (Carter, 1993) In December 1994, following that explosion, Rhône-Poulenc completed the Institute Modification Project, involving $50 million in improvements. These improvements included: moving the phosgene unit closer to the MIC process to reduce the distance phosgene has to travel in pipes; adding a new cooling system for MIC tanks, using chloroform, rather than water-based brine; ­adding redundant warning systems to detect leaks and to monitor pressure, 4  West Virginia State College became West Virginia State University in 2004.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 53 temperature, and possible water-contamination at concentrations as low as 2 ppm; upgrading the scrubber and flare systems; and adding another backup generator (Ward, 1994). The U.S. Chemical Safety and Hazard Investigation Board (CSB) report on the 2008 incident states that, [t]he five-year accident history for the RMP-regulated chemicals reports an acci- dent that released approximately 15 pounds of phosgene (October 1999), another that released less than 1 pound of chlorine (May 2000), and a third that released approximately 3,000 pounds of liquid chloroform (August 2001). Each resulted in one or more worker exposures, and the phosgene release prompted a shelter-in place-alert. However, the company reports none of the releases involved offsite consequences (CSB, 2011). Following its acquisition of the Institute facility from Aventis CropScience, Bayer CropScience completed 20 projects to enhance process safety and eco- nomic competitiveness, with particular attention paid to the phosgene and MIC units. These changes included a new, downsized phosgene unit, reductions in pipeline capacity in chlorine lines, downsizing the MIC unit to match lower demands (since inventory of MIC required for production was reduced by 80 per- cent since mid-1980s), modernizing equipment and instrumentation to safeguard the purity of the components used in the MIC process, additional emergency neutralization processes, and updated transfer processes. 2008 Accident in Methomyl Facility As described in an earlier section, the production requirements and schedules varied for the different pesticides manufactured at the plant, and the methomyl process (located in the WCC) was only operated periodically in response to sea- sonal demand for the product. These gaps in the production schedule provided opportunities to perform repairs and system upgrades. In 2008, Bayer upgraded the methomyl control system and replaced the residue treater with a stainless steel tank during one of these downtimes. The process was restarted in August, with operations personnel, engineering staff, and contractors working around the clock to complete system upgrades. Dwindling supplies of methomyl and an increase in demand for thiodicarb created pressure to restart the operation (CSB, 2011). On August 28, 2008, amid startup procedures, an explosion occurred, result- ing in the deaths of two plant operators and considerable damage to the WCC. A full investigation of the incident was performed by the CSB and the results of that investigation reported in 2011. An overview of key events and findings from that report is provided here. The upgrades on the methomyl control system were significant, and as a con- sequence, the restart procedures were not routine. At the time of the startup, criti-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 54 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE cal procedures had not been completed. In particular, process computer system engineers had not verified the functionality of all process controls and instruments in the new control system, and changes to standard operating procedures that were needed because of changes to system controls had not yet been finalized. In addition, the staff struggled with significant problems as they attempted to bring each subsystem online, including a missing valve on a solvent line, non- operational heat tracing on a process line, a broken stem on a vapor condenser water cooling system valve, and many problems tuning control loops and calibrat- ing instruments for the newly installed computer control system. These problems were further complicated by the operators’ lack of familiarity with new methomyl work station functions and changes to some process variables (CSB, 2011). The explosion originated in the new residue treater in the methomyl produc- tion unit. The methomyl was synthesized in solvent through a series of steps. In the final stage, the solvated methomyl was transferred to a crystallizer, where an “anti-solvent” was added to cause the product to precipitate. The solid methomyl was then separated from the solvent via centrifugation. The remaining liquid, consisting of solvent, residual methomyl, and other compounds resulting from the synthesis, was transferred to a “flasher,” where the solvent was separated from the other materials and recycled in the production process. After separa- tion of the solvent, the remaining material (residual solvent, up to 22 percent ­methomyl, and impurities) was transferred to the residue treater. The role of the residue treater was to decompose the remaining methomyl in this liquid to a concentration of no more than 0.5 percent. At that point, this flammable liquid could then be burned for fuel within the facility. By August 28, methomyl production had begun, although the residue treater had not yet been brought online. There were multiple issues with the production startup that operators were endeavoring to fix, one of which was that the system was depleting solvent faster than expected. This created a need to get the solvent recovery system on line as quickly as possible to replenish the solvent. Because the last stage in the solvent recovery process was the residue treater, that system also needed to be brought online. When beginning the startup of the recovery system, operators failed to prefill the residue treater to the minimum operating level and to heat the liquid to the minimum operating temperature before adding the methomyl. Decomposition of methomyl is an exothermic reaction, therefore it was necessary for safe operation of the system to control of temperature and solvent levels. A control system was designed to prevent addition of methomyl until the solvent was at minimum volume and temperature, but the operators bypassed the safety devices during the startup. In addition, samples taken from the liquid coming from the crystallizer indicated that methomyl concentrations were as much as eight times greater than the specified operating limit, the staff did not have time to review the laboratory results and were unaware of the problem (CSB, 2011).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 55 At 10:25 PM, the residue treater high-pressure alarm sounded, and in response, a control board operator directed two outside operators to check the vent system of the residue treater. Eight minutes later, the vessel exploded and initiated a fire that burned for 4 hours. The explosion killed both operators who were sent to inspect the unit; two other workers onsite and six firefighters were treated for possible toxic chemical exposure at a local hospital. The Kanawha-Putnam County Emergency Management Director advised more than 40,000 residents, including the resident students at the West ­Virginia State University directly adjacent to the facility, to shelter-in-place for more than 3 hours (Huntington News Net., 2011). During the emergency, the Bayer ­CropScience emergency response organization failed to provide timely and accu- rate information about the incident. In part this was because, continuous air monitors located in and around the production units to detect MIC leaks had mal- functioned in May, causing spurious alarms. The system had not been repaired and restarted even though the MIC storage tank had been refilled. In addition, fence-line monitors were inadequately designed and located for detecting MIC releases (CSB, 2011). Emergency Response After 2008 In the wake of the accident, the emergency response systems in place at the facility and in the surrounding area were examined, and a number of recommen- dations were made by CSB in the areas of communication and planning. The report also noted efforts by local emergency responders (Metro 9-1-1), KPEPC, and Bayer to improve communication between the three groups in the event of an emergency. These efforts included direct telephone lines installed from the facil- ity to Metro 9-1-1 headquarters, development of a method for e-mailing residents in case of a release, increasing call center capacity, and introducing a 15-minute rule for calling an advisory shelter-in-place if an event has been reported but no additional information is available from the facility. Conversations with Matthew Blackwood and Larry Zuspan, representatives from KPEPC in 2011 and testi- mony provided by Chief Joseph Crawford before Congress in 2009 confirmed that changes to emergency response have been made since the 2008 explosion. CSB also advised modifying KPEPC’s Basic Plan and/or the Functional Annex 16, Chemical HazMat Response, to ensure clear delineation of onsite and offsite authority in case of an incident. The relevant changes within the two documents were adopted by KPEPC in May 2011. In February 2009, as part of a settlement with EPA to resolve issues identi- fied in 2001 at the facility, Bayer agreed to support the following activities as part of supplemental environmental projects (CIC, 2009): • Funding for a breathing air system for the Kanawha Valley Emergency Preparedness Training Center;

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 56 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE • Equipment for the St. Albans, Jefferson and Institute fire departments; • Training courses for Kanawha Valley emergency responders; and • Enhancements for emission dispersion modeling programs for the Metro 9-1-1 center. Note that informal feedback was received after the public meeting in ­Institute, West Virginia from a local volunteer firefighter. He expressed concern about availability of emergency equipment in all jurisdictions in the Kanawha Valley. This question was later raised to KPEPC representatives, who stated that they had no knowledge of any particular concern but that efforts were underway to acquire equipment for local fire departments. It is beyond the scope of this study to look further into this question, but asking local personnel for additional input may aid in identification of any gaps in coverage or, if no such gaps are apparent, assist in dissemination of information about available resources. REFERENCES AAUP (American Association of University Professors). 2011 Black Colleges with Highest White Enrollments [online]. Available: http://www.aaup.org/AAUP/comm/rep/HBCUChart.htm. Ac- cessed: Sept. 29, 2011. Bayer CropScience. 2009. Bayer Crop Science Announces Investment of $25 Million for Insti- tute Site. Bayer News Release: August 26 [online]. Available: http://www.bayerus.com/News/ NewsDetail.aspx?ID=586330BF-C83B-4EF3-93DBFF791373C7D7. Accessed: Feb 14, 2012. Bayer CropScience. 2011a. Bayer CropScience Announces Decision not to Resume. News: March, 18, 2011 [online]. Available: http://www.press.bayer.com/baynews/baynews.nsf/id/Bayer-Crop- Science-announces-decision-not-to-resume-MIC-production. Accessed: Sept. 29, 2011. Bayer CropScience. 2011b. Bayer CropScience to Reduce Operations in Institute, West Virginia, and Close Woodbine, Georgia, Site. News: January 11, 2011 [online]. Available: http://www.bayer cropscience.com/bcsweb/cropprotection.nsf/id/EN_20110111?open&l=EN&ccm=500020. Ac- cessed: Sept. 29, 2011. Bayer CropScience. 2011c. Overview [online]. Available: http://www.bayercropscience.com/bcsweb/ cropprotection.nsf/id/AccessPlans. Accessed: Sept. 29, 2011. Baron, R. C., R. A. Etzel, and L. M. Sanderson. 1988. Surveillance for adverse health effects follow- ing a chemical release in West Virginia. Disasters 12:356-365. Blackwood, M. and Zuspan, L. 2011. Discussion with NRC Committee. Washington, DC. Carter, H. W. 1993. Letter to Van Long, Plant Manager, Rhône-Poulenc, Charleston, W., from Hazo W. Carter, President, West Virginia State College. August 30, 1993 [online]. Available: http:// library.wvstateu.edu/facultysenate/acadyear2008-2009/environmental-issues/Rhône-Polenc- PresCarter-Aug30-1993.pdf. Accessed: Feb. 16, 2012. CIC (Community Improvement Committee). 2009. Community Minutes of March 25 meeting. CSB (U.S. Chemical Safety and Hazard Investigation Board). 2011. Investigation Report: Pesticide Chemical Runaway Reaction Pressure Vessel Explosion, Bayer CropScience, LP, Institute West Virginia, August 28, 2008. Washington, DC: CSB [online]. Available: http://www.csb.gov/ assets/document/Bayer_Report_Final.pdf. Accessed: Sept. 29, 2011. EPA (U.S. Environmental Protection Agency). 2004. Carbaryl IRED Facts, October 2004 [online]. Available: http://www.epa.gov/opp0001/reregistration/REDs/factsheets/carbaryl_factsheet.pdf. Accessed: May 1, 2012.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. INDUSTRIAL PRODUCTION AND USE OF MIC AT BAYER CROPSCIENCE 57 EPA. 1998. R. E. D. Facts Thiodicarb [online]. Available: http://www.epa.gov/opp00001/chem_ search/reg-actions/reregistration/fs_PC-114501_1-Dec-98.pdf. Accessed: May 1, 2012. EPA. 2009. Bayer CropScience to Pay Penalty for Environmental Violations. U.S. Environmental Protection Agency, Region 3, News Release, February 27 [online]. Available http://yosemite. epa.gov/opa/admpress.nsf/90829d899627a1d98525735900400c2b/c0a0da8becf0bf6b8525756e 004d6226!OpenDocument. Accessed: Feb. 2, 2012. EPA. 2010. Agreement to Terminate All Uses of Aldicarb, October 2010 [online]. Available: http:// www.epa.gov/oppsrrd1/REDs/factsheets/aldicarb_fs.html. Accessed: Sept. 29, 2011. Fortun, K. 2001. Advocacy After Bhopal: Environmentalism, Disaster, New Global Orders. Chicago: University of Chicago Press. Houston Chronicle. 1985. Nervous System Toxin Predominated in Carbide Leak Section 1, p. 2, August 16 [online]. Available: http://www.chron.com/CDA/archives/archive.mpl/1985_31269/ nervous-system-toxin-predominated-in-carbide-leak.html. Accessed: Sept. 29, 2011. Huntington News Net. 2011. Abbreviated Text of Citizens Complaint against Bayer to Prevent MIC Restart, February 9. Available: http://www.huntingtonnews.net/1563?format=print. KPEPC (Kanawha/Putnam Emergency Planning Committee). 2011. History [online]. Available: https://www.kpepc.org/history/default.aspx. Accessed: Sept. 29, 2011. Los Angeles Times. 1985. Union Carbide Delays Resuming Production of Chemical That Killed 2,000. May 4 [online]. Available: http://articles.latimes.com/1985-05-04/news/mn-20608_1_ union-carbide-corp. Accessed Sept. 29, 2011. Martin, W. 2011. ECC Presentation to NAS. Presentation at the Second Meeting on Inherently Safer Chemical Processes. March 21-22, 2011, West Virginia State University. OECD (Organisation for Economic Co-operation and Development (OECD). 1997. OECD Environ- mental Health and Safety Publications Series on Chemical Accidents No. 1: Report of the OECD Workshop on Risk Assessment and Risk Communication in the Context of Chemical Accident Prevention, Preparedness and Response. Paris: OECD [online]. Available: http://www.oecd. org/officialdocuments/displaydocumentpdf/?cote=ocde/gd%2897%2931&doclanguage=en. Ac- cessed: Feb. 2, 2012. PCMIC (People Concerned About MIC). 2011. History [online]. Available: http://peopleconcerned- aboutmic.com/history/. Accessed: Sept. 29, 2011. PrimaTech, Inc. 1993. “Audit of Incident Investigation and Review of Emergency Response to August 18, 1993 Incident at Rhône-Poulenc AG Company Institute, West Virginia.” Princeton, NJ. Smythe, S. 2011. An Evaluation of Alternate MIC Technologies. Presentation at the First Meeting on Inherently Safer Chemical Processes, February 9. Washington, DC. U.S. News. 2010. College Ranking & Lists: West Virginia State University [online]. Available: http:// colleges.usnews.rankingsandreviews.com/best-colleges/west-virginia-state-3826. Accessed: Sept. 29, 2011. Ward, K., Jr. 1994. Is MIC unit safe or a potential Bhopal? Sunday Gazette Mail, B-1, May 8 [online]. Available: http://wvgazette.com/static/watchdog/micstory.pdf. Accessed: Sept. 28, 2011. Ward, K., Jr. 2010. Bayer to stop making one of its MIC pesticides. The Charleston Gazette, August 17 [online]. Available: http://blogs.wvgazette.com/watchdog/2010/08/17/bayer-to-stop-making- one-of-its-mic-pesticides/. Accessed: Sept. 29, 2011. Ward, K., Jr. 2011. Residents Sue to Delay Start-Up of Bayer’s MIC Unit. The Charleston Gazette, February 9 [online]. Available: http://wvgazette.com/News/Bayerexplosion/201102081007?pa ge=2&build=cache. Accessed: Sept. 29, 2011. Woomer, W. J. 2000. The Institute Site: From George Washington to the World of Chemicals. Charles- ton, WV: B. J. W Printing.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 4 The Concepts of Inherently Safer Processes and Assessment INTRODUCTION The committee was asked to consider the processes used by Bayer Crop- Science to manufacture methyl isocyanate (MIC) and carbamate pesticides in Institute, West Virginia, and compare its analysis to “the inherently safer process assessments conducted by Bayer and previous owners of the Institute site.” Whereas the preceding chapter provided an overview of the plant and its history to provide background on the development of the processes, this chapter provides an overview to the concept of inherently safer processes (ISPs) and describes the role of ISPs in a process safety management (PSM) system as background for the analysis of the decisions made during those developments. Chapter 5 contains the analysis of alternative methods for production of MIC and the carbamate pesticides produced in Institute, including consideration of ISPs. This chapter also provides an introduction to the role that ISP analyses can play in decision- making. More information about the broader context in which companies manage decision making, and a suggested framework for approaching that process in complex scenarios, is presented in Chapter 6. THE ISP CONCEPT ISP is best described as a philosophy for engineering design of material processing plants, rather than a specific set of technologies or processes. The ISP philosophy can be applied at all stages in the life cycle of a manufacturing plant, from early process invention and research, through development, plant design, operation, and eventual shutdown and demolition, and at all levels of design detail. 59

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 60 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE It is an approach that encourages the designer to attempt to eliminate or minimize hazards (physical, inhalational, etc.) identified at each stage in the process life cycle, and at every level of process and plant design, rather than accepting the existence of the hazards and designing safety systems to control those hazards. It may not always be feasible to eliminate or reduce hazards, but the ISP philosophy requires that this be attempted before moving on to specification of risk manage- ment equipment and procedures. Note that describing a process as “inherently safer” can only be done in the context of specific hazard or subset of hazards and that management of all hazards must be considered in order to design a safer process. Thus, a substitution (inherent) might eliminate one type of hazard but require the development of new standard operating procedures (procedural) to manage a different one. The terms “inherently safer processes” (ISPs),1 and variations such as “inher- ently safer technology” (IST) and “inherently safer design” (ISD) were first used in discussions about PSM in the 1970s after serious process industry incidents around that time.2 These incidents focused industry, government, and public attention on PSM, and resulted in the initial development of many of the PSM techniques and regulations that are in common use throughout the world today. The ISP philosophy was first fully articulated in 1977 by Trevor Kletz, a senior safety advisor for Imperial Chemical Industries (ICI). That year Kletz presented the Jubilee Lecture to the Society of Chemical Industry in Widnes, England, which he titled “What you don’t have, can’t leak.” In his talk, Kletz challenged the practice of storing large quantities of flammable or toxic mate- rials at manufacturing plants and questioned the need for the use of elevated temperatures and pressures in processing (Kletz, 1978). He also suggested that risk management efforts should aim at elimination of hazards where feasible, instead of using safety systems and procedures to manage the risk. This should be accomplished, for example, by reducing the amounts of hazardous material used in processes, using less-hazardous materials, or developing technology that allows for processes to proceed under milder conditions. Kletz described this as “inherently safer.”3 In subsequent years, a set of principles for ISPs were established within the chemical community, an effort supported by Kletz (1984, 1985, 1991, 1998) and others in the chemical industry (Puranik et al., 1990; Ashford, 1993; Windhorst, 1995; Mannan, 2005; See also additional references at the end of this chapter). As 1  The term “inherently safer processes” is used here in accordance with the language of the state- ment of task. 2  These included a 1974 explosion at a chemical plant in Flixborough, England that resulted in the deaths of 28 and injuries to another 36 individuals and a 1976 chemical release at Seveso in Milan, Italy that sickened many in the surrounding area. 3  In his 1977 lecture, Kletz used the term “intrinsically safer.” This was later changed to “inherently safer” to avoid confusion with the use of “intrinsically safe” to describe electrical equipment designed to meet specific hazardous area classification requirements.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 61 the principles spread and were adopted, many examples of their implementation emerged. The Center for Chemical Process Safety (CCPS) aggregated this infor- mation in the book Inherently Safer Chemical Processes: A Life Cycle Approach (Bollinger et al., 1996; CCPS, 2008b). The early versions focused primarily on general concepts, but as acceptance of ISPs by the professional community has grown, the later versions extended the scope to provide more specific guidance on application of those concepts to process design. Today there are a number of working definitions of ISPs, some of which are presented in Box 4.1. In general, these definitions are quite consistent and reflect a consensus of the engineering community on what ISP means. BOX 4.1 Definitions of Inherently Safer Processes CCPS (2008b, p. 11). “Inherent safety is a concept, an approach to safety that focuses on eliminating or reducing the hazards associated with a set of conditions. A chemical manufacturing process is inherently safer if it reduces or eliminates the hazards associated with materials and operations used in the process and this reduction or elimination is permanent and inseparable. The process of identifying and implementing inherent safety in a specific context is called inherently safer design. A process with reduced hazards is described as inherently safer compared to a process with only passive, active, and procedural controls. An inher­ ently safer process should not, however, be considered ‘inherently safe’ or ‘absolutely safe.’ While implementing inherent safety concepts will move a process in the direction of reduced risk, it will not remove all risks. No chemical process is without risk, but all chemical processes can be made safer by applying inherently safer concepts.” Kletz and Amyotte (2010, p. 4). “Intensification, substitution, attenua­ tion, and limitation of effects produce inherently safer design because they avoid hazards instead of controlling them by adding protective equipment. The term inherently safer implies that the process is safer because of its very nature and not because equipment has been added to make it safer. Note that we talk of inherently safer plants, not inherently safe ones, for we cannot remove all hazards.” State of New Jersey and Contra Costa County, California. New ­Jersey, in its Toxic Catastrophe Prevention Act (TCPA) (NJDEP, 2009), and ­Contra Costa County, California, in its Industrial Safety Ordinance continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 62 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE (­Contra Costa Health Services, 1999), require consideration of ISPs as part of their regulation of hazardous industrial facilities. Both regulations cite the 1996 CCPS definition of ISP (Bollinger et al., 1996) (the regula­ tions were ­issued before publication of the second edition of the CCPS book), which is substantially the same as the 2008 definition above, although not as concisely stated. U.S. Department of Homeland Security/CCPS. The U.S. Department of Homeland Security (DHS), concerned about the potential for intentional release of hazardous materials by terrorist attack, has been interested in ISP as an approach to chemical security. In 2010, the Chemical Security Analysis Center of DHS asked the CCPS to develop a scientific definition of IST (CCPS, 2010, p. Exec 1). A summary of that definition is: Inherently Safer Technology (IST), also known as Inherently Safer ­Design (ISD), permanently eliminates or reduces hazards to avoid or reduce the consequences of incidents. IST is a philosophy, applied to the design and operation life cycle. . . . IST considers options, including eliminating a hazard, reducing a hazard, substituting less hazardous material, using less hazardous process conditions, and design a process to reduce the potential for, or consequences of, human error, equipment failure. . . . IST’s are relative. A technology can only be described as inherently safer when compared to a different technology, including a description of the hazard or set of hazards being considered, their location, and the potentially ­affected population. . . . IST’s are based on an informed decision process. Because an option may be inherently safer with regard to some hazards and inherently less safe with regard to others, decisions about the optimum strategy for managing risks from all hazards are required. The decision process must consider the entire life cycle, the full spectrum of hazards and risks, and the potential for transfer of risk from one impacted popula­ tion to another. BOX 4.1 Continued HIERARCHY OF HAZARD CONTROL PSM is an interactive, ongoing method for controlling hazards across a facility or organization, with the overall goal of reducing the frequency and/or consequence of an incident. As described in Chapter 2, within the United States, requirements for PSM exist under the Occupational Health and Safety Administra- tion’s (OSHA) process safety management standard (OSHA, 29 CFR 1910.119). The PSM standard lists 14 mandatory elements ranging from employee training to process hazard analysis to change management. In practice, PSM is a system

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 63 that necessitates consideration of multiple options for achieving a safe process and the possible outcomes from each of those options. For example, when deter- mining which hazard management strategy is the best option for a given situation, it is important to understand the effect that any one change in process design may have on all classes of hazard and how that change may affect the type of control strategy required to maintain a safe working environment. One approach for acknowledging and addressing these trade-offs is to con- sider a hierarchy of hazard control. The hierarchy contains four tiers, inherent, passive, active, and procedural, which are described briefly below.4,5 Consider- ing these possible hazard control methods in turn can help identify options for process design or modifications to improve process safety. Inherent The inherent approach to hazard control is to minimize or eliminate the hazard. Substituting water for a flammable solvent to eliminate the fire hazard is an example. CCPS identifies four ISP strategies to consider when designing or modifying a process (CCPS, 2008b). As adapted from that volume, one can: Substitute—use materials, chemistry, and processes that are less hazardous; Minimize—use the smallest quantity of hazardous materials feasible for the process, reduce the size of equipment operating under hazardous conditions, such as high temperature or pressure; Moderate—reduce hazards by dilution, refrigeration, process alternatives that operate at less-hazardous conditions; reduce potential impact of an accident by siting hazardous facilities remotely from people and other property; or Simplify—eliminate unnecessary complexity, design “user-friendly” plants. Kletz and Amyotte (2010, pp. 16-17) use somewhat different terminology and identify more specific categories (which can be mapped into the four CCPS categories above), but the basic philosophy remains the same. As stated in that reference: One person’s intensify may be another’s minimize. Someone’s attenuate may be someone else’s moderate. You may wish to consider segregate as a measure 4  As with the terminology regarding inherent safety categories, these classifications fall along a spectrum of process safety approaches, and people may disagree about the category into which a par- ticular design falls. For example, some might consider that a high pressure reactor design capable of containing a runaway reaction is an inherently safer design. Others would call this a passive strategy because the hazard—the high pressure from the runaway reaction—still exists, although it is robustly contained by a high pressure vessel. 5  Not that the use of these terms is not limited to chemical process safety but are also used in consideration of nuclear facility design and management.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 64 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE separate from inherent safety; your colleague may consider it a form of limita- tion of effects….the characteristics of a user-friendly plant are sometimes not sharply divided and may merge into one another. Process design, like life, is seldom linear. The following definitions will be familiar to many in the process industry. These have been summarized and adapted from the 2008 publication Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd Edition from the AIChE Center for Chemical Process Safety, and similar definitions can be found in many reference texts on process safety. Passive Passive safety systems are those that control hazards with process or equip- ment design features without additional, active functioning of any device. For example, a containment dike around a hazardous material storage tank limits a spill to an enclosed area because of the geometry and construction of the dike, and no action is required to provide this function. Active Active safety systems control hazards through controls and systems designed to monitor and maintain specific conditions or to be triggered by an event. Active systems include process controls, safety instrumented systems (SIS), and mitiga- tion systems. A sprinkler system put in place to extinguish a fire is an example of an active system designed to minimize consequences. A control system that regulates solvent flow into a reactor vessel and prevents overflow is an example of a monitoring system. Procedural Procedural safety systems control hazards through personnel education and management. Such systems include standard operating procedures, safety rules and procedures, operator training, emergency response procedures, and manage- ment systems. For example, an operator may be trained to monitor the solvent level in a reactor vessel and to shut off the feeds to the tank if the volume exceeds a given quantity. In general, inherent and passive strategies are the most robust and reliable, requiring the least monitoring or interaction to be effective, but incorporation of strategies from all tiers of the hierarchy should be considered and incorporated as needed for comprehensive PSM. Note that all process safety controls have the potential to reduce the probability or likelihood that a worst-case accident

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 65 occurs. However, the incorporation of ISP concepts into process design also has the potential to provide assurance that, should a worst-case release occur (i.e., the entire chemical inventory under worst meteorological conditions), an absolute upper bound to the magnitude of an offsite release exists, and that this upper bound is less severe than the worst-case accident resulting from conventional passive, active, and procedural controls. When performing a process safety assessment, one should consider each level of this process safety “hierarchy” in turn. Quite logically, if the hazard can be controlled with a system that emphasizes inherent safety, active controls will not be necessary. However, since ISP is defined in the context of a specific hazard, the risk of introducing new hazards must be considered. For example, one can describe a process alternative as inherently safer with respect to the acute toxicity of a particular raw material when compared with another alternative. This state- ment does not say anything about the relative inherent safety characteristics of the two processes with respect to other hazards (fire, explosion, reactive chemis- try, chronic toxicity, environmental impact, etc.). These hazards may be greater, reduced, or remain essentially unchanged between the two process alternatives, and the ISP for one hazard may also introduce new concerns. Thus, it will always be necessary for process plant designers and operators to develop rigorous PSM systems incorporating the appropriate combination of inherent, passive, active, and procedural safety systems to manage all hazards. Some will be best managed using inherent methods, but others will inevitably remain and be effectively managed with other PSM systems. One must never assume that it is unnecessary to worry about all elements of PSM because one “inherently safer” process has been implemented. INCORPORATING ISP INTO THE PROCESS LIFE CYCLE The philosophy of ISP applies at all stages, but available options, or the feasibility of implementing those options, change over the course of a tech- nology’s life cycle. Every life cycle begins with initial research and product/ process conception, and then moves through process development, conceptual plant design, scaleup, engineering and detailed plant design, plant construction, startup, and ongoing operation and future modification (Hendershot, 2011a,b). In each of these phases, different kinds of choices and decisions are made by chemists, engineers, and other technologists. Both the second edition of the CCPS book, Inherently Safer Chemical Processes: A Lifecycle Approach and the recent volume by Kletz and Amyotte contain examples of how such analyses can be incorporated into a process hazard analysis, including examples from industry, and each contains additional citations for more information. These descriptions will not be reproduced here. The purpose of this section is not to provide a step- by-step description of how such analyses can be done, but to provide the reader

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 66 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE with a broad overview of the elements of the analysis as context for the rest of the report. There is potential synergy between process simulation and understanding ISP characteristics of a process. Process simulation is a mathematical representation of industrial chemical processes, often used in process design, control, and optimiza- tion. Simulations assist engineers in evaluating process alternatives and to identify possible options to, for example, reduce energy consumption, minimize waste, perform cost and benefit studies, and maximize profitability. These tools provide information about process operating conditions and inventory in-process equip- ment, both of which are important factors in understanding ISP. It may be possible to more explicitly incorporate ISP considerations into process simulation tools, e.g., the inventory of hazardous materials for different process options. Linking process simulation models to accident consequence and likelihood ­models would have the potential to facilitate the investigation of potential benefits of process alternatives being studied. It is clear that the best opportunity for implementing ISP into a facility is early in the life cycle of a product or process. At that early stage, process tech- nologies have not been chosen, facilities have not been built, and customers have not yet evaluated product samples or made commitments based on products with particular characteristics. As a product moves through its life cycle, these and other factors may limit options, make changes more difficult, or involve more people and organizations in the change. Development of an ISP, as with the devel- opment of any new process, requires extensive resources, including for example, expert personnel, laboratory facilities, pilot plant facilities, and significant finan- cial expenditures, and modifications can become more costly when the process involves modification of an existing facility. Some typical process life-cycle stages and some examples of ISP options that are best considered at an early stage include: • Selection of basic technology. Consider ISP options for the chemical synthesis route, raw material and chemical intermediate hazards, energetic reac- tions, etc. • Implementation of the selected technology. Consider how the chosen process chemistry will be implemented. Can hazardous operating conditions be minimized through better catalysts or other changes in operating conditions? Can impurities and by-products be avoided to eliminate purification steps? What specific unit operations are required? What is the order of processing steps? • Plant design. Consider ISP aspects of plant proximity to the surrounding population, in-plant occupied areas, and sensitive environmental areas; the gen- eral layout of the equipment on the selected plant site; and the number of parallel systems and size of those system (Hendershot, 2010a). • Detailed equipment design. Minimize the inventory of hazardous mate- rial in specific pieces of process equipment. Consider the impact of equipment

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 67 layout on the length and size of piping containing hazardous materials. Consider human factors in the design of equipment to minimize the potential for incorrect operation and human error (Hendershot, 2010a). • Operation. Use ISP principles on ongoing PSM activities such as man- agement of change, incident investigation, pre-startup safety reviews, operating procedures, and training to identify new opportunities for ISP. It is important to consider the entire footprint of a process when evaluating ISP options. Is risk actually reduced, or is it transferred somewhere else, perhaps increasing overall risk? One example used to demonstrate this concept relates to the balance of onsite storage versus increased deliveries of hazardous mate- rial (Hendershot, 2006; CCPS, 2010). If a plant reduces the size of a hazardous material storage tank, would the smaller tank size require a change from shipment of the material to the plant in railroad tank cars to much smaller trucks? Such a change could then result in a greater number of shipments overall to meet process requirements (one rail car can hold approximately an order of magnitude more material than a truck). With the additional shipments traveling by road instead of rail, the change in storage tank size could result in greater overall risk from release, depending on details of the transportation route. It is also important to recognize that an ISP assessment is often not going to result in a clear, well-defined, and feasible path forward for a company. It is a useful philosophy that can help a company reduce its risk and provide struc- ture for consideration of the full range of options in process design. The results of any analysis, however, have to be considered in context. For example, as already described, the inherent safety of one hazard may be reduced and another increased depending on size of a shipment or the mode of transportation of the shipment, or risk may shift from one community well equipped to respond to an emergency to one less able to do so. The cost to eliminate a hazard completely may be prohibitive, but introducing a well-designed passive control system may be feasible. Consideration of these and other, broader trade-offs (community perception, product quality requirements, etc.) should be factored into any final decision. ADDITIONAL CONSIDERATIONS As stated in Manuele (2003), “An organization’s culture consists of its ­values, beliefs, legends, rituals, mission, goals, performance measures, and sense of responsibility to its employees, to its customers, and to its community, all of which are translated into a system of expected behavior.” When the philosophy of ISP is incorporated into the culture of an organization, it becomes one of the cultural norms that guide behavior within that organization. Consideration of ISP can then be incorporated into all process and design activities rather than being considered an additional check-the-box exercise.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 68 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE CCPS (2008) highlighted elements within organizations that can encourage successful adoption of ISP as part of the organizational culture. The first of these is integration of ISP into the PSM system. This should include consideration of ISP at all stages in the process life cycle, particularly at three key stages: product and process development, conceptual facility planning and early design, and during routine operation (including modifications and incident investigation). The second element is education and awareness. ISP is a philosophy of design; its application should extend beyond just engineering design to plant operation activities. Identifying opportunities to eliminate or reduce hazards should be part of the job for everyone involved in the design and operation of a process facility. This can only happen if there is a broad awareness and understanding of ISP concepts and principles, and these require that education and supporting documentation be made available to personnel. RELATIONSHIP BETWEEN EMERGENCY PREPAREDNESS AND ISP Emergency preparedness (EP is often considered to be an alternative to ISP strategies because EP is a procedural control). However, as is the case with active, passive, and other procedural controls (e.g., personnel training), EP can—and should—be implemented concurrently with ISP, e.g., where Horng et al. (2005) recommended combining source reduction with warning systems to reduce ­chlorine risks in Taiwan. A closer examination reveals that EP and ISP are closely linked because the latter can be used to reduce the magnitude of incident demands on the onsite and offsite emergency response organizations by reducing the size of the vulnerable zones (VZs) around chemical facilities. Specifically, applying ISP principles to the EPA (1987) procedure for calculating VZs shows that substitution decreases VZ size by reducing source toxicity (i.e., level of concern), whereas minimization achieves this objective by reducing the quantity available for release, and moderation reduces VZ size by decreasing the temperature and pressure of a release. Smaller VZs reduce the demands on the emergency response organizations by reducing the size of the population at risk. Of particular importance is the fact that smaller VZs often mean that there are smaller special populations at risk—such as residents of schools, hospitals, nursing homes, jails, and athletic stadiums (see Lindell and Perry, 2006, Table 1, for a list of special facilities). Special populations generally have more logistical impediments to implementing population protection actions such as evacuation (Van Willigen et al., 2002) and, probably to a lesser extent, sheltering in-place (Sorensen et al., 2004). Although the adoption of ISP strategies can have a positive effect on nearby offsite risks, it is important to recognize that they can have a negative effect on more remote offsite risks by transferring rather than reducing total risk (see CCPS, 2008b, p. 212). This risk transfer occurs when reducing onsite chemical inventory has the unintended consequence of increasing the number of shipments

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 69 and thus increasing the probability of releases on transportation routes. This can have an adverse impact on emergency response because releases from onsite sources, by their very nature, take place at locations where they are expected to occur and where there are (relatively) ample resources for emergency response. Releases during transportation, by contrast, take place at unexpected locations where there are likely to be fewer resources to support an emergency response. For example, the sites of transportation incidents will lack the detection and monitoring systems that are often installed around fixed-site facilities. Moreover, the primary responders to transportation incidents will be public sector hazardous materials response teams that are likely to have a relatively limited knowledge of any given chemical, given that hundreds of chemicals might pass through their jurisdictions. By contrast, facility personnel often handle only a few chemicals and thus usually have a deeper knowledge of these chemicals’ characteristics and behavior. Additional information about the relationship between ISP and emergency response and emergency preparedness can be found in Appendix C. OPTIONS FOR INCORPORATING ISP IN PSM There are two common approaches to formal consideration of ISP: inde- pendent, stand-alone ISP reviews and incorporation of ISP into existing process safety review activities. Independent ISP Reviews An independent ISP review is conducted by a team that uses knowledge of chemistry, engineering, operation, process safety, and other relevant expertise to examine a process with the objective of understanding its hazards and finding ways to eliminate or reduce those hazards. The review can be done at any stage in the process life cycle from early product and process development through oper- ating facilities. The more established the process, the more difficult and costly it becomes to take advantage of ISP opportunities involving the basic process technology. Thus, early consideration of ISP in product and process selection is important. Major renovation of established facilities also provides an opportunity to reevaluate the basic process technology from an ISP perspective. The most important tool for an ISP review is an extensive checklist to help the team think about strategies and how they might apply to the process being considered. ISP reviews can draw upon any of the traditional process safety review techniques (e.g., HAZOP,6 What If, and Checklists) to identify hazards, 6  HAZOP (Hazard and Operability Analysis) is a method of systematic evaluation of existing pro- cesses and operations developed for process hazard analysis and commonly used within the chemical industry.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 70 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE and then use ISP checklists and principles to help identify opportunities to eliminate or reduce hazards. (See, CCPS, 2008b.) Some organizations have also incorporated incident consequence modeling into these reviews to help the review team understand the magnitude of a potential incident arising from the hazard and the potential benefit of ISP approaches to reducing the incident’s consequences. It is important to remember, however, that there are limitations to the use of checklists, and they should be considered only one element of the review and evaluation process. Incorporation into Process Safety Reviews Designers and operators of processing facilities use a series of health, safety, and environmental reviews at various stages in process design, development, and operation as a part of their PSM procedures. The goal is to identify hazards, and in many cases, the focus is on managing or mitigating the hazards through add-on safety devices and procedures once they have been identified. To include ISP considerations, the protocols for conducting these reviews need to specifically require consideration of ISP opportunities as a part of these reviews. Additional, ISP-specific guide words can be added to guide word-based methodologies, such as HAZOP to encourage ISP consideration. ISP consider- ations also can be incorporated into all PSM activities, for example, manage- ment of change, incident investigation, pre-startup safety reviews, operating procedures, human factors reviews, and any other activities that generate lists of hazards and potential incidents. The important thing is to make sure that the participants in the activity are encouraged and trained to focus initially on elimi- nating and reducing hazards instead of managing and controlling hazards. This may not always be possible or feasible, but the participants should look for those opportunities rather than just assume that the hazards are present and design systems and procedures to control them. These two approaches complement each other, and strong PSM programs incorporate both pieces. MEASURING INHERENT SAFETY When incorporating ISP into the PSM system, it would obviously be helpful to have a method for evaluating the inherent safety of any given approach. To that end, a relatively large number of ISP assessment tools exist for attempting to measure the degree of inherent safety of a given process or processing alter- native, but there is no current consensus on ISP metrics. These techniques have been reviewed by, among others, Lees (Mannan, 2005, pp. 32.11-32.18), Khan and Amyotte (2003), Khan et al. (2003), and Kletz and Amyotte (2010). Most of these reviews have originated in the academic arena, and in general, these indices have not been applied in industry because they are in early stages of develop-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 71 ment and their value has not been accepted. One potential problem is that many of the proposed indices consider many different kinds of process hazards—fire, explosion, acute toxicity, chronic toxicity, temperature, pressure, etc.—and use penalty factors to create an overall hazard index. This means that the creator of the index has applied some kind of evaluation of the relative importance of different hazards. If, as is often the case, the origin and justification for the relative importance are unclear, appropriate use of the index can be challenging. One of the earliest efforts to develop an assessment tool was the approxi- mately decade-old INSIDE (INherent SHE [Safety, Health, Environment] In DEsign) project conducted in Europe, and which resulted in INSET (INherent SHE Evaluation Tool), a toolkit “to identify inherently safer design options throughout the life of a process and to evaluate the options” (CCPS, 2008a). There are also well-known process safety methodologies such as checklist and what-if analyses that have been adapted for ISP consideration, primarily in terms of identifying hazards that could be addressed by the principles of inherent safety. Well-established indexing methods such as the Dow Fire and Explosion Index (F&EI) (Dow Chemical Co., 1994b), the Dow Chemical Exposure Index (CEI) (Dow Chemical Co., 1994a), and the Mond Index (Doran and Greig, 1993) have numerous inherent safety aspects associated with their calculation procedures. The F&EI is a tool designed to help rank hazards in terms of relative physical damage in case of fire or explosion at a facility, and the CEI is a tool to aid in ranking the acute health hazard potentials of materials in the event of an airborne chemical release. The F&EI contains many elements related to ISP— for example, inventory of flammable or combustible material, high temperature, high pressure, exothermic reaction chemistry. However, the F&EI only considers fire and explosion hazards. The CEI was designed to consider material toxicity. Although these indexes have some value in characterizing the inherent safety of a plant, neither was developed with the intention of measuring inherent safety. The Mond Index is similar to the Dow F&EI, but is designed to address a wider range of materials and process and storage configurations. Etowa et al. (2002) quantified the ISP features of both Dow indexes (F&EI and CEI) and demonstrated the beneficial impact of the principles of minimi- zation, substitution, and moderation. The work of Edwards and coworkers at Loughborough University in the United Kingdom resulted in one of the first indexes designed specifically to address ISP opportunities—the prototype index of inherent safety, or PIIS (Edwards and Lawrence, 1993; Edwards et al., 1996). Over the past decade there has been a proliferation of ISP indexing proce- dures and assessment methodologies appearing in the process safety literature. Table 4.1, adapted and updated from Kletz and Amyotte (2010) presents a sum- mary of the literature in the area from 2002-2010. Observations on the entries in Table 4.1 (again adapted from Kletz and Amyotte, 2010) include the following:

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 72 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 4.1  Examples of Development of ISP Assessment Methodologies and Their Application and Extension, 2002-2010 Reference Contribution Adu et al. (2008) Comparative evaluation of various methods for assessing EHS hazards in early phases of chemical process design. Al-Mutairi et al. (2008) Linking of inherent safety and environmental concerns with optimization of process scheduling. Carvalho et al. (2008) Method for identifying retrofit design alternatives of chemical processes. Uses Inherent Safety Index (ISI) developed by other researchers. Cordella et al. (2009) Further development of procedure for decomposition product analysis (Cozzani et al., 2006) to account for acute and long-term harm to human health, ecosystem damage, and environmental media contamination. Cozzani et al. (2006) Procedure for assessment of hazards arising from decomposition products formed due to loss of chemical process control. Applicable to consideration of substitution principle. Gentile et al. (2003) Fuzzy-logic-based index for evaluation of inherently safer process alternatives with the aim of linking to process simulation. Gupta and Edwards (2003) Graphical approach for evaluating inherent safety based on earlier developed Loughborough Prototype Index of Inherent Safety (PIIS). Hassim and Hurme (2010a) An Inherent Occupational Health Index was developed to assess the health risk of process routes during the process research and development stage. The index can be used to compare process routes or to determine the level of inherent occupational health hazards. Hassim and Hurme (2010b) The Health Quotient Index (HQI) was developed for assessment during the preliminary process design phase. This index quantifies a worker’s health risk from exposure to fugitive emissions by using data from process flow diagrams. This method can be used to quantify the level of risk from a process or to compare alternative processes. Hassim and Hurme (2010c) The Occupational Health Index (OHI) was developed for assessment during the basic engineering stage. “This method relies on the information available in piping and instrumentation diagrams and the plot plan.” The health aspects considered are chronic and acute inhalation risks, and dermal/eye risk. Hassim and Hurme (2010d) This method estimates inhalation exposures and risks and can be used early in the design stages by utilizing process flow diagrams. The risk of chemical exposure can be evaluated through either the “hazard quotient method or calculating the carcinogenic chemicals intake and the resulting risk of cancer.”

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 73 Reference Contribution Hassim and Edwards (2006) Process Route Healthiness Index (PRHI) for quantification of health hazards arising from alternative chemical process routes. Application is in early stages of chemical plant design. Hurme and Rahman (2005) Discussion of implementation of inherent safety throughout process life-cycle phases. Use of ISI developed earlier. Khan and Amyotte (2004) Integrated Inherent Safety Index (I2SI). Khan and Amyotte (2005) Further development of I2SI to include cost model. Kossoy et al. (2007) Use of nonlinear optimization method to select inherently safer operational parameters for given configuration of reactor equipment and materials. Primary concern is cooling failure. Landucci et al. (2007) Procedure and indexes for evaluating inherent safety at preliminary process flow diagram (PFD) stage for hydrogen storage options. Landucci et al. (2008) Further development of PFD method (Landucci et al., 2007) by use of quantitative key performance indicators (KPIs) to remove subjective judgment. Leong and Shariff (2008) Further development of iRET (Shariff et al., 2006) to incorporate a quantitative inherent safety level (ISL), thus enabling integration of design simulation software with an Inherent Safety Index Module (ISIM). Application is again at the preliminary design stage. Leong and Shariff (2009) Evolution of ISIM (Leong and Shariff, 2008) to a Process Route Index (PRI) for comparison and ranking of different routes to manufacture the same product based on hazard potential of routes. Meel and Seider (2005) Use of game theory to achieve inherently safer operation of chemical reactors. Palaniappan et al. (2002a) “Methodology for the integrated inherent safety and waste minimization analysis during process design.” Palaniappan et al. (2002b) Indexing procedure for inherent safety analysis at process route selection stage. Palaniappan et al. (2002c) Indexing procedure for inherent safety analysis at process flowsheet development stage. Discussion of iSafe, an expert system for automating procedures developed by Palaniappan et al. (2002b,c). Rahman et al. (2005) Comparative evaluation of three ISIs with expert judgment at process concept phase. Rusli and Shariff (2010) This paper presents the Qualitative Assessment for Inherently Safer Design (QAISP) method for application during preliminary design. This qualitative method combines hazard review techniques with inherently safer design concepts to generate inherently safer plant options/proactive measures. Shah et al. (2003) SREST (substance, reactivity, equipment, and safety technology) layer assessment method for environment, health, and safety (EHS) aspects in early phases of chemical process design. TABLE 4.1  Continued continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 74 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Reference Contribution Shariff and Leong (2009) This paper proposes a method of evaluating inherent risk within a process as a result of the chemicals used and the process conditions. Through integration with HYSYS, the method can be used as early as the initial design stages to determine the probability and consequence of possible risk due to major accidents. Shariff and Zaini (2010) This paper reports on the development of Toxic Release Consequence Analysis Tool (TORCAT), a “tool for consequence analysis and design improvement via inherent safety principle by utilizing an integrated process design simulator with toxic release consequence analysis model.” Shariff et al. (2006) Integrated Risk Estimation Tool (iRET) for inherent safety application at preliminary design stage. iRET links the design simulation software HYSYS with an explosion consequence model. Srinivasan and Kraslawski (2006) Application of TRIZ methodology for creative problem solving to design of inherently safer chemical processes. Srinivasan and Nhan (2008) Inherent Benign-ness Indicator (IBI), a statistical-analysis- based method for comparing alternative chemical process routes. Tugnoli et al. (2009) A quantitative inherent safety assessment method is presented. This method utilizes process flow diagrams in early design stages. The result of the assessment is a quantification of the inherent safety of the process scheme by a set of key performance indicators. SOURCE: Adapted from Kletz and Amyotte (2010) and supplemented with additional citations from the literature from late 2009-2010. TABLE 4.1  Continued • Many of the methods deal specifically with the early concept and route- selection stages of the design process. • Some of the approaches use sophisticated mathematical and problem- solving techniques such as fuzzy logic. • There has been a growing trend to link inherent safety with environmental and health issues in an effort to achieve an integrated approach. • There have been attempts to incorporate inherent safety assessment into process design simulators, and these efforts should be encouraged. • Some of the indexing methods have been in existence long enough for comparative evaluations to be made among them. When commenting in 2005 on potential barriers to wider adoption of inher- ently safer design principles in the process industries, Edwards (2005) noted that the issue may not be the availability of ISP assessment tools but rather the limited use of these tools by industry. Reasons might include the subjective judgment

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 75 required by some of these tools and also their attendant complexity (Kletz and Amyotte, 2010). In 2011, it appears that the same availability of tools, yet limited uptake by industry, exists. Additional concerns surround the incorporation of ISP and PSM analysis into the business decisions a company must make. This is discussed in greater detail in Chapter 6. Another approach that considers some important aspects of ISP, is conse- quence analysis of potential incidents. Estimates of the potential impact of an incident will include evaluation of the effect of inventory of hazardous material, flammable and toxic properties, plant operating temperatures and pressures, plant location, and other factors. Designers considering ISP alternatives for a process can model consequences associated with potential design options and understand whether the proposed ISP options have a significant impact on incident conse- quences. However, modeling and evaluating potential probabilities and impacts of system failures (worst-case accidents) can present their own challenges, espe- cially with regards to modeling human behavior. This can lead to flawed evalu- ations in terms of emergency response and risk communication needs. This is described in greater detail in Box 4.2. BOX 4.2 ISP and Probability Safety Analysis

Assessments about the safety of systems comprising conventional ­active, passive, and procedural controls are typically based on probabi­ listic safety analyses (PSAs) that estimate the probability of a worst-case accident from three inputs. These are (1) a probabilistic safety model (e.g., a mathematical model such as a fault tree or event tree) that iden­ tifies the events, such as process component and engineering safety feature (ESF) failure, that are required to produce a release; (2) the esti­ mated probabilities of those events; and (3) the logical interrelationships among those events. The probabilistic safety model is used to combine the estimated probabilities of the individual events (component or ESF failure) to produce the estimated probability of the worst-case accident.

Once a probabilistic safety model has been developed, it can be used to compare the accident probabilities associated with different plant/process designs. Ultimately, the mathematical model is often used to determine when the probability of the worst-case accident has been decreased to a level that is acceptable to plant management. However, it is important to recognize that any mathematical model is a simplifica­ tion of reality that ignores factors the analyst considers to have minimal effects on the probability of an offsite release. In addition, probabilistic continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 76 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE safety models sometimes ignore factors for which there are no available data or for which there is no established procedure for including them in the analysis.

One common problem in probabilistic safety models is that they are applied to systems composed of both people and technical systems but only the technical (equipment) components are modeled. This problem is being addressed in techniques that address human reliability (e.g., Swain and Guttman, 1983; Gertman et al., 2005; Spurgin, 2010) but human reliability is not always considered in plant PSAs.

Another common problem in probabilistic safety models is that the builders of the model often assume that the events in the model are independent. This assumption is violated when a common cause can fail multiple process components or ESFs, such as when an earthquake simultaneously fails a pipe carrying a toxic chemical, the secondary con­ tainment for that pipe, the flare tower, and the water curtain. Less obvi­ ously, the independence assumption is violated when a single operator fails to properly control multiple ESFs, a single maintenance person fails to properly maintain multiple ESFs, a single manager fails to properly supervise multiple operators or maintainers, or when an organizational unit’s safety culture tolerates inadequate performance. Such dependen­ cies could be included in the model, but often this is not done.

The neglect of human reliability and event dependence in probabilistic safety models leads to systematic underestimates of incident probabili­ ties. However, such underestimates will not create significant problems when two system designs being compared that are very similar in their susceptibility to human error and common-cause failures. This is be­ cause in such cases comparison of similar system designs by subtraction of the failure probability of one system from the failure probability of the other yields the correct difference even if both of the absolute estimates are biased. For example, suppose the estimated failure probability for System 1 is PE1 (which equals PT1 - PB, where PT1 is the true failure probability for System 1 and PB is the bias due to omitted error causes) and, similarly, the estimated failure probability for System 2 is PE2 (which equals PT2 - PB, where PT2 is the true failure probability for System 2 and PB is again the bias due to omitted error causes). The difference between the estimated failure probabilities for the two systems is unbiased as long as the omitted error causes are the same in both systems because PE2 - PE1 = (PT2 - PB) – (PT1 - PB) = PT2 - PT1. The difference between the estimated failure probabilities for the two systems is unbiased as long as the omitted error causes are the same in both systems because PE2 - PE1 = (PT2 - Pe) – (PT1 - Pe) = PT2 - PT1. By contrast, the absolute esti­ BOX 4.2 Continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 77 mates of failure probability (i.e., the differences of PE2 and PE1 from zero) are biased to the extent that failure causes have been omitted from the probabilistic safety model. This illustration explains why it is so important to compare probabilistic safety analyses of (relatively) similar systems and to be very skeptical of estimates of absolute failure probabilities. Unless the failure modes for both systems are identical, the bias in each estimate may not be the same in which case the probability models may not be useful even for comparing alternative systems unless they are corrected to account for common-cause failures and human errors.

One consequence of underestimating the failure probability of a con­ ventional system of active, passive, and procedural controls is that such underestimates make ISP strategies seem to be less advantageous than they would be if the failure probability of a conventional system of active, passive, and procedural controls were accurately estimated. If the magnitude of the underestimate were known to be small, then there would be little reason to be concerned about it. However, the magnitude of the under­estimate is not known, but the evidence from published post­ accident investigations suggests that it might be sufficiently large that conventional strategies of active, passive, and procedural controls are being chosen in situations where ISP strategies might produce signifi­ cantly greater levels of safety at reasonable cost. To avoid this problem of underestimation, PSAs need to more carefully consider human reliability, common-cause errors and, in particular, organizational safety culture.

Another consequence of underestimating the failure probability of a conventional system of active, passive, and procedural controls is that such underestimates can lead to a neglect of offsite emergency ­response and emergency preparedness because of the belief that they are ­unnecessary. Consequently, plant personnel have insufficient famil­ iarity with offsite agencies emergency plans and procedures to work effectively with them when emergencies occur. This can lead to major problems in the implementation of warning and protective actions (shelter in place or evacuation) of nearby residents.

Finally, underestimating the failure probability of a conventional sys­ tem of active, passive, and procedural controls hinders risk communica­ tion with other stakeholders. In many cases, community groups focus on the worst-case accident and have relatively little interest about the estimated probability of that event. By contrast, plant personnel typically focus on the (estimated) low probability of a worst-case accident and believe that this justifies a low priority for what they consider to be only marginally greater safety at significantly greater cost. The disagreements are likely to be particularly acute if community groups mistrust plant management and, thus, have low confidence in the effectiveness of a conventional system of active, passive, and procedural controls.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 78 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE REFERENCES Adu, I. K., H. Sugiyama, U. Fischer, and K. Hungerbuhler. 2008. Comparison of methods for assess- ing environmental, health and safety (EHS) hazards in early phases of chemical process design. Process Saf. Environ. Protect. 86(3):77-93. Al-Mutairi, E. M., J. A. Suardin, S. M. Mannan, and M. M. El-Halwagi. 2008. An optimization ap- proach to the integration of inherently safer design and process scheduling. J. Loss Prevent. Proc. Ind. 21(5):543-549. Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2006. Incorporation of inherent safety principles in process safety management. Pp. 175-207 in 21st Annual Center for Chemical Process Safety International Conference on Process Safety Challenges in a Global Economy. New York: American Institute of Chemical Engineers. Ashford, N. A. 1993. The Encouragement of Technological Change for Preventing Chemical Ac- cidents: Moving Firms From Secondary Prevention and Mitigation to Primary Prevention. Cambridge, MA: Center for Technology, Policy and Industrial Development, Massachusetts Institute of Technology. Berger, S. A., and R. J. Lantzy. 1996. “Reducing Inherent Risk Through Consequence Modeling.”1996 Process Plant Safety Symposium, ed. Hatice Cullingford, 15-23. Houston, TX: South Texas Sec- tion of the American Institute of Chemical Engineers. Atherton, J., and F. Gil. 2008. Incidents that Define Process Safety. Hoboken, NJ: Wiley. Bollinger, R. E., D. G. Clark, R. M. Dowell, R. M. Ewbank, D. C. Henershot, W. K. Lutz, S. I. Meszaros, D. E. Park, and E. D. Wixom. 1996. Inherently Safer Chemical Processes: A Life Cycle Approach. New York: Center for Chemical Process Safety of American Institute of Chemical Engineers. Carvalho, A., R. Gani, and H. Matos. 2008. Design of sustainable chemical processes: System- atic retrofit analysis generation and evaluation alternatives. Process Saf. Environ. Protect. 86(5):328-346. CCPS (Center for Chemical Process Safety). 1998. Guidelines for Design Solutions for Process Equipment Failures. Hoboken, NJ: Wiley. CCPS. 2008. Guidelines for Hazard Evaluation Procedures, 3rd Ed. Hoboken, NJ: Wiley. CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd Ed. Hoboken, NJ: Wiley CCPS. 2010. Final Report: Definition for Inherently Safer Technology in Production, Transportation, Storage, and Use. Prepared by Center for Chemical Process Safety, The American Institute of Chemical Engineers, for U.S. Department of Homeland Security, Science & Technology, Chemical Security Analysis Center, Aberdeen Proving Ground, MD. July 19 [online]. Avail- able: http://www.aiche.org/uploadedFiles/CCPS/Resources/KnowledgeBase/IST%20Final%20 Definition%20Report.pdf. Accessed Sept. 23, 2011. Conta Costa Health Services. 1999. County Ordinance Chapter 450-8: Industrial Safety Ordi- nance. Contra Costa County, California [online]. Available: http://cchealth.org/groups/hazmat/ industrial_safety_ordinance.php. Accessed: Sept. 23, 2011. Cordella, M., A. Tugnoli, F. Barontini, G. Spadoni, and V. Cozzani. �����������������������������

1. Inherent safety of sub-

stances: Identification of accidental scenarios due to decomposition products. J. Loss Prevent. Proc. Ind. 22(4):455-462. Cozzani, V., F. Barontini, and S. Zanelli. 2006. Assessing the inherent safety of substances: precursors of hazardous products in the loss of control of chemical systems. In 06 AIChe: Proceedings of American Institute of Chemical Engineers Spring National Meeting, April 23-27, 2006, Orlando, FL. New York: American Institute of Chemical Engineers. DHS (U.S. Department of Homeland Security). 2010. Final Report: Definition For Inherently Safer Technology in Production, Transportation, Storage, and Use. Prepared by CCPS for U.S. DHS. July 2010.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 79 Doran, P., and T. R. Greig. 1993. Mond Index: How to Identify, Assess and Minimise Potential Haz- ards on Chemical Plant Units for New and Existing Processes, 2nd Ed. Northwich: Imperial Chemical Industries. Dow (Dow Chemical Company). 1994a. Dow’s Fire and Explosion Index Hazard Classification Guide, 7th Ed. New York: American Institute of Chemical Engineers. Dow. 1994b. Dow’s Chemical Exposure Index, 1st Ed. New York: American Institute of Chemical Engineers. Edwards, D. W. 2005. Are we too risk-averse for inherent safety? An examination of current status and barriers to adoption. Process Saf. Environ. Protect. 83(2):90-100. Edwards, D. W., and D. Lawrence. 1993. Assessing the inherent safety of chemical process routes. Process Saf. Environ. Protect. 71(B4):252-258. Edwards, D. W., A. G. Rushton, and D. Lawrence. 1996. Quantifying the Inherent Safety of Chemi- cal Process Routes. Paper presented at the 5th World Congress of Chemical Engineering, July 14-18, 1996, San Diego, CA. Englund, S. M. 1991. Design and operate plants for inherent safety—Part 2. Chem. Eng. Prog. (May):79-86. Englund S. M. 1991. Design and operate plants for inherent safety—Part 1. Chem. Eng. Prog. (March):85-91. Englund, S. M. 1993. “Process and Design Options for Inherently Safer Plants.” Prevention and Control of Accidental Releases of Hazardous Gases, ed. Vasilis M. Fthenakis, 9-62. New York: Van Nostrand Reinhold. Englund, S. 2007. Safety condition in chemical process industries. Pp. 83-146 in Kent and Riegel’s Handbook of Industrial Chemistry and Biotechnology, Vol. 1, ed. J. A. Kent. New York: Springer. EPA (U.S. Environmental Protection Agency). 1987. Technical Guidance for Hazards Analysis: Emer- gency Planning for Extremely Hazardous Substances. U.S. Environmental Protection Agency, Federal Emergency Management Agency, U.S. Department of Transportation. December [on- line]. Available: http://www.epa.gov/osweroe1/docs/chem/tech.pdf. Accessed: Oct. 4, 2011. Etowa, C. B., P. R. Amyotte, M. J. Pegg, and F. I. Khan. 2002. Quantification of inherent safety aspects of the Dow indices. J. Loss Prevent. Proc. Ind. 15(6):477-487. French, R. W., D. D. Williams, and E. D. Wixom. “Inherent Safety, Health and Environmental (SHE) Reviews.” Proceedings of the 29th Annual Loss Prevention Symposium, ed. Everett D. Wixom and Robert P. Benedetti, Paper 1c. New York: American Institute of Chemical Engineers, 1995. Gentile, M., W. J. Rogers, and M. S. Mannan. 2003. Development of a fuzzy logic-based inherent safety index. Process Saf. Environ. Protect. 81(6):444-456. Gertman, D., H. Blackman, J. Marble, J. Byers, and C. Smith. 2005. The SPAR-H Human Reliability Analysis Method. NUREG/CR-6883. Idaho National Laboratory. Rockville, MD: U.S. Nuclear Regulatory Commission [online]. Available: http://www.nrc.gov/reading-rm/doc-collections/ nuregs/contract/cr6883/cr6883.pdf. Accessed: Feb. 15, 2012. Gowland, R. T. 1995. “Applying Inherently Safer Concepts to an Acquisition Which Handles Phosgene.”Proceedings of the 29th Annual Loss Prevention Symposium, ed. Everett D. Wixom and Robert P. Benedetti, Paper No. 1d. New York: American Institute of Chemical Engineers. Gupta, J. P., and D. W. Edwards. 2003. A simple graphical method for measuring inherent safety. J. Hazard. Mater. 104(1-3):15-30. Hassim, M. H., and D. W. Edwards. 2006. Development of a methodology for assessing inherent occupational health hazards. Process Saf. Environ. Protect. 84(5):378-390. Hassim, M. H., and M. Hurme. 2010a. Inherent occupational health assessment during basic engineer- ing stage. J. Loss Prevent. Proc. Ind. 23(2):260-268. Hassim, M. H., and M. Hurme. 2010b. Inherent occupational health assessment during preliminary design stage. J. Loss Prevent. Proc. Ind. 23(3):476-482. Hassim, M. H., and M. Hurme. 2010c. Inherent occupational health assessment during process re- search and development stage. J. Loss Prevent. Proc. Ind. 23(1):127-138.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 80 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Hassim, M. H., and M. Hurme. 2010d. Occupational chemical exposure and risk estimation in process development and design. Process Saf. Environ. Protect. 88(4):225-235. Hendershot, D.C. 2003. Inherently Safer Design. SACHE Faculty Workshop, September 2003, Baton Rouge, LA [online]. Available: http://static.scribd.com/docs/io019xho1iqpt.txt. Accessed: Sept. 27, 2011. Hendershot, D. C. 2006. An overview of inherently safer design. Process Saf. Prog. 25(2):98-107. Hendershot, D. C. 2010a. A summary of inherently safer technology. Process Saf. Prog. 29(4):389-392. Hendershot, D. C. 2010b. Inherently safer technology. J. Chem. Health Saf. 17(2):29-30. Hendershot, D. C. 2011a. Defining inherently safer technology. J. Chem. Health Saf. 18(1):46-47. Hendershot, D. C. 2011b. Inherently Safer Design: An Overview of Key Elements. All Business com [online]. Available: http://www.allbusiness.com/safety-accidents-disasters/accidents-chem- ical/15519792-1.html#ixzz1Y7Tswa3b. Accessed: Sept. 27, 2011. Hendershot, D. C., and S. Berger. 2006. Inherently Safer Design and Chemical Plant Security and Safety. Prepared for submission to the U.S. Senate Environment and Public Works Committee, June 21, Washington, DC [online]. �������������������������������������������������������� Available: http://epw.senate.gov/109th/Hendershot_Testi- mony.pdf. Accessed: Sept. 27, 2011. Horng, J-J., Y-S. Lin, C-M. Shu, and E. Tsai. (2005). Using consequence analysis on some chlorine operation hazards and their possible effects on neighborhoods in central Taiwan. J. Loss Prevent. Proc. Ind. 18:474-480. Hurme, M., and M. Rahman. 2005. Implementing inherent safety throughout process lifecycle. J. Loss Prevent. Proc. Ind. 18(4-6):238-244. Khan, F. I., and P. R. Amyotte. 2003. How to make inherent safety practice a reality. Can. J. Chem. Eng. 81(1):2-16. Khan, F. I., and P. R. Amyotte. 2004. Integrated inherent safety index (I2SI): A tool for inherent safety evaluation. Process Saf. Prog. 23(2):136-148. Khan, F. I., and P. R. Amyotte. 2005. I2SI: A comprehensive quantitative tool for inherent safety and cost evaluation. J. Loss Prevent. Proc. Ind. 18(4-6):310-326. Khan, F. I., R. Sadiq, and P. R. Amyotte. 2003. Evaluation of available indices for inherently safer design options. Process Saf. Prog. 22(2):83-97. Kletz, T. A. 1978. “What you don’t have, can’t leak.” Chem. Ind. (May 6):287-292. Kletz, T. A. 1984. Cheaper, Safer Plants, or Wealth and Safety at Work: Notes on Inherently Safer and Simpler Plants. Rugby, Warwickshire, UK: The Institution of Chemical Engineers. Kletz, T. A. 1985. Inherently safer plants. Plant/Operations Progress. 4(3):164-167. Kletz, T. A. 1991. Plant Design for Safety: A User-Friendly Approach. New York: Hemisphere Pub. Kletz, T. A. 1996. Inherently safer design: The growth of an idea. Process Saf. Prog. 15(1):5-8. Kletz, T. A. 1998. Process Plants: A Handbook for Inherently Safer Design. Philadelphia: Taylor & Francis. Kletz, T. A., and P. Amyotte. 2010. Process Plants: A Handbook for Inherently Safer Design, 2nd Ed. Boca Raton, FL: CRC Press. Kossoy, A., A. Benin, and Yu. Akhmetshin. 2007. Simulation-based approach to design of inherently safer processes. In Loss Prevention 2007: 12th International Symposium on Loss Prevention and Safety Promotion in the Process Industries. Rugby, UK: IChemE. Landucci, G., A. Tugnoli, C. Nicolella, and V. Cozzani. ���������������������������������������������

1. Assessment of inherently safer technol-

ogies for hydrogen storage. Pp. 1191-1196 in Loss Prevention 2007: 12th International Sympo- sium on Loss Prevention and Safety Promotion in the Process Industries. Rugby, UK: IChemE. Landucci, G., A. Tugnoli, and V. Cozzani. ��������������������������������������������������������

1. Inherent safety key performance indicators for hy-

drogen storage systems. J. Hazard. Mater. 159(2-3):554-566. Landucci, G., A. Tugnoli, C. Nicolella, and V. Cozzani. ���������������������������������������������

1. Assessment of inherently safer technol-

ogies for hydrogen storage. Pp. 1191-1196 in Loss Prevention 2007: 12th International Sympo- sium on Loss Prevention and Safety Promotion in the Process Industries. Rugby, UK: IChemE.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. THE CONCEPTS OF INHERENTLY SAFER PROCESSES AND ASSESSMENT 81 Leong, C. T., and A. M. Shariff. 2008. Inherent safety index module (ISIM) to assess inherent safety level during preliminary design stage. Process Saf. Environ. Protect. 86(2):113-119. Leong, C. T., and A. M. Shariff. 2009. Process route index (PRI) to assess level of explosiveness for inherent safety quantification. J. Loss Prevent. Proc. Ind. 22(2):216-221. Lin, D., A. Mittelman, V. Halpin, and D. Cannon. 1994. Inherently Safer Chemistry: A Guide to Cur- rent Industrial Processes to Address High Risk Chemicals. Washington, DC: Office of Pollution Prevention and Toxics, U.S. Environmental Protection Agency. Lindell, M. K., and Perry, R. W. (2006). Onsite and offsite emergency preparedness. Pp. 1959-1971 in S. Lee. (Ed.) Encyclopedia of Chemical Processing. New York: Marcel Dekker. Mannan, S., ed. 2005. Lee’s Loss Prevention in the Process Industries, 3rd Ed. Oxford, UK: Elsevier Butterworth-Heinemann. Mansfield, D. P., R. D. Turney, R. L. Rogers, M. Verwoerd, and P. Bots. “How to Integrate Inherent SHE in Process Development and Plant Design.”IChemE Conference, Major Hazards Onshore and Offshore 1995. Manuele. F. A. 2003 On the Practice of Safety. Hoboken, NJ: John Wiley & Sons. Meel, A., and W. D. Seider. 2005. Dynamic risk assessment of inherently safe chemical processes: Ac- cident precursor approach. In 2005 Spring National Meeting Conference Proceedings, Atlanta, GA. New York: American Institute of Chemical Engineers. Mulhern, B. 2008. Up on green roofs. Turf Magazine, January [online]. Available: http://www.turf magazine.com/article-192.aspx. Accessed Sept. 27, 2011. NJ DEP (New Jersey Department of Environmental Protection). 2009. News about the TCPA Pro- gram: Toxic Catastrophe Prevention Act (TCPA) TCPA 13:1K-24, March 16 [online]. Available: http://www.state.nj.us/dep/rpp/brp/tcpa/tcpanews.htm. Accessed: Sept. 23, 2011. Palaniappan, C., R. Srinivasan, and I. Halim. 2002a. A material-centric methodology for develop- ing inherently safer environmentally benign processes. Comput. Chem. Eng. 26(4-5):757-774. Palaniappan, C., R. Srinivasan, and R. Tan. 2002b. Expert system for the design of inherently safer processes. 1. Route selection stage. Ind. Eng. Chem. Res. 41(26):6698-6710. Palaniappan, C., R. Srinivasan, and R. Tan. 2002c. Expert system for the design of inherently safer processes. 2. Flowsheet development stage. Ind. Eng. Chem. Res. 41(26):6711-6722. Puranik, S. A., K. K. Hathi, and R. Sengupta. “Prevention of Hazards Through Technological Alternatives.”Safety and Loss Prevention in the Chemical and Oil Processing Industries, 581-

1. IChemE Symposium Series, no. 120. Rugby, Warwickshire, UK: The Institution of Chemical

Engineers, 1990. Rahman, M., A. M. Heikkila, and M. Hurme. 2005. Comparison of inherent safety indices in process concept evaluation. J. Loss Prevent. Proc. Ind. 18(4-6):327-334. Rogers, R. L., and S. Hallam. 1991. “A Chemical Approach to Inherent Safety.” IChemE Symposium Series No. 124:235-241. Rogers, R. L., D. P. Mansfield, Y. Malmen, R. D. Turney, and M. Verwoerd. 1995. The INSIDE project: Integrating inherent safety in chemical process development and plant design. In Inter- national Symposium on Runaway Reactions and Pressure Relief Design, ed. G. A. Melhem and Harold G. Fisher, 668-89. New York: American Institute of Chemical Engineers. Rusli, R., and A. M. Shariff. 2010. Qualitative assessment for inherently safer design (QAISP) at preliminary design stage. J. Loss Prevent. Proc. Ind. 23(1):157-165. Scheffler, N. E. 1995. Inherently safer latex plants. In Proceedings of the 29th Annual Loss Preven- tion Symposium, ed. Everett D. Wixom and Robert P. Benedetti, Paper 1b. New York: American Institute of Chemical Engineers. Shah, S., U. Fischer, and K. Hungerbuhler. 2003. A hierarchical approach for the evaluation of chemical process aspects from the perspective of inherent safety. Process Saf. Environ. Protect. 81(6):430-443. Shariff, A. M., and C. T. Leong. 2009. Inherent risk assessment—A new concept to evaluate risk in preliminary design stage. Process Saf. Environ. Protect. 87(6):371-376.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 82 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Shariff, A. M., and D. Zaini. 2010. Toxic release consequence analysis tool (TORCAT) for inherently safer design plant. J. Hazard. Mater. 182(1-3):394-402. Shariff, A. M., R. Rusli, C. T. Leong, V. R. Radhakrishnan, and A. Buang. 2006. Inherent safety tool for explosion consequences study. J. Loss Prevent. Proc. Ind. 19(5):409-418. Sorensen, J. H., Shumpert, B. L. and. Vogt, B. M. (2004). Planning for protective action decision making: evacuate or shelter-in-place. J. Hazard. Mater. A109, 1-11. Spurgin, A. J. (2010). Human Reliability Assessment: Theory and Practice. Boca Raton: CRC Press. Srinivasan, R., and A. Kraslawski. 2006. Application of the TRIZ creativity enhancement approach to design of inherently safer chemical processes. Chem. Eng. Process. 45(6):507-514. Srinivasan, R., and N. T. Nhan. 2008. A statistical approach for evaluating inherent benign-ness of chemical process routes in early design stages. Process Saf. Environ. Protect. 86(3):163-174. Swain, A. D., and H. E., Guttmann. 1983. Handbook on Human Reliability Analysis with Emphasis on Nuclear Power Plant Application. NUREG/CR-1278. SAND 80-0200 RX, AN. Final Report. Rockville, MD: U.S. Nuclear Regulatory Commission. Tugnoli, A., G. Landucci, and V. Cozzani. ���������������������������������������������������������

1. Key performance indicators for inherent safety: Ap-

plication to the hydrogen supply chain. Process Saf. Prog. 28(2):156-170. U.S. Department of Labor. Occupational Health and Safety Administration. Process safety man- agement of highly hazardous chemical. (29 CFR § 1910.119) [online]. Available at http:// www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760. Ac- cessed: April 6, 2011. Van Willigen, M., T. Edwards, B. Edwards, and S. Hessee. 2002. Riding out the storm: The experi- ences of the physically disabled during Hurricanes Bonnie, Dennis, and Floyd. Natural Hazards Review 3(3):98-106. Windhorst, J. C. A. 1995. Application of inherently safe design concepts, fitness for use and risk driven design process safety standards to an LPG project. In Loss Prevention and Safety Pro- motion in the Process Industries, ed. J. J. Mewis, Hans J. Pasman, and E. E. De Rademacker, 543-54. Amsterdam: Elsevier Science B. V.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 5 MIC and Pesticide Production at the Institute Plant: Alternatives Assessment INTRODUCTION In this chapter, possible alternative methods for production of methyl iso- cyanate (MIC) and carbamate pesticides at the Bayer CropScience facility are presented. This chapter directly addresses Tasks 2 and 3.1 of the committee’s statement of task. Before beginning, however, it is important to address two points. First, when the committee began its work, there was an assumption that Bayer CropScience would be restarting production of MIC and the carbamate pesticides. Were that to be done, then a “[r]eview [of] current and emerging technologies for producing carbamate pesticides, including carbaryl, aldicarb, and related compounds.” (SOT, Task 2) would potentially have value for the company. During the course of the study, however, Bayer CropScience (Bayer) announced they would not be restarting production of MIC. This was based on a combination of the factors described in Chapters 1 and 3 including deregistration of aldicarb, carbosulfan, and carbofuran with the U.S. Environmental Protection Agency (EPA) and the continued economic viability of the other pesticides manu- factured at the facility. In light of these changes, the committee determined that an in-depth review of the field as a whole would provide little value to the sponsor or the reader beyond what a targeted review of processes considered by Bayer and the legacy owners of the facility would provide. Thus, the analyses presented in this chapter focus on those processes identified by the current and former owners as most likely to meet the manufacturing needs of the Institute facility. Second, the process assessments presented here may be incomplete because the analysis is based in large part on materials provided by Bayer CropScience that were generated by former site owners, primarily Rhône-Poulenc. At the first 83

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 84 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE meeting of the committee, Dr. Steven Smythe speaking on behalf of the company, stated that 29 routes to MIC production had been identified, and four had been evaluated in greater detail. Although the materials relating to the alternatives and their evaluation were provided to the committee for review in good faith, the documentation was rather disjointed and discontinuous, with documents rang- ing from undated handwritten notes without attribution to in-depth typewritten analyses of findings. Therefore, the process assessments presented here are drawn from docu- ments provided by Bayer and from the current academic and patent literature. Information gaps within the historic documents could result in gaps within these assessments. ALTERNATIVES ASSESSMENT In considering the adoption of a new or redesigned process, it is helpful to break down the impact that the proposed redesign would have on the elements outlined in Chapter 4, namely selection of basic technology, implementation of the selected technology, plant design, detailed equipment design, and impact on operations. The options facing the facility’s owners—Bayer CropScience today and the legacy companies in the past—were (1) continuing with the existing pro- cess, (2) adopting an alternative chemical process not involving MIC, (3) using an alternative process involving MIC production that would consume MIC immedi- ately (just-in-time) and thus not require storage, and (4) reducing the volume of stored MIC and the risks of transporting MIC from one facility within the site to another by rearranging process equipment. Each of these has implications for the facility as a whole, and the technical considerations for them are presented below. However, a key motivation for this NRC study is to evaluate whether Bayer could have identified a superior process for manufacturing pesticides at the Institute facility that would have reduced risks to the surrounding communities. Any potential changes proposed by Bayer CropScience were compared to the processes in place in 2008, referred to here as the “existing process,” for the chemistry and production methods in place at that time. Production of MIC There are a number of possible methods for production of MIC. This chemis- try has been used for decades, and much has been written about the possible paths for production. In light of Bayer’s decision to no longer produce or store large quantities of MIC onsite, a full evaluation of every possible alternative method of production is not presented here. Rather, this section describes four methods eval- uated by Bayer and previous owners of the facility. The evaluations of these processes and the role those evaluations played in Bayer’s decision making are described in Chapter 6.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 85 In 2010, Bayer identified four alternative processes for generating MIC (referred to here as DuPont, cyanate, diphenylcarbonate, and Enichem) based in part on earlier evaluations conducted by prior owners of the Institute site. The company stated that data for their analyses were derived in part from the follow- ing sources (Smythe, 2011): • The Union Carbide Corporation (UCC) process. Current operating data and cost • DuPont. Stanford Research Institute Report and internal evaluation per- formed by Rhône-Poulenc • Cyanate. Patent literature between 1973 and 1985 • Diphenylcarbonate. Domagen operating costs and conditions between 1971 and 2002 • Enichem. Patent literature from 1975 and internal evaluation performed by Rhône-Poulenc All four of the processes generate MIC in a gaseous form, rather than a liq- uid form, which would have necessitated some adjustments to the downstream production processes at Institute to be used directly or incorporation of a recovery step to condense or capture liquid-phase MIC. In addition, none of the processes had been run at a scale similar to the existing MIC process at Institute. Note that all process flow diagrams below were provided by Bayer ­CropScience to the committee. The Union Carbide Corporation (UCC) Process in Institute The synthetic method for the production of MIC has remained largely unchanged since 1966, when production began in Institute. In this process, devel- oped by Union Carbide, phosgene (Cl2CO) and methyl amine (CH3NH2, MMA) are combined to form N-methyl carbamoyl chloride (C2H4NClO, MCC), from which hydrogen chloride (HCl) is eliminated to generate MIC. See Figure 5.1. The MCC generation takes place at high temperature and low pressure in a reactor with a specialized design that permits very fast reaction times and com- plete conversion of MMA to MCC, followed by a pyrolizer to split MCC into FIGURE 5.1  Synthesis of MIC from N-methyl carbomoyl chloride, as used at the Bayer CropScience facility.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 86 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE UCC Process via Mono-Methylamine (MMA) and Phosgene Methylamine (MMA) CO Cl2 MIC Waste water HCl Chloroform (TCM) MIC Reaction MIC Recovery Phosgene generation HCl Scrubber HCl Absorption Residue treatment TCM extraction Phosgene Recovery Waste water DMAC Recycle DMAC Recycle Phosgene Recycle UCC Process via Mono-Methylamine (MMA) and Phosgene Methylamine (MMA) CO Cl2 MIC Waste water HCl Chloroform (TCM) MIC Reaction MIC Recovery Phosgene generation HCl Scrubber HCl Absorption Residue treatment TCM extraction Phosgene Recovery Waste water DMAC Recycle DMAC Recycle Phosgene Recycle FIGURE 5.2  Process flow diagram for production of MIC via mono-methylamine and phosgene (UCC process). SOURCE: Smythe (2011). MIC and HCl. The pyrolizer has an inclined orientation to separate the HCl from the MIC, avoiding any re-formation of MCC. The process, as used at the Bayer CropScience facility, produced extremely pure MIC (99.9 percent), which was then stored in liquid form before being transferred for use in production of carba- mate pesticides. A diagram of the process and the equipment used for production of MIC is shown in Figure 5.2. DuPont Process In 1985, DuPont developed a methylformamide oxidation process to make its own MIC when the Union Carbide facility halted production following the Bhopal disaster (Carcia, 1984; Rao, 1985). The DuPont process combines monomethyl- amine and carbon monoxide to provide N-methylformamide (see Figure 5.3). The N-­methylformamide is then oxidized with oxygen/palladium (through an air intake) at very high temperatures to generate gaseous MIC and water. To prevent the MIC from reacting with the water, it is almost immediately fed into a process to produce methomyl and oxamyl carbamate pesticides. When Rhône-Poulenc considered the plausibility of developing this method for producing MIC at the Institute facility, concerns, such as whether downstream

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 87 pesticide production could continue with the vapor phase MIC or if recovery of liquid MIC was required, had to be considered. If the vapor phase could be used, then this process would have the advantage of using MIC as soon as it is produced (just-in-time production). DuPont’s production facility in LaPorte, Texas is able to use vapor phase MIC, so there is no MIC storage on site, and since it is pro- duced as a gas rather than a liquid, only a small amount of MIC is in the system at any given time. However, according to Bayer’s analysis, the concentration of impurities in the MIC generated using the DuPont process is higher than with the UCC process. Cyanate Process The cyanate process has been used in South Africa, and it is currently used as a method for making MIC in Asian countries. This method combines ­potassium or sodium cyanate and dimethyl sulfate in an aromatic solvent to generate MIC and potassium or sodium sulfate (See Figures 5.4 and 5.5). This is one of the earliest methods for synthesis of isocyanates reported in the literature, having been discovered by Alfred Wurtz in 1849. In contrast to the DuPont process, but similar to the UCC process, the cyanate process is a batch process and requires some capacity for storing MIC. The yield of MIC was reported in a patent awarded in 1980 as on the order of 80-85 percent relative to added potassium cyanate (Giesselmann et al., 1980). An important consideration any company contemplating adoption of this process is the amount of waste generated as a result of this reaction, which is roughly 1.5 kg of solid K2SO4 or Na2SO4 waste per kg of MIC produced. FIGURE 5.3  Synthesis of MIC from N-methylformamide, used by DuPont. FIGURE 5.4  Synthesis of MIC from sodium cyanate, used in the cyanate process.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 88 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Sodium Cyanate Process via Dimethyl Sulfate (DMS) DMS Solvent (e.g.o-DCB) MIC Waste water NaOCN Residue MIC Reaction MIC Recovery Solvent drying Hydrolysis Organic stripping Solvent Recycle Na2CO3 water Vent FIGURE 5.5  Process flow diagram for production of methyl isocyanate via dimethyl sulfate and sodium cyanate (cyanate process). SOURCE: Smythe (2011). Bayer Diphenylcarbonate and Dimethylurea Process Bayer used a diphenylcarbonate process to make MIC at its Dormagen plant between 1971 and 2002, combining diphenylcarbonate with dimethylurea (Kober and Smith, 1968). In this method, the dimethylurea and diphenyl­carbonate are heated to form MIC and phenol via an exchange-replacement-elimination sequence (See Figure 5.6). The diphenylcarbonate process has the advantage of not requiring chlorine or phosgene as inputs, but it does generate large amounts of phenol, although this can be recovered by cooling the product mixture and recycling for use in the production of diphenylcarbonate. The diagram in Figure 5.7 shows the process. Enichem Diphenylcarbonate Process Enichem, a chemical company based in Europe, also had a process to make MIC that combined diphenylcarbonate with methylamine (Romano et al., 1984;

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 89 DPC DMU Diphyl MIC PhOH Residue Vent Reaction mixture MIC Recovery PhOH Recovery PhOH Storage MIC Reaction Bayer Process via Diphenylcarbonate (DPC) and Dimethylurea (DMU) DPC DMU Diphyl MIC PhOH Residue Vent Reaction mixture MIC Recovery PhOH Recovery PhOH Storage MIC Reaction Bayer Process via Diphenylcarbonate (DPC) and Dimethylurea (DMU) FIGURE 5.7  Process flow diagram for production of MIC via diphenylcarbonate and dimethylurea (Bayer diphenylcarbonate process). SOURCE: Smythe (2011). FIGURE 5.6  Synthesis of MIC from diphenylcarbonate and dimethylurea, used in the diphenylcarbonate process. Rivetti et al., 1987) (see Figure 5.8). As with Bayer’s diphenylcarbonate process, the Enichem diphenylcarbonate process is essentially a replacement-elimination reaction. The two reactants are mixed and heated to form N-methylcarbamate, also known as phenyl-N-methylurethane, and phenol. Further heating leads to the elimination of MIC and additional phenol. The mixture is then cooled to remove the phenol and remaining N-methylcarbamate allowing MIC to undergo addi- tional purification steps (see Figure 5.9). Because phenol is also a by-product of the Enichem reaction, manufacturers using this method must consider whether to dispose of or recycle this material.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 90 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE DPC Methylamine (MMA) Diphyl MIC PhOH Residue Vent NMC Reaction MIC Recovery PhOH Recovery PhOH Storage MIC Reaction Enichem Process via N-Methylcarbamate (NMC) DPC Methylamine (MMA) Diphyl MIC PhOH Residue Vent NMC Reaction MIC Recovery PhOH Recovery PhOH Storage

MIC Reaction

FIGURE 5.8  Synthesis of MIC from diphenylcarbonate and methylamine, used in Enichem diphenylcarbonate process. FIGURE 5.9  Process flow diagram for production of MIC via N-methylcarbamate (Enichem process). SOURCE: Smythe (2011). In the late 1980s, Rhône-Poulenc considered this option in great detail, including the manufacture of diphenylcarbonate onsite from dimethylcarbon- ate and phenol, which would negate the need for phosgene in the production of diphenylcarbonate. The company then engaged with Enichem to evaluate the feasibility of adopting and licensing this process from Enichem in Institute, West Virginia. Carbamate Pesticide Production MIC was produced at the Institute facility to act as a reactant in the synthesis of carbamate pesticides. In this section the focus is primarily on the possible tech-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 91 nical alternatives for production of carbamate pesticides at the Institute facility. The assumption that carbamate production would continue was implicit in the Committee’s Statement of Task, which focused on identifying different technolo- gies for producing carbamate pesticides and possible approaches for reducing or eliminating the use of MIC in their production. A broader range of alternatives could be considered, including not making any carbamate pesticides, or even not making any pesticides at all, which reduce safety risks. However, such alterna- tives could lead to a different set of risks to society—such as, losses of crop production, higher prices for food, possible starvation in developing countries unable to afford higher food costs, etc. Alternative processes that lead to lower quality and reduced effectiveness in the resulting pesticides, also relate to the overall benefits of the pesticide under consideration. Consideration of the various nonprocess alternatives are discussed briefly in Chapter 6 when ways to quantify the benefits and costs from different production processes are described. Alternative Production Methods for Carbamate Pesticides The carbamate pesticides in production in Institute in 2008 were all N-­monomethyl carbamates, with carbaryl, aldicarb, and thiodicarb the primary pesticides produced onsite. The chemical reactions used to produce these pesti- cides are summarized in Figure 5.10. There are two reaction types available for the final step in synthesizing carbamate pesticides: additions to MIC and replace- ments in carbamates and carbonates (second and third equations of 5.10). The different pesticides are characterized by differences in the R group and physical formulations, but the underlying synthetic chemistry is similar. Specific applica- tions of the carbamate synthesis equations are shown in Figure 5.11. An early CH3NCO HOR CH3NHCO2R CH3NHCOX CH3NHCO2R HOR HX CH3NH2 OC(OR)2 CH3NHCO2R HOR addition replacement replacement + + + + + FIGURE 5.10  Possible methods for synthesis of N-monomethyl carbamate pesticides. These equations represent the generic forms of the possible synthetic pathways discussed later in this chapter.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 92 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE FIGURE 5.11  Synthesis routes for the production of carbaryl (without and with MIC) and aldicarb (with MIC). (A) A synthetic route for production of carbaryl without the use of MIC; (B) A synthetic route for production of carbaryl using MIC; and (C) A synthetic route for the production of aldicarb using MIC. non-MIC process for carbaryl is shown in the first equation. The MIC-based syn- theses of carbaryl and aldicarb are shown in the second and third equations. The most recent processes used by Bayer, DuPont, and Enichem to produce carbamate pesticides (described earlier) all use MIC. Carbaryl The first carbamate pesticide in production at the Institute plant was ­carbaryl. This broad-spectrum pesticide has relatively moderate toxicity to mammals, and it is commonly found in both agricultural and residential uses. It has a dem- onstrated toxicity for aquatic life (EPA, 2004), and environmental release is a concern for users of carbaryl. See Tables 5.1 and 5.2. Carbaryl was originally produced with a non-MIC-based chloroformate pro- cess (see Figure 5.11) using intermediates produced elsewhere, and this process was used for many years (1961-1977). In this reaction, 1-naphthol is reacted with phosgene to create a chloroformate. Reaction of the chloroformate with methylamine results in the formation of carbaryl. In 1978, the production process for carbaryl was changed to use MIC. See Figure 5.12 for a flow diagram of this process. The reasons given for the change were that the chloroformate process was highly corrosive, had lower yield, and generated considerable waste products. One internal report stated that with the change in process, the yield of carbaryl went from 86 percent to 92 percent with respect to 1-naphthol with a purity of 99 percent (Peck, 1978). Production of carbaryl then became the largest volume consumer of MIC at the Institute plant. At one point, because of high demand for the product, 40 million pounds of MIC was produced annually. In 2008, the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 93 TABLE 5.1  Acute Toxicity Categories for Carbaryl Guideline No. Study MRID No. Results Toxicity Categorya 81-1 Acute oral—rat (99% a.i.) 00148500 LD50 for males = 302.6 mg/k; for females = 311.5 mg/kg; combined = 307.0 mg/kg II 81-2 Acute dermal—rabbit (99% a.i.) 00148501 LD50 > 2000 mg/kg III 81-3 Acute inhalation—rat (99% a.i.) 00148502 LC50 > 3.4 mg/L IV 81-4 Primary eye irritation—rabbit (99% a.i.) 00148503 Not a primary eye irritant IV 81-5 Primary skin irritation—rabbit (99% a.i.) 00148504 Not a primary skin irritant IV 81-6 Dermal sensitization—guinea pig (99% a.i.) 00148505 Negative NA

aI, highly toxic, severely irritating; II, moderately toxic, moderately irritating; III, slightly toxic, slightly irritating; IV, practically non-toxic, not an irritant. SOURCE: EPA (2004). process used a continuous fixed bed reactor run for 12 days followed by shutdown for 3 days to dissolve the accumulation of solids from the reactor (Martin, 2011). Aldicarb The Institute plant began producing aldicarb in 1976 (equation 5.11). Bayer personnel stated that of all the carbamates being produced at Institute, aldicarb was most clearly dependent on the use of the highly purified MIC generated from the existing Institute process. The primary uses of this pesticide are in early applications in commercial agriculture to control nematodes and sucking insects (U.S. EPA, 2010). In contrast to carbaryl, aldicarb and its metabolites are highly toxic through oral, dermal, and inhalational routes of exposure. Aldicarb is also toxic to fish and aquatic invertebrates. To render it safe to use, the aldicarb was processed into granules that reduced generation of dust and facilitated handling of the material, which in turn reduced exposure to the users. The MIC-based aldicarb production process used a batch reactor, with an extended cook-out period that generated a complete reaction (see Figure 5.13). This material was then shipped to Woodbine, Georgia for binding onto particles of gypsum. This method necessitated a very clean coating of the pesticide being deposited on the particles of gypsum in the final formulation. Any impurities in the MIC could lead to imperfections in the coating, resulting in serious problems with clumping of the final product in the applicators. Such impurities could also

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 94 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 5.2  Typical Human Hazard and Precautionary Statements Toxicity Category Systemic effects (oral, dermal, inhalation toxicity) Irritation effects (skin and eye) Sensitizera I Fatal (poisonous) if swallowed [inhaled or absorbed through skin]. Do not breathe vapor [dust or spray mist]. Do not get in eyes, on skin, or on clothing. [Front panel first-aid statement required.] Corrosive, causes eye and skin damage [or skin irritation]. Do not get in eyes on skin, or on clothing. Wear goggles or face shield and rubber gloves when handling. Harmful or fatal if swallowed. [Front panel first- aid statement required.] If product is a sensitizer: Prolonged or frequently repeated skin contact may cause allergic reactions in some individuals. II May be fatal if swallowed, [inhaled or absorbed through the skin]. Do not breathe vapors [dust or spray mist]. Do not get in eyes, on skin, or on clothing. [Appropriate first-aid statement required.] Causes eye [and skin] irritation. Do not get in eyes, on skin, or on clothing. Harmful if swallowed. [Appropriate first-aid statement required.] III Harmful if swallowed [inhaled or absorbed through the skin]. Avoid breathing vapors [dust or spray mist]. Avoid contact with skin [eyes or clothing]. [Appropriate first-aid statement required.] Avoid contact with skin, eyes, or clothing. IV No precautionary statements required No precautionary statements required.

aThere are no categories of sensitization. SOURCE: 40 CFR § 156.62. lead to greater formation of dust with correspondingly higher health risks. These issues were identified as a serious problem with most alternative sources of MIC, which tended to produce MIC of lower purity, which would in turn affect produc- tion of aldicarb. Figure 5.13 shows a simple process flow diagram for production of aldicarb. Other Carbamates Other carbamate pesticides (utilizing MIC) were also in production at Institute in 2008, but were not analyzed by the Committee for reasons described below. These pesticides include thiodicarb (Larvin), carbosulfan (Marshal), methomyl, which used a continuous plug flow reactor; and carbofuran (Furadan), which used a solventless process. The carbofuran unit was owned by FMC and operated by Bayer. When the Committee’s investigation began, Bayer had already decided to shut down production of methomyl and carbofuran after the 2008 accident. Pro-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 95 FIGURE 5.12 Basic process flow diagram for production of carbaryl. SOURCE: Martin (2011). FIGURE 5.13 Basic process flow diagram for production of aldicarb. SOURCE: Martin (2011).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 96 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE duction of carbosulfan and thiodicarb continue using methomyl and carbofuran from an external source. The decision to close down those lines was apparently related to their location: those operations were in another part of the plant, requir- ing a separate MIC storage tank and a long pipe to transfer the MIC to that area. Of the carbamate pesticides being produced at Institute in 2008, only ­carbaryl had been produced by a non-MIC process. At the time the present study was initiated, it appeared that a modified MIC process for the synthesis of carbaryl would be restarted at the Institute plant. In that case, a complete and critical review of the literature, patents, and worldwide practice for MIC-based and non-MIC-based N-monomethyl carbamate pesticide syntheses could have been appropriate, although such a review would have required considerable time and resources. Given the decision by Bayer to discontinue production of both MIC and N-monomethyl carbamate pesticides at the Institute plant, such a detailed review became unnecessary. ALTERNATIVE ARRANGEMENTS OF PROCESSES A key concern with the overall design of the production processes at the Institute plant was the need for storage of considerable amounts of MIC. This arose because of the characteristics of the production processes for MIC and the four carbamate pesticides. To account for the agricultural calendar, the production of MIC was ideally run on a continuous basis through most of the year, with only limited shutdowns (except for one long shutdown in July and August). The dif- ferent carbamate processes had different schedules. The aldicarb and ­carbofuran processes ran all year long, whereas the carbaryl, oxamyl, and ­methamyl processes only required MIC during 4-5 months of the year. In addition, the Institute aldicarb and oxamyl processes ran in batch mode, and the carbaryl process was shut down for a few days every two weeks to dissolve solids from the reactor. Between the seasonal fluctuations and the short-run fluctuations in the carbamate processes, there was considerable variation in the need for MIC over time. The operators at the Institute plant had developed some degree of flexibility in the production rate for the MIC process, roughly a 3:1 (high:low) ratio, but they still relied upon a maximum MIC inventory level of 200,000 pounds to coordinate the MIC and carbamate production over time (Martin, 2011). At various times the owners of the Institute site considered ways to reduce the amount of MIC being stored onsite. Reductions in MIC storage could offset impacts on the risk of the overall process. Smaller inventories of MIC would reduce the magnitude of damages from a potential accidental release of MIC from storage. However, holding smaller inventories would increase the number of times the MIC and carbamate processes had to be started or stopped, due to halting MIC production when the storage capacity was reached and stopping the carbamate process when the MIC in storage was used up. This could increase the overall risk of the process, because startup and shutdown periods have the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 97 greatest potential for accidents (the 2008 methomyl accident happened during process startup) (CSB, 2011). There were substantial reductions in the maximal MIC storage amounts at the Institute plant, from 1 million pounds at its peak to about 200,000 pounds more recently, as the scale of overall MIC production fell from over 40 million pounds annually in the late 1970s to around 10 million pounds by 2008 (Smythe, 2011). From 1989 to 1991 Rhône-Poulenc conducted an evaluation of alterna- tive approaches to MIC production, including having separate MIC generators attached to each carbamate production line in order to reduce the need for MIC storage. This approach could have reduced the potential damage in the case of an accident because the amount of MIC being stored on each line would be smaller, but there would have been four times as many places for an accident to occur. In the end, the complications associated with having four separate MIC produc- tion units was considered to outweigh the benefits of reduced MIC storage, and the production process was not changed. In 1993, Rhône-Poulenc’s Institute Modification Project allowed the MIC production unit to operate at reduced rates, permitting a better match between MIC and carbamate production rates without increasing MIC storage. Most recently, in August 2009, Bayer announced plans to reduce the amount of MIC storage from 200,000 pounds to 40,000 pounds, as part of a $25 million investment project that also strengthened the layers of pro- tection around the MIC production and storage units, and eliminated aboveground storage of MIC (Bayer CropScience, 2009). Another important issue relates to the physical layout of the production process. In the case of the Institute plant, in 2008, the production of carbamate pesticides occurred in two separate areas of the plant, with the aldicarb and carbaryl processes located relatively close to the MIC production area, whereas the carbofuran and methomyl processes were located some distance away, in the West Carbamoylation Complex (WCC). Each night the MIC needed for the next day’s carbofuran and methomyl production was transferred to an aboveground holding tank. The proximity of that MIC tank to the explosion in the methomyl production unit in 2008 was a key concern in the investigation of the accident. Bayer’s 2009 decision to shut down the WCC helped reduce the risks associated with storing MIC in an aboveground tank and the overnight pumping of MIC to that tank (Bayer CropScience, 2009; Smythe, 2011). Technical Considerations A comparison of different production processes begins with consideration of the underlying chemical reaction. This determines the per-unit variable cost of production, along with energy and capital costs. There may be some uncertainty, especially on the capital costs, as well as a learning curve associ- ated with operating a new production process. These uncertainties provide a substantial advantage for an incumbent production process, along with the cost

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 98 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE advantage that no additional capital costs are required to continue using the existing equipment. Balanced against the costs of production is the revenue to be gained, which is likely to be influenced by the quality of the product. For the four alternative MIC production methods described above (DuPont, cyanate, ­diphenylcarbonate, and Enichem), purity of the MIC produced was an issue. According to the anal- ysis provided by Bayer, the DuPont process generated considerable impurities at startup, which would have been unacceptable for the high-purity production requirements for the manufacture of aldicarb. Collection and purification of the gaseous MIC prior to use in the synthesis would require storage of a quantity of MIC on site and would, to some degree, reduce the benefit of just-in-time production of the chemical. Adoption of this process at the Institute site also presents additional technical challenges, since it would have required adapting the Institute aldicarb and carbaryl processes to work with gaseous MIC rather than liquid MIC. In addition, as production of aldicarb oxime ran as a batch process, onsite storage of MIC would still be required for at least short periods of time. The cyanate method could match MIC production more closely to the batch versions of carbamate production. However, in order to accommodate the con- tinuous production units of carbaryl and methomyl, onsite storage would again be required. In addition, the cyanate process is generally run on a much smaller scale than the UCC process; and adapting it to the Institute scale of production would require a very large number of reactors being built on site, which have an increased risk of leaks and equipment failures. Finally, as mentioned previously, the cyanate process generates significant quantities of hazardous waste that would need to be controlled and disposed of appropriately. The diphenylcarbonate process for MIC production was used by Bayer in Germany until 2002. When that process was phased out, the company lost its in-house expertise. More importantly, however, this process depends on a supply of dimethylurea, which had been purchased from BASF in Germany but was not readily available in the United States. It is unclear whether onsite production of DMU was considered. There were also concerns about the quality of the MIC produced by the process, which could affect the final production of aldicarb. As with the DuPont process, an additional purification step might have resolved this issue, thought this would also have introduced a requirement for some onsite stor- age capacity. This process also requires the generation of phenol, which is also a hazardous material that must be managed, either by recycling of the material in the process or through treatment and disposal. The Enichem process, although listed as potentially promising in the late 1980s, also presented some concerns. For example, the process had only been run on a very small scale (less than 5 percent of the level of production at Insti- tute), and there were also concerns about the quality of the MIC that would be produced. The different MIC processes vary considerably in the purity of the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 99 product MIC, with the Institute UCC process providing the highest MIC purity, which affects the quality of the resulting carbamate pesticides. INFORMATION REQUIRED FOR SCREENING ALTERNATIVES Performing a comprehensive inherently safer processes (ISP) analysis requires considerable information (see Chapter 4). There are multiple dimen- sions along which the processes can be compared, and many characteristics of each process need to be taken into account. These comparisons can then be incorporated into the process safety management (PSM) evaluations and, in turn, can affect business decisions. Indirectly, incorporating or developing systems that are “inherently safer” may reduce overall lifetime costs to a company by reduc- ing the possibility of accidental release of hazardous materials from the process, with potential damages to personnel, the production facility, and the surrounding community. When a company faces a decision about whether or how to change a process, more than the safety elements are considered, although safety could be a deciding factor in whether to move ahead. Some process characteristics are obviously part of any business decision, including the costs of the chemicals, labor and energy requirements, and new capital expenditures, as well as the quality of the product and revenues expected from its production. There can also be environmental impacts anticipated from the process, depending on the nature of the inputs being used and any by-products being generated. Many of these characteristics involve a substantial degree of uncertainty. The underlying chemical reaction may support relatively straightforward calculations of the amounts of different chemical and energy inputs needed for the process, and hence the expected per-unit production costs. The costs of developing and installing new capital equipment for the pro- cess will be less certain, as will the steepness of the learning curve when starting a new process. On the other hand, the probability and consequences of a major accident are much less certain, making it difficult to quantify those risks and consider them along with the other characteristics in the final decision-making process. Any firm approaching a redesign must consider the position of the product in the market and its expected life-cycle. At this point, carbamate pesticides are relatively mature products, with a limited remaining market life, and hence a less desirable focus for new investment. Of the pesticides made at Institute, aldicarb seemed to have fewer competing products, which may help explain why Bayer was initially willing to spend $25 million in 2010 to extend aldicarb production for a limited number of additional years (Bayer CropScience, 2009). In addition to production costs, the reaction identifies the particular chemi- cals involved in the process, as either inputs or by-products, and hence the hazards associated with the process. In addition to MIC itself, phosgene and chlorine are commonly used as reactants in carbamate production, and generation

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 100 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE of unwanted by-products such as phenol also increases risks. Balanced against the hazards from the chemicals are the safety measures being employed in the process. These add to the costs of running the process, but reduce the risk of accidental exposures, both within the facility and in the surrounding community. Regulatory Considerations A company’s decisions about production processes are also strongly influ- enced by constraints imposed by other entities. For example, manufacturing carbamate pesticides for sale in the United States requires that the pesticide be approved by EPA. The pesticide approval process can take multiple years, and approval is needed when there is a substantial change in the production pro- cess for the pesticide. This gives a considerable advantage to an incumbent process that has already been approved by EPA. When Bayer evaluated several alternative methods for producing MIC in 2010, a major drawback of all the alter- natives, as identified by the company, was that changing the MIC process would require an EPA review and reapproval of the “new” pesticide, because the purity of the MIC could change. The reregistration process can be lengthy, could result in significant periods of lost production. . . such a gap in production could risk permanent loss of customers (farmers), who would have to switch to alternative pest control measures for at least one growing season. Government regulation of workplace and environmental hazards can also influence company decisions, given the hazardous nature of the chemicals involved. For example, the creation of EPA and the federal Clean Air Act and Clean Water Act legislation increased pressure to reduce air and water pollution in the 1970s. This pressure to limit pollution helped drive the decision by Carbide to switch away from a highly-polluting (non-MIC) process for carbaryl production to a MIC-based process that generated less pollution. This example highlights the complexities of regulating production processes—efforts to reduce exposures to one set of hazardous chemicals may lead to changes that increase the risks of exposure to other chemicals. For more information about policy initiatives relat- ing to ISP, see Appendix D. Company-Community Relationships Government regulators are not the only source of external pressures on the company’s decisions. The local community can also influence the decisions, and the relationship between the company and the surrounding community can be very important in this process. The relationship between a chemical company and the community that sur- rounds it is a complex one. Chemical companies manufacture useful products and provide employment for the local communities, but to create these prod- ucts, most chemical manufacturing processes require use of hazardous materials

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 101 and/or processes of some form. These hazards are managed through, among other things, process controls, training and education, and management systems. Regulatory structures, professional standards, and other forms of required and voluntary guidance reinforce and encourage safe practices. In case of accidents or leaks, emergency response systems are in place to help minimize the adverse consequences and control the event. Ideally, these protective systems overlap and integrate in such a way that the risks posed by the chemical and physical hazards onsite are as low as possible. Community perception and understanding of risk and safety are important. For example, when considering responses to accidents or leaks, if an incident large enough to require local emergency response services to respond is a pos- sibility, then a thorough understanding of the potential risks posed is required for development of an appropriate response and training of emergency personnel and community members. At a basic level, a neutral or positive relationship between a facility and its community allows for open discussion about risks and responses. It allows for a sense of trust that the experts onsite are operating with care and consideration. A negative relationship can influence the community perception of risk, lead to distrust, and create an environment of defensiveness and lack of engagement on important issues relevant to everyone involved. This issue has been examined in the literature with respect to community risk perception of nuclear and chemical facilities among other hazards (Starr, 1969, 1981, 1985). Community perception is built on so-called risk perception “frames,” which are closely linked with individual views about how societal decisions should be made (social control frames) and the way they think about a given problem (cog- nitive frames) (Wildavsky and Dake, 1990; Dake, 1991; Elliott and Hanke, 2003; Gray, 2003; Lewicki et al., 2003). In short, people use different frames, based on background, education, social norms, and the like, to define whether a problem exists and if so, what the problem is. People with different frames may disagree about the problem, its size and scope, and how to address it. Relevant to chemical manufacturing, one area in which differences in fram- ing exist is in how people view environmental hazards and whether they pose health risks for the community. Researchers working in the field of risk percep- tion have shown that parties confronting environmental hazards develop consider- ably different frames about the characteristics and intensity of the hazard (Elliott, 1984). Conflicting differences in how technical and lay populations frame risks occur frequently: the former stress prediction and prevention of risks whereas the latter are concerned about risk detection and repairing damage from risks that have occurred. Community perceptions of risk stem from a diverse set of factors ranging from the psychological to social processes of framing, to cultural expectations, and these factors play themselves out within a context of a particu- lar facility and the risks associated with that facility, the relationship between the facility and the surrounding community, and corresponding processes of com- munication, control, and conflict or collaboration.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 102 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE With regards to consideration of ISP, discussions between a facility and the community regarding trade-offs between possible alternative manufacturing methods could help the two sides understand their respective risk perceptions and tolerances. These shared understandings could then be used to help develop reporting and emergency response systems, outreach and communication strate- gies, and other activities in support of maintaining a safe environment and posi- tive relationship. Analysis and discussion of trade-offs is likely to be complex, and decision-aid methods, such as the example described in Chapter 6, could be useful for framing such a discussion by identifying points of disagreement and concurrence among stakeholder groups. The findings from these analyses can be used by companies to aid in decision making by helping to clarify the issues of concern to the members of the community. A good example of the role communities can play in facility decision-making processes can be seen in a comparison of the community relations at the Institute plant with those at a DuPont plant in La Porte, Texas. DuPont had been producing their methomyl insecticide, Lannate, using MIC shipped from the Institute plant. In 1985, restrictions on transportation of MIC following the Bhopal accident led DuPont to modify their Lannate production process to generate its own MIC. DuPont’s good relationship with the surrounding community permitted an open exchange of information about the new process, so that the community was willing to allow DuPont to start producing MIC in the facility, albeit with a process that involved no storage of MIC and only a few pounds of MIC in the process at any one time (Carberry, 2011). In contrast, the poor relationship between Bayer and its surrounding community resulted in a court injunction filed by community mem- bers to stop Bayer from resuming MIC production at Institute. This contributed to a complete shutdown of MIC production, even though Bayer had been producing MIC there for many years, had recently spent $25 million installing additional safety features, had reduced MIC storage levels by 80 percent, and was planning to phase out MIC production altogether within a few years. Thus, good commu- nity relations are crucial to a facility’s gaining local acceptance of their decisions. Today, decision making for the production, storage, and use of MIC and other hazardous chemicals is predominantly made by facility operators within the context of national, state, and local regulations and requirements. At the same time, the chemical industry has increasingly realized the importance of effective working relations with the communities in which plants are located. One example of this is the Responsible Care program described briefly in Chapter 2. This vol- untary program seeks to improve health, safety, and environmental performance in the chemical industry. At the heart of the International Council of Chemical Associations program is an effort for “companies to be open and transparent with their stakeholders—from local communities to environmental lobby groups, from local authorities and government to the media, and of course the general public.” Community advisory panels, as well as a wide range of other outreach efforts, have followed.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 103 These efforts by the chemical industry have increased transparency, outreach, and dialogue with stakeholders external to facilities. However, as is seen in the dynamics surrounding questions of safety associated with MIC production and use at Bayer in Institute, West Virginia, these efforts have sometimes failed to produce a convergence of perspectives as to what poses significant risks to the community or how best to manage those risks. Divergent perceptions of risk, a problem common to many facilities that pose some level of risk to the sur- rounding community, are particularly important when the risks are potentially as substantial as those for chemicals such as MIC or phosgene. In Institute, there are obviously divergent perceptions of the risk posed by large-scale manufacture and storage of MIC at the Bayer facility between individuals working at the facility and at least one subset of the community. The most prominent group advocating for the removal of MIC from the facility is People Concerned about MIC (PCMIC), a group formed after the Bhopal disaster and which has worked toward that goal since that time. QUANTIFYING COSTS AND BENEFITS OF ALTERNATIVES Corporate decision making, at least as modeled by economists, is funda- mentally driven by the goal of profit maximization. Nicholson (2005) provides a standard textbook discussion of various terms used in this section, including profit-maximization, capital costs, expected value, and externalities. In terms of the technical considerations mentioned earlier, decision making involves a com- parison of the revenues generated by a production process with the costs of that production. At its simplest level, per-unit revenues from the sale of a pesticide could be compared to the per-unit costs of the chemicals and energy needed to produce the pesticide, and so a firm choosing among alternative processes that produced exactly the same product should choose the lowest-cost alternative. This calculation could be complicated by consideration of the capital expenditures associated with the processes, which enter the calculations as a one-time cost rather than a per-unit cost. However, suitable tools are available to deal with that, such as the present discounted value of future costs and revenues, or the annual cost of renting the capital each year. A profit-maximizing firm should also consider any risks involved in the production process. An accident causing a temporary shutdown in production and extensive repairs will represent a cost to the firm, but a cost with consider- able uncertainty attached to it, both in terms of magnitude and probability. One approach would be to assign the “expected value” of the accident (accident cost*probability), and so an accident with $50 million of damages and a three percent chance of happening each year would be assigned an expected annual cost of $1.5 million. It would then be profitable for the firm to implement safety mea- sures that could cut the damages (or the accident probability) in half, as long as those safety measures cost less than $750,000 per year. Firms are often assumed

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 104 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE to use expected values to make these calculations, although if the potential risks are extremely large (e.g., complete shutdown of the facility or bankruptcy of the firm), the firm might be “risk averse,” equivalent to being willing to pay more than the expected value of the risk for some sort of insurance policy to avoid the risk. In the case of production risk using ISP to avoid the risk entirely would be one way of “buying insurance” against an accident. From the point of view of the broader society, a key problem with the profit- maximizing decision described above is that the firm would not include in its calculations all the costs borne by people who might be exposed as a result of an accident at the facility. This discrepancy between “private” and “social” costs has been a central topic in Benefit-Cost Analysis (BCA) for many years (see Pigou, 1952 for an early example and Boardman et al., 2010) for a modern textbook approach). BCA is commonly applied to government (and private) decisions to see whether they are in society’s best interest (benefits>costs), and is required for major federal regulations (e.g., under Executive Order 13563, January 18, 2011, regulations “must take into account benefits and costs, both quantitative and qualitative”). A firm’s decisions about risks, even those involving risks to others, can sometimes coincide with the socially optimal decision. Risks to the facility’s workers could, at least in principle, be reflected in compensating differentials— higher wages needed to attract workers to those risky jobs (assuming they know about the risk)—and would be included as a cost in the firm’s profit calculations. However, risks affecting people outside the facility would not generally be con- nected to the firm’s costs. Ignoring these external costs, called externalities, can lead a profit-maximizing firm to choose a riskier production process than would be optimal for society as a whole (Nicholson, 2005). One way of forcing firms to “internalize” these external costs (recognize the costs in their decision making) is through legal liability—if those damaged by an accident can sue the firm and collect full compensation for their damages, it provides an incentive for firms to reduce risks. The existence of externalities provides an economic justification for the activities of regulatory agencies (such as EPA or OSHA) that constrain firms’ decisions about utilizing hazardous production processes with high levels of external risks. The presence of regulators imposing penalties for violations of safety regulations can provide an incentive to firms to reduce the risks associ- ated with their production processes. Community groups picketing the facility or organizing boycotts of the firm’s products can also impose direct costs on firms using risky production processes. Both types of external pressures, regulatory and community-based, can lead firms to reduce risks, in order to reduce their likeli- hood of being penalized for those risks. Corporate Social Responsibility (CSR), whose history is discussed in ­Carroll (1999) and elsewhere, is another approach to firms’ decision making that empha- sizes society’s role in permitting the firm to operate. CSR sees the firm as having

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 105 a responsibility to take into account the external effects of its decisions. From this perspective, firms should consider how their decisions could achieve socially- preferred outcomes, considering external costs and benefits even when there are no regulatory or community pressures to do so. Many discussions of CSR describe firms as accepting lower profits in return for social acceptance, but Porter and Kramer (2006) argue that socially responsible decisions can also benefit the firm’s long-run profitability, especially if the firm focuses on providing benefits to society using its areas of expertise. Whatever decision-making process is being followed, one key element in the calculation of the optimal decision is the risk of an accident. This can be complicated, especially when the risk of a substantial release affecting the area outside the facility involves the simultaneous failure of multiple layers of protec- tion. Calculations of such risks often assume that the probability of each layer’s failure is independent, so that three layers of protection, each with a 1-in-10,000 risk, would provide an overall risk of 1-in-a-trillion. One lesson from the Bhopal accident is that, at least in that institutional setting, failures to manage risk were correlated across the layers of protection, greatly increasing the risk of an acci- dent. Regulatory decisions under BCA can depend heavily on the calculations of the risk of low-probability events, such as the probability of a large accident at a chemical plant, or the probability of a given person dying of lung cancer after being exposed to air pollutants. A key difference between these two examples lies in the frequency of their observations. Millions of people are exposed to air pollution every year, and the (very small) fraction of individuals who die after the exposure can be calculated, which allows one to determine reasonably precise estimates of the risk’s probability. For large industrial accidents, which fortunately rarely occur, calculations of the probabilities involved depend on engineering models of the effectiveness of the different layers of protection. It is not that such calculations cannot be made—they are done regularly as part of both applications of BCA and profit maximizing decisions by firms—but as noted in Box 4.1, there are inherent uncertainties and biases involved. There is also the sensitive issue of assigning values to the illnesses or deaths of people that could result from a major accident. For profit-maximizing deci- sions by the firm, these values can be related back to the potential liability costs of an accident, as discussed earlier. For BCA applications, the most common tool is the “value of a statistical life” (VSL). Suppose that a typical worker requires $5,000 extra wages per year in order to accept a risky job that has a 1-in-1,000 chance of a fatal accident during the year. A group of 1,000 such workers would, on average, have suffered one extra death per year—and would have accepted a total of $5 million to bear the risk of that death—so the VSL would be $5 mil- lion. Considerable effort has been expended by both academics and regulatory agencies to refine their VSL estimates, as well as to consider whether and how VSL values might vary within the population (see Aldy and Viscusi, 2007 for a recent example). Despite the common use of VSL in these calculations, many

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 106 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE are uncomfortable about “putting a dollar value on a life”, and regulators face considerable controversy when making adjustments to VSL (see Nelson, 2011 for a discussion of such controversies at EPA). IMPLEMENTING METRICS A fully quantitative inherently safer process (ISP) analysis that assigns val- ues to all the benefits and costs from alternative production processes, including risks of accidents and other uncertain outcomes, would require considerable resources and a level of detail about production costs and risks that were not made available for this study. The owners of the Institute plant have done some comparisons of alternative production processes, although these were not fully quantitative. The most recent example of this sort of analysis at Institute was an analysis of alternative methods of producing MIC, mentioned in above (Smythe, 2011). A summary of the results is shown in Table 5.3. The first thing to note is that the various dimensions in the analysis are described in qualitative terms (high, low, medium), which rules out any sort of fully quantitative analysis of trade-offs across dimensions. The underlying study did include dollar amounts for the per-unit cost of production (summarized here in low/high terms, to avoid revealing any confidential business information), but the other dimensions were qualitative. This sort of qualitative information could still be valuable in conducting an ISP analysis of the processes and could be used in support of or as a start- ing point to quantitative analyses. One value would come in identifying cases where option A is “dominated” by option B, that is B performs better on every dimension. This would be unusual, given multiple dimensions, but it helps to rule out clearly unsatisfactory options. A second value comes in helping focus the discussion of trade-offs. Also indicated in Table 5.3 that the Bayer process has low process complexity, low waste generation, and low internal recycle streams. All of these characteristics would tend to make it an “inherently safer” process, relative to the other four. However, the need for a supply of dimethylurea (DMU) was a major obstacle, because it was not available in the United States, made this option unfeasible at the Institute plant. It is unclear whether onsite production of DMU was considered as part of the analysis. When Bayer explained how this information was used in its decision mak- ing about the best MIC production process, major advantages were seen for the incumbent process. The “bottom line” yes/no questions— “adaptation of infra- structure,” “R&D required,” and “registration required” —played a crucial role in the decision. These all show “no” for the Institute process and “yes” for the four alternative processes. “Adaptation of infrastructure” refers to the potentially large capital costs that would be needed to install the equipment needed for a new process (while the equipment for the existing process is already in place). “R&D required” reflects the uncertainty and learning costs associated with beginning

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

perience Mature Mature Mature Mature One Unit? SOURCE: Adapted from Smythe, 2011. a: F – Very Flammable, F+ – Extremely Flammable, T – Toxic, T+ – Very Toxic, Xn – Harmful, C – Corrosive.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 108 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE any new production process. The final element, “registration required”, confers a unique advantage upon the incumbent process in the case of pesticide production. As noted earlier, the need for EPA to reapprove the “new” version of the pesticide (made using MIC generated by a new MIC production process with different impurities) would cause a delay of months to years (once the agricultural cycle is taken into account) in marketing the pesticide. Since carbamate pesticides are near the end of their marketing life anyway, such a delay could make the shift to a new process uneconomical. If it were possible to keep the old process operating during the EPA review of the new process, “registration required” might be less of an absolute barrier, but that was not the situation faced by Bayer in 2010, and few facilities would have the extra physical space needed to continue running the old process while constructing the new one. Bayer eventually decided to continue the existing MIC production process, but with an 80 percent reduction in the maximum MIC storage levels (from 200,000 pounds to 40,000 pounds), and other safety enhancements, including the elimination of aboveground MIC storage and the closure of the methomyl facility. The August 26, 2009 news release announcing this decision identified “the concerns of public officials and the site’s neighbors” as an important factor and promised to “continue its dialogue and close cooperation with the com- munity and govern­mental agencies involved” (Bayer CropScience, 2009). This highlights the importance of external pressures on the decision-making process. Bayer personnel indicated that the decision-making process was carried out at the corporate level, including the size of the reduction in MIC storage levels, and the facility’s involvement was limited to confirming that a reduction in MIC storage to 40,000 pounds was feasible. In particular, the size of the reduction in MIC storage did not seem to be based on a specific analysis of the potential trade-off between the risks of larger MIC storage capacity and the risks of more frequent startup/shutdown conditions (i.e., why was 40,000 pounds the optimal MIC stor- age capacity, rather than 30,000 or 60,000 pounds?). As noted earlier, this study focuses on alternative processes for producing carbamate pesticides at the Institute plant. In these calculations, the relative costs (both production costs and potential accident risks) associated with dif- ferent processes have been considered, but the decision whether to produce the pesticides at all, which would depend on the overall benefits and costs of pesticide production, was not. Expanding the analysis to include these decisions would require additional information, including the benefits of these particular pesticides to farmers, relative to using other pesticides or no pesticides at all. These benefits may be reflected (at least partially) in the price of the pesticide, and thus be included in the company’s decision. Many of the decisions by Bayer in recent years have been of this type: deciding first to shut down the methomyl and carbofuran production lines, then later to stop MIC production altogether, along with the production of additional carbamate pesticides. Looking again at the four MIC manufacturing processes in light of consider-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 109 ations such as those discussed above, Bayer’s predecessors developed a table to help evaluate the trade-offs among the alternatives. Although this table provides a very useful starting point for a comparison of technologies, it excludes factors that may be important in the decision-making process, from the perspective of both the company and the community. For example, it does not include the vol- ume of onsite MIC storage required, the risk of an accidental release into the sur- rounding community (which is related to storage volumes), the purity of the resulting MIC, or the likelihood of facing a community lawsuit. The next chapter discusses one possible systematic framework for identifying the key attributes that must be included into this type of decision and for analyzing the trade-offs. CONCLUSIONS Several decisions regarding process safety were made over the years by the owners of the Institute, West Virginia plant. Most of these decisions involved add- ing safety protections to existing processes, rather than changes to the underlying process. Bayer and its predecessors evaluated trade-offs among the alterna- tives, but while analysis provides a very useful starting point for a comparison of technologies, it excludes factors that may be important in the decision, from the perspective of both the company and the community. The only major change in production process was in 1978 from chloroformate to isocyanate in the carbaryl production. For an ISP analysis that focused solely on MIC usage, this was going in the “wrong” direction, but increasing environmental concerns in the 1970s about the level of pollution by-products of the chloroformate process, relative to the isocyanate process, were the driving factor behind that decision. Depending on the extent of environmental damages caused by the pollution from the chloroformate process and the probability and magnitude of the damages from an accidental MIC release, the overall risks generated by carbaryl production at the Institute plant might well have been reduced by the change to using MIC. Decisions about the production processes at the Institute plant appear to have been driven by business conditions and external pressures, rather than resulting from an application of ISP analysis to the processes. A timeline of these decisions is provided in Appendix B. The earliest example in the data was the establishment of the Union Carbide Reactive Chemicals employee awareness training program and the Kanawha Valley Emergency Planning Committee, following explosions at the site in 1954 and 1955. The 1984 Bhopal accident led to expansion of the MIC destruction capacity and other safety enhancements. Restrictions on the shipment of MIC following Bhopal also led FMC to shift its production of carbofuran to the Institute plant. The 2008 methomyl accident and EPA regulatory decisions led Bayer to not restart the methomyl and carbofuran production lines, and the court injunction and other delays in restarting production eventually led Bayer to close down MIC production at Institute. The decisions at the Institute plant also demonstrate the importance of vari-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 110 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE ous barriers to change in existing production processes. On the cost side, there are investment costs for installing new production equipment and the uncertainty and learning costs associated with beginning a new process. In addition to these cost factors, a key factor in recent decisions at the Institute plant about their car- bamate pesticide production process was the requirement for EPA registration of pesticides. This gives a substantial advantage to incumbent production processes, since changing to a new production process for an existing product means a delay in production while the “new” version of the product is being approved by EPA—potentially losing customers as farmers switch to other products during one or more growing seasons. REFERENCES Aldy, J. E., and W. K. Viscusi. 2007. Age differences in the value of statistical life: Revealed prefer- ence evidence. Review of Environmental Economics and Policy. Vol. 1, Issue 2. Summer. Pp. 241-260. Bayer CropScience. 2009. Bayer Crop Science Announces Investment of $25 Million for Institute Site. Bayer News Release: August 26 [online]. Available: http://www.bayerus.com/News/News Detail.aspx?ID=586330BF-C83B-4EF3-93DBFF791373C7D7. Accessed: Feb 14, 2012. Boardman, A. E., D. H. Greenberg, A. R. Vining, and D. L. Weimer. 2010. Cost-Benefit Analysis: Concepts and Practice. 4th ed. Prentice-Hall. Carberry, J. 2011. Transition to Just-in-time Production of MIC. Presentation to the committee in Washington, DC. Carcia. P. F. et al. 1984. Catalytic Conversion of Formamides to Isocyanates. US Patent Number 4,469,640. Issued September 4. Carroll, A. B. 1999. Corporate social responsibility: Evolution of a definitional construct. Business and Society. Vol. 38. No. 3. September. Pp. 268-295. CSB (U.S. Chemical Safety and Hazard Investigation Board). 2011. Investigation Report: January 2011 Pesticide Chemical Runaway Reaction Pressure Vessel Explosion. Report No. 2008-08- I-WV [online]. Available: http://www.csb.gov/assets/document/Bayer_Report_Final.pdf. Ac- cessed: February 6, 2012. Dake, K. 1991. Orienting Dispositions in the Perception of Risk: An Analysis of Contemporary Worldviews and Cultural Biases. J. Cross-Cultural Psychol. 22:61-82. Elliott, M. 1984. Improving community acceptance of hazardous waste facilities through alternative systems for mitifating and managing risk. Hazardous Waste: A Journal for Technology, Health, Environmental and Policy Research 1(3):397-410. Elliott, M., and R. Hanke. 2003. Framing effect in toxic disputes: Cross-case analysis. Pp. 333-354 in Making Sense of Intractable Environmental Conflicts: Concepts and Cases, R. Lewicki, B. Gray, and M. Elliott, eds. Washington, DC: Island Press. EPA (U.S. Environmental Protection Agency). 2004. Carbaryl IRED Facts [online]. Available: http:// www.epa.gov/oppsrrd1/REDs/carbaryl_ired.pdf. Accessed: February 6, 2012. EPA. 2010. Agreement to Terminate All Uses of Aldicarb, October 2010 [online]. Available: http:// www.epa.gov/oppsrrd1/REDs/factsheets/aldicarb_fs.html. Accessed: Sept. 29, 2011. Giesselmann, G., K. Gunther, and W. aus der Funter. 1980. Process for the production of methyl isocyanate. U.S. Patent 4,206,136. Gray, B. 2003. Framing of environmental disputes. Pp. 11-34 in R. Lewicki, B. Gray, and M. Elliott (Eds.), Making Sense of Intractable Environmental Conflicts: Concepts and Cases. Washington, DC: Island Press.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. MIC AND PESTICIDE PRODUCTION AT THE INSTITUTE PLANT 111 International Council of Chemical Associations [online]. Available: http://www.icca-chem.org/en/ Home/Responsible-care/What-we-do/. Accessed: February 6, 2012. Kober, E., and T. Smith. 1968. Process for preparing isocyanates. United States Patent 3,366,662. Lewicki, R., B. Gray, and M. Elliott. 2003. Making Sense of Intractable Environmental Conflicts: Concepts and Cases. Washington, DC: Island Press. Martin, W. 2011. ECC Presentation to NAS. Presentation at the Second Meeting on Inherently Safer Chemical Processes. March 21-22, 2011. West Virginia State University. Peck, D. W. 1978. Technology Summary Report: Manufacture of Carbaryl. Memorandum. Nelson, G., “EPA Plans to Revisit a Touchy Topic—the Value of Saved Lives”. Greenwire.com. January 18, 2011. Nicholson, W. 2005. Microeconomic Theory: Basic Principles and Extensions. 9th Ed. South-Western. Pigou, A. C. 1948. The Economics of Welfare. 4th Ed. Macmillan and Co. Ltd. Porter, M. E., and M. R. Kramer. 2006. Strategy and society: The link between competitive advantage and corporate social responsibility. Harvard Business Review. December. Rao, V. N. M. et al., 1985. Multi-Stage Process with Adiabatic Reactors for the Preparation of Iso- cyanates. U.S. Patent Number 4,537,726. Issued: August 27, 1985. Rivetti, F., F. Mizia, G. Garone, and U. Romano. 1987. Process for the Production of N-Methylcar- bamates. U.S. Patent Number: 4,659,845. Issued: April 21, 1987. Romano, U., F. Rivetti, and G. Sasselli. 1984. Improved process for preparing alkyl isocyanates. European Patent Number: EP 0 125 726 A1. Issued: November 21, 1984. Smythe, S. 2011. An Evaluation of Alternate MIC Technologies. Presentation at the First Meeting on Inherently Safer Chemical Processes. February 9. Washington, DC. Starr, C. 1969. Social benefit versus technological risk. Science 165:1232. Starr, C. 1981. Risk criteria for nuclear power plants: A pragmatic proposal. Risk Anal. 1:113. Starr, C. 1985. Risk management assessment and acceptability. Risk Anal. 5:97. Wildavsky, A., and K. Dake. 1990. Theories of risk perception: Who fears what and why? Daedalus. 119:41-60.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 6 A Framework for Decision Making INTRODUCTION Chapter 5 presented four alternatives available to Bayer: (1) continuing with the existing process, (2) adopting an alternative chemical process not involving MIC, (3) using an alternative process for MIC production that would consume MIC immediately and thus not require storage, and (4) reducing the volume of stored MIC and the risks of transporting MIC from one facility within the site to another by rearranging process equipment. Table 6.1 summarizes how these four alterna- tives compare along several key performance features, or “attributes”, some of which were captured in Table 5.3 and some of which are additional attributes that could have been considered an analysis of trade-offs. An “X” indicates that the given manufacturing approach is superior to the others along the given attribute. As is clear from this comparison, none of the alternatives is superior to all the ­others along every attribute. For example, the Institute process, while posing higher risks due to the volume of MIC stored, generates less wastewater than the original non- MIC process used to produce carbaryl, and also has many cost advantages Given that no alternative clearly dominates the others, the question arises as to what decision-making framework could be used to identify the “best” choice. Benefit-cost analysis (BCA), as described in Chapter 5, assigns dollar values to the different attributes, based on their expected values, adds together all the ben- efits and costs for each alternative, then chooses the one with the highest net ­benefits. While Chapter 5 illustrated that valuing uncertain attributes can be diffi- cult in many cases, BCA has been used extensively for many years by government agencies, and certain conventions have been adopted (such as using the value of a statistical life to evaluate fatality risks) to deal with some common attributes. 113

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 114 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 6.1  Multiple Attribute Analysis of Alternative Carbamate Pesticide Production Processes (1)—Existing Institute Process (2)—Non-MIC Processes (3)—Process Producing Gaseous MIC Consumed Immediately (4)—Alternative MIC-based Process Arrangements, Reducing Onsite Storage Potentially Important Attributes External/Regulatory Pressures Manufacturing Approach (1) (2) (3) (4) Liability for harm to surrounding communities X X Community acceptance X ? Liability for worker injury due to MIC exposure X ? Liability for worker injury due to dust exposure X Wastewater disposal requirements X X Length of time for regulatory approval X Internal/Cost Pressures Product purity X X Cost and availability of chemical feedstocks X X Capital costs X Equipment O&M costs X Costs of safety equipment ? ? ? ? Process corrosivity X X Process yield X Availability of in-house expertise X X Previous experience with large-scale production X NOTE: “X” indicates that the given pesticide manufacturing approach performs better than the others along the given attribute. “?” indicates that information available to the committee was insufficient to evaluate the approach along the given attribute. The complex, multi-attribute decision-making Bayer and the legacy owners faced when modifying the MIC and carbamate-pesticide production processes is a challenge that will be familiar to many in the chemical industry. Incorporating risk considerations into these analyses can be particularly challenging as the final decision may affect individuals and organizations beyond the company itself, e.g., reducing or increasing requirements for local emergency responders. In fact, several experts in chemical engineering have suggested that the lack of effective methods for analyzing such trade-offs is a major barrier to the widespread use of inherently safer processes (ISP; Khan and Amyotte, 2004). With this in mind, the committee chose to present one possible approach for analyzing these and other trade-offs, while recognizing other methods are also possible.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 115 The alternative to BCA described in this chapter is multi-attribute utility theory (MAUT), one of a suite of methods—or decision aids—developed to assist with complex decision-making involving multiple stakeholders. MAU (described in more detail in the next section) keeps the attributes separate throughout the process and emphasizes the multi-dimensional nature of the decision process. The method recognizes explicitly that different people could assign different values to the different attributes—both in how strongly the person weights different attributes when making the final decision and possibly even in whether the attri- bute is considered to be positive or negative. By forcing the user to confront the multiple attributes and decide their relative importance, MAU may help clarify a difficult decision (or at least the difficult trade-offs involved). However, MAU is still a relatively unfamiliar process for most companies, which is a disadvantage when it comes to applying the method in real-world cases. MULTI-ATTRIBUTE UTILITY THEORY The need for trade-offs among conflicting objectives under uncertainty is pervasive in many decisions faced by businesses, government agencies, and other organizations. Decision scientists have conceived formal methods for balancing such trade-offs and have established mathematically that these methods yield the choice that maximizes the utility to the decision maker. Many approaches to multiple-criteria decision making are available from the fields of economics and decision analysis, including, for example, analytic hierarchy process (AHP) analysis and fuzzy set theory. Overviews of methods for multi-attribute or crite- ria decision analysis can be found in Belton and Stewart (2002), Figueira et al. (2005), and DeBrucker et al. (2012). There are strengths and weaknesses for each methodology, and these should be evaluated and understood by any user prior to application. MAU, one example of these analysis methods, assigns a numeric value (utility) representing a specific decision maker’s preferences to each of the (multi-attribute) outcomes of each choice under consideration. The discussion below illustrates how MAU could be employed in supporting decision making in the chemical manufacturing industry, while recognizing that the AHP, fuzzy set theory, and other decision-making frameworks also could be considered. MAU is not a new idea to the chemical community. In 1995, the Center for Chemical Process Safety (CCPS) published a book that suggested that MAU and other decision aids could be used to support process safety assessments (CCPS, 1995). However, these decision aids, although employed regularly in other busi- nesses, have yet to take hold in the chemical process industry. The CCPS’s obser- vation from its 1995 book remains true today: “Decision aids have been applied only to a very limited extent in risk decision problems in [the chemical process] industry.” The CCPS indicates key obstacles to adopting these tools include lack of familiarity with the tools among chemical process industry decision makers and fear that the methods are either too simple or too costly. Nonetheless, the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 116 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE committee believes that MAU and/or other techniques from decision analysis could prove highly valuable for strengthening the integration of safety concerns into decision making in the chemical process industry. Use of these techniques could benefit not only those at risk due to safety breaches but the industries themselves, as the techniques can lead to the identification of profitable safety solutions that otherwise may have been overlooked. These tools could also assist in strengthening the relationship between companies and communities by provid- ing a framework for requesting and receiving input from external stakeholders. Such input may help identify overlooked concerns or areas where additional com- munication and outreach could be beneficial for maintaining a safe environment and a positive relationship with the external stakeholders. This section first provides an overview of MAU theory and its use for analyz- ing trade-offs in complex decision problems under uncertainty. Then, it describes some limitations of the inherent safety indexes currently being used. Finally, it suggests an approach for employing MAU concepts in ISP assessments focused on improving the choice of chemical manufacturing process. However, as noted previously, MAU theory is not the sole method of approaching these difficult questions, although it is hoped that the discussion here will demonstrate the potential utility of these types of decision aids. Decision Sciences and MAU Models: Background The field of decision sciences emerged from the axioms of rational choice first posed by mathematician John von Neumann and economist Oskar ­Morgenstern in 1947. Von Neumann and Morgenstern proved that if an agent (decision maker) has preferences with four specific characteristics (completeness, transitivity, con- tinuity, and independence), then there must exist a mathematical equation known as a utility function such that the decision makers’ preferences can be captured by maximizing the equation’s expected value (von Neumann and ­Morgenstern, 1947; French, 1986). The utility function is usually designated as U(x), where x=(x1, . . ., xn) is a vector representing how well a particular decision option satisfies each of n attributes important to the decision maker. Because the utility function includes multiple attributes, it provides a framework to consider trade- offs among those attributes (for example, among cost, risk, and performance). Since von Neumann and Morgenstern published the axioms of rational util- ity, decision scientists have developed systematic methods for characterizing utility functions (see, e.g., Keeney and Raiffa, 1976; French, 1986; Raiffa et al., 2002). Many different mathematical forms for utility functions have been con- ceived. Each functional form makes certain assumptions about independence of and/or interactions among the conflicting objectives. For example, the simplest type of utility function is linear in all the attributes:

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 117

∑ ) ) ( (

…

= U x x kU x , , n i i i i n 1 1

(6.1) In this function, the Ui(xi) represents individual utility functions for each of the decision maker’s n objectives, and the ki represents weights assigned to the differ- ent objectives. These weights reflect the value to the decision maker of an option that offers the best possible outcome along objective i, while setting all other objectives at their worst possible values. For this type of utility function to accu- rately characterize preferences, certain strict independence conditions must hold (for details, see Clemen and Reilly, 2001, and other texts on decision theory). In essence, the decision makers’ preferences for one attribute cannot change as levels of some other attribute change, even if the outcomes along attributes are uncertain. Another type of utility function, requiring weaker independence condi- tions, is the multiplicative function, expressed as follows:

∏ ) ) ( ( +

…

+ kU x x kkU x 1 , , [ 1] n i i i 1

(6.2) Several textbooks explain in detail the methods for determining which func- tional form is appropriate for the decision situation at hand (e.g., Keeney and Raiffa, 1976; Bunn, 1984; Clemen and Reilly, 2001). Formal courses in decision analytic methods are offered in many business and engineering schools. In gen- eral, the methods involve the following steps: • Identifying the fundamental objectives of the decision makers and attri- butes that can be used to represent progress along each objective; • Eliciting individual utility functions for each attribute (the Ui(xi) in the above equations)—functions that may be linear, concave, or convex, depending on the decision makers’ risk tolerance; • Testing the attributes for independence to determine the appropriate func- tional form (e.g., linear, multiplicative, linear-multiplicative) for the MAU model; and • Eliciting the scaling constants (the k and ki in the above equations) for the multi-attribute function. The resulting MAU model will be specific to the decision makers upon whose values it is based, and as a practical matter, it may be difficult for the decision makers to identify their preferred attributes. Adding to the complexity, even if different interest groups can agree on the attributes that should be con- sidered in a decision, they may prefer different trade-offs among the attributes (e.g., willingness to trade cost savings for decreased health hazard) or have difficulty assigning values to the trade-offs, and they may exhibit different risk tolerances (willingness to gamble on outcomes with the potential for high payoff

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 118 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE but also high risks of loss). As a result, different utility functions (with different single-attribute utility functions and scaling constants) are needed to reflect the preferences of groups with different values. It is worth noting that some efforts to develop indexes for ISP assessments assume that there is a single correct pro- cess design from an inherent safety perspective. However, groups with disparate values may have differing utility functions that may lead to differences in the preferred manufacturing process. Although multiple MAU models may be needed to reflect different groups’ values, these models can be extremely useful in guiding negotiations among groups in conflict (Raiffa et al., 2002). As Clemen and Reilly (2001) point out, “Understanding trade-offs can be crucial for making progress in negotiation set- tings.” By making values explicit, MAU models can reveal similarities and differ- ences in the value structures of groups. As an example, MAU models can be used to identify trade-offs between risk reductions and cost reductions. Keeney and McDaniels (1992) show that a MAU function developed to inform strategic deci- sions of the British Columbia Hydro and Power Authority (BC Hydro) implies that the company decision makers value a hectare of wilderness lost at $2,500 (see Box 6.1). That is, at least $2.5 million in economic benefits would be needed to justify a company choice that would damage a thousand hectares of wilderness. Disagreements on certain features of a decision do not always result in different preferred alternatives. That is, a MAU process may reveal that groups in conflict might make similar choices in spite of their different values. When groups do differ in their preferred alternatives, a MAU model can highlight the main features of the decision about which groups disagree, and this may facilitate compromise. Raiffa et al. (2002) provides detailed guidance on the use of MAU models in negotiations among parties in conflict. Decision analytic methods are now widely employed in business and other applications, from fire department operations planning to nuclear power facility siting (Keeney and Raiffa, 1976; von Winterfeldt and Edwards, 1986; Keefer et al., 2004). The Decision Analysis Society, a specialty group within INFORMS (Institute for Operations Research and the Management Sciences), organizes regular conferences to exchange both academic and practical information on decision analysis and publishes a journal, entitled Decision Analysis. Keeney and Raiffa (1976) and von Winterfeldt and Edwards (1986), along with more recent issues of Decision Analysis, provide many more practical examples of applica- tions of MAU theory to decision making. The example provided in Box 6.2 shows that firms can “discover” new information about their preferences by using MAU—in this case, an alternative that was preferred in four out of five attributes turned out not to be the optimal choice, because of the high value the firm placed on the fifth attribute. Note that MAU provides a framework for making rational decisions; it does not necessarily describe how people actually make decisions. In fact, substantial research has indicated that individuals often do not act in accordance with the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 119 BOX 6.1 MAU Model Informs Strategic Decisions in the Hydropower Industry

The British Columbia Hydro and Power Authority (BC Hydro) has used MAU to inform strategic decisions since the late 1980s, when the company commissioned Ralph Keeney and Tim McDaniels to support a comprehensive reassessment of the company’s planning processes. Keeney and McDaniels constructed a MAU model that BC Hydro then used to support decisions related to capital equipment upgrades, supply planning, and other corporate strategic issues. Keeney and McDaniels (1992) and Clemen and Reilly (2001) summarize how the MAU model was developed and the values revealed by the model.

First, Keeney and McDaniels interviewed BC Hydro’s key decision makers to identify their objectives and sets of attributes for measuring progress toward those objectives. The result was the set of six funda­ mental objectives and 22 attributes for measuring performance shown in Table 6.2. Next, Keeney and McDaniels assessed a MAU function for combining all of these attributes into a summary measure of utility for the company. The result was a combination linear-multiplicative utility func­ tion (see Keeney and McDaniels, 1992). This function then was pro­ grammed into a spreadsheet to allow BC Hydro’s managers to assess the overall utility of various decision alternatives.

Keeney and McDaniels used the resulting MAU function to illustrate the dollar value, from the company’s perspective, of various attributes. For example, they showed that the value of a hectare of wilderness, from the company’s perspective, is equivalent to $2,500, so that any process change that would cause such a loss but produce less than $2,500 in expected gain would not be worthwhile. Similarly, they showed that two power outages per year of 2 hours duration each to 20,000 large (com­ mercial and industrial) customers was equivalent to $83 million. Keeney and McDaniels observed that “if BC Hydro had opportunities to reduce expected outages of that nature at a cost less than $83 million, those opportunities would be good investments from the utility’s perspective.”

After Keeney and McDaniels’ MAU decision support model was in place, BC Hydro’s Director of Strategic Planning commented, The structured set of objectives has influenced BC Hydro planning in many contexts. Two examples include our work to develop a decision framework for supply planning, and a case study of an investment to upgrade reliability. . . . Less obvious has been an evolution in how key senior planners view planning issues. The notion of a utility function over a range of objectives (rather than a single objective, like costs) is evident in many planning con­ texts. The specific trade-offs in the elicitation process are less important than the understanding that trade-offs are unavoidable in electricity utility decisions and that explicit, well-structured, informed trade-offs can be highly useful. (Keeney and McDaniels, 1992, p. 109, as quoted in Clemen and Reilly, 2001)

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 120 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 6.2  Fundamental Objectives and Attributes for Measuring Progress along Objectives Described in Hydropower Case Study in Box 6.1

1. Maximize contribution to economic development

Minimize cost of electricity use (mills per kilowatt-hour in 1989 Canadian dollars)

Maximize funds transferred to government (annualized dividend payable)

Minimize economic implications of resource losses (cost of resource losses in 1989 Canadian dollars)

Act consistently with the public’s environmental values

About local environmental impacts

To flora (hectares of mature forest lost)

To fauna (hectares of wildlife habitat lost of Spatzizi Plateau quality)

To wildlife ecosystems hectares of wilderness lost of the Stikine Valley quality)

To limit recreational use (hectares of high quality recreational land lost)

To aesthetics (annual person-years viewing high voltage transmission lines in quality terrain)

About global impacts (generation capacity in megawatts that results in “fossil fuel” pollution)

Minimize detrimental health and safety impacts

To the public

Mortality (public person-years of life lost)

Morbidity (public person-years of disability equal in severity to that causing employee lost work time)

To employees

Mortality (employee person-years of life lost)

Morbidity (employee person-years of lost work time)

Promote equitable business arrangements

Equitable pricing to different customers (constructed scale, see text)

Equitable compensation for concentrated local impacts (number of individuals that feel they are inequitably treated)

Maximize quality of service

To small customers

Minimize outages (expected number of annual outages to a small customer annually)

Minimize duration of outages (average hours of outage per outage to small customers)

To large customers

Minimize outages (expected number of annual outages to a large customer annually)

Minimize duration of outages (average hours of outage per outage to large customers)

Improve new service (elapsed time until new service is installed)

Improve response to telephone inquiries (time until human answers the telephone)

Be recognized as public service oriented (constructed scale, see text) SOURCE: Keeney and McDaniels, 1992.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 121 BOX 6.2 MAU Informs Materials Choices in the Automotive Industry

As an example of practical application of MAU to inform system de­ sign in industry, consider the example of choosing materials for automo­ bile frames and skins presented in Thurston (1990). Thurston designed a MAU model for use by a French automobile manufacturer working on long-range plans for its future vehicle fleets (those to be manufactured in the next 5-10 years). The company’s design engineers faced three ­options for vehicle frame-and-skin systems:

Traditional steel uni-body,

Internal steel frame with nonstructural external polymer composite skin, and

Steel and polymer composite frame with polymer composite skin.

The design engineers were perplexed about which material choice to pursue, because although steel could be produced with the lowest operating cost, it did not perform as well along other attributes (including durability and flexibility) as the other choices. Thurston, in describing this case study, noted, “When decision makers are faced with several alterna­ tive systems, each system may be represented as a bundle of seemingly incommensurate attributes. The best choice is not always clear.” In this case, the automotive company, with support from decision analysts, used a MAU model to help decide which of the three vehicle frame-and-skin systems maximized the utility to the company, given the need to trade-off cost and performance attributes.

Thurston interviewed the decision makers at the company (in this case, engineering materials design managers focused on long-term fleet planning) to determine which attributes were important in their decision. The decision makers identified five attributes:

Capital cost (billions of francs),

Operating cost (francs per vehicle),

Weight (kg),

Corrosion resistance (years of resistance to corrosion), and

Design flexibility (number of body styles possible per platform).

With the company’s engineers, Thurston then measured the perfor­ mance of each of the three materials options along these five attributes. Table 6.3 shows the results. continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 122 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

Next, through in-person and electronic surveys of the decision ­makers, Thurston determined an appropriate form for the MAU function—in this case, multiplicative: KU x Kk U x 1 1 i i i i n 1∏ ) ( ) ( ) (

+

+

Thurston then assessed the individual utility functions Ui(xi) for each of the five attributes, again through surveys of the decision makers, and the scaling constants ki for each utility function, as well as the overall scaling constant K. As an example, Figure 6.1 shows single-attribute utility functions for operating cost and flexibility in number of body types possible per platform.

As shown, these single-attribute functions convert the levels of each option along each attribute to a value between 0 and 1 that reflects the decision makers’ tolerance of risk. For example, the concave shapes of these utility functions show that the decision maker is risk averse in preferences for capital costs and flexibility, gaining more from initial incremental cost savings and design flexibility than from subsequent increments.

Figure 6.2 shows the resulting attribute scores and rankings of the three design alternatives. As shown, the steel frame with polymer com­ posite skin option has the highest utility. This result was counter-intuitive to the decision makers, since the polymer composite skin-and-frame option scored highest along four of the five attributes, including capital costs. However, the high variable costs of this latter system outweighed the benefits along the other four attributes. Thus if the decision makers TABLE 6.3  Alternative Automotive Frame-and-Skin Systems and Their Performance Along Key Attributes Design Capital Cost (Billion Francs) Operating Cost (Francs per Vehicle) Weight (Kilos) Design Flexibility (Number of Bodies per Platform) Corrosion Resistance (Years) Steel Uni-body 3 30 500 1 5 Steel Frame; PC Skin 2 40 425 5 15 Steel and PC Frame; PC Skin 1.5 45 350 5 15 SOURCE: Reproduced from Thurston, 1990. BOX 6.2 Continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 123 FIGURE 6.1  Single-attribute utility functions for cost and flexibility for the auto industry case study described in Box 6.2. Note that the dots represent points on the utility function assessed through structured interviews with the company’s decision makers. SOURCE: Thurston, 1990. continued

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 124 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE had chosen the option that seemed intuitively to be the right choice, this decision would not have accurately reflected their true preferences. BOX 6.2 Continued FIGURE 6.2  Attribute levels and final rankings of the alternative auto frame- and-skin designs discussed in Box 6.2. SOURCE: Thurston, 1990. tenets of rational decision theory (Kahneman et al., 1982). Decision analysis, by providing a framework for the decision process, can help overcome the well- known human cognitive limitations that can lead to less-than-optimal decision- making (Clemen and Reilly, 2001). It is also important to recognize that, as with any modeling system, the quality of the data used in the analysis is critical, and care must be taken to ensure that the inputs collected from the various stakeholder communities—utility values for MAU—accurately represent their views. Limitations of Existing Inherent Safety Indexes Chemical engineers in the field of ISP design have conceived a number of summary indexes intended to capture the trade-offs in objectives embodied by

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 125 different design options. Examples include the integrated inherent safety index (I2SI) and a set of European Union (EU) indexes known as the INSET Toolkit. (For descriptions of these methods, see Chapter 4 and Khan and Amyotte, 2004.) When considered from a formal decision analysis perspective, these indexes have a number of limitations, both theoretical and practical. The main theoreti- cal weakness is that the indexes were not designed to follow the von Neumann- Morgenstern model of rational choice, so there is no guarantee that the index value for a given manufacturing process will be able to reflect a given decision maker’s actual preferences and attitudes toward risk. Perhaps more importantly, these indexes—in contrast to a MAU approach—do not allow for the possibility of multiple decision makers with different preferences. As an example, consider the I2SI index (Khan and Amyotte, 2004). This index is intended to combine assessments of multiple inherent safety attributes into a single numeric value. The equation for computing this index is:

I SI ISI PHCI HI PHCI 2 alt alt base

base

(6.3) where ISIalt, PHCIalt, HIbase, and PHCIbase are all subindexes computed as func- tions of various process design attributes. For each manufacturing process con- sidered, the ratio HIbase/PHCIbase is the same, so that when comparing multiple alternatives the above equation reduces to:

I SI c ISI PHCI c Min ISI PHCI 2 {200, } alt alt i i j j 2 1 5 1 10 ∑

∑

×

×

=

(6.4) where c is a constant and the summation terms in the equation represent the attri- butes listed in Table 6.4. The values for the summation terms are determined from a combination of subjective judgments about the degree to which each process unit satisfies the principles of ISP. An index such as the I2SI provides a single calculation that cannot be adjusted to reflect the variation in preferences among attributes and willingness to tolerate risk that different constituencies may exhibit. For example, a company owner may be willing to tolerate a small risk of a spill that could have health effects in the community if the alternative involved a much higher risk of a fire that would seriously damage the facility, whereas members of the community may not accept such a trade-off, and employees of the firm (who place some value on keeping the facility intact in order to retain their jobs) may prefer something in between the owner and the community. In addition to putting different weights

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 126 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 6.4  Attributes Included in the I2SI (Equation 6.4) Attribute Category : Adherence to principles of inherently safer design Attribute Description Representation in I2SI Equations Extent to which process minimizes use of hazardous materials ISI1 = ISIm Extent to which process substitutes safer materials for more hazardous ones ISI2 = ISIsu Extent to which process attenuates risks by operating under safer conditions (e.g., room temperature and pressure) ISI3 = ISIa Extent to which process simplifies manufacturing (e.g., by avoidance of multiproduct or multiunit operations or congested pipe or unit settings) ISI4 = ISIsi Extent to which process limits potential negative consequences of out-of- normal operations (e.g., by unit segregation) ISI5 = ISIl Attribute Category : Need for add-on processes to control hazards Attribute Description Representation in I2SI Equations Pressure control required PHCI1 = PHCIp Temperature control required PHCI2 = PHCIt Flow control required PHCI3 = PHCIf Level control required PHCI4 = PHCIl Concentration control necessary PHCI5 = PHCIc Inert venting necessary PHCI6 = PHCIiv Blast wall needed PHCI7 = PHCIbw Fire resistance wall needed PHCI8 = PHCIfr Sprinkler system necessary PHCI9 = PHCIs Forced dilution needed PHCI10 = PHCId on different attributes, a MAU model can reflect differences in risk tolerances in the form of the utility function: linear functions represent risk neutrality; concave functions represent a preference for gambling on high risks that have potentially high payoffs; and convex functions represent risk aversion (for details, see Cle- men and Reilly, 2001). The existing indexes are the proverbial black box: input a set of numbers based on the process being evaluated, and the index produces a single value for each alternative, which is then used to rank the different alternatives and identify the optimal decision. All of the trade-offs, uncertainties, and risk tolerances are hidden from view because they are implicitly assumed in the underlying calcula- tions, rather than explicitly chosen parameters. Because these indexes implicitly assume one value structure, the effects of alternative value structures on the pref- erence ordering of the alternatives cannot be assessed. Indeed, because the trade- offs in the index are completely opaque (to the analysts as well as to ­others), it is unlikely that companies will be able to use such indexes to build trust within the communities in which their facilities are located. A more transparent approach,

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 127 that is, one that makes the trade-offs in attributes and risk tolerances explicit, is needed if the outcomes of ISP assessments are to be widely embraced. EMPLOYING MAU MODELS IN ISP ASSESSMENTS The existing inherent safety indexes could serve as a starting point for building MAU functions to inform process design choices, with inherent safety in mind. For ISP design, fundamental objectives have been described as elimi- nation, minimization, substitution, moderation, and simplification. The indexes provide useful starting points for constructing MAU functions in that they identify a number of the attributes by which progress along these fundamental objectives could be measured. For example, the attributes in the I2SI include costs associated with any damage that might occur due to a safety breach and costs associated with a process control option under consideration. Other attributes that could be included might be the number of fatalities that could occur in an accident and the potential loss of community goodwill (which can lead to additional costs for the company in its future decision-making). CCPS (1996), mentioned at the beginning of this chapter, provides an illustration of the use of MAU to choose a process control device for a hypothetical chemical distillation column. EMPLOYING MAU MODELS AT BAYER CROPSCIENCE MAU and ISP decision-making tools could have been used to inform manu- facturing process design choices at numerous points in the history of the Institute pesticide plant, starting with the introduction of MIC to the site in 1978. As noted in Chapter 5, changes to the production process made at the Institute facility were generally considered in response to business conditions or external pressures, without explicit consideration of ISP principles. Several of these decision points could have provided opportunities to introduce MAU approaches, which would have recognized the multi-attribute nature of the decision and the differences in preferences between the firm and the community, perhaps resulting in a decision- making process that would have been more acceptable to the community. That, in turn, might have allowed production to continue at the plant in some form. Chapter 5 mentions the 1984 Bhopal accident and the 2008 methomyl acci- dent as significant opportunities for broadening the approach to decision making at Institute. Other opportunities arose when the plant changed ownership. Choices that better accounted for the multiple costs and benefits involved—including the costs associated with risks imposed on the community—could have prevented the types of accident risks that persisted until the use of MIC ceased at the site. Without such a multi-attribute decision framework in place, the decisions at the Institute site seem to have focused on production costs and the business risk of interrupting the flow of product to the market, which resulted in the decision to

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 128 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE continue with the same basic production process with some modifications rather than adopting an entirely new approach. This bias in favor of an existing production process is not surprising and may even reflect the optimal decision, especially from the company’s point of view. “Steel in the ground” is a powerful motivator. It avoids the up-front capital costs of a new process, along with any uncertainties about how well the process will operate or what its operating cost will be. Critically and objectively reviewing a process that has been in operation for many years can be difficult for those work- ing at a chemical production facility. For example, from a practical standpoint, it is likely that, over time, a given process will have been modified from its initial design. Minor changes in procedures, modifications to existing equipment, and the effect of age and maintenance on the system must be taken into account dur- ing the trade-off analysis. This may be challenging if, due to staffing changes or insufficient documentation, the modifications from the initial design have not been recorded. In addition, alternative processes may always seem “hypothetical,” and concerns about risks expressed by community members may be ascribed to their lack of understanding of the process and its many layers of safety protec- tions. These factors make it difficult to apply MAU (and ISP) analyses to exist- ing plants in ways that can really identify promising alternatives to the existing process. Implementing a structured, multi-attribute decision process such as MAU analysis may be easier when designing a new production process or an entirely new facility. In such cases, no incumbent process has an advantage in terms of capital costs or production uncertainties, since all the alternative processes are new and hence hypothetical. In addition, the company may be involved in negoti- ations with regulators—who, in turn, are considering the concerns of community groups—in order to obtain an operating permit, so the need to address concerns held by those outside the facility will be more salient. During these initial inter- actions between the facility and its neighbors, a MAU analysis could serve to educate community members about the trade-offs between risks and economic considerations of importance to the company, while informing the company of the community’s concerns about different types of production risks. However, conducting a MAU analysis for the MIC issue would not neces- sarily have resulted in different decisions by the companies owning the Institute plant. Especially using the company’s own valuation on the multiple attributes of the alternatives, continuing with the existing MIC process might well have seemed optimal. The advantage that would be gained from using multi-criteria analysis is that the company would have explicitly identified the most important attributes of the alternative processes and assigned a valuation to those attributes. Using MAU could also have provided a calculation into which the preferences of others (e.g., community members) could easily be incorporated.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. A FRAMEWORK FOR DECISION MAKING 129 CONCLUSIONS No one carbamate pesticide production process dominates all the ­others along every attribute that owners of the Institute site considered or could have consid- ered. However, given the necessary trade-offs, a decision-analysis approach, such as MAU, could have helped the various plant owners consider all aspects of their choices. A decision analysis approach might also have facilitated the communi- cation process between the company and the surrounding community, allowing the two groups to compare their preferences regarding the decision attributes and their potentially differing tolerances and attitudes toward risk. Although the CCPS has advocated for the development of such an approach since 1995, it has not become institutionalized in the chemical process industry. A new decision- making framework, incorporating some of the work done to develop exist- ing ISP indexes but also allowing explicit consideration of differences in decision makers’ preferences across multiple attributes, could assist in the incorporation of ISP considerations into decision making in the chemical manufacturing industry and communication of those considerations to a concerned public. Design decisions cannot be strictly objective with regards to ISP as these choices will always require trade-offs among attributes and varying levels of risk; different individuals or constituencies may have different value systems and thus make different trade-offs. However, a new decision framework could support incorporation of the attributes in existing indexes, while adhering, and drawing benefit from, the mathematics of multi-attribute or -criteria decision analysis. The committee recommends that the Chemical Safety Board or other appropriate entity convene a working group to chart a plan for incorporat- ing decision theory frameworks into ISP assessments. The working group should include experts in chemical engineering, ISP design, decision sciences, negotiations, and other relevant disciplines. The working group should iden- tify obstacles to employing methods from the decision sciences in process safety assessments. It should identify options for tailoring these methods to the chemical process industry and incentives that would encourage their use. REFERENCES Belton, V.,and T. S. Stewart. 2002. Multiple Criteria Decision Analysis: An Integrated Approach. Norwell: Klumber Academic Publishers. Bunn, D. W. 1984. Applied Decision Analysis. New York: McGraw-Hill. CCPS (Center for Chemical Process Safety). 1995. Tools for Making Acute Risk Decisions with Chemical Process Safety Applications. New York: American Institute of Chemical Engineers. Clemen, R. T., and T. Reilly. 2001. Making Hard Decisions with Decision Tools. Belmont, CA: Duxbury Press. DeBrucker, K., Macharis, C., and A. Verbeke. 2012. Multi-criteria analysis and the resolution of sustainable development dilemmas: a stakeholder management approach. European Jounral of Operational Research. Available online.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 130 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Figueira, J., S. Greco, and M. Ehrgott. 2005. Multiple Criteria Decision Analysis: State of the Art Surveys. New York: Springer Science and Business Media, Inc. French, S. 1986. Decision Theory: An Introduction to the Mathematics of Rationality. Chichester: Ellis Horwood. Kahneman, D., P. Slovic, and A. Tversky. 1982. Judgment Uner Uncertainty: Heuristics and Biases. Cambridge, UK: Cambridge University Press. Keefer, D. L., C. W. Kirkwood, and J. L. Corner. 2004. Perspective on decision analysis applications, 1990-2001. Decision Anal. 1(1):4-22. Keeney, R., and T. McDaniels. 1992. Value-focused thinking about strategic decisions at BC. Hydro. Interfaces 22(6):94-109. Keeney, R., and H. Raiffa. 1976. Decisions with Multiple Objectives: Preferences and Value Tradeoffs. New York: Wiley. Khan, F. I., and P. R. Amyotte. 2004. Integrated Inherent Safety Index (I2SI): A tool for inherent safety evaluation. Process Saf. Prog. 23(2):136-148. Raiffa, H., J. Richardson, and D. Metcalfe. 2002. Negotiation Analysis: The Science and Art of Col- laborative Decision Making. Boston: Belknap Harvard. Thurston, D. L. 1990. Multiattribute utility analysis in design management. IEEE Trans. Eng. Man- age. 37(4):296-301. von Neumann, J., and O. Morgenstern. 1947. Theory of Games and Economic Behavior, 2nd Ed. Princeton, NJ: Princeton University Press. von Winterfeldt, D., and W. Edwards. 1986. Decision Analysis and Behavioral Research. Cambridge, UK: Cambridge University Press.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 7 Process Safety Management at Bayer CropScience 131 All safety assessments and practices exist within the context of an organiza- tion, and as a result, the environment in which a company operates and the safety culture that it fosters within its walls affect the efficacy of any hazard control system. This chapter presents process safety management (PSM) from both a general perspective and with specific reference to the system implemented at Bayer CropScience (Bayer) and considers the context in which this system oper- ates in Institute, WV. This chapter also addresses Bayer’s use of inherently safer process (ISP) assessments conducted by Bayer within their PSM system, as well as the context in which these assessments were considered. PSM—GENERAL CONSIDERATIONS PSM is a concept well familiar to the global chemical engineering community. These PSM systems, described in Chapter 4, are conceptual and management frameworks developed to aid in the control of hazards on site. The components of any given PSM system may vary somewhat between countries and organiza- tions, but the fundamental structures remain similar. These systems make explicit the understanding that controlling a hazard—whether physical, toxic, electrical, etc.—requires a sociotechnical system, and therefore, requires engagement at all levels of an organization. For example, if ventilation is required to maintain a safe environment, purchase of the equipment required to provide that ventilation is only one piece of the sociotechnical system. There must also be adequate training of personnel so that they know how and when to use the equipment, monitoring of the equipment’s performance and employee’s compliance with safety protocols, emergency response protocols in case the equipment fails, periodic auditing of the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 132 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE protocols regarding ventilation by management to proactively identify and address any emerging concerns or new understandings about the risk posed by a given material, etc. These systems have been developed in response to the knowledge that once a hazard and its risks are brought into an environment, the risk “remains, waiting for an opportunity to happen unless the management system is actively monitoring company operations for concerns and taking proactive actions to cor- rect potential problems” (Amyotte et al., 2007). Having an effective management system for process-related hazards—fire, explosion, and toxic release—is therefore considered by many in the chemical process industries to be a critical corporate objective. Formally, PSM is defined as the application of management principles to the identification, understanding, and control of process hazards to prevent process-related incidents OSHA’s PSM standard, 29 CFR § 1910.119. Various approaches exist for PSM. One example is the 1989 system developed by the Center for Chemical Process Safety (CCPS, 1989), which served as the basis for a 12-element system recommended by the Canadian Society for Chemical Engineering (CSChE, 2002). More recently, the CCPS has developed guidance on a 20-element, risk-based approach to managing process safety (CCPS, 2007); see Table 7.1. Within the United States, OSHA administers Process Safety Management of Highly Hazardous Chemicals standard 29 CFR § 1910.119, which defines requirements for handling of those materials. It consists of 16 elements, 14 of which are mandatory. PSM AT BAYER CROPSCIENCE As most companies do, Bayer CropScience has its own PSM system. ­Bayer’s 14-element system is shown in Table 7.2, with noted similarities between this system and the CCPS-developed listing in Table 7.1. For this discussion, Bayer’s element 4, Process hazard analysis, is most relevant. This analysis consists of the following steps (Patrick Ragan, Bayer CropScience unpublished material, August 8, 2011):

1. Hazard identification (using a variety of methods including preliminary

safety analysis; hazard and operability study (HAZOP); what-if review; check- list review; what-if/checklist review; fault tree analysis; event tree analysis; and failure modes, effects and criticality analysis (FMECA);

1. Severity determination;
2. Probability determination;
3. Risk assessment (using a risk matrix); and
4. Risk management (including application of risk reduction measures).

Within step five, the list of preventive safety measures given includes pas- sive, active, and procedural measures for hazard control, but there is no specific requirement to consider ISP measures.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. PROCESS SAFETY MANAGEMENT AT BAYER CROPSCIENCE 133 TABLE 7.1  Risk-Based Process Safety Management System Accident Prevention Pillar Risk-Based Process Safety Element Commit to process safety Process safety culture Compliance with Standards Process safety competency Workforce involvement Stakeholder outreach Understand hazards and risk Process knowledge management Hazard identification and risk analysis Manage risk Operating procedures Safe work practices Asset integrity and reliability Contractor management Training and performance assurance Management of change Operational readiness Conduct of operations Emergency management Learn from experience Incident investigation Measurement and metrics Auditing Management review and continuous improvement SOURCE: Adapted from CCPS (2007). TABLE 7.2  Bayer CropScience System for PSM of Hazardous Chemicals Focus Element Commitment

1. Leadership and culture
2. Employee participation

Understanding risk

1. Process safety information
2. Process hazard analysis

Managing risk

1. Operating procedures
2. Training
3. Contractors
4. Pre-Startup safety review
5. Mechanical integrity
6. Safe work practices
7. Management of change

Response and corrective action

1. Incident investigation
2. Emergency planning and response
3. Compliance audits

SOURCE: Provided by Patrick Ragan, Bayer CropScience, on August 8, 2011.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 134 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE ISP ASSESSMENTS AT BAYER CROPSCIENCE Although claimed to be an integral PSM component, inherent safety considerations are incorporated into Bayer’s PSM efforts in an implicit man- ner that is dependent on the knowledge base of the individual facilitating the particular activity (e.g., process hazard analysis or PHA). Although an implicit system of ISP incorporation does not mean an absence of a commitment to inherent safety, it does mean that the commitment is not visible to the extent that could be considered desirable. The disadvantage of an implicit system of ISP is corporate memory. The extensive work of Professor Trevor Kletz over several decades of process safety research, practice and writing has clearly demonstrated that organizations do not generally have a long-term memory—at least not a memory longer than about 10 years. Corporate memory resides with individuals, and individuals retire, resign, or otherwise move on to other opportunities. While acknowledging the value of individual memory and active sharing of information between employees, if ISP consideration requirements are not explicitly recorded within the suite of PSM documentation, then such requirements may be forgotten or potentially ignored. It would be beneficial for Bayer to formally incorporate ISP assessment into the company’s PSM system and training and to record such assessments as part of its audit and review processes. Doing so would provide regular opportunities to update the assessment protocols in light of any new developments in the area. As mentioned in Chapter 4, descriptions on how ISP considerations can be incorporated into all elements of a PSM system are available. These include spe- cific suggestions for training initiatives using the various ISP resources. Recom- mendations are also given regarding compliance audits related to identification and implementation of ISP. Both of these elements (training and audits) would seem particularly relevant to the case of Bayer CropScience and the Institute facility. Documented training of personnel with respect to the concept of inher- ent safety, for example, would contribute to creating and maintaining a consistent level of knowledge within the organization and formalize corporate memory in this area. In the course of reviewing the materials provided by Bayer CropScience regarding the alternatives assessment performed by Bayer and the previous ­owners of the facility and the design of the post-2008 facility redesign, it was clear that safety considerations did come into play in the analysis. However, the focus of the alternatives assessments and the redesign was primarily directed toward managing the hazard rather than eliminating or reducing it, which is con- sistent with the focus on passive, active, and procedural controls within the PSM. Appendix B provides a detailed history of process changes that occurred at the Institute facility, and points where ISP-type decisions were made are highlighted. A summary of specific examples of the process changes that occurred are listed in Box 7.1. For example, every time a significant reduction of MIC inventory

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. PROCESS SAFETY MANAGEMENT AT BAYER CROPSCIENCE 135 BOX 7.1 Summary of Process Design Changes with Implications for Safety at the Institute Facility Consistent with ISP Principles • Union Carbide Company (UCC) practiced principles of sustainability in 1978 when it switched from the chloroformate process to the ­isocyanate process for carbaryl production achieving higher yields, less waste, less corrosion, and less environmental impact. • UCC practiced passive and active safety strategies in 1978 and 1985 in the design of the MIC process featuring refrigerated underground stor­ age, emergency scrubbers, and emergency flares. • UCC followed ISP principles in its search for alternative chemistries to MIC prior to 1985. • UCC followed ISP principles in its focus on less hazardous MIC- adducts in 1986 (for remote production to avoid aldisol transportation). • Rhône-Poulenc practiced passive and active safety strategies in 1988 with MIC incinerator and carbaryl reliability optimization, and ISP prin­ ciples with MIC downsizing measures (Project MN). • Rhône-Poulenc followed ISP principles in 1989 to 1991 in the evalua­ tion and design of Enichem phenylmethylcarbamate process with cracking at remote (Project MS) or at four individual carbamate plants in Institute, eliminating MIC storage and transport and reducing total MIC inventory for all carbamate production to a few hundred pounds. However, this process was not implemented. • Rhône-Poulenc practiced passive and active safety strategies in its 1993 Institute Modification Project. • The Rhône-Poulenc 1994 Risk Management Plan contains passive, active, and mostly procedural safety elements. • Bayer followed ISP principles in modeling and analyzing the opera­ tional impacts of reducing MIC inventory. • Bayer MIC Unit Layers of Protection strategy contains mostly passive and active and some inherent safety elements. • Bayer (Project MINEXT) practiced ISP in 2010 by closing the West Carbamoylation Center and by reducing carbamate production to two products and reducing MIC inventory by 80 percent, and practiced pas­ sive and active safety strategies by eliminating aboveground storage, and using double-walled construction, steam-ammonia curtains, and other measures. • Bayer followed ISP principles in 2010 by evaluating alternative chem­ istries for the production and use of gaseous (instead of liquid) MIC, including chemistries avoiding the use of phosgene (although none was evaluated to be competitive or timely in the present business environment). • Bayer also followed ISP principles in 2010 by substituting a non­ reactive material for brine in the MIC storage tank refrigeration systems.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 136 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE occurred, one aspect of the philosophy of ISP (reduction) was implemented, even if that term was not used. Since ISP was not a formal consideration for the facility’s owners, the committee finds that the managers of the facility in Institute missed opportuni- ties to perform full safety assessments. Bayer CropScience did perform PSM assessments, however, Bayer and the legacy companies did not perform systematic and complete ISP assessments on the process for manufacturing MIC or the processes used to manufacture pesticides at the Institute site. Bayer and the previous owners performed various hazard and safety assess- ments and made certain business decisions that resulted in MIC inventory reduction, elimination of aboveground MIC storage, and adoption of various passive, active, and procedural safety measures. However, these assessments did not incorporate, in an explicit and structured manner, the principles of minimization, substitution, moderation, and simplification. The legacy owners identified possible alternative methods that could have resulted in a reduction in MIC production and inventory, but determined that limita- tions of technology, product purity, cost, and other issues prohibited their implementation. ISP ASSESSMENTS—EXTERNAL CONTEXT Because Bayer implicitly uses ISP practices and principles within their PSM system (e.g., reducing inventory of MIC and acknowledging the safety benefit drawn from that), it is a useful exercise to consider what incentives could exist for the explicit incorporation of ISP assessments into the PSM system. Indeed, within the industry broadly, there are barriers to the formal consideration of ISP including the perception that inherent safety is impractical, or costly, that there is a lack of institutional infrastructure and frameworks for evaluating inherently safer processes, and a lack of standards and guidance measures for existing opera- tions (CCPS, 2008). The purpose of this section of the report is not to endorse one method or another for encouraging the adoption of ISP. Rather it is to provide a brief overview of possible drivers and barriers to formal, explicit consideration of ISP by a company. One possible mechanism for overcoming these barriers is through profes- sional standards within the field of chemical engineering. Inherently safer pro- cess assessments are a valuable component of process safety management. However, as noted in Chapter 4, at this time the view of what constitutes an inherently safer process varies among professionals, so the chemical industry lacks a common understanding and set of practice protocols for identifying safer processes. Externally, industry standards could affect the formal incorporation of ISP into PSM. It is clear that companies look to professional organizations, such as CCPS, for guidance on these issues. Alternatively, were ISP to be incorporated

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. PROCESS SAFETY MANAGEMENT AT BAYER CROPSCIENCE 137 into the standards of the American Chemistry Council Responsible Care Pro- gram, for example, it would likely encourage adoption of ISP concepts into PSM methodologies. Of course, regulatory policy could drive companies’ adoption of ISP ­analyses. In Chapter 4, Box 4.1 presented definitions of ISP, including two drawn from regu- latory policy initiatives within the United States that require consideration of ISP. In reviewing those policies, it is clear that the link between ISP strategies and the framework set down by cleaner production and pollution prevention regulations is seen as a starting place for considering the role of ISP in context (Zwetsloot and Ashford, 2003). It is important to remember, however, that the effective implemen- tation of ISP relies on the awareness of the professional, technical community, and studies (Wilson et al., 2008; Copsey, 2010) have highlighted the need to improve links between workforce preparation and industry knowledge of inherently safer strategies for risk reduction. In the United States, companies are required to have PSM systems in place for handling of highly hazardous chemicals. However, the elements of OSHA’s PSM (29 CFR § 1910.119) standard do not require any explicit consideration of ISP. Rather the requirements accept the presence of a hazard, and the risks that may come with its use, and are thus directed to the tiers of the PSM hierarchy geared toward control and management of the hazard and its risk rather than elimination of the hazard itself. The PSM elements required by OSHA were presented in detail in Chapter 2 and are listed in Table 7.3. The U.S. Environmental Protection Agency (EPA) policy has considered the possibility of inherent safety at least since the early 2000s, but measures regarding chemical accident prevention have tended to focus on prior planning and “inspection and . . . corrective and preventive maintenance.” (Ashford and ­Zwetsloot, 1999). Therefore, the concept of safety planning is far from new, but TABLE 7.3  Fourteen Required Elements of OSHA’s PSM Standard • Process safety information, • Process hazard analysis, • Operating procedures, • Employee participation, • Training, • Contractors, • Pre-startup safety review, • Mechanical integrity, • Hot work, • Management of change, • Incident investigation, • Emergency planning and response, • Compliance audits, and • Trade secrets.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 138 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE the far-reaching ramifications of ISP appear to require a greater degree of plan- ning and technological investment than do traditional safety strategies that tend to be “failsafe” rather than “foolproof.” (Ashford and Zwetsloot, 1999). The difficulties of implementing ISP also can be observed in the EPA Risk Management Program (RMP) (EPA, 2001), which is still intentionally more oriented to risk management than risk prevention (Malloy, 2008), and as a policy matter does not mandate ISP. Nevertheless, companies dealing with hazardous chemicals must develop accident prevention plans during hazard emergency response planning, but this policy does not extensively involve stakeholders out- side of firms (CCPS, 2009). Other pertinent regulations and laws include the Pollution Prevention Act (PPA), which is not primarily directed at accidents (Ashford and Caldhart, 2010), and the Department of Homeland Security’s Chemical Facility Anti-Terrorism Standards (CFATS) (Malloy, 2008). The post-September 11 approach is particu- larly amenable to ISP (CCPS, 2009), because the unpredictable nature of terror- ist attacks may create challenges for traditional assessments based on internal production risks. However, regulatory bodies have tended to conclude that ISP shift rather than prevent risks (Malloy, 2008). This is an important critique that warrants further research, because of the possibility that inherently safer technol- ogy may lead to the reallocating of risk to other areas of the production process (Hendershot, 2010). The previous paragraphs were a brief overview of the policy context for ISP. More information, including international initiatives, can be found in Appendix D. Finally, in regard to the perception of cost barriers to ISP, it is important to recognize that for most established manufacturing processes, the materials in use, whether hazardous or not, are cost competitive, and shifts to lower risk technol- ogy or process design can involve costs and uncertainties for companies (CCPS 2009). This being the case, these cost issues, and/or the perception of them, present a major practical barrier for industry to adopting safer processes (­Malloy, 2008). However, greater production stability associated with inherently safer technology may lead to “greater reliability of production” and operations econo- mies (Ashford and Zwetsloot, 1999; Malloy, 2008), which, if applicable, can be seen as an overall benefit to the company. As discussed earlier in this report, however, the costs associated with redesigning an existing facility mean that the barriers posed by these costs will be much lower when incorporated into an initial design or as part of a planned, significant modification of an existing site.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. PROCESS SAFETY MANAGEMENT AT BAYER CROPSCIENCE 139 REFERENCES Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2006. Incorporation of inherent safety principles in process safety management. Pp. 175-207 in 21st Annual Center for Chemical Process Safety International Conference on Process Safety Challenges in a Global Economy. New York: American Institute of Chemical Engineers. Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2007. Incorporation of inherent safety principles in process safety management. Process Saf. Prog. 26(4):333-346. Ashford, N., and C. Caldhart. 2010. Government regulation of environmental and occupational health and safety in the United States and the European Union. Chapter 30 in Occupational and Envi- ronmental Health: Recognizing and Preventing Disease and Injury, 6th Ed., B. S. Levy, D. H. Wegman, R. Sokas, and S. Baron, eds. Oxford, UK: Oxford University Press [online]. Available: http://hdl.handle.net/1721.1/55358 or from http://18.7.29.232/bitstream/handle/1721.1/55358/ Chapter-30%20_GovRegOfEnvl%26OccH_9Feb10.pdf?sequence=1. Ashford, N., and G. Zwetsloot. 1999. Encouraging inherently safer production in European firms: A report for the field. J. Hazard. Mater. 78:123-144 [online]. Available: http://dspace.mit.edu/ bitstream/handle/1721.1/1582/ISPRA.pdf?sequence=1. CCPS (Center for Chemical Process Safety). 1989. Guidelines for Technical Management of Chemical Process Safety. New York: American Institute of Chemical Engineers CCPS. CCPS. 2007. Guidelines for Risk Based Process Safety. Hoboken, NJ: John Wiley & Sons. CCPS. 2008. Guidelines for Hazard Evaluation Procedures, 3rd Ed. Hoboken, NJ: John Wiley & Sons. CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd Ed. Hoboken, NJ: John Wiley & Sons. Copsey, S., ed. 2010. Mainstreaming Occupational Safety and Health into University Education. Luxembourg: European Agency for Safety and Health at Work, Publications Office of the Euro- pean Union [online]. Available: http://osha.europa.eu/en/publications/reports/mainstream_osh_ university_education. Accessed: Oct. 3, 2011. CSChE (Canadian Society for Chemical Engineering). 2002. Process Safety Management, 3rd Ed. Ottawa, ON: Canadian Society for Chemical Engineering. EPA (U.S. Environmental Protection Agency). 2001. Hazardous Materials Emergency Planning Guide. NRT 1. National Response Team, U.S. Environmental Protection Agency. July 2001 [online]. Available: http://www.epa.gov/oem/docs/chem/cleanNRT10_12_distiller_complete. pdf. Accessed: Oct. 3, 2011. Hendershot, D. C. 2010. A summary of inherently safer technology. Process Saf. Prog. 28(4):389-392. Malloy, T. F. 2008. Of natmats, terrorism, and toxics: Regulatory adaptation in a changing world. UCLA J. Environ. Law & Policy. 26(1):97-127. OSHA (Occupational Safety and Administration). 1992. Process Safety Management 29 CFR 1910.119. Wilson, M. P., M. R. Schwarzman, T. F. Malloy, E. W. Fanning, and P. J. Sinsheimer. 2008. Green Chemistry: Cornerstone to a Sustainable California. University of California, Berkeley [on- line]. Available: http://coeh.berkeley.edu/greenchemistry/briefing/ or www.coeh.ucla.edu/green chemistry.htm. Zwetsloot, G., and N. Ashford. 2003. The feasibility of encouraging inherently safer production in industrial firms. Saf. Sci. 14(2/3):219-240 [online]. Available: http://dspace.mit.edu/bitstream/ handle/1721.1/1581/Feasibility.pdf?sequence=1.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 8 Post-Incident Retrospective Process Assessment Part 3.5 of this study’s statement of task was to “[c]omment, if possible, on whether and how inherently safer process assessments can be utilized during post-incident investigations.” Unlike the preceding chapter, this portion of the task looks beyond Bayer and requires broad consideration of the application of inherently safer process (ISP) assessments under these circumstances. The conclusion from the analysis presented here is that the principles of ISP assess- ment can be used to good effect in conducting an incident investigation when the objective is the prevention of potential incidents having similar funda­ mental, underlying (root) causes. Examples are provided to demonstrate how this might be done and the extent of current practice in this regard. This chapter also provides information regarding emergency response systems and discusses how ISP assessments could be used to improve and support effective emergency planning and response. INCIDENT INVESTIGATION—AN ESSENTIAL COMPONENT OF A SAFETY MANAGEMENT SYSTEM As noted in Chapter 7, incident investigation is not a one-time, stand-alone event, but instead a necessary element within a functioning process safety man- agement (PSM) system. Indeed, it is one of the mandatory elements of OSHA’s PSM standard, which requires, “the investigation of each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical in the workplace” (Department of Labor, 2000). Comprehensive protocols and advice are available for conducting inves- tigations of chemical process incidents (e.g., CCPS, 2003). Such guidelines 141

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 142 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE emphasize the need for a PSM system to be simultaneously retrospective and prospective, with incident investigation providing the vital bridge between the lessons of the past and safer designs and operation in the future (CCPS, 2003). This point is expanded upon in the following sections. Relationship Between A Priori and Post-Facto Assessment Although advance preparation is essential, incident investigations are con- ducted after the fact—that is, after a loss-producing event or a near-miss has occurred. In conducting a post-incident process assessment, it is important to avoid the problem of hindsight bias. Hindsight bias, known commonly as “­Monday morning quarterbacking” or “20-20 hindsight” is the tendency to view events as more foreseeable or more inevitable after the fact than they actually would have appeared at the time actions needed to be taken (Fischhoff, 1975; Blank et al., 2007; Louie et al., 2007). In particular, anyone who is judging the safety of a facility after an incident has information that was not available to those who conducted any pre-incident process assessment. Although most people recognize it would be unfair to use later information to second-guess earlier decisions, research on hindsight bias cited above has shown that cognitive biases can limit our ability to recognize the additional information that we have acquired after the event. While such new information should never be ignored, it is important to acknowledge that critical factors may not have been obvious before an incident, because this can help identify new opportunities for analysis, monitoring, communication, etc. The chain of events that produced a chemical release is obvious in retrospect because it happened, even though it might not have been obvious in prospect because safety analysts failed to imagine that such an event chain could happen. In such cases, it is important to judge what the safety analysts could reasonably have been expected to anticipate by examining the safety analyses conducted in other facilities. If facilities with similar designs had also failed to anticipate that chain of events, then those conducting a pos-tincident process assessment should be wary of the effects of hindsight bias. However, if facilities with similar designs had anticipated that chain of events, then those conducting a post-incident pro- cess assessment should be less concerned that their analyses are being affected by hindsight bias. Alternatively, it might be that the probability (rather than the possibility) of that chain of events might seem more likely in retrospect than in prospect because a pre-incident safety assessment underestimated the probability that such an event chain could happen. In this case, it is important to balance the possibil- ity that the post-incident process assessment is being affected by hindsight bias against the possibility that any pre-incident process assessment was affected by optimistic bias (Weinstein, 1989), also known as comparative optimism (Klar and Ayal, 2004). In other words, the pre-incident process assessment might have

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT 143 assumed that engineered safety features would not fail, that emergency operating procedures would be implemented effectively, that everyone at risk would receive warning messages, and so on. Aside from any erroneous assumptions about the quality of the facility design, there is ample documentation that facilities “as built” and “as maintained” typically differ—sometimes substantially—from their original designs (as evidenced by the Bhopal tragedy). Further, operational and design changes over the life of a facility can introduce new hazards not anticipated by the original designers; this illustrates the need for an effective management-of-change protocol within an overall PSM system. Consequently, preincident process assessments can provide unrealistically optimistic estimates of incident probabilities. Issues of hindsight, and hindsight bias, are critical when the focus of an investigation is solely on a given incident itself, perhaps for reasons relating to litigation or disciplinary measures. It is precisely this retrospective nature of incident investigation, however, that gives this PSM element its dominant role in learning from experience. As noted in CCPS (2007), the process of incident investigation involves reporting, tracking, and investigating incidents, together with management of the development and documentation of recommendations arising from investigations. If the sole purpose is simply to establish guilt and assign blame to plant personnel, the result will not only be ineffective recommen- dations but also missed opportunities to prevent repeat occurrences. CCPS (2007) further comments that a much more effective approach to incident investigation is to develop recommendations that address systemic causes. In other words, it is the management system deficiencies (often termed root causes) that need to be identified in an effort to avoid not just the same or a similar incident from happening again, but also incidents that could occur because of the existence of deeper, management-system causation factors. Examples in this latter category would include shortcomings in any of the elements of a PSM system. Because PSM involves a suite of considerations that complement one another, efforts directed at a particular element can have a positive effect on one or more other elements. For example, commitment to a strong process safety culture will undoubtedly affect all remaining PSM elements as previously discussed in Chapter 7. It is difficult to envisage senior managers searching for PSM system deficiencies during an incident investigation without those same managers being fully committed to ensuring a sound safety culture; Sutton (2008) has demon- strated this strong correlation between root-cause analysis through incident inves- tigation and the development of a company’s safety culture. Similarly, hazard identification and risk analysis, which by their nature are a priori activities, can be used to inform the process of incident investigation, a post facto activity as previously mentioned. A tool commonly used to identify process hazards is a checklist of rel- evant concerns. Table 8.1 gives a partial listing of items drawn from the ISP checklist found in Appendix A of CCPS (2009). The recommended questions in

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 144 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 8.1  Partial ISP Checklist (adapted from CCPS, 2009) ISP Alternative a b c d e MINIMIZE Can hazardous raw materials inventory be reduced? Can hazardous in-process storage and inventory be reduced? Can hazardous finished product inventory be reduced? Can alternative equipment with reduced hazardous material inventory requirement be used? SUBSTITUTE Is this hazardous process/product necessary? Is it possible to completely eliminate hazardous raw materials, process intermediates, or by-products by using an alternative process or chemistry? Is an alternative process available for this product that eliminates or substantially reduces the need for hazardous raw materials or production of hazardous intermediates? Is it possible to substitute less hazardous raw materials? MODERATE Is it possible to limit the supply pressure of hazardous raw materials to less than the maximum allowable working pressure of the vessels to which they are delivered? Can the process be operated at less severe conditions for hazardous reactants or products by considering improved thermodynamics or kinetics to reduce operating temperatures or pressures? Can process units for hazardous materials be designed to limit the magnitude of process deviations? SIMPLIFY Can equipment be designed such that it is difficult or impossible to create a potential hazardous situation due to an operating or maintenance error? Can passive leak-limiting technology be used to limit potential loss of containment? Has attention to control system human factors been addressed through logical arrangement of controls and displays that match operator expectations? NOTES: a = Applicable (Y/N), b = Opportunities/Applications, c = Feasibility, d = Current Status, e = Recommendation. SOURCE: Adapted from CCPS (2009).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT 145 Table 8.1—which provide explicit, structured consideration of the four key ISP principles (minimization, substitution, moderation, and simplification)—can be asked at virtually any stage of process design and operation to identify potential hazards and suggest remedial actions. They can also be asked at the stage of inci- dent investigation with the aim of root-cause prevention. This point is elaborated upon in the following paragraph and later in this chapter. Kletz and Amyotte (2010) have commented that reports of incident investiga- tions often deal only with the immediate causes of the incident (i.e., the triggering events), but not with ways of avoiding the hazard. If an investigation protocol is designed primarily to determine why control of hazards was lost, it is unlikely that emphasis will be placed on examining why the hazard was tolerated and whether it could have been avoided in the first place. A primary function of effective inci- dent investigation must therefore be to challenge company personnel to question the basic technology underlying the affected materials, equipment, and processes. Several questions have been posed by Kletz and Amyotte (2010) to motivate incident investigators and investigation teams to think of less obvious ways of preventing process incidents. These questions, given below in adapted form, raise issues similar to the checklist questions listed in Table 8.1: • What is the purpose of the operation involved in the incident?

Why do we do this?

How else could we do it?

Who else could do it?

When else could we do it?

Where else could we do it?

What could we do instead? • What equipment failed?

How can we prevent failure or make it less likely?

How can we detect failure or approaching failure?

How can we control failure (i.e., minimize consequences)?

What does this equipment do?

What other equipment could we use instead?

What could we do instead? • What material leaked (exploded, decomposed, etc.)?

How can we prevent a leak (explosion, decomposition, etc.)?

How can we detect a leak or approaching leak (etc.)?

What does this material do?

What material could we use instead?

What safer form could we use the original material in?

What could we do instead? • Which people could have performed better? (Consider people who might supervise, train, inspect, check, or design better than they did, as well as people who might construct, operate, or maintain better than they did.)

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 146 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

What could they have done better?

How can we help them to perform better? (Consider training, instructions, inspections, audits, etc., as well as changes to design.)

What could we do instead? Kletz and Amyotte (2010) further challenge incident investigators to keep a more general, overarching set of questions in mind when following their estab- lished investigation protocol. These questions are as follows: • Did a lack of application of the principles of ISP play a role in incident causation? • Would minimization, substitution, moderation, and simplification have helped to prevent the incident or mitigate the consequences? • How effective were the available passive and active engineered safety devices with respect to prevention and mitigation? • How effective were the available procedural safety measures with respect to prevention and mitigation? • Were recommendations made to avoid the hazards and to permanently remove them wherever possible? AN APPROACH TO ISP-BASED INCIDENT INVESTIGATION The discussion in the preceding section demonstrated that similar questions can and should be asked during both hazard identification and incident investiga- tion. A structured use of checklist questions is, however, required for effective performance of the tasks of identifying hazards and investigating incidents. Hazard identification/risk analysis and incident investigation are distinct PSM elements. Because PSM is underpinned by the concept of continuous improvement, it stands to reason that the use of ISP principles in conducting these activities will lead to opportunities for refinement of the ISP assessment method- ologies. Mahnken (2001) has illustrated the general use of case histories arising from incident investigations to enhance process hazard analysis methodologies such as the familiar HAZOP (HAZard and OPerability study). Similarly, Khan (2006) has demonstrated how case histories can assist in identifying the need for improved hazard identification—particularly with respect to thermal stability of reactive materials and the potential for runaway chemical reactions. Khan (2006) further comments that “it is . . . necessary to make full use of all opportunities at the conceptual stages of process development and design to reduce the frequency of accidents in the chemical process industries.” This is essentially a call for early ISP consideration and an examination of the effectiveness of preincident ISP assessments based on the findings of post-incident investigations. Formalized approaches to ISP-based hazard identification are available in the process safety literature—for example, the protocol for use of ISP checklist

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT 147 questions in conducting a process hazard analysis (PHA), which is described in Appendix B of CCPS (2009). In a similar vein, Goraya et al. (2004) have pro- posed the ISP-based protocol for incident investigation shown in Figure 8.1. Key features of this approach are as follows (Goraya et al., 2004): • Incorporation of a basic framework utilizing best practices drawn from industry; • Adoption of an integrated approach that considers all potential categories of loss (people, property, production, and environment; “property” meaning assets and “production” meaning uninterrupted business operation); • Classification of evidence collected after the incident into convenient data categories as appropriate with respect to data fragility (position, people, parts, and paper); • Use of a loss causation model for identification of factors which dis- tinguishes between “immediate causes, basic causes, and lack of management control factors” (i.e., management system deficiencies); • Introduction of inherent safety guidewords or “mind triggers”(minimize, substitute, moderate, and simplify) at both the initiation and completion of the protocol, in an attempt to encourage ISP considerations during the collection of data and the development of recommendations, respectively; • Use of explicit inherent safety checklist questions structured around key ISP principles (see, for example, Goraya et al., 2004; CCPS, 2009; Kletz and Amyotte, 2010) during root-cause analysis; and • Adoption of a layered approach for making recommendations. It is the last three items in the above list that make the protocol of Goraya et al. (2004) explicit in its consideration of ISP. The final item in particular, which was first introduced to the process safety community by Professor Trevor Kletz, is critical to the integration of ISP within the investigation protocol. As described previously in this chapter, it should be well-understood that the root causes of process incidents are typically management system deficiencies; this accounts for the third layer of recommendations shown in Figure 8.1. It is of course necessary to take immediate action to remove existing hazards following an incident; hence the first layer of recommendations in Figure 8.1. ISP, by its very nature, requires an attempt to avoid hazards and to permanently remove them wherever possible. It is therefore fundamentally impossible to address the second layer of recom- mendations in Figure 8.1 without explicit consideration of the principles of ISP. A positive result of second-layer ISP recommendations is thus the identification of opportunities for overall design improvements during facility rebuild in the case of significant asset loss. Such ISP opportunities represent a specific application of the well-established need to make general process improvements on the basis of both incident data (Leggett and Singh, 2000) and lessons learned from major incidents (Balasubramanian and Louvar, 2002).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 148 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE FIGURE 8.1  Inherent safety-based incident investigation methodology. SOURCE: Goraya et al. (2004).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT 149 However, the implementation of ISP improvements resulting from second- layer recommendations will not necessarily be seen as a practical approach by all decision makers. Sociologist Andrew Hopkins has addressed this issue in his recent book on high-reliability organizations (Hopkins, 2009). He comments that although a focus on incident investigation recommendations that are deemed practical to implement will at least increase the likelihood of action being taken, it will not ensure that more fundamental (and potentially more costly) system enhancements will be undertaken. Hopkins (2009) gives the example of additional training being provided to air traffic controllers who had made procedural errors, as opposed to removing hazards by making changes to the computer software running the air traffic con- trol consoles, which had been identified as the root-cause source of error. Such system-wide improvements to the underlying technology, although resource- intensive and requiring comprehensive risk assessment, remain the best response to hazards identified during an incident investigation (Hopkins, 2009). As discussed in Chapter 7, the principles of inherent safety have broad appli- cation to all elements of a PSM system. This point is repeated here as a reminder that ISP enhancements can be beneficial to all PSM aspects—not only those involving hazard identification, risk analysis, and incident investigation (Amyotte et al., 2007; CCPS, 2009; Kletz and Amyotte, 2010). LONG-TERM TRENDS IN INVESTIGATION RESULTS The documentation resulting from investigations by the U.S. Chemical Safety and Hazard Investigation Board (CSB) represents some of the most acces- sible process incident information available in the public domain. As noted on its Web site (www.csb.gov), CSB is an independent, nonregulatory federal agency charged with investigating industrial chemical incidents. Such incidents are inves- tigated by a team of CSB employees, and from the evidence collected, root and contributing causation factors are identified. With this information, the CSB creates sets of recommendations for various bodies such as facility managers, regulatory agencies, and technical associations. Following a completed investiga- tion, documentation in the form of a full investigation report, case study, safety bulletin, or urgent recommendations are made available on the CSB Web site. These documents often have accompanying video support and are widely recog- nized as valuable learning tools for improving safety in the process industries. An analysis of these publicly available CSB reports has recently been under- taken by Amyotte et al. (2011), primarily from the perspective of the actual and potential use of ISP principles in incident investigations. Approximately 60 reports covering the period 1998-2010 were reviewed; this resulted in the identifi- cation of numerous ISP examples related to incident prevention and consequence mitigation. These findings were often implicitly referenced in the documentation (i.e., not named as inherent safety per se), with a growing trend in recent years

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 150 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE toward explicit use of ISP terminology when identifying causation factors and making recommendations. Particularly noteworthy in this latter regard are the BP Texas City (CSB, 2007), Valero McKee (CSB, 2008), and Xcel Energy (CSB, 2010a) investigation reports, as well as the urgent recommendations resulting from the Kleen Energy (CSB, 2010c) and ConAgra (CSB, 2010b) investigations. In accordance with the concept that ISP is not a stand-alone approach to risk reduction, the review of CSB reports by Amyotte et al. (2011) also identified a sig- nificant number of actual and potential measures related to the other categories in the overall hierarchy of controls. The majority of the non-ISP safety features were related to procedural safety, followed by active engineered devices and, to a lesser extent, passive engineered devices. These results were determined to be generally consistent with the work of Kidam et al. (2010), who reviewed 364 chemical pro- cess industry incident descriptions in the Failure Knowledge Database maintained on the Japan Science and Technology Web site. The analysis by Amyotte et al. (2011) identified investigation lessons similar to those given by Kaszniak (2010) in his independent review of CSB reports, and by Yang et al. (2009) in their analysis of case histories (including a small subset of CSB investigations). It is not known whether other organizations that conduct process incident investigations have adopted ISP as an integral component of their investiga- tion protocols. It does appear, however, that at least one such organization—the CSB—has made a conscious attempt to explicitly utilize the concept and prin- ciples of ISP during post-incident investigations. As noted by Amyotte et al. (2011), this is a welcome trend that should be encouraged and widely adopted in the process industries. Expanded use of ISP considerations during process inci- dent investigations is predicated on widespread knowledge and understanding of the inherent safety concept itself. Continued educational (e.g., Hendershot, 2006; Hendershot and Murphy, 2008) and training (e.g., IChemE, 2005) efforts in this regard are therefore imperative. CONCLUSIONS This chapter has provided a review of incident investigation from both a general perspective as a key element of a PSM system and with specific ISP considerations in mind. Incident investigations are most useful in the process industries when they are conducted with the objective of determining root causes. Such causes typically reside at the level of management system deficiencies and are often related to shortcomings in hazard identification and risk assessment protocols. Explicit incorporation of the principles of ISP can play an important role in the efficacy of an incident investigation protocol. Lessons learned from incident investigations—both general and those spe- cific to ISP—can also have a beneficial impact on PSM overall. Such lessons can be used to make systemic improvements involving all categories in the hierarchy of controls and to help identify previously unforeseen hazards in a given process

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT 151 or industry sector. Because incident investigation acts within a management system based on continuous improvement, it is to be expected that investigation results will provide valuable input to the methodologies being used to predict hazards and prevent their occurrence. REFERENCES Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2007. Incorporation of inherent safety principles in process safety management. Process Saf. Prog. 26(4):333-346. Amyotte, P. R., D. K. MacDonald, and F. I. Khan. 2011. An analysis of CSB investigation reports for inherent safety learnings. Paper No. 44a in Proceedings of 13th Process Plant Safety Sym- posium, 2011 Spring Meeting & 7th Global Congress on Process Safety, March 13-16, 2011, Chicago, IL. New York: American Institute of Chemical Engineers. Balasubramanian, S. G., and J. F. Louvar. 2002. Study of major accidents and lessons learned. Process Saf. Prog. 21(3):237-244. Blank, H., J. Musch, and R. F. Pohl. 2007. Hindsight bias: On being wise after the event. Soc. Cogni- tion 25(1):1-9. CCPS (Center for Chemical Process Safety). 1989. Guidelines for Technical Management of Chemical Process Safety. New York: American Institute of Chemical Engineers. CCPS. 2003. Guidelines for Investigating Chemical Process Incidents. 2nd Ed. New York: American Institute of Chemical Engineers. CCPS. 2007. Guidelines for Risk Based Process Safety. Hoboken, NJ: John Wiley & Sons. CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd Ed. Hoboken, NJ: John Wiley & Sons. CSB (Chemical Safety Board). 2007. Investigation Report: Refinery Explosion and Fire—BP, Texas City, TX. Report No. 2005-04-I-TX. Washington, DC: CSB [online]. Available: http://www.csb. gov/assets/document/CSBFinalReportBP.pdf. Accessed: Sept. 28, 2011. CSB. 2008. Investigation Report: LPG Fire at Valero-McKee Refinery—Valero Energy Corporation, Sunray, TX. Report No. 2007-05-I-TX. Washington, DC: CSB [online]. Available: http://www. csb.gov/assets/document/CSBFinalReportValeroSunray.pdf. Accessed: Sept. 28, 2011. CSB. 2010a. Investigation Report: Xcel Energy Hydroelectric Plant Penstock Fire—Cabin Creek, Georgetown, CO. Report No. 2008-01-I-CO. Washington, DC: CSB [online]. Available: http:// www.csb.gov/assets/document/Xcel_Energy_Report_Final.pdf. Accessed: Sept. 28, 2011. CSB. 2010b. Urgent Recommendations from ConAgra Investigation. Washington, DC: CSB [online]. Available: http://www.csb.gov/assets/document/CSB_Gas_Purging_Urgent_Recommendations. (2).pdf. Accessed Sept. 28, 2011. CSB. 2010c. Urgent Recommendations from Kleen Energy Investigation Washington, DC: CSB [online]. Available: http://www.csb.gov/assets/document/KleenUrgentRec.pdf. Accessed: Sept. 28, 2011. CSChE (Canadian Society for Chemical Engineering). 2002. Process Safety Management, 3rd Ed. Ottawa, ON: CSChE. Department of Labor. 2000. Process Safety Management. OSHA 3132. Washington, DC: OSHA Publications Office. Fischhoff, B. 1975. Hindsight ≠ foresight: The effect of outcome knowledge on judgment under uncertainty. J. Exp. Psychol. Human 1(3):288-299. Goraya, A., P. R. Amyotte, and F. I. Khan. 2004. An inherent safety-based incident investigation methodology. Process Saf. Prog. 23(3):197-205. Hendershot, D. C. 2006. Inherently Safer Design. SAChE (Safety and Chemical Engineering Educa- tion) [online]. Available: http://sache.org/index.asp. Accessed: Sept. 28, 2011.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 152 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Hendershot, D. C., and J. Murphy. 2008. Inherently Safer Design Conflicts and Decisions. SAChE (Safety and Chemical Engineering Education) [online]. Available: http://sache.org/index.asp. Accessed Sept. 28, 2011. Hopkins, A, ed. 2009. Learning from High Reliability Organisations. Sydney, Australia: CCH Aus- tralia Limited. IChemE (Institution of Chemical Engineers). 2005. Inherently Safer Process Design, Training Re- source STP001. Rugby, UK: IChemE. Kaszniak, M. 2010. Oversights and omissions in process hazard analyses: Lessons learned from CSB investigations. Process Saf. Prog. 29(3):264–269. Khan, A. A. 2006. Case histories and recent developments to improve safety assessments during process development. Process Saf. Prog. 25(3):245-249. Khan, F. I., and P. R. Amyotte. 2003. How to make inherent safety practice a reality. Can. J. Chem. Eng. 81(1):2-16. Kidam, K., M. Hurme, and M. H. Hassim. 2010. Inherent safety based corrective actions in accident prevention. Pp. 447-450 in Proceedings of 13th International Symposium on Loss Prevention and Safety Promotion in the Process Industries, June 6-9, 2010, Bruges, Belgium, Vol. 2. Rugby, UK: Institution of Chemical Engineers. Klar, Y., and S. Ayal. 2004. Event frequency and comparative optimism: Another look at the indirect elicitation method of self-others risk. J. Exp. Soc. Psychol. 40(6):805-814. Kletz, T., and P. R. Amyotte. 2010. Process Plants: A Handbook for Inherently Safer Design. Boca Raton, FL: CRC Press. Leggett, D., and J. Singh. 2000. Process improvements from incident data. Process Saf. Prog. 19(1):13-18. Louie, T. A., M. N. Rajan, and R. E. Sibley. 2007. Tackling the Monday-morning quarterback: Ap- plications of hindsight bias in decision-making settings. Soc. Cognition 25(1):32-47. Mahnken, G. E. 2001. Use case histories to energize your HAZOP. Chem. Eng. Prog. 97(Mar.):73-78. OSHA (Occupational Safety and Health Administration). 2000. Process Safety Management. OSHA

1. U.S. Department of Labor, Occupational Safety and Health Administration, Washington,

DC [online]. Available: http://www.osha.gov/Publications/osha3132.html. Accessed: Feb. 14, 2012. Sutton, I. S. 2008. Use root cause analysis to understand and improve process safety culture. Process Saf. Prog. 27(4):274-279. Weinstein, N.D. 1989. Optimistic biases about personal risks. Science 246(4935):1232-1233. Yang, X., L. Dinh, D. Castellanos, C. Osorio, D. Ng, and M.S. Mannan. 2009. Common lessons learned from an analysis of multiple case histories. Pp. 43-50 in Hazards XXI: Process Safety and Environmental Protection in Changing World, November 10-12, 2009, Manchester, UK. IChemE Symposium Series No. 155. Rugby, UK: Institution of Chemical Engineers.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendixes

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix A Statement of Task The National Research Council will produce a detailed written report, con- clusions, and recommendations where appropriate on the following subjects:

1. Review the current industry practice for the use and storage of MIC in

manufacturing processes, including a summary of key lessons and con- clusions arising from the 1984 Bhopal accident and resulting changes adopted by industrial users of MIC.

1. Review current and emerging technologies for producing carbamate

pesticides, including carbaryl, aldicarb, and related compounds.

The review should include:

1. 1 Synthetic methods and patent literature

1. 2 Manufacturing approaches used worldwide for these materials

1. 3 Manufacturing costs for different synthetic routes

1. 4 Environmental and energy costs and trade-offs for alternative

approaches

1. 5 Any specific fixed-facility accident or transportation risks associated

with alternative approaches

1. 6 Regulatory outlook for the pesticides including their expected life-

time on the market

1. Examine the use and storage of MIC at the Bayer CropScience facility

in Institute, West Virginia:

1. 1 Identify possible approaches for eliminating or reducing the use of

MIC in the Bayer carbamate pesticide manufacturing processes, through, for example, substitution of less hazardous intermediates, 155

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 156 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE intensifying existing manufacturing processes, or consuming MIC simultaneously with its production.

1. 2 Estimate the projected costs of alternative approaches identified

above.

1. 3 Evaluate the projected benefits of alternative approaches identified

above, including any cost savings, reduced compliance costs, liabil- ity reductions, reduced emergency preparedness costs, and reduced likelihood or severity of a worst-case MIC release or other release affecting the surrounding community.

1. 4 Compare this analysis to the inherently safer process assessments

conducted by Bayer and previous owners of the Institute site.

1. 5 Comment, if possible, on whether and how inherently safer process

assessments can be utilized during post-accident investigations.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix B Carbamate Pesticide and Methyl Isocyanate Timeline 4 June 1954: Acrolein tank car explosion and 1955 ethylene oxide distillation column explosion at the Institute site led to the establishment of the Union ­Carbide Reactive Chemicals employee awareness training program and the Kanawha Valley Emergency Planning Committee. 1958: Carbaryl (Sevin) commercialized by Union Carbide (UCC); production by chloroformate process (phosgene + 1-naphthol → 1- naphthol chloroformate; naphthol chloroformate + methylamine → carbaryl) (None of the intermediates were made at Institute). 5 January 1961: First shipment of carbaryl from Institute. 1966: Methomyl introduced (and registered in 1968) by DuPont; production by isocyanate process (methomyl oxime + methyl isocyanate → methomyl). 1966: UCC startup of MIC Unit 1 for use in carbamate pesticides (other than carbaryl). 1976: UCC aldicarb (Temik) production started in Institute East Carbamoylation Center; production by isocyanate process (aldicarb oxime + methyl isocyanate → aldicarb). April 1978: UCC startup of new Syngas plant and MIC Unit 2 (Total Unit 1 and Unit 2 capacity: 42M lb/yr MIC). 157

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 158 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE 1978: UCC carbaryl production changed to isocyanate process (phosgene + methylamine → methyl isocyanate; methyl isocyanate + naphthol → carbaryl) in Institute East Carbamoylation Center; isocyanate process claimed to involve higher overall yields, fewer losses from hydrochloride adduct by-products, less waste and environmental impact, and fewer and less severe corrosion problems. 1978: Sophisticated drum-filling operation enables MIC to be shipped to cus­ tomers in France, India, Brazil, and United States. Literature describes four general routes to carbaryl (http://www.exchemistry.com/ sevin.html):

1. 1-naphthol + phosgene then + methylamine (chloroformate process),
2. 1-naphthol + methyl isocyanate (isocyanate process),
3. 1-naphthol + methyl carbamoyl chloride, and
4. 1-naphthol + dimethyl urea.

In principle, these four approaches may also apply to any of the carbamates; as far as is known, however, only the chloroformate process was used as an alterna- tive to the isocyanate process, and that was for carbaryl, and that was abandoned. 1979: UCC shuts down MIC Unit 1 because of lower projected demand. 1984: UCC methomyl and Larvin production started using isocyanate process in Institute West Carbamoylation Center on old olefins site. 1984: Toluene diisocyanate site converted to Miscellaneous Carbamates Unit for aldicarb, Standak, Broot, and Zectran. 3 December 1984: Bhopal accident. 1985: MIC destruction capacity and other safety enhancements added at Institute. 23 April 1985: Boros (UCC) report on possible research alternatives:

1. Aqueous medium for aldicarb oxime + MIC reaction (similar to DuPont

1970 patent).

1. Onepot process for aldoxycarb (aldicarb oxime + methyl isocyanate

(water) → aldicarb; aldicarb + H2O2/HCOOH → aldoxycarb [Standik]).

1. General process for carbamates: ROH + CO + CH3NH2 (Pd/O2) →

carbamate + H2O (caustic, chlorine, phosgene, MIC eliminated; need high Pd productivity and recovery) (based on Asahi Chemical article in Journal of Organic Chemistry, 1984).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 159

1. Use of MIC/NaHSO3 solid adduct (reported 27 July 1976) instead of

MIC demonstrated for carbaryl, aldicarb, methomyl, and carbofuran.

1. Conversion of methyl formamide to MIC over dehydrogenation catalyst

(Sun Ventures & DuPont, 1976).

1. Review of 55 MIC patents between January 1944 and July 1979 reveal

primary method of MIC production to be phosgenation of methylamine followed by either (a) HCl removal by some separation technology, or (b) HCl removal by reaction with an acid receptor.

1. NaOCN + dimethyl sulfate → MIC + sodium sulfate (cyanate process)

(Deutsche Gold patent; operated by Sunko, June 1980). June 1985: DuPont, given loss of availability of bulk MIC, develops methyl for- mamide oxidation process for MIC(g) production and integrates with continuous methomyl process for minimum MIC inventory. 11 August 1985: Accidental release of aldicarb oxime and methylene chloride in Miscellaneous Carbamates Unit (aldicarb plant) (Lead in part to new OSHA safety program for chemical plants and EPA Chemical Emergency Preparedness Program). January 1986: FMC, given the loss of availability of bulk MIC, starts production of carbofuran (Furadan) (operated by UCC on old ethyl alcohol site) in Institute West Carbamoylation Center; production by isocyanate process (carbofuran phe- nol + methyl isocyanate → carbofuran). 1986: UCC updates MIC patent review (July 1979-December 1985); patent activ- ity shifting to MIC “carriers”:

1. Phosgenation of methylamine followed by pyrolysis of methyl car-

bamoyl chloride (traditional route; little patent activity);

1. Phosgenation of ureas (Philagro);
2. Thermal decomposition of carbamic acid esters (Bayer, EniChemica);
3. Thermal decomposition of trisubstituted ureas (Bayer);
4. Thermal decomposition of oxazolidinones (Agency of Industrial Science

and Technology);

1. Thermal decomposition of oxalamate (BASF);
2. Thermal decomposition of N-substituted acetylacetamides (Bayer);
3. Thermal decomposition of dialkylmalonamides (Bayer);
4. Thermal decomposition on N,N’-disubstituted allophanates (BASF);
5. Thermal decomposition of organosilicon intermediates (Soviet publications);
6. Thermal decomposition of reversible boron-MIC adducts (Vertac);
7. Dehydrogenation of N-methylformamide (DuPont);
8. Methylation of metal cyanate (Degussa, FMC);

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 160 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

1. Acetyl chloride and sodium azide (USSR); and
2. Amination of chloroformate (Hungary).

Recommended UCC research alkyl carbamates, boron compounds, and silyl carbamates. March 1986: UCC report on pyrolysis of aryl N-methyl carbamates to MIC. ~1986: UCC report on concept to react diphenyl carbonate and methylamine to make phenylmethylcarbamate based on EniChemica technology. October 1986: In a meeting with Nor-Am Chemical, UCC discloses that although it had been working on a phenyl methylcarbamate (and butylphenyl methylcar- bamate) process for shipment to make aldicarb at Woodbine, Georgia, Brazil, and France, it discovered that it could ship aldisol (aldicarb/methylene chloride solution) instead, and therefore was less interested in the phenyl methylcarbamate process. December 1986: Rhône-Poulenc (RP) buys Union Carbide Agricultural Products Division March 1987: Study by Schering Agrichemicals related to local Michigan pro- duction of carbamates given the loss of availability of bulk MIC (small scale: 1M lb/yr final product). Three basic approaches:

1. Via MIC from onsite MIC generation,
2. Via methyl carbamoyl chloride from methylamine phosgenation (with-

out pyrolysis), or

Via methyl carbamoyl chloride from methyl formamide and sulfuryl chloride. In turn, three cases were considered for onsite MIC generation:

1. Sodium cyanate + dimethyl sulfate (Sunko);
2. Methyl formamide oxidation (DuPont); and
3. Diphenyl carbonate processes (two versions):

a) Diphenyl carbonate + methylamine (EniChemica and Union Carbide),

b) Diphenyl carbonate + dimethyl urea (Bayer). Concluded changing to EniChemica process had 5- to 6-year payback vs. contin- ued Sunko contract manufacture; recommended continue sulfuryl chloride route development.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 161 April 1988: RP evaluates DuPont methyl foramide oxidation route to MIC production. October 1988: RP Project MN:

1. MIC vent gas incinerator,
2. Carbaryl reliability and optimization,
3. Comparison of UCC and RP syngas and phosgene technologies, and
4. MIC downsizing (use of new discrete simulator software package).

31 January 1989: RP Project MS (presentation to Perez and Robirds) (preparation of MIC and aldicarb at Woodbine to eliminate aldisol transport from Institute to Woodbine). Two MIC processes considered:

1. Cyanate process (NaOCN + dimethyl sulfate → MIC) (semibatch)

Pros: Low MIC inventory (200 lb or less); dimethyl sulfate to be made by RP

Cons: Dimethyl sulfate transportation; NaOCN availability; high vari- able costs; environmental protection concerns

1. DuPont methyl formamide oxidation process (methyl formamide +

O2 → MIC + H2O)

Pros: DuPont technology; cost depends on methyl formamide cost, but lower than cyanate process

Cons: Need for pilot plant; Long development and startup time; lower MIC quality could risk lower aldicarb quality; needs “miracle” process and technology relationship with DuPont

Also considered transfer of Woodbine formulation capabilities to Institute (except gypsum granulation) and maintaining existing MIC and aldicarb technologies in Institute; this was the preferred alternative 1989: RP consideration of Enichem technology for phenyl methylcarbamate technology for individual MIC production at each carbamate process. July 1989: RP discussion of two alternative routes to diphenyl carbonate for Enichem process:

1. Phenol phosgenation
2. Phenol + CO + O2

December 1989: RP further discussions of Enichem MIC technology at Institute

1. Manufacturing and inventory cost analysis,
2. Concept and objectives,
3. MIC generators/users interface,

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 162 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

1. Quality program, and
2. Impact on plant operaion.

Expected MIC inventories: 150 lb of methomyl, 300 lb of carbaryl, 50-300 lb of aldicarb. January 1990: RP considers MIC minimization (identified as “Bayer alterna- tive” based on diphenyl carbonate + dimethyl urea) as well as MIC containment alternatives. 10 July 1991: RP report on Enichem-RP technical meeting on dimethyl carbon- ate, diphenyl carbonate, and MIC

1. Dimethylcarbonate is made from methanol, CO, and O2 over Cu and Pd;
2. Diphenylcarbonate is either made from phenol and phosgene or phenol,

CO, and O2, or by transesterification of dimethylcarbonate with phenylacetate;

1. Phenylmethylcarbamate is made from diphenylcarbonate and methyl-

amine to be cracked at each carbamate process to MIC. December 1991: RP designs (but does not build) a new MIC plant for Institute based on phenylmethylcarbonate production, storage, and distribution to various carbamate processes to be cracked to gaseous MIC. 18 August 1993: An explosion in the methomyl/Larvin plant killed one employee and critically injured two others. RP was charged with 27 safety violations including failure to properly maintain, inspect, and test piping systems and other equipment. OSHA fined RP a record $1.6 million. 1993: RP conducts $50M Institute Modification Project (IMP) related to MIC, phosgene, and chlorine safety. Aspects include chlorine unloading, chlorine trans- fer, phosgene production, elimination of hard-to-clean small diameter piping, MIC refining system and phosgene separation system leak detection, water leak detection by analysis for CO2, reduce number of make tanks, field storage tank modifications, MIC transfer line changes, methylamine storage relocation, local storage of caustic for MIC destruction, standby emergency diesel electric genera- tor; allow MIC production unit to operate at reduced rates (700-4000 lb/hr); new MIC instrumentation; replace Crane canned pumps with external recirculation with Sundyne canned pumps with internal recirculation; radiation shields for MIC and Cl2 transfer lines near fire hazards; control room air safety; replace Karbate reboilers with tantalum; MIC make analyzers; piperack crossing barriers; MIC capacity reduced to 22M lb/yr.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 163 1994: RP MIC Risk Management Plan. Process design

1. Emergency dump tank available for safe transfer of product from leaking

vessel,

1. Scrubber will destroy MIC from any storage tank,
2. Flare tower will destroy MIC vapors from process vents,
3. Backup control room instruments,
4. Automatic MIC isolation valves stop leaks,
5. Diking and spill collection sump,
6. Fire deluge system,
7. MIC leak detection alarms,
8. Safety relief valves protect vessels from over pressure,
9. Diesel generator for backup power,
10. Sealless pumps for pure liquid MIC,
11. Fire protection for pipe rack transfer lines, and
12. Independent nitrogen supply to prevent cross contamination.

Equipment design

1. Double-walled underground storage tank,
2. Pressure vessels coded by ASME,
3. Blastmat protection on aboveground MIC storage facilities,
4. Stainless steel construction,
5. Pipelines over roads protected by barriers, and
6. Double-walled pipelines with leak detection analyzers on critical trans-

fer lines. Safety reviews

1. Process hazard analysis completed every five years,
2. Ongoing safety reviews for design changes,
3. Operational reviews completed for all process changes, and
4. Safety review team includes safety experts, engineers, union operators,

and union maintenance personnel. Procedures

1. Strictly enforced inventory limits,
2. Annual review of operating procedures,
3. Personnel safety procedures, and
4. Strictly enforced cross-plant transfer procedure.

Training

1. Skilled union operators are trained and qualified,
2. Maintenance personnel are fully trained, and

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 164 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

1. Hazard communications training provided for all personnel, including

contractors. Mechanical Integrity

1. Periodic testing and inspections for tanks, columns, heat exchangers,

pumps, instruments, pipes. Emergency Response

1. Dedicated in-plant Emergency Operations Center,
2. Trained Incident Commander onsite,
3. Trained emergency squad onsite at all times,
4. Plant-wide notification system,
5. Dispersion modeling system,
6. Regular meetings and coordination with community responders,
7. Onsite dispensary and doctor,
8. Periodic unannounced drills,
9. Courtesy notification to METRO of minor releases, and
10. Plant can activate community alarm (Good Samaritan Agreement).

Incident Investigation

1. Formal investigations conducted for significant events,
2. Reporting procedures for all events, and
3. Conducted with operators, union, and safety representatives.

Audits

1. In-plant audits,
2. Corporate audits,
3. Job observation,
4. Auditing for critical safety procedures, performed by each department,
5. CMA Responsible Care self-audits conducted annually, and
6. Ongoing risk assessment process.

12 August 1996: AgrEvo evaluation of Kuo-Ching (Taiwan) MIC production MIC made batchwise by cyanate process (NaOCN + dimethyl sulfate); two batch lines; 1000kg/batch; no overnight storage. Has/Does: Scrubbers, dump tanks, backup control room instruments, auto- matic MIC isolation valves, diking, fire deluge system, pressure relief valves, backup diesel power, gravity flow for MIC, mechanical seals on agitators, fire protection for transfer lines, periodic process hazard analysis, safety reviews for design and equipment changes, operational reviews for process changes, safety review team expertise, inventory limits, annual review of procedures, personnel safety procedures, enforced plant procedures, trained and qualified operators, trained maintenance, hazard communications, testing and inspection for leaks,

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 165 trained emergency squad, emergency notification system, coordination with com- munity emergency responders, unannounced drills, community alarm, formal incident investigation, reporting procedure, investigations conducted with opera- tors and safety representatives. Does Not Have/Do: Heat transfer fluid inert to MIC, MIC leak detection alarms, double-walled storage tanks, blastmat protection on aboveground storage tanks, double-walled pipelines, dedicated in-plant emergency operation center, onsite trained incident commander, onsite dispensary and doctor. AgrEvo expressed unspecified concerns over conditions of the MIC unit and a renovation was promised. March 1999: RP purchases FMC carbofuran and carbosulfan manufacturing facilities and establishes Carbamate Excellence Center. November 1999: RP begins production of new carbamate Oxamyl in Miscel- laneous Carbamates Unit. December 1999: Rhône-Poulenc agricultural products division merged with Hoechst Shering AgrEvo to form Aventis CropScience. October 2001: Aventis CropScience sold to Bayer to become Bayer CropScience. October 2002: Bayer conducts safety analyses of MIC and carbamate operations. 2002: Bayer MIC Inventory Reduction Conclusions.

1. Increased unavailability of MIC could lead to operational delays in con-

suming units;

1. Limiting maximum MIC capacity would lead to increased shut down start

up cycles for MIC unit;

1. Points 1 and 2 are inversely proportional; and
2. Forcing MIC inventory levels down appears feasible, but costly for MIC

manufacture and downstream consumers. 28 August 2008: Bayer methomyl residue treater accident. May 2009: Carbofuran banned by the U.S. Environmental Protection Agency. 2009: Bayer MIC production 9M lb. 5 April 2009: House Energy and Commerce Committee asks U.S. Chemical Safety and Hazard Investigation Board to investigate alternative MIC technologies.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 166 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE 26 August 2009: Bayer announces $25 M plant modification. Modification plan includes the following (Martin, 2011). Bayer MIC Unit Layers of Protection Primary measures:

1. Process design.
2. Equipment, piping, and instrumentation standards:

a. Exotic materials of construction throughout the process to minimize corrosion.

1. Operator training and experience, mature, well-documented procedures.
2. Online analysis allows verification of MIC quality before adding to stor-

age tank:

a. MIC purity must be maintained to minimize the probability and rate of undesirable reactions;

b. Multiple analyzers based on diverse technologies used to monitor MIC quality both before and after entering storage tanks; and

c. Proper levels of adverse reaction inhibitors are maintained in under- ground storage.

1. MIC storage tanks are located underground:

a. Tank integrity is protected by jacket and vault.

1. MIC tanks are maintained at low temperatures, minimum needed pres-

sure, and are instrumented with redundant pressure, level, temperature, and temperature rate of rise alarms:

a. Temperature rise is an indication of loss of refrigeration and/or reaction;

b. Higher temperature increases the rate of reaction for undesirable reactions; and

c. Pressure indicates venting due to contaminated MIC and/or loss of refrigeration.

1. Buffered cooling with non-reactive solvent for all MIC storage:

a. Prevents contamination with reactive coolant.

1. Canned rotor pumps are used for refined MIC service:

a. Prevents seal leakage to the environment even at trace levels.

1. Dedicated nitrogen supply for MIC services which can also provide a

backup for instrument air.

1. Distillation condensers are placed high in the structure to avoid reflux

pumps.

1. Structured process hazards analysis by HAZOP method.
2. The refined MIC has online analysis for water and major impurities:

a. Provides early detection of water contamination in the event of a leak in the condenser or vent condenser.

b. Both make stream and storage tanks in building are covered.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 167

1. Continually charged MIC transfer lines outside MIC unit process struc-

ture are double-walled:

a. Adds additional structural integrity to the transfer lines,

b. Prevents small leakage from welds and flanges or from corrosion,

c. Annulus is nitrogen swept and the sweep gas analyzed for organics for early detection, and

d. Steam/ammonia curtain around MIC process structure to mitigate any leaks within structure.

1. Transfer from MIC underground tank to carbaryl unit is done continu-

ously using double walled pipe. The MIC goes directly into the reaction loop around the continuous carbamoylation reactor. There is no MIC storage in the carbaryl unit.

1. Transfer from MIC underground tank to the aldicarb unit is also done

continuously using double-walled pipe.The MIC goes directly into the batch aldicarb reactor and there is no MIC storage in the unit. Secondary measures:

1. Emergency vents to scrubber then to flare:

a. MIC-bearing emergency vents have two buffers before the environment.

1. Sufficient caustic to destroy all stored MIC in the unit:

a. Emergency equipment operates even in loss of site power and utilities.

1. Diesel generator provides backup power for controls and pumps needed

to destroy MIC:

a. Allows operation of all equipment necessary to destroy MIC, even in the event of a complete electrical power outage, utility outage; and

b. Sphere nitrogen can quickly be set to supply unit instrument air header.

1. Ambient air monitors are provided to detect MIC/phosgene release:

a. Provides an early warning of fast-developing releases;

b. Includes sweeps on double-walled equipment and piping; and

c. Covers process structure and storage building.

1. An emergency dump tank as large as the single largest MIC tank is

provided:

a. Provides an additional storage location in case of an emergency around the MIC storage tanks; and

b. The tank is always empty, with a nitrogen blanket, is double-walled construction, and is underground. Bayer Phosgene Handling Considerations

1. Phosgene product is condensed using chilled solvent.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 168 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE

1. Small condenser accumulator is in place to provide a buffer to prevent

CO reaching the MIC process.

1. All liquid phosgene vessels and piping are double walled.
2. Phosgene product is transferred to the MIC unit phosgene vaporizer by

pressure to avoid pumps. 2010: Bayer planned MIC production: 11.5M lbs 2010: In response to House Energy and Commerce Committee request to investigate alternative MIC technologies, Bayer evaluated five most promising alternatives:

1. Current Bayer (UCC) process MIC(l): (phosgene + methylamine)
2. Diphenylcarbonate process MIC(g): (diphenyl carbonate + dimethyl urea

based on Bayer 1971-2002 Dormagen operating data)

1. Enichem process MIC(g): (diphenylcarbonate + methylamine based on

RP 1989-1990 evaluation)

1. Cyanate process MIC(g): (NaOCN + dimethyl sulfate based on Russian/

Japanese 1973-1985 patent literature)

1. DuPont process MIC(g): (methyl foramide oxidation based on SRI and

RP evaluation). The carbaryl process needed to be modified to handle gaseous MIC in the last four alternatives. Evaluation Summary Diphenylcarbonate (Bayer) Pros • Investment smaller than Enichem process, • Good chemical stability of diphenylcarbonate, • Residue amount smaller than Enichem process, and • Lower storage requirements than Enichem process. Cons • Rely on competition for supply of raw material (dimethylurea from BASF); • Handling of other toxic materials (e.g., phenol); • Impact of MIC quality on product quality and hence registration likely (new registration, if at all, requires 2-3 years); in addition, impact on ­aldicarb formulation highly likely because of its complexity and ­sensitivity to low level of impurities; • Impact on manufacturing technologies for aldicarb and carbaryl; signifi- cant amount of process development required for adaptation (2-3 years); • Large amount of equipment required; • Diphenylcarbonate plants have been shut down more than 10 years; no in- house know-how available any longer; learning curve expected to be steep.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 169 Enichem Pros • No need for chlorine and phosgene, and • Reduction of MIC inventory. Cons • Impact of MIC quality on product quality and hence registration likely (new registration, if at all, requires 2-3 years); in addition, impact on ­aldicarb formulation highly likely because of its complexity and ­sensitivity to low level of impurities; • Impact on manufacturing technologies for aldicarb and carbaryl: signifi- cant amount of process development required for adaptation (2-3 years); • Utilization of recycle phenol (no experience of Enichem technology at large scale available); • Effluents quantities and qualities (residual phenol); and • Learning curve to be absorbed. Cyanate Pros • Currently used by most of the Asian suppliers at small scale, it has the advantage to produce MIC on demand: one batch of MIC for one ­carbamoylation batch. Cons • Includes handling of other toxic materials (e.g, DMS); • Produces large amount of waste (6 kg per kg MIC); • For large quantities such as 4,000 Mt/year and the need to feed large continuous units like carbaryl or methomyl, high level of MIC inventory is required; • MIC can only be produced in batch, requiring a large number of large- batch reactors; technology involves more equipment than currently at Institute, increasing safety risk; • Impact of MIC quality on product quality and hence registration likely (new registration, if at all, requires 2-3 years); in addition, impact on ­aldicarb formulation highly likely because of its complexity and s­ensitivity to low level of impurities; • Impact on manufacturing technologies for aldicarb and carbaryl: signifi- cant amount of process development required for adaptation (2-3 years); and • Learning curve will be steep. DuPont Pros • DuPont Technology produces MIC from air oxidation of methylfor- mamide; MIC is available diluted in N2 streams.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 170 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Cons • MIC quality is different, impacting product quality and hence registration (new registration, if at all, requires 2-3 years); in addition, impact on aldi- carb formulation highly likely because of its complexity and sensitivity to low level of impurities; • Impact on manufacturing technologies for aldicarb and carbaryl: signifi- cant amount of process development required for adaptation (2-3 years); • Because of a mix of batch and continuous process, MIC inventory needed; • Process streams may contain traces of toxic materials (e.g., HCN); and • Supply of raw material (methylformamide) in the hands of competitors (BASF and DuPont). Conclusions Only DuPont process shows competitive manufacturing cost, but: • Unknown impact of by-products on product quality and registration; • Unknown impact of wastes on Institute waste handling facilities; and • Low catalyst lifetime (frequent shutdowns). Recommendation

Continue with the existing MIC technology at Institute but reduce manu- facturing to two products (aldicarb and carbaryl) allowing downsizing of the MIC plant and reduction of MIC inventory by 80 percent. 2010: Bayer $25M Project MINEXT to reduce inventory by MIC 80 percent

1. Passive and active safety systems:

a. Underground storage, double-walled construction; SS inner shell;

b. Refrigerated MIC storage;

c. Adjacent empty dump tanks;

d. Scrubbers and flare system independently capable of destroying MIC in process and storage;

e. Double-walled piping with annular nitrogen purge;

f. Air monitoring;

g. Automated control system; automated safety supervisory system, trained operators, and technical professionals; and

h. Steam-ammonia curtain to mitigate phosgene or MIC leaks;

i. Leak detection and repair process for extremely small leaks. 11 January 2011: Bayer announces plans to restart the East Carbamoylation Center and the new reduced MIC inventory system for aldicarb and carbaryl production, but for a period of no more than 2 years.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX B 171 18 March 2011: As a result of legal challenges and delays that meant missing the production window to meet demand for the 2011 growing season, Bayer announces decision not to restart aldicarb, carbaryl, or MIC production facilities and to permanently shut down the East Carbamoylation Center, ending all MIC and carbamate pesticide production at Institute.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix C Emergency Response and Emergency Preparedness Emergency response is commonly conceived as providing an additional layer of protection that goes beyond engineered safety features (ESFs) such as water curtains and flare systems (CCPS, 2009). That is, the emergency response is intended to be independent of all ESFs so that it can perform even if those systems fail. Indeed, an effective emergency response involves linked onsite and offsite emergency response organizations that perform emergency assessment, hazard operations, population protection, and incident management actions. On the basis of federal guidance for nuclear and chemical emergency preparedness (USNRC/FEMA, 1980; NRT, 1987, 1988), Lindell and Perry (1992, 2006, 2007) defined emergency assessment as actions taken to define the nature and magnitude of an event by evaluating conditions in the facility and the surrounding physical environment—especially plant conditions, chemical releases, and meteorological conditions (McKenna, 2000). Hazard operations consist of preventive and correc- tive actions to control leaks, spills, fires, and stabilize containers (Lesak, 1999). Population protection includes the use of personal protective equipment and safe havens to protect facility personnel. In addition, it includes offsite actions such as warning people in potentially affected areas to shelter in-place or evacuate, providing evacuation transportation support and traffic management, establish- ing public shelters (congregate care facilities for those who lack the funds to pay for hotels/motels or nearby, and providing medical treatment for those who are injured (Perry and Lindell, 2007). Finally, incident management ensures that emergency assessment, hazard operations, and population protection actions are undertaken in a timely and effective manner and that responders have sufficient resources—including support staff, equipment, and facilities—to do their jobs. Effective incident management provides coordination between onsite and offsite 173

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 174 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE emergency response organizations through a mutually agreed emergency clas- sification system and standardized forms for continuing emergency assessments. In addition, coordination between onsite and offsite organizations is facilitated by mutual adoption of organizational structures such as the Incident Command System (DHS, 2008). People sometimes erroneously assume that major disasters are just larger versions of routine emergencies, and so available personnel can improvise a satisfactory response using available resources. In fact, major disasters involve both quantitatively larger and qualitatively different demands that arise from tasks that are not performed, and resources that are not available, during routine operations. Thus, emergency planners need to follow a systematic process that develops accurate assessments of incident demands and community capabilities, identifies the gaps between demands and capabilities, and develops a strategic plan for reducing this gap (Lindell and Perry, 2007). Specifically, they must use hazard/vulnerability analysis to identify, in advance, what are the abnormal inci- dent demands that should be expected and what are the novel emergency response functions that will need to be performed in response to these demands. In addi- tion, they need to identify the organizations that will perform these emergency response functions and the resources those organizations will need in order to perform their emergency response functions. Emergency operations plans and procedures can be developed by following guidance from the federal government (NRT, 1987, 1988; FEMA, 2010) and chemical industry (CMA, 1985), national standards (NFPA, 2010), and accredi- tation programs (EMAP, 2010). These documents are sometimes misinterpreted to suggest that the development of paper plans and procedures is a sufficient condition for adequate emergency preparedness. Instead, development of written plans and procedures should be considered to be a necessary, but not a suffi- cient, condition. At minimum, plans and procedures need to be supplemented by periodic audits to ensure that they are current (e.g., telephone numbers are up to date) and that equipment is properly maintained (e.g., portable instruments are charged and calibrated). In addition to developing emergency operations plans and procedures, emer- gency planners need to conduct training needs assessments to identify any tasks that are critical, infrequent, and difficult (Goldstein and Ford, 2002). Critical tasks are those that are essential to protecting the health and safety of facility personnel, offsite responders, and the offsite population. In addition, although some emergency response tasks are the same as ones performed during normal operations, it is important to identify which of them are performed infrequently and therefore provide few opportunities for emergency responders to practice and develop skilled performance. Finally, some tasks might be difficult to perform because of their cognitive, psychomotor, or physical demands. Effective emer- gency preparedness requires identifying these infrequent, critical, and difficult tasks, selecting the appropriate personnel for each position in the emergency

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX C 175 response organization, and providing the levels of initial and refresher training needed to ensure emergency responders continuing proficiency. Like safety train- ing, emergency response training can be accomplished in a number of different ways that address workers’ abilities and performance motivation (Lindell, 1994). Because of the significant uncertainties about disaster demands, emergency plan- ners need to provide training that facilitates emergency responders’ ability to improvise so that they can develop incident action plans that adapt to the distinc- tive circumstances of each emergency (Ford and Schmidt, 2000; Mendonça and Wallace, 2004). Finally, effective emergency preparedness programs rely on methods such as drills, exercises, and minor incidents. Individual responder drills—as well as tabletop, functional, and full-scale exercises—need to be reviewed by qualified evaluators. Critiques of these drills and exercises can be used not only to identify needs for additional individual training but also can be used as opportunities for organizational learning. That is, these critiques can be used as the basis for revis- ing plans, procedures, and selection and training programs. DEVELOPING AND MAINTAINING EMERGENCY PREPAREDNESS To identify organizational and contextual factors associated with establishing and maintaining emergency preparedness, we conducted a search for articles on emergency preparedness at chemical facilities. This search yielded a number of scholarly articles on emergency preparedness but most of them provide recom- mendations for developing facility emergency preparedness rather than examining factors that influence its development and maintenance. Of the few articles that discuss changes in facility emergency preparedness, most examine the effects that major incidents such as Bhopal exert on subsequent laws and regulations with which chemical facilities must then comply (e.g., Belke and Dietrich, 2005; Joseph et al., 2005; Gerbec and Kontic, 2009). Only two studies have examined factors influencing emergency preparedness at chemical facilities. Quarantelli et al. (1979) found that larger companies had more extensive planning processes than smaller ones, and Lindell and Perry’s (1998) examination of hazardous materi- als—handling firms in Los Angeles, California, found that all facilities in the study were more likely to engage in hazard assessment and emergency preparedness measures than hazard mitigation measures in the year after the 1994 Northridge Earthquake. Moreover, they substantially increased their implementation of hazard mitigation measures such as plant site, plant design, process modification, exter- nal hazard protection, chemical substitution, and administrative controls during that time period. Surprisingly, however, there was no evidence of a relationship between experienced damage and implementation of these mitigation measures. A broader literature on organizational emergency preparedness reveals that businesses generally engage in limited levels of emergency preparedness (Mileti et al., 1993; Drabek, 1994a; Dahlhamer and D’Sousa, 1997). As was the case

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 176 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE in the Quarantelli et al. (1979) study, the most reliable indicator for predicting organizational emergency preparedness is organizational size (Drabek, 1991, 1994a,b; Dahlhamer and D’Souza, 1997; Perry and Lindell, 2007). In addition, some ­studies have found evidence of a positive relationship between disas- ter experience and business emergency preparedness (Dahlhamer and Reshaur, 1996; Dahlhamer and D’Souza, 1997; Webb et al., 2000). Finally, some studies on organizational emergency preparedness have found that other characteristics, including business age, scope (local vs. national) and type may correlate with degree of emergency preparedness, but at this time, the findings are inconsistent across studies. There has been a substantially smaller amount of research on the conditions that facilitate community emergency preparedness (Lindell and Perry, 2001, 2007). An analogue of management support, support from senior elected and appointed officials, as well as the wider community, is an important element in community emergency preparedness but other elements are also important (­Lindell and Perry, 2006, 2007). These include hazard exposure/vulnerability, community resources, extra-community resources, routine staffing/organization, and the type of planning process adopted. In addition, EPA performed a sys- tematic study of community preparedness for chemical accidents and found that there was often poor coordination between plants and communities as well as few communication protocols in place for emergency response (Rogers and Sorensen, 1991; Sorensen and Rogers, 1988­). All of these factors directly or indirectly affect individual outcomes for those participating in the community emergency preparedness system (job satisfaction, organizational commitment, organizational attachment, and organizational citizenship), as well as organizational outcomes such as the quality, timeliness, and cost of products such as hazard/vulnerability analyses, community capability assessments, emergency plans and procedures, training programs, and risk communication programs. SUMMARY Effective emergency response requires pre-incident emergency preparedness to ensure that onsite and offsite emergency response organizations have adequate staffing, training, and resources. There is extensive guidance available for devel- oping and maintaining emergency preparedness, but the level of organizational emergency preparedness is generally modest. It appears that a major impediment is that many organizations underestimate the demands of a major incident, or overestimate their ability to improvise an effective response, or both. Additional impediments to the development of effective emergency preparedness programs are perceptions that emergency preparedness is “an intractable problem and that disaster reduction policies lack clear and measurable performance objectives” (Waugh, 1988). These problems are exacerbated by the disparity between the costs and benefits of effective emergency preparedness programs; such programs

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX C 177 have substantial short-term costs but only “pay off” in the long term. The limited amount of existing research suggests that organizational emergency preparedness is usually determined by factors such as organizational size and disaster experi- ence, but other factors also need to be examined (Lindell and Perry, 2007). ISP strategies can avoid some of the shortcomings of organizational emer- gency preparedness programs by reducing the toxicity of the chemicals being used or produced, the quantity of the chemicals being stored, and the conditions under which they are being stored. However, chemical facility designers need to consider the potential for ISD strategies to transfer risks from communities surrounding fixed-site facilities to those on transportation routes where the lower quantities released are likely to be at least partially offset by lower levels of emergency preparedness. REFERENCES Belke, J. C., and D. Y. Dietrich. 2005. The post-Bhopal and post-9/11 transformations in chemical emergency prevention and response policy in the United States. J. Loss Prevent. Proc. Ind. 18:375-379. CCPS (Center for Chemical Process Safety). 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd ed. Hoboken NJ: John Wiley & Sons. CMA (Chemical Manufacturers Association). 1985. Community Awareness and Emergency Response: Program Handbook. Washington, DC: CMA. Dahlhamer, J. M., and M. J. D’Sousa. 1997. Determinants of business-disaster preparedness in two U.S. metropolitan areas. Int. J. Mass Emerg. Disasters 15:265-281. Dahlhamer, J. M., and L. M. Reshaur. 1996. Businesses and the 1994 Northridge Earthquake: An Analysis of Pre- and Post-disaster Preparedness. Newark, DE: University of Delaware Disaster Research Center. DHS (U.S. Department of Homeland Security). 2008. National Incident Management System. Wash- ington, DC: DHS. Drabek, T. E. 1991. Anticipating organizational evacuations: Disaster planning by managers of tourist- oriented private firms. Int. J. Mass Emerg. Disasters 9:219-245. Drabek, T. E. 1994a. Disaster Evacuation and the Tourist Industry. Boulder, CO: University of Colo- rado Institute of Behavioral Science. Drabek, T. E. 1994b. Risk perceptions of tourist business managers. Environ. Prof. 16:327-341. EMAP (Emergency Management Accreditation Program). 2010. EMAP Standard. Lexington, KY: EMAP. FEMA (Federal Emergency Management Agency). 2010. Developing and Maintaining Emergency Operations Plans, Comprehensive Preparedness Guide (CPG) 101, Ver. 2.0. Washington, DC: FEMA. Ford, J. K., and A. Schmidt. 2000. Emergency preparedness training: Strategies for enhancing real- world performance. J. Hazard. Mater. 75:195-215. Gerbec, M., and B. Kontic. 2009. Implementation of the Seveso II Directive in Slovenia: Survey of implementation and opinions of operators regarding its safety benefits. Saf. Sci. 47:561-568. Goldstein, I. L., and J. K. Ford. 2002. Training in Organizations: Needs Assessment, Development and Evaluation, 4th Ed. Pacific Grove, CA: Brooks/Cole. Joseph, G., M. Kaszniak, and L. Long. 2005. Lessons after Bhopal: CSB a catalyst for change. J. Loss Prevent. Proc. Ind. 18:537-548.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 178 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Lesak, D. M. 1999. Hazardous Materials: Strategies and Tactics. Upper Saddle River, NJ: Prentice-Hall. Lindell, M. K. 1994. Motivational and organizational factors affecting implementation of worker safety training. Pp. 211-240 in Occupational Medicine State of the Art Reviews: Occupational Safety and Health Training, M. J. Colligan, ed. Philadelphia: Hanley and Belfus. Lindell, M. K., and R.W. Perry. 1992. Behavioral Foundations of Community Emergency Planning. Washington, DC: Hemisphere Press. Lindell, M. K., and R.W. Perry. 1998. Earthquake impacts and hazard adjustment by acutely hazard- ous materials facilities following the Northridge earthquake. Earthquake Spectra 14:285-299. Lindell, M. K., and R. W. Perry. 2001. Community innovation in hazardous materials management: Progress in implementing SARA Title III in the United States. J. Hazard Mater. 88:169-194. Lindell, M. K., and R. W. Perry. 2006. Onsite and offsite emergency preparedness. Pp. 1959-1971 in Encyclopedia of chemical processing, S. Lee, ed. New York: Marcel Dekker. Lindell, M. K., and R. W. Perry. 2007. Planning and preparedness. Pp. 113-141 in Emergency Management: Principles and Practice for Local Government, 2nd Ed., K. J. Tierney and W. F. Waugh, Jr., eds. Washington, DC: International City/County Management Association. McKenna, T. 2000. Protective action recommendations based upon plant conditions. J. Hazard. Mater. 75:145-164. Mendonça, D., and W. A. Wallace. 2004. Studying organizationally-situated improvisation in response to extreme events. Int. J. Mass Emergencies and Disasters 22:5-29. Mileti, D. S., J. D. Darlington, C. Fitzpatrick, and P. W. O’Brien. 1993. Communicating Earthquake Risk: Societal Response to Revised Probabilities in the Bay Area. Fort Collins, CO: Colorado State University Hazards Assessment Laboratory and Department of Sociology. NFPA (National Fire Protection Association). 2010. NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. Quincy, MA: NFPA. NRT (National Response Team). 1987. Hazardous Materials Emergency Planning Guide. NRT-1. Washington DC: NRT. NRT. 1988. Criteria for Review of Hazardous Materials Emergency Plans. NRT-1A. Washington DC: NRT. Perry, R. W., and M. K. Lindell. 2007. Emergency Planning. Hoboken, NJ: John Wiley & Sons. Quarantelli, E. L., C. Lawrence, K. J. Tierney, and Q. T. Johnson. 1979. Initial findings from a study of socio-behavioral preparations and planning for acute chemical hazard disasters. J. .Hazard. Mater. 3:79-90. Rogers, G. and Sorensen, J. 1991. Adoption of Emergency Planning Practices for Chemical Hazards in the United States. Journal of Hazardous Materials. 27:3-26. Sorensen, J. H. and G. O. Rogers. 1988. Local Preparedness for Chemical Accidents: A survey of U.S. Communities. Industrial Crisis Quarterly 2:89-108. USNRC/FEMA (U.S. Nuclear Regulatory Commission/Federal Emergency Management Agency).

1. Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and

Preparedness in Support of Nuclear Power Plants. NUREG-0654/FEMA-REP-1. Washington, DC: USNRC/FEMA. Waugh, W. L., Jr. 1988. Current policy and implementation issues in disaster preparedness. Pp. 111- 125 in Managing Disaster: Strategies and Policy Perspectives, L. K. Comfort, ed. Durham, NC: Duke University Press. Webb, G. R., K. J. Tierney, and J. M. Dahlhamer. 2000. Business and disasters: Empirical patterns and unanswered questions. Nat. Hazards Rev. 1:83-90.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix D Policy Context of Inherently Safer Processes This appendix is an expansion of the discussion of the external policy con- text contained in Chapter 7. The purpose of this appendix is not to endorse any regulation or policy. Rather it is to provide a brief overview of the policy context in which inherently safer process assessments exist today. U.S. FEDERAL AND STATE REGULATIONS The U.S. Occupational Safety and Health Administration (OSHA) and Envi- ronmental Protection Agency (EPA) are the two main federal government bodies that administer regulations that potentially mandate, or encourage, inherently safer processes. Of these, OSHA is more relevant inside the plant because of its concern with the immediate safety of workers, whereas EPA regulations focus more on potential ramifications to more general environmental health and safety (Fallon et al., 2007; Malloy, 2008). Occupational Safety and Health Administration The OSHA process safety management of highly hazardous chemicals standard (29 CFR § 1910.119) requires companies handling listed hazardous ­chemicals to conduct a process hazard analysis (PHA), and develop a safety plan in accordance with 29 CFR 1910.119 (see also Fallon et al., 2007). It is there- fore potentially an institutional vehicle for the development of inherently safer processes in hazard planning at OSHA-supervised facilities, although it does not necessarily mandate such an approach. 179

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 180 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Within the process safety management standard, section 1910.119(c) man- dates employee participation in the elaboration of safety plans. The section states: “Employers shall consult with employees and their representatives on the conduct and development of process hazards analyses and on the development of the other elements of process safety management in this standard.” (29 CFR 1910.119 c) Despite this language the extent and methods of employee consultation are not described in the regulation. Buttressing employee participation in hazard manage- ment could be an effective organizational strategy for implementing inherently safer design in facilities with high risk for hazardous events, and warrants further research. Environmental Protection Agency (EPA) EPA policy has considered the possibility of inherently safer processes at least since the early 2000s, but measures regarding chemical accident prevention have tended to focus on prior planning and “inspection and to corrective and pre- ventive maintenance” (Ashford and Zwetsloot, 1999). Therefore, the concept of safety planning is far from new, but the far-reaching ramifications of inherently safer processes appear to require a greater degree of planning and technological investment than do traditional safety strategies that tend to be “failsafe” rather than “foolproof” (Ashford and Zwetsloot, 1999). The difficulties of implementing inherently safer design can be observed in the EPA Risk Management Program (RMP) (EPA, 2001), which is still intention- ally more oriented to risk management than risk prevention (Malloy, 2008), and as a policy matter does not mandate inherently safer processes. Nevertheless, companies dealing with hazardous chemicals must develop accident prevention plans during hazard emergency response planning, but this policy does not exten- sively involve stakeholders outside of firms (CCPS, 2009). Other pertinent regulations and laws include the Pollution Prevention Act (PPA), (which is not primarily directed at accidents) (Ashford and Caldhart, 2010), and the Department of Homeland Security’s Chemical Facility Anti- Terrorism Standards (CFATS) (Malloy, 2008). The post-September 11 approach is particularly amenable to inherently safer design (CCPS, 2009), because the unpredictable nature of terrorist attacks may create challenges for traditional assessments based on internal production risks. However, regulatory bodies have tended to conclude that inherently safer design shifts rather than pre- vents risks (Malloy, 2008). This is an important critique that warrants further research, because of the possibility that inherently safer technology may lead to the reallocating of risk to other areas of the production process (Hendershot, 2010).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 181 EUROPEAN SAFETY REGULATIONS Renewed European Policy for Chemicals The European Union’s Renewed European Policy for Chemicals (REACH) 2007 amendments (EC, 2006) require a registry system for hazardous chemicals, based on the “principle of substitution” (Garcia-Serna et al., 2007). Although REACH is primarily concerned with chemical toxicity, it also contains hazard prevention components. REACH is being gradually phased in, and technical sup- port on risk reduction is available Initially the REACH program was supervised by the European Chemicals Bureau (ECB) (Garcia-Serna et al., 2007), but in 2008 ECB was superseded by the European Chemicals Agency, which now runs a central database and registra- tion procedure. The program, is aimed at both producers and downstream users, and will mandate the progressive substitution of the most dangerous chemicals within a much larger system of registration. The crux of how REACH works in the case of dangerous chemicals is as follows: Substances with properties of very high concern will be made subject to authorization; the Agency will publish a list containing such candidate sub- stances. Applicants will have to demonstrate that risks associated with uses of these substances are adequately controlled or that the socioeconomic benefits of their use outweigh the risks. Applicants must also analyze whether there are safer suitable alternative substances or technologies. If there are, they must pre- pare substitution plans, if not, they should provide information on research and development activities, if appropriate. The Commission may amend or withdraw any authorization on review if suitable substitutes become available (EC, 2007). Seveso and Seveso II In the EU, the Seveso Directive (96/82/EC) revised the framework directive on Major Accident Hazards of Certain Industrial Activities, and for the first time promoted inherently safer processes as the recommended strategy for plant safety reports (Ashford and Zwetsloot, 1999; Zwetsloot and Ashford, 2003). In the late 1990s reforms were made, titled Seveso II (most recently updated in 2005). Seveso II is more directly oriented toward inherently safer processes than is the case for similar regulations in the United States. Under Seveso II, an operator must present a conceptual model for avoid- ing hazardous incidents, as well as documentation supporting the effective- ness of the safety plan (SFK, 2001). A more detailed comparison and examination of Seveso II’s mechanics is outside the scope of this appendix but Seveso II should be a priority for future research. It is also worth mentioning that Seveso II has important land use ramifica- tions. The different models of adoption of its directives in different EU member

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 182 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE countries could provide interesting case studies for comparison (Basta et al., 2008). A preliminary review has found some evidence that European land use regulations are more explicitly oriented to creating frameworks for safer siting (Landucci et al., 2008). While further research into their details is required, two noteworthy examples are: a) “Decreto Ministeriale 9 Maggio 2001, Suppl. Ord. G. U. n.138 del 10/06/01, Requisiti minimi di sicurezza in materia di pianificazione urbanistica e territoriale per zone interessate da stabilimenti a rischio di incidente rilevante.” (Landucci et al., 2008) b) “Major Accident Commission, Technical Committee for Plant Safety (SFK/TAA Germany), Guidance SFK/TAA-GS-1, Recommendations for separation distances between establishments under major accidents ordinance and areas requiring protection within the framework of land use-planning (in German), Bonn (D), 2005” (Landucci et al., 2008) These regulations, and other similar ones, are potentially helpful illustrations of how local and county governments within the EU comply with Seveso II. For example, France employs a consequences-based approach, focusing on damages thresholds, whereas the Netherlands and the United Kingdom regulate on the basis of a risk-based approach, using “calculated risk indexes” (Cozzani et al., 2006).1 The former of these two methods tends to be more conservative, and prioritizes the reduction of inventories of hazardous materials. Therefore, although risk assessment can provide a starting point for analysis, a conse- quences-based approach may be more amenable to the creation of inherently safer land-use policies related to the siting of hazardous facilities (Cozzani et al., 2006). What is particularly different about the European approach, when compared with the U.S. approach, is the fluidity of the integration of land-use policy into safety policy. Example: United Kingdom The United Kingdom is involved in various policies to promote safer design. Health and Safety Executive’s (HSE) Policy and Guidance on Reducing Risks as Low as Reasonably Practicable in Design (HSE, 2003). It is a national level approach to assess safety management at the workplaces. This policy uses lan- guage suggesting an approach favoring inherent safety. However, more definite conclusions will require further research and comparison with OSHA regulations in the United States. 1  The U.S. Chemical Facility Anti-TerrorismStandards (72 Fed. Regist. 17688 [2007])) also uses risk-based performance safety.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 183 The UK also has a system of hazard prevention regulation in line with Seveso II, such as the Installation Handling Hazardous Substances Regulations (NIHHS), Control of Major Accidents Hazards Regulation (COMAH), the Planning Act 1990, and the Planning (Hazardous Substances) Regulations 1992 (Basta et al., 2008). Therefore, not only does the UK currently undertake workplace safety regulations that potentially promote inherently safer processes, but land-use plan- ning also interfaces with hazard planning (Basta et al., 2008). Coordination for these planning processes occurs under the auspices of the HSE, which takes a risk-oriented approach to chemical releases, but consequences-oriented approach to energy sector related risks (Basta et al., 2008). U.S. STATE REGULATIONS New Jersey New Jersey claims to be the first state to have implemented anti-terrorism and inherently safer process design into chemical plant regulation (Politicker NJ 2005), and the NJ Toxic Catastrophe Prevention Act Program is well discussed in current literature (see, e.g., CCPS, 2009). At present there are two primary pieces of legislation under which inherently safer systems and technology are regulated in the state: the New Jersey Domestic Security Preparedness Act (NJ OHSP, 2001) and the Toxic Catastrophe Prevention Act (TCPA) (NJ DEP, 2009; Fallon et al., 2007). New Jersey has the oldest and most developed toxic hazard regulation system in the United States, and its concept of inherently safer processes now extends to all registered facilities. TCPA was first passed in 1986, but only took force in 1988, and it now regulates all facilities using more than 10,000 pounds of listed hazardous substances per year (Fallon et al., 2007). The Bhopal accident inspired the first iteration of the TCPA, and the September 11, 2001, terrorist attacks led state officials to explore expansion the program to include concepts approximating inherently safer process requirements (CCPS, 2009). TCPA is overseen by the New Jersey Bureau of Release Prevention. Facili- ties must submit an offsite consequences report to the Bureau, while the State Domestic Security Preparedness Task Force2 oversees those regulations related to DSPA (Fallon et al., 2007). Using the CCPS’ framework, New Jersey established a concept of inherent safety based on reducing hazardous chemical stocks, find- ing less hazardous substitutes, using hazardous materials in their least dangerous form possible, and designing equipment with aims at eliminating equipment and human error (TCPA as cited in Fallon et al., 2007). The Task Force oversaw the important task of developing sector-specific industry best practices in conjunction with leading facilities. Now, TCPA facilities must, under a 2005 New Jersey executive order, comply with the Task Force’s 2  Overseen by the New Jersey Office of Homeland Security and Preparedness (OHSP).

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 184 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE best practices (Fallon et al., 2007).3 For TCPA facilities, compliance involves conducting a review, and produces a reviewable assessment, of the viability of implementing inherently safer strategies and technology during mandatory vul- nerability assessments related to antiterrorism regulations (CCPS, 2009). This review was a 120-day process and only led to 19 percent of facilities finding new measures, and less than half made no new recommendations. However, CCPS notes that the existing hazard reduction framework had been in place since the 1985 introduction of the TCPA, and many facilities may have already incorpo- rated most practicable inherently safer policies. In sum, inherent safety reviews must be undertaken in all TCPA-regulated processes, and also in the case of vulnerability assessments under New Jersey state security requirements. In terms of creating an institutional environment to facilitate compliance, various consultants are now engaged in providing services to companies regulated under the New Jersey regulations, including, for example, Accu-Tech (2011) and Chilworth (2011). Moreover, New Jersey keeps data and plans prepared under the TSPA and DSPA confidential and privileged (P.L. 1963, c. 73 (C.47:1A-1 et seq; CCPS, 2009). This policy decision stems from a desire to create trust between facilities and regulators. Under the antiterrorism executive order, the New Jersey Domestic Security Preparedness Task Force submitted an inherently safer technol- ogy (IST) checklist to facilities hosting hazardous processes, which is one method recommended by Amyotte et al. (2007). Those authors also recommended policies based upon carefully designed guidewords—such as minimize, substitute, moder- ate, and simplify—that can be incorporated into hazard management planning to improve compliance with checklists. The idea behind checklists and guidewords is standardizing the concepts of inherent safety within the culture of facilities design and process management. On that note, one benefit of the longevity of New Jersey’s program is the potential to examine its effectiveness at standardizing the culture of inherent safety, which may prove necessary in creating programs to encourage more wide spread adoption of inherently safer design and technology. California Contra Costa County Contra Costa’s legislation4 (County Ordinance Chapter 450-8) provides an additional layer of regulation for facilities that are already under California Acci- dental Release Prevention (CalARP) and EPA supervision (CCPS, 2009). The Contra Costa Industrial Safety Ordinance (ISO) dates from 1998 after a series 3  However, under DSPA the number of reporting facilities is much greater, and over 800 facilities had to provide special vulnerabilities assessments (Fallon et al., 2007). 4  The Industrial Safety Ordinance has also been adopted by the City of Richmond, which is in Contra Costa County.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 185 of incidents spurred resident concern (Malloy, 2008). Like New Jersey, Contra Costa is also home to a national-level concentration of chemical plants, which brought heightened safety scrutiny, along with the need to protect the economic base the plants provide. These facilities must submit their safety plans to the county and show, through supporting documentation, that they have “to the greatest extent feasible” implemented safer systems (Malloy, 2008 and County Ordinance Chapter 450- 8.016(d)(3)). Under the Contra Costa Program Guidance document, determina- tions that inherently safer options are not feasible are more strictly scrutinized than in New Jersey. For a facility not to implement an inherently safer process requires conflict with the law, a financial analysis demonstrating economic infea- sibility, or an analysis based upon generally accepted engineering principles that risk will increase (Malloy, 2008). This requires weighing the circumstances, and in practice is designed to elicit proof that facilities have identified and acted to minimize hazard. However, at early stages of the Contra Costa program, efforts were limited by a lack of guidance as to expectations and best practices regard- ing inherently safer systems. CCPS has identified the publication of guidelines as important in fostering reasonable expectations about feasibility (CCPS, 2009). The Contra Costa County program is also much smaller than the New Jersey program, including only nine facilities (seven in the county and two in the City of Richmond): “two Air Products facilities (within the Shell Refinery and the Tesoro Refinery), ConocoPhillips Rodeo Refinery, Air Liquide-Rodeo Hydrogen Plant, General Chemical West’s Bay Point Works, Shell Oil Martinez Refinery and Tesoro Golden Eagle Refinery. The City of Richmond’s Industrial Safety Ordinance (Municipal Code Chapter 6.43, RISO) is almost identical (except for the 2006 amendment) to the County’s Industrial Safety Ordinance. The two facilities located in Richmond that are subject to this ordinance include: Chevron Richmond Refinery and General Chemical West’s Richmond Works” (Contra Costa Health Services, 2011a). Another important difference between the New Jersey initiative and that in Contra Costa is that the CalARP Program Guidance Document5 (compliance plan document) is administered by the Contra Costa Health Services Department, and not a security-oriented or industry-oriented regulator. However, the program’s key elements are very similar to New Jersey’s and include a 5-year incident his- tory, an offsite consequence analysis, process hazard analysis, 3-year compliance audits,6 emergency response planning, and a risk management plan (Contra Costa Health Services, 1998). Newer elements of the program include more focus on “human factors,” including safety culture assessments and security vulnerability analysis (Contra 5  http://cchealth.org/groups/hazmat/california_accidental_release_prevention_guidance_document. php. 6  The county is currently in its fourth round of audits.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 186 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Costa Health Services, 2011b). County administrators claim that major accidents and releases have declined at a steady rate since the ISO’s implementation in 2000.7 It should be noted that in the Contra Costa and New Jersey programs, lim- ited public access to information about the facilities creates barriers to rigorous external evaluation of their performance (Malloy, 2008; CCPS, 2009). Beyond Contra Costa County, other California policies do appear to be rel- evant to inherently safer concepts. These include the Cal/EPA Green Chemistry Initiative, the California Accidental Release Prevention Program (CARPP), and the Silicon Valley Toxic Gas Ordinance. Green Chemistry California Assembly Bill 1879 directs the California Department of Toxic Substances Control (DTSC) to create a system for reducing, substituting, and in some cases banning chemicals of concern (Heartney and Norris, 2008). A “Green Ribbon Science Panel” has been established to advise the California Green Chemistry Initiative (CA DTSC, 2011), which will include a Toxics Information Clearing House. This is a more stringent pollution reduction program than the EPA’s Toxic Release Inventory (TRI), because it gives state regulators the ability to target specific chemicals, and design management and reduction processes for them throughout their lifecycle, including the “design, manufacturing, and distri- bution processes.” (CA DTSC, 2008a,b) This legislation is primarily concerned with exposure. California Accidental Release Prevention (CalARP) Program The CalARP Program requires risk management plans for facilities, as well as assessments of seismic risks, but does not explicitly mandate inherently safer design. It is a program similar to EPA’s Risk Management Program, although stricter and more detailed. One notable difference is the emphasis on stake- holder involvement in the planning process (Sawyer, 2010; Contra Costa Health Services, 2012). On the subject of worker involvement, the regulation requires training and information on safety management planning. However, this process is not central to the regulations, although, the programs administrators do include the following language in a document titled “Agency Guidance”: Never forget about who’s actually running the plant: it’s the “hourly” workers. As CalARP Program regulators, we’re typically only interacting with plant manage- 7  The graphs provided do not include four major chemical accidents or releases (MCAR), which occurred in November 2010 but produced limited effects to the community, nor do they include transportation-related events. This is an important gap in the data, given arguments that reducing onsite storage risk may increase transportation-related risks.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 187 ment, engineers, and “salaried” RMP/PSM staff. In theory, these ­people know how their plant operates and ultimately make decisions on process changes. In reality, it’s the hourly workers who really know the nuances of the operation, and can be invaluable in foreseeing the effects of any proposed modifications. This is one area of the Prevention Program where both the plant manager and the youngest apprentice should be regarded on the same level. Make sure that the plant manager and the hourly workers are both somehow included in this em- ployee participation plan. Don’t forget about contractors too, although if there’s going to be some major change, chances are that contractors are going to be involved as part of the mix at the management level anyway.8 (CA OES, 2005). Santa Clara County Toxic Gas Ordinance In Silicon Valley, Santa Clara County has implemented a Toxic Gas Ordi- nance to control dangerous conditions related to toxic gases. The ordinance dates from 1990 (Stanford University, 2009). This is a targeted program within the semi-conductor industry. SELECTED INTERNATIONAL GUIDELINES United Nations Environmental Program (UNEP) The United Nations Environment Program (UNEP) has produced A Flex- ible Framework for Addressing Chemical Accident Prevention and Preparedness (UNEP, 2009). Discussing the role of stakeholders, UNEP specifically mentions that one role of industrial management is to promote inherently safer processes. The UN’s direct role in managing chemical accident hazard is minimal, but it does have the capability of promoting common practices and discourse in a glob- ally consolidating industry. Therefore, implementation of inherently safer produc- tion within globally fluid supply chains could be aided by the UN framework. Organisation for Economic Cooperation and Development (OECD) Organisation for Economic Cooperation and Development (OECD) has pro- duced a detailed set of guidelines (OECD Guiding Principles for Chemical Acci- dent Prevention, Preparedness, and Response) for developing hazard management planning, and safety procedures in the relevant industries of its member countries. Although the document is not organized around the concept of inherent safety, it does state that: “Public authorities should encourage industry to take measures to improve safety, for example by utilizing the principles of inherently safer technol- 8  See California Regulations: http://www.oes.ca.gov/Operational/OESHome.nsf/PDF/CalARP%20 Guidance%201-31-05/$file/CalARPGuid1-05.pdf.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 188 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE ogy.” (OECD, 2003) Furthermore, the OECD recommends the establishment of safety performance indicator (SPI) programs. What distinguishes the OECD program from others is its extensive and detailed discussion of risk and hazard identification between facilities and stake- holder groups, including workers, the general public, and management. It is also noteworthy that the guidelines involve stakeholders in the assessment of accept- able community risks in the production process. International Labor Organization (ILO) Guidelines The International Labor Organization (ILO) has developed a set of workplace safety guidelines, incorporating a Plan Do Check Act (PDCA) system (SFK, 2001). What distinguishes the ILO model is a focus on employee participation in the creation of health and safety management systems (ILO, 2001). Further research could compare the ILO guidelines with actual practices at chemical plants in the United States. GENERAL COMMENTS Barriers include the perception that inherent safety is impractical or costly, the lack of institutional infrastructure and frameworks for evaluating inherently safer processes, and a lack of standards and guidance measures for existing opera- tions (CCPS, 2009). In order to prove more effective than existing practices, inherently safer programs must be distinguished from mitigation focused on “engineered safety” (device-centered) and “procedural safety” (behaviorally-centered) (Amyotte et al., 2007). Moreover the literature focuses on the benefits of beginning the plan- ning process as early as possible in the production lifecycle (Mary Kay O’Connor Process Safety Center, 2002).9 Current programs, such as those found in New Jersey and Contra Costa County, include broad mandates which might be improved through focusing efforts for improvements on more discrete elements of the production and tech- nology development process. Given that some studies have found that nearly 45 percent of incident causation is attributable to process and equipment integrity and process knowledge failures (Amyotte et al., 2007), these could be crucial phases of process to focus efforts for promoting inherent safety. 9  Malloy (2008) notes that some industry groups (DHS and American Chemical Council) criticize the concept of inherent safety because of its vagueness, arguing that it could lead to arbitrary penalties and results that actually increase facility risk.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 189 REFERENCES AcuTech. 2011. Inherently Safer Technology (IST). AcuTech, Alexandria, VA [online]. Available: http://www.acutech-consulting.com/images/file/AcuTech%20IST%20Flyer.pdf. Accessed: Oct 11, 2011. Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2007. Incorporation of inherent safety principles in process safety management. Process Saf. Prog. 26(4):333-346. Ashford, N. A., and C. C. Caldhart. 2010. Government regulation of environmental and occupa- tional health and safety in the United States and the European Union. Pp. 640-663 in Occu- pational and Environmental Health: Recognizing and Preventing Disease and Injury, 6th Ed., B. S. Levy, D. H. Wegman, S. L. Baron, and R. K. Sokas, eds. New York: Oxford University Press [online]. Available: http://18.7.29.232/bitstream/handle/1721.1/55358/Chapter-30%20_ GovRegOfEnvl%26OccH_9Feb10.pdf?sequence=1. Accessed: Sept. 29, 2011. Ashford, N. A., and G. Zwetsloot. 1999. Encouraging inherently safer production in European firms: A report for the field. J. Hazard. Mater. 73(1-3):123-144. Basta, C., M. Christou, M. Struckl, and B. Ale. 2008. Translating the Risk of Major Accidents into Opportune Safety Distances from Dangerous Establishments: Recent Developments of the Eu- ropean Regulation as Deriving from Selected National Practices. Presentation at the PSAM08 International Congress, May 18-23, 2008, Hong Kong [online]. Available: http://www.delft cluster.nl/website/files//PSAM9_0421_paper.pdf. Accessed: Sept. 30, 2011. CA DTSC (California Department of Toxic Substances Control). 2008a. California Green Chem- istry Initiative, Final Report [online]. Available: http://www.dtsc.ca.gov/ PollutionPrevention/ GreenChemistryInitiative/upload/GREENChem.pdf. Accessed: Sept. 30, 2011. CA DTSC. 2008b. California Green Chemistry Initiative: Frequently Asked Questions. [online]. Available: http://www.dtsc.ca.gov/PollutionPrevention/GreenChemistryInitiative/ upload/FAQs greenchem.pdf. Accessed: Oct. 6, 2011. CA DTSC. 2011. Green Ribbon Science Panel Overview [online]. Available: http://www.dtsc.ca.gov/ PollutionPrevention/GreenChemistryInitiative/GreenRibbon.cfm. Accessed: Oct. 6, 2011. CA OES (California Governor’s Office of Emergency Services). 2005. California Accidental Release Prevention (CAlARP) Program: Administrative Agency Guidance [online]. Available: http:// www.oes.ca.gov/Operational/OESHome.nsf/PDF/ CalARP%20Guidance%201-31-05/$file/ CalARPGuid1-05.pdf. Accessed: Oct. 5, 2011. CCPS (Center for Chemical Process Safety). 2009. Inherently Safer Chemical Processes: A Life Cycle Approach, 2nd Ed. Hoboken, NJ: John Wiley & Sons. Chilworth. 2011. Chilworth Global, Princeton, NJ [online]. Available: http://www.chilworth.com/ consulting_team.cfm. Accessed: Oct. 11, 2011. Contra Costa Health Services. 1998. CalARP Program Guidance Document, July 1, 1998 [on- line]. Available: http://cchealth.org/groups/hazmat/california_accidental_release_ prevention_ guidance_document.php. Accessed: Oct 6, 2011. Contra Costa Health Services. 2011a. Industrial Safety Ordinance [online]. Available: http://cchealth. org/groups/hazmat/industrial_safety_ordinance.php. Accessed: Oct. 6, 2011. Contra Costa Health Services. 2011b. Industrial Safety Ordinance: Annual Performance Review and Evaluation Report, January 25, 2011 [online]. Available: http://cchealth.org/groups/hazmat/pdf/ iso/iso_report_2010.pdf. Accessed: Sept. 30, 2011. Contra Costa Health Services. 2012. Risk Management Program, CalARP and ISO Differences [on- line]. Available: http://cchealth.org/groups/hazmat/differences_rmp_calarp_iso.php. Accessed: Oct. 6, 2011. Cozzani, V., R. Bandini, C. Basta, and M. D. Christou. 2006. Application of land-use planning criteria for the control of major accident hazards: A case-study. J. Hazard. Mater. 136(2):170-180.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 190 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE EC (European Commission). 2006. Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorization and Restriction of Chemicals (REACH), establishing a European Chemicals Agency, amending Directive 1999/45/EC and repealing Council Regulation (EEC) No 793/93 and Commission Regulation (EC) No 1488/94 as well as Council Directive 76/769/EEC and Commission Direc- tives 91/155/EEC, 93/67/EEC, 93/105/EC and 2000/21/EC [online]. Available: http://eur-lex. europa.eu/LexUriServ/ LexUriServ.do?uri=CELEX:32006R1907:en:NOT. Accessed: Oct. 3, 2011. EC. 2007. REACH in Brief. European Commission Environment Directorate General, October 2007 [online]. Available: http://ec.europa.eu/environment/ chemicals/reach/pdf/2007_02_reachin brief.pdf. Accessed Oct. 4, 2011. EPA (U.S. Environmental Protection Agency). 2001. Hazardous Materials Emergency Planning Guide. NRT 1. National Response Team, U.S. Environmental Protection Agency. July 2001 [online]. Available: http://www.epa.gov/oem/docs/chem/ cleanNRT10_12_distiller_complete. pdf. Accessed: Oct. 3, 2011. Fallon, R., D. M. Keller, M. Lenkowsky, T. C. Lung, R. Mosquea, E. Olsen, V. Remoquillo, and P. C. Steele. 2007. Chemical Security in New Jersey: An Overview of Planning, Information Shar- ing, and Response, June 11, 2007. Maxwell School of Syracuse Universitty [online]. Available: http://insct.syr.edu/uploadedFiles/insct/uploadedfiles/PDFs/Chemical%20Security%20in%20 New%20Jersey.pdf. Accessed: Oct. 3, 2011. Garcia-Serna, J., L. Perez-Barrigon, and M. J. Cocero. ��������������������������������������������

1. New trends for design towards sustain-

ability in chemical engineering: Green engineering. Chem. Eng. J. 135(1-3):7-30. Heartney, M. T., and T. H. Norris. 2008. Update 1: California Enacts Sweeping “Green Chemistry” Laws. Client Advisory, October 2008. Arnold & Porter, LLP [online]. Available: http://www. martindale.com/environmental-law/article_Arnold-Porter-LLP_531198.htm. Accessed: Sept. 29, 2011. Hendershot, D. C. 2010. A summary of inherently safer technology. Process Saf. Prog. 29(4):389-392. HSE (Health and Safety Executive). 2003. Policy and Guidance on Reducing Risks as Low as Reason- ably Practicable in Design. Health and Safety Executive, UK [online]. Available: http://www. hse.gov.uk/risk/theory/alarp3.htm. Accessed: Oct. 6, 2011. ILO (International Labor Organization). 2001. Background. Chapter 1 in Guidelines on Occupa- tional Safety and Health Management Systems. ILO-OSH 2001. SafeWork/ILO, Geneva [on- line]. Available: http://www.ilo.org/wcmsp5/groups/public/---ed_protect/---protrav/---safework/ documents/publication/wcms_110496.pdf. Accessed: Oct. 3, 2011. Landucci, G., A. Tugnoli, C. Nicolella, and V. Cozzani. Assessment of inherently safer technologies for hydrogen production. Proceedings of the 5th International Seminar on Fire and Explosion Hazards, Edinburgh, UK, 23-27 April 2007. Edited by D. Drysdale, D. Bradley, V. Molkov and R. Carvel. Published by the School of Engineering and Electronics, University of Edinburgh,

1. ISBN: 978-0-9557497-2-8. Pp. 138-148. Available: http://www.see.ed.ac.uk/feh5/pdfs/

FEH_pdf_pp138.pdf Malloy, T. 2008. Of natmats, terrorists, and toxics: Regulatory adaptation in a changing world. J. Environ. Law Policy 26(1):93-127. Mary Kay O’Connor Process Safety Center. 2002. White Paper: Challenges in Implementing Inherent Safety Principles in New and Existing Chemical Processes. Mary Kay O’Connor Process Safety Center, Texas Engineering Experiment Station, Texas A & M University System, College Sta- tion, TX [online]. Available: http://pscfiles.tamu.edu/library/center-publications/white-papers- and-position-statements/whitepaper_inherentsafety1.pdf. Accessed: Oct. 3, 2011. NJ DEP (New Jersey Department of Environmental Protection). 2009. Toxic Catastrophe Prevention Act (TCPA) Program [online]. Available: http://www.nj.gov/dep/rpp/brp/tcpa/. Accessed: Oct. 11, 2011.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX D 191 NJ OHSP (New Jersey Office of Homeland Security & Preparedness. 2001. New Jersey Domestic Security Preparedness Act [online]. Available: http://www.state.nj.us/njhomelandsecurity/about- us/dsptf.html. OECD (Organisation for Economic Co-operation and Development). 2003. Guiding Principles for Chemical Accident Prevention, Preparedness and Response: Guidance for Industry (Including Management and Labour), Public Authorities, Communities and Other Stakeholders. Series on Chemical Accidents No. 10. Paris: OECD [online]. Available: http://www.oecd.org/data oecd/10/37/2789820.pdf. Accessed: Oct. 7, 2011. Politicker NJ. 2005, November 29. New Jersey Becomes First State to Require Chemical Plant Se- curity Measures to Protect Against Terrorist Attack [online]. Available: http://www.politickernj. com/acting-governor-richard-j-codey-3. Accessed: Oct. 6, 2011. Sawyer, R. 2010. Writen Testimony of Randall L. Sawyer, Director, Contra Costa Health Services, Hearing on “Work Place Safety and Worker Protections in the Gas and Oil Industry” Before the Committee on Health, Education, Labor and Pensions, Subcommittee on Employment and Workplace Safety, U.S. Senate, June 10, 2010 [online]. Available: http://help.senate.gov/imo/ media/doc/Sawyer.pdf. Accessed: Oct. 3, 2011. SFK (Störfall-Kommission-Hazardous Incidents Commission). 2001. Aid for Integration of Safety Management System Pursuant to Annex III of the Hazardous Incident Ordinance of 2000 Within Existing Management Systems. SFK-GS-31. Prepared by the Working Group on Management Systems, Adapted at the 37th Meeting of the Hazardous Incidents Commission (SFK) on May 30, 2001. SFK Major Hazard Commission under the Federal Minister for the Environment, Nature Conservation and Nuclear Safety(BMU), Germany [online]. Available: http://www. kas-bmu.de/publikationen/sfk_gb/sfkgs31engl.pdf. Accessed: Oct. 3, 2011. Stanford University. 2009. Background on Santa Clara County’s Toxic Gas Ordinance [online]. Available: http://www.stanford.edu/dept/EHS/prod/researchlab/lab/tgo/08-133.pdf. Accessed: Oct. 11, 2011. UNEP (United Nations Environment Programme). 2009. A Flexible Framework for Addressing Chemical Accident Prevention and Preparedness: United Nations Environment Programme, January 27, 2009 [online]. Available: http://www.unep.fr/scp/sp/saferprod/pdf/Flexible Framework_Guidance_270109.pdf. Accessed: Oct. 7, 2011. Zwetsloot, G., and N. A. Ashford. 2003. The feasibility of encouraging inherently safer production in industrial firms. Safety Sci. 14(2/3): 219-240.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix E Meeting Agendas Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience The National Academy of Sciences Keck Center 500 Fifth Street, N.W., Room 100 Washington, DC 20001 AGENDA February 9, 2011 10:30 a.m. Welcome

• Elsa Reichmanis, Committee Chair 10:35 a.m. Overview of the National Academy of Sciences Study

• Kathryn Hughes, National Research Council 10:50 a.m. Context of the Study and Overview of CSB Investigation

• Amy McCormick and Lucy Sciallo-Tyler, U.S. Chemical Safety and Hazard Investigation Board (Study Sponsors) 11:30 a.m. Lunch

• Lunch available in the Keck Center Atrium on the 3rd floor 12:30 p.m. Overview of the use of MIC at Bayer CropScience

• Steven Smythe, Bayer CropScience 2:30 p.m. Overview of Inherently Safer Chemical Processes and Practices

• Scott Berger, Center for Chemical Process Safety, AIChE

• Randall Sawyer, Contra Costa County 193

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 194 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE 3:20 p.m. Break 3:30 p.m. Defining Inherently Safer Processes at DHS

• George Famini and George Emmett, DHS Chemical Security Analysis Center 4:00 p.m. Public Comment Session

• Please sign up to speak during the public comment session

• All comments limited to 3 minutes 4:30 p.m. Transition to Just-in-Time Production of MIC

• John Carberry, Carberry EnviroTech 5:15 p.m. Adjourn Open Session Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience West Virginia State University Alumni Center Institute, WV 25112 AGENDA March 21, 2011—WVSU Alumni Center 6:15 p.m. Public Comment Session

• Please sign up to speak during the public comment session

• All comments limited to 3 minutes

Welcome

• Elsa Reichmanis, Committee Chair

Overview of National Academy of Sciences Study

• Kathryn Hughes, National Research Council 8:15 p.m. Adjourn Open Session

• Note: May adjourn earlier if no additional comments March 22, 2011—WVSU Alumni Center 11:20 a.m. Presentation—Bayer CropScience

• EHS and Training Procedures and Policies 12:30 p.m. Adjourn Open Session

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX E 195 Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience National Academies Keck Center 500 Fifth Street, NW, Room 100 Washington, DC 20001 AGENDA May 24, 2011—Keck Center, Room 105 9:30 a.m. Kanawha Putman Emergency Planning Committee (via telephone)

• Matthew Blackwood et al. 10:15 a.m. Overview of the EPA Risk Management Program (tentative)

• Craig Mattheisson, EPA Inherently Safer Chemical Processes: The Use of Methyl Isocyanate (MIC) at Bayer CropScience National Academies Jonsson Center Woods Hole, Massachusetts AGENDA August 8, 2011 11:00 a.m. Patrick Ragan, Bayer CropScience

• Vice President Quality, Health, Safety and Environment, North America

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix F Biographies of Committee Members Elsa Reichmanis (NAE) is a professor of chemical and biomolecular engineer- ing at the Georgia Institute of Technology. Prior to joining Georgia Tech, she was director of materials research at Bell Labs, Alcatel-Lucent. She is noted for the discovery, development, and engineering leadership of new families of lithographic materials and processes that enable very large scale integration manufacturing. Her research interests include the design and development of polymeric and hybrid organic/inorganic materials for electronic and photonic applications. A particular focus relates to organic/polymer semiconducting mate- rials and processes for plastic electronics and photovoltaics. She is the recipient of several awards, was elected to the National Academy of Engineering in 1995, and has participated in several National Research Council (NRC) activities. She currently serves as a member of the National Science Foundation (NSF) Math and Physical Sciences Advisory Committee, she recently served as cochair of the NRC Board on Chemical Sciences and Technology, and was a member of the Visiting Committee on Advanced Technology of the National Institute of Standards and Technology (NIST). She is an elected member of the Bureau of the International Union for Pure and Applied Chemistry (IUPAC). She has been active in the American Chemical Society throughout her career, having served as 2003 President of the Society. In other technical activities, she served as a member of the Air Force Scientific Advisory Board and is an associate editor of the ACS journal, Chemistry of Materials. Paul Amyotte is a professor of chemical engineering in the Department of Pro- cess Engineering and Applied Science, and the C.D. Howe Chair in Engineering, at Dalhousie University, Halifax, Canada. He holds a bachelor’s degree from the 197

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 198 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Royal Military College of Canada, a master’s from Queen’s University, and a Ph.D. from the Technical University of Nova Scotia, all in chemical engineering. He is a fellow of the Chemical Institute of Canada, the Engineering Institute of Canada, and Engineers Canada. He is a past president of the Canadian Society for Chemical Engineering and of the Association of Professional Engineers of Nova Scotia, and is a past chair of the Canadian Engineering Qualifications Board. He is the editor of the Journal of Loss Prevention in the Process Industries, and has recently served as chair of the Safety and Security Strategic Projects Panel of the Natural Sciences and Engineering Research Council of Canada. Dr. Amyotte’s teaching, research, and practice interests are in the areas of process safety, inher- ently safer design, and dust explosion risk reduction. He has consulted to industry, government, and academia in these and related areas, and has published or pre- sented approximately 180 papers in the field of industrial safety. Recent research accomplishments and professional engagements include the delivery of keynote lectures at the 2010 Mary Kay O’Connor Process Safety Center Annual Sympo- sium and Nanosafe 2010 (International Conference on Safe Production and Use of Nanomaterials), expert testimony at the U.S. Chemical Safety and Hazard Investigation Board public hearing on the Kleen Energy natural gas explosion (June 2010), and coauthorship with Professor Trevor Kletz on the second edition of Process Plants: A Handbook for Inherently Safer Design published by the Taylor & Francis Group in 2010. Peter Beak (NAS) is CAS Professor Emeritus at the University of Illinois at Urbana-Champaign. Dr. Beak’s research interests are in synthetic, structural, and mechanistic organic chemistry, new reaction processes, synthetic methodology, and reactive intermediates, and his work has clarified the effect of molecular environment on structure—stability relationships, provided new reactions that are widely used for chemical synthesis, and identified novel reactive intermediates. His current research involves the determination of reaction trajectories in atom- transfer reactions and asymmetric synthesis. Dr. Beak has held editorships, lec- tureships, and leadership positions in professional organizations. He has received a number of awards, lectured around the world, and served as research advisor for more than 100 graduate and postdoctoral students. Dr. Beak served on the NRC committee that authored the 1995 edition of Prudent Practices in the Laboratory. Dr. Beak is a member of the National Academy of Sciences (elected in 2003) and the American Academy of Arts and Sciences. He received his B.A. from Harvard University in 1957 and his Ph.D. from Iowa State University in 1961 and then joined the faculty at Illinois. Michael L. P. Elliott is the associate director, Center for Quality Growth and Regional Development, and associate professor, with joint appointments to the Schools of City and Regional Planning and Public Policy at the Georgia Insti- tute of Technology. He is a cofounder and has served as codirector of both the

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX F 199 Consortium on Negotiation and Conflict Resolution and the Southeast Negotia- tion Network. Dr. Elliott’s work, both as a researcher and mediator, focuses on community engagement, environmental dispute management, risk perception and management, and environmental planning and policy. His particular expertise lies in the design and evaluation of environmental dispute resolution and participatory processes, and in the mediation of public policy disputes, especially as they relate to toxics and their management. In these capacities, he has worked regionally on issues ranging from specific conflicts over solid and hazardous waste and the sit- ing and managing of locally unwanted facilities to the design of local and regional policies for managing environmental risk, natural resources, and the quality of growth. Nationally, he has worked with agencies such as the U.S. Environmental Protection Agency, the National Park Service, the Army Environmental Policy Institute, the U.S. Council on Environmental Quality, and the President’s Confer- ence on Cooperative Conservation. Internationally, he has provided consultations and training for resolving environmental and land disputes in Estonia, Israel and Palestine, Nicaragua, Kazakhstan, and Germany. Dr. Elliott received his B.S. and Ph.D. from Massachusetts Institute of Technology and his M.C.P. from the University of California, Berkeley. Wayne B. Gray holds the John T. Croteau Chair in Economics at Clark Univer- sity, where he has taught since 1984, when he received his Ph.D. in economics from Harvard University. Dr. Gray is also a research associate at the National Bureau of Economic Research and the director of the Boston Census Research Data Center. He has served as a member of the U.S. Environmental Protection Agency’s (EPA’s) Advisory Council for Clean Air Compliance Analysis, the Science Advisory Board for Massachusetts’ Executive Office of Environmental Affairs, and a National Research Council committee examining proposed changes in EPA’s New Source Review program. Dr. Gray’s research focuses on the effec- tiveness and economic impact of government regulation of environmental and workplace hazards, including studies on productivity, investment, and plant loca- tion, working with plant-level data for steel mills, oil refineries, and pulp and paper mills. He has examined regulation of air and water pollution, and measured the effects of enforcement on compliance status and pollution emissions. He has also written several papers on the effectiveness of Occupational Safety and Health Administration enforcement activity, examining impacts on regulatory compli- ance, workplace injuries, and exposures to hazardous substances. Dennis C. Hendershot has been a staff consultant for the Center for Chemical Process Safety (CCPS) since 2005, and serves as editor of the monthly CCPS Process Safety Beacon. Mr. Hendershot spent 35 years working for Rohm and Haas Company, in process research and development for a variety of agricultural, chemical, acrylic monomer, and polymer processes. Since the late 1970s he has worked in development and implementation of process safety management pro-

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 200 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE grams, including HAZOP, fault tree analysis, quantitative risk analysis, incident investigation, and process risk management systems. From 2005 through 2008, Mr. Hendershot worked with Chilworth Technology as a principal process safety specialist. Mr. Hendershot is a fellow of the American Institute of Chemical Engi- neers (AIChE), a fellow of the Center for Chemical Process Safety, and a member of the American Chemical Society. Mr. Hendershot was chair of the Safety and Health Division of AIChE, and a member of the AIChE Board of Directors. He has chaired a number of subcommittees of CCPS, including inherently safer design, risk assessment, hazard evaluation procedures, reactive chemistry, risk tolerance criteria, and undergraduate education. Mr. Hendershot has received the AIChE Doyle Award for the best paper presented at the annual Loss Prevention Symposium twice (1989 and 2002), and received AIChE’s Walton-Miller Award for contributions to process safety in 2006. In 2000, the Mary Kay O’Connor Process Safety Center at Texas A&M University presented Mr. Hendershot with its Merit Award for contributions to Process Safety. Andrea Kidd Taylor is a lecturer at the Morgan State University (MSU) School of Community Health and Policy (SCHP) in Baltimore, Maryland. She has more than 25 years’ experience in occupational and environmental health and safety. Before joining the MSU faculty, Dr. Taylor served a 5-year term on the U.S. Chemical Safety and Hazard Investigation Board (CSB), a board established under the Clean Air Act Amendments of 1990 to investigate chemical accidents at fixed facilities, an appointment that she received from President Clinton with confirmation by the U.S. Senate. Prior to the CSB, she worked as an industrial hygienist and occupa- tional health policy consultant for the United Auto ­Workers in Detroit, Michigan. Dr. Taylor serves as an executive board member of the American Public Health Association and as a member of the Beyond Pesticides/National Coalition against the Misuse of Pesticides Advisory Board. She formerly served as a member of the U.S. Presidential Advisory Committee on Gulf War Veterans’ Illnesses and as a health representative on the National Advisory Committee on Occupational Safety and Health (NACOSH). She has authored many publications, including articles that highlight minority workers, chemical safety, and disease and injury prevention. Dr. Taylor was selected by the MSU-SCHP students in 2007 and 2009 to receive the Golden Apple Award for excellence in teaching and advising. Her research interests are occupational and environmental health and safety interven- tions and policies, indoor air quality in public schools, minority workers, and the prevention of environmental exposure to pests and pesticides. Michael K. Lindell has a graduate degree in Social Psychology from the Univer- sity of Colorado (1975) with a specialty in disaster research and has completed hazardous materials emergency responder training through the Hazardous Mate­ rials Specialist level. Dr. Lindell has nearly 40 years of experience in the field of emergency management, during which time he has conducted 47 major research

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX F 201 projects, many funded by the National Science Foundation, on the processes by which individuals and organizations respond to natural and technological hazards. In addition, he has had extensive experience in providing technical assistance to government agencies, industry groups, and private corporations in development of emergency plans and procedures. Professor Lindell organized and chaired an American Society of Civil Engineers Specialty Conference on Hazardous Facilities and served twice as Secretary of the Executive Commit- tee for the ASCE Council on Natural Disaster Reduction. He co-chaired the organizing committee for a conference on protective action decision making in nuclear power plant accidents and was a member of the steering committee for a similar conference on protective action decision making in chemical emergen- cies. He participated in NSF’s Second Assessment of Research and Applications on Natural Hazards, serving as a member of the committee on Preparedness and Response, and chairing the committee on Adoption, Implementation, and Evaluation of Hazard Adjustments. He has served on eight consultant panels for the International Atomic Energy Agency in developing planning guidance for response to nuclear and radiological incidents, has made presentations to five National Research Council panels, and served as a member of two National Research Council ­panels—Disasters Research in Social Sciences and Assessing Vulnerabilities Related to the Nation’s Chemical Infrastructure. Professor Lindell has made nearly 200 presentations before scientific societies and short courses for emergency planners, as well as being an invited participant in workshops on risk communication and emergency management in the United States and internationally. He has written extensively on emergency management and is the author of more than 80 technical reports, 100 journal articles and book chapters, and 10 books/monographs. The latter include a book on risk communication in multiethnic communities (Sage, 2004) and a textbook on community emergency planning (Wiley, 2007). Professor Lindell is currently a member of the federal Advisory Committee on Earthquake Hazards Reduction and is completing his term as editor of the International Journal of Mass Emergencies and Disasters. Jacqueline MacDonald Gibson is an assistant professor in the Department of Environmental Sciences and Engineering at the University of North Carolina, Chapel Hill. She conducts interdisciplinary research on the quantification of risks due to environmental contamination and on the quantitative comparison of policy options for controlling environmental risks. As an example, she is the principal investigator for a study to assess public health risks due to environmen- tal contamination in the United Arab Emirates and to develop a national strategy to reduce those risks. Dr. MacDonald Gibson earned a dual Ph.D. degree from the Department of Engineering and Public Policy and the Department of Civil and Environmental Engineering at Carnegie Mellon University in 2007. Prior to returning to school in 2003 to study for her Ph.D., she was a senior engineer at the RAND Corp. While at RAND, she served as liaison to the White House Office of

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 202 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Science and Technology Policy. She also previously was associate director of the Water Science and Technology Board, a unit of the National Research Council of the National Academy of Sciences. In those previous positions, she led a range of studies including assessment of options for improving potable water service to small U.S. communities, evaluation of regulatory requirements for the reme- diation of contaminated groundwater, assessment of research priorities for new environmental remediation technologies, evaluation of research on alternative methods for detecting and cleaning up landmines, and evaluation of risk assess- ment methods for sites contaminated with unexploded military ordnance. She has given briefings on these and other topics to a variety of federal officials, members of Congress and their staffs, and institutional advisory boards. Dr. MacDonald Gibson earned an M.S. degree from the Department of Civil and Environmental Engineering at the University of Illinois, Urbana-Champaign, and a B.A. in math- ematics from Bryn Mawr College. Jeffrey J. Siirola (NAE) is currently retired from the Eastman Chemical Com- pany where he was a technology fellow in Eastman Research in Kingsport, ­Tennessee. His areas of interest include chemical process synthesis, computer- aided conceptual process engineering, engineering design theory and meth- odology, chemical process development and technology assessment, resource conservation and recovery, sustainable development and growth, artificial intelli- gence, nonnumeric computer programming, and chemical engineering education. Dr. Siirola is secretary and a member of the Board of Directors of the Accredita- tion Board for Engineering and Technology. He is also a trustee and past president of CACHE (Computer Aids for Chemical Engineering Education), and a member of the American Chemical Society, the American Association for Artificial Intel- ligence, and the American Society for Engineering Education. He has served on numerous National Science Foundation and National Research Council panels, and on the advisory boards of several journals and chemical engineering depart- ments. Dr. Siirola is a member of the National Academy of Engineering and was the 2005 president of the American Institute of Chemical Engineers. He received a B.S. in chemical engineering from University of Utah in 1967 and a Ph.D. in chemical engineering from the University of Wisconsin-Madison in 1970.

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. Appendix G Acronyms ACS American Chemical Society AHP Analytic Hierarchy Process AIChE The American Institute of Chemical Engineers ASCE Council on Natural Disaster Reduction BCA Benefit-Cost Analysis BC Hydro British Columbia Hydro and Power Authority CAAA U.S. Congress of the Clean Air Act Amendments CACHE Computer Aids for Chemical Engineering Education CalARP California Accidental Release Prevention CARPP California Accidental Release Prevention Program CCPS Center for Chemical Process Safety CEI Dow Chemical Exposure Index CFATS Department of Homeland Security’s Chemical Facility Anti- Terrorism Standards CLC The Institute Community Liaison Committee CMA Chemical Manufacturers Association COMAH Control of Major Accidents Hazards Regulation CPS Chemical Process Safety CSB U.S. Chemical Safety and Hazard Investigation Board CSR Corporate Social Responsibility DHS U.S. Department of Homeland Security DSPA New Jersey Domestic Security Preparedness Act 203

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 204 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE DTSC California Department of Toxic Substances Control ECB European Chemicals Bureau ECC East Carbamoylation Complex EHS Environment, Health and Safety EP Emergency Preparedness EPA U.S. Environmental Protection Agency EPCRA Emergency Planning and Community Right-to-Know Act (also known as SARA Title III) ERPG Emergency Response Planning Guidelines ESF Engineering Safety Feature EU European Union F&EI Dow Fire and Explosion Index FMECA Fault Tree Analysis; Event Tree Analysis; and Failure Modes, Effects and Criticality Analysis HAZOP Hazard and Operability Analysis HCl Hydrogen Chloride HQI Health Quotient Index HSE Health and Safety Executive IBI Inherent Benign-ness Indicator ICI Imperial Chemical Industries ILO International Labor Organization INFORMS Institute for Operations Research and the Management Sciences INSET INherent SHE Evaluation Tool INSIDE INherent SHE [Safety, Health, Environment] In DEsign iRET Integrated Risk Estimation Tool ISD Inherently Safer Design I2SI Integrated Inherent Safety Index ISI Inherent Safety Index ISIM Inherent Safety Index Module ISL Inherent Safety Level ISO The Contra Costa Industrial Safety Ordinance ISP Inherently Safer Processes IST Inherently Safer Technology IUPAC Bureau of the International Union for Pure and Applied Chemistry KPEPC Kanawha/Putnam Local Emergency Planning Committee KPIs Key Performance Indicators KVEPC Kanawha Valley Emergency Planning Committee

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. APPENDIX G 205 LEPC Local Emergency Planning Committees MAU Multi-Attribute Utility MAUT Multi-Attribute Utility Theory MCC N-Methyl Carbomoyl Chloride MIBK Methyl Isobutyl Ketone MIC Methyl isocyanate MMA Mono-Methylamine NACOSH National Advisory Committee on Occupational Safety and Health NAS National Academy of Sciences NCF Naphthylchloroformate NIST National Institute of Standards and Technology NIHHS Installation Handling Hazardous Substances Regulations NRC National Research Council NSF National Science Foundation OECD Organisation for Economic Cooperation and Development OHI Occupational Health Index OSHA United States, Occupational Safety and Health Administration PCMIC People Concerned about MIC PDCA Plan Do Check Act PFD Process Flow Diagram PHA Process Hazard Analysis PIIS Loughborough Prototype Index of Inherent Safety PPA Pollution Prevention Act PRI Process Route Index PRHI Process Route Healthiness Index PSAs Probabilistic Safety Analyses PSM Process Safety Management QAISP Qualitative Assessment for Inherently Safer Design REACH European Union’s Renewed European Policy for Chemicals RISO The City of Richmond’s Industrial Safety Ordinance RMP Risk Management Program SERC State Emergency Planning Committees SFK/TAA Major Accident Commission, Technical Committee for Plant Safety (Germany) SIS Safety Instrumented Systems

The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience Copyright National Academy of Sciences. All rights reserved. 206 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE SPI Safety Performance Indicator SREST Substance, Reactivity, Equipment, and Safety Technology TCPA Toxic Catastrophe Prevention Act TORCAT Toxic Release Consequence Analysis Tool TRI EPA’s Toxic Release Inventory UCC Union Carbide Corporation UCIL Union Carbide India Limited UNEP United Nations Environment Program VSL Value of a Statistical Life VZs Vulnerable Zones WCC West Carbamoylation Complex

FD06449 ｜ 2012_美国_CSB_Chevron Richmond 炼油厂 火灾 - Chevron Richmond Refinery Fire__最终报告_2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所：化工/石化 ｜ 起火原因： ｜ 来源格式：pdf

19 potential worker fatalities, 6 injuries, 15,000 people sought medical treatment Oxygen source Ignition source People present “Hot Zone” not of sufficient size to protect personnel Released process fluid autoignited Leak in 4-Sidecut line 4-Sidecut piping component was extremely thin No formal method to communicate, implement, oversee and track to completion ETC findings and recommendations Line constructed of variable corrosion rate-prone carbon steel Turnaround team relied on inspection data Flammable material released PHYSICAL EVENTS AND CONDITIONS OUTCOME CHEVRON INDUSTRY CODES AND STANDARDS Increased sulfidation corrosion rates in low- silicon carbon steel Decision to remove insulation to identify leak location rather than shut down unit Essential process safety analyses not required by regulator No requirement for ALARP No Damage Mechanism Hazard Review performed Thorough safeguard evaluation not conducted in PHA Refer to Chevron Regulatory Report Refer to Chevron Interim Investigation Report Refer to Chevron Final Investigation Report LEGEND Chevron reliability programs not effective to implement ETC Sulfidation Failure Prevention Initiative No guiding emergency leak response protocol in place 100% component inspection not in Richmond Inspection Plan Consequences of potential damage mechanisms were not evaluated Unit metallurgists were not consulted Minimal industry emergency leak response protocol requirements Inconsistent API standards API does not require 100% component inspection Regulatory regime reactive and activity-based rather than goal-based Regulators had little input into safety precautions in the refinery. Assumption that non-inspected components were of sufficient thickness Important safety projects not brought to management rather than IMPACT team for approval if outside framing document requirements Requests for replacement or 100% inspection outside of framing document requirements Low-silicon component not inspected Inspection data did not indicate pipe was thin Risk of catastrophic failure not perceived by decision makers Trust in management Stop Work uncommon for shutting down plant “Stop Work” not called Past practice is to keep running with a small leak Recommendations to replace or 100% inpect 4-Sidecut line not implemented T-Min lowered so 4-sidecut could stay in operation Chevron did not use API 574 default values Chevron allowed inspector to lower alert thickness No MOC performed to evaluate risk of new T-Min Thorough inherently safer systems analysis not conducted in PHA Regulator does not require or oversee safety culture assessment follow-up action items

FD06450 ｜ 2012_美国_Chevron Richmond 炼油厂 火灾 - Chevron Richmond Refinery Fire__最终报告.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所：化工/石化 ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INTERIM INVESTIGATION REPORT

CHEVRON RICHMOND REFINERY FIRE

CHEVRON RICHMOND REFINERY RICHMOND, CALIFORNIA AUGUST 6, 2012 KEY ISSUES • INHERENTLY SAFER DESIGN • DAMAGE MECHANISM HAZARD REVIEW • EFFECTIVE ANALYSIS OF PROCESS SAFEGUARDS IN PROCESS HAZARD ANALYSIS

Chevron Richmond Refinery Interim Investigation Report April 2013

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Chevron Richmond Refinery Interim Investigation Report April 2013

3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Summary On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, experienced a catastrophic pipe failure in the #4 Crude Unit. The pipe ruptured, releasing flammable, hydrocarbon process fluid which partially vaporized into a large vapor cloud that engulfed nineteen Chevron employees. All of the employees escaped, narrowly avoiding serious injury. The flammable portion of the vapor cloud ignited just over two minutes after the pipe ruptured. The ignition and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of unknown and unquantified particulates and vapor traveling across the Richmond, California, area. In the weeks following the incident, approximately 15,000 people from the surrounding area sought medical treatment due to the release. Testing commissioned by the U.S. Chemical Safety and Hazard Investigation Board (CSB) and the California Division of Occupational Safety and Health (Cal/OSHA) determined that the pipe failed due to thinning caused by sulfidation corrosion, a common damage mechanism in refineries. As a result of the incident, the Chevron Richmond Refinery crude unit remains out of commission over eight months later. In addition, Cal/OSHA issued the refinery 17 citations related to the incident and eight additional citations, with a total proposed fine of nearly one million dollars. In this interim report, the CSB is issuing recommendations to Chevron, the City of Richmond, Contra Costa County, Cal/OSHA, the State of California, and the U.S. Environmental Protection Agency, addressing the need for inherently safer design, rigorous and documented damage mechanism hazard reviews, and thorough analyses of process safeguards. This interim investigation report contains detailed analyses of and makes recommendations to Chevron and regulatory bodies at the local, state, and federal level. The CSB believes the findings and recommendations presented in this report can be applied to refineries, chemical plants, and other industries nationwide to improve process safety. The CSB plans to release a comprehensive Final Investigation Report later in 2013 that will include analyses and recommendations relating to technical and regulatory investigation findings which are not included in this interim report. The Final Investigation Report will cover topics including: the importance of having a competent, well-funded regulator and an adaptable regulatory regime; Chevron safety culture; process safety indicator data collection and reporting; emergency planning and response; stop work authority; and recommendations for improvement of petroleum industry standards and recommended practices. Some of these issues are previewed at the end of this interim report under Additional Issues Currently Under Investigation.

Chevron Richmond Refinery Interim Investigation Report April 2013

4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table of Contents Figures ........................................................................................................................ 5 Acronyms and Abbreviations .................................................................................... 6 Background and Findings .......................................................................................... 8 Sulfidation Corrosion ...............................................................................................16 Sulfidation Corrosion Inspection Techniques ..........................................................21 Chevron Sulfidation Corrosion Knowledge and Expertise .....................................24 Other Significant Sulfidation Occurrences ..............................................................27 Process Hazard Analysis ..........................................................................................31 Operational Changes ................................................................................................33 Chevron Sulfidation Corrosion Inspection and Mitigation .....................................36 Inherently Safer Systems .........................................................................................40 Regulatory Oversight ...............................................................................................46 Recommendations ....................................................................................................53 Additional Issues Currently Under Investigation ....................................................59 Regulatory Oversight ............................................................................................59 Emergency Planning and Reporting .....................................................................61 Emergency Response ............................................................................................62 Safety Culture .......................................................................................................62 References ................................................................................................................65

Chevron Richmond Refinery Interim Investigation Report April 2013

5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Figures Figure 1. The burned remains of the fire truck that was consumed by the fire.

............................................ 9 Figure 2. Vapor cloud over Richmond area and smoke from Chevron Richmond Refinery fire

............... 10 Figure 3. Initial vapor cloud formation and subsequent ignition

................................................................ 11 Figure 4. C-1100 Crude Unit Atmospheric Column and Upstream Process Equipment

............................ 12 Figure 5. Overhead view of the equipment in the #4 Crude Unit

............................................................... 13 Figure 6. 4-sidecut line configuration……………………………………………………………...……..14 Figure 7. Photo of rupture on 4-sidecut 52-inch component

...................................................................... 15 Figure 8. Graph showing how corrosion rates increase in carbon steel.

..................................................... 18 Figure 9. 4-sidecut piping sample

.............................................................................................................. 20 Figure 10. Modified McConomy Curves from API RP 939-C

................................................................... 23 Figure 11. Chevron’s key sulfidation events between 1974 and 2013.

...................................................... 24 Figure 12. Schematic of failed piping from the Chevron Salt Lake Refinery.

........................................... 28 Figure 13. Failed piping component that resulted in the 2007 Richmond crude unit fire.

.......................... 29 Figure 14. Percentage increase of the sulfur content in the 4-sidecut.

........................................................ 34 Figure 15. Key events at the Richmond refinery between 1998 and 2013.

................................................ 36 Figure 16. Hierarchy of controls.

................................................................................................................ 41

Chevron Richmond Refinery Interim Investigation Report April 2013

6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Acronyms and Abbreviations ALARP As Low As Reasonably Practicable API

American Petroleum Institute ASTM American Society for Testing and Materials BIN

Business Improvement Network bpd

Barrels Per Day BPTC BP Texas City CAA

Clean Air Act Cal/OSHA California Division of Occupational Safety and Health CCPS Center for Chemical Process Safety CCR California Code of Regulations Chevron ETC Chevron Energy Technology Company CML

Condition Monitoring Locations CSB

U.S. Chemical Safety and Hazard Investigation Board CSHO Compliance Safety and Health Officer CWS

Community Warning System EPA

Environmental Protection Agency °F

degree Fahrenheit HSE

Health and Safety Executive ISO

Industrial Safety Ordinance ISS

Inherently Safer Systems IST

Inherently Safer Technology KPI

Key Process Indicator

Chevron Richmond Refinery Interim Investigation Report April 2013

7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD LEPC Local Emergency Planning Committee LOPA Layers of Protection Analysis MOC Management of Change NEP

National Emphasis Program OEM U.S. EPA Office of Emergency Management OSHA Occupational Safety and Health Administration P&P

Policy and Procedures PHA

Process Hazard Analysis PMI

Positive Materials Identification psig

Pounds Per Square Inch Gauge PSM

Process Safety Management RISO City of Richmond Industrial Safety Ordinance RLOP Richmond Lube Oil Project RMP

Risk Management Plan SIP

Shelter-In-Place TML

Thickness Monitoring Location UK

United Kingdom USW United Steelworker International Union wt. % Weight Percent

Chevron Richmond Refinery Interim Investigation Report April 2013

8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Background and Findings

1. On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California (Chevron

Richmond Refinery), experienced a catastrophic pipe rupture in the #4 Crude Unit (crude unit). The ruptured pipe released a flammable hydrocarbon process fluid which then partially vaporized into a large vapor cloud that engulfed nineteen Chevron U.S.A. Inc. (Chevron) employees. At 6:33 pm, approximately two minutes after the release, the flammable portion of the vapor cloud ignited.i

i Surveillance footage provided by Chevron. Chevron clarified to CSB that video time is approximately 5 minutes out of sync. The video can be found at Eighteen of the employees safely escaped from the cloud just before ignition; one employee, a firefighter, was inside a fire engine that caught fire when the vapor cloud ignited (Figure 1). Because he was wearing full body fire-fighting protective equipment, he was able to make his way to safety. Six Chevron employees suffered minor injuries during the incident and subsequent emergency response efforts. http://www.csb.gov/videoroom/detail.aspx?VID=69 (accessed February 8, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 1. The burned remains of the fire truck that was consumed by the fire. A firefighter was in the cab when the vapor cloud ignited. The fire truck was positioned approximately 65 feet from the leak location.

Chevron Richmond Refinery Interim Investigation Report April 2013

10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• The ignition and subsequent continued burning of the hydrocarbon process fluid resulted in a

large plume of unknown and unquantified particulates and vapor traveling across the Richmond, California, area (Figures 2 and 3). This resulted in a Community Warning System (CWS) Level 3 alert,i and a shelter-in-placeii (SIP) was issued at 6:38 pm1 for the cities of Richmond, San Pablo, and North Richmond. It was lifted later that night at 11:12 pm after the fire was fully under control. In the weeks following the incident, nearby medical facilities received over 15,000 members of the public seeking treatment for ailments including breathing problems, chest pain, shortness of breath, sore throat, and headaches. Approximately 20 people were admitted to local hospitals as inpatients for treatment. Figure 2. Vapor cloud (white) over Richmond area and smoke (black) from Chevron Richmond Refinery fire as seen from San Rafael in Marin County.2

i A Community Warning System Level 3 alert indicates that a facility within Contra Costa County has had a release that has offsite impact and is categorized by any of the following:

• Off-site impact that may cause eye, skin, nose and/or respiratory irritation to the general population.
• Fire, explosion, heat, or smoke with an off-site impact. Example: On a process unit/storage tank where

mutual aid is requested to mitigate the event and the fire will last longer than 15 minutes.

• Hazardous material or fire incident where the incident commander or unified command, through

consultation with the Contra Costa Health Services Hazardous Material Incident Response Team, requests that sirens should be sounded. See http://cchealth.org/hazmat/pdf/incident_notification_policy.pdf (accessed April 9, 2013). ii Contra Costa County considers a shelter-in-place to include going inside a home or nearest building, closing doors and windows, and turning off heating, ventilation, and air conditioning. See http://cchealth.org/emergencies/shelter- in-place.php (accessed February 6, 2013). Chevron Richmond Refinery Interim Investigation Report April 2013

11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 3. Initial vapor cloud formation (white cloud) and subsequent ignition (black smoke) as seen from a pier in San Francisco, California.

1. The incident occurred from the piping referred to as the “4-sidecut” stream, one of several

process streams exiting the C-1100 Crude Unit Atmospheric Column (Figure 4).i A plot plan of the crude unit shows the leak location relative to C-1100 (Figure 5). As shown in Figure 6, light gas oil (the crude unit 4-sidecut process fluid) exits the atmospheric column via a 20-inch nozzle and is split into a 12-inch line and an 8-inch line. The August 6, 2012, pipe rupture (Figure 7) occurred on a 52-inch long componentii of the 4-sidecut 8-inch line (the 52-inch component). The line operated at a temperature of 640 degrees Fahrenheit (°F)iii

i The atmospheric column separates crude oil feed into different streams through distillation. These streams are further processed in other units in the refinery. and had an operating pressure of approximately 55 pounds per square inch gauge (psig) at the rupture location. At the ii The term “component” refers to a portion of piping between welds or flanges. It includes straight run piping and pipe fittings. iii The auto-ignition temperature for this process, the temperature at which a material will combust in the presence of sufficient oxygen without an ignition source, was also 640 °F. This number is based on the Chevron Light Gas Oil Material Safety Data Sheet. Chemical testing of 4-sidecut samples following the incident indicated lower auto- ignition temperatures; however, these samples may not have been representative of typical 4-sidecut process fluid.

Chevron Richmond Refinery Interim Investigation Report April 2013

12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD time of the incident, light gas oil was flowing through the 8-inch line at a rate of approximately 10,800 barrels per day (bpd).i

Figure 4. C-1100 Crude Unit Atmospheric Column and Upstream Process Equipment.

i This is the equivalent of 315 gallons per minute (gpm). A barrel equals 42 gallons.

Chevron Richmond Refinery Interim Investigation Report April 2013

13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 5. Overhead view of the equipment in the #4 Crude Unit showing the leak location, commonly referred to as a plot plan.

Chevron Richmond Refinery Interim Investigation Report April 2013

14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 6. 4-sidecut line configuration and rupture location.

8-inch 4-sidecut line 12-inch 4-sidecut line 52-inch component Rupture Location

Chevron Richmond Refinery Interim Investigation Report April 2013

15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. The CSB commissioned Anamet, Inc., a materials engineering and laboratory testing company,

to conduct testing of the 4-sidecut pipe, including the failed 52-inch component. The testing concluded that the rupture was due to pipe wall thinning caused by sulfidation corrosion,3

1. Anamet’s metallurgical analysis found that the 52-inch component where the rupture occurred

had experienced extreme thinning; the average wall thickness near the rupture location was approximately 40 percent thinner than a dime which is discussed below. i (the thinnest American coin). Between 1976 and 2012, the 52-inch piping component had lost, on average, 90 percent of its original wall thickness in the area near the rupture. The piping had an initial nominal wall thickness of 0.322- inchii

when it was installed in 1976. Figure 7. Photo of rupture on 4-sidecut 52-inch component.

i The U.S. Mint reports that a dime has a thickness of 1.35 mm, or 0.053 inches. Information can be found at http://www.usmint.gov/about_the_mint/?action=coin_specifications (accessed February 14, 2013). ii This portion of the 4-sidecut line was constructed of 8-inch Schedule 40 carbon steel piping.

Chevron Richmond Refinery Interim Investigation Report April 2013

16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Sulfidation Corrosion

1. Sulfidation corrosion is a damage mechanismi that is well understood in the refining industry.

The sulfidation corrosion industry guidance document, American Petroleum Institute (API) Recommended Practice (RP) 939-C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineriesii [Sulfidation] …is not a new phenomenon, but was first observed in the late 1800s in a pipe still (crude separation) unit, due to the naturally occurring sulfur compounds found in crude oil. When heated for separation, the various fractions in the crude were found to contain sulfur compounds that corroded the steel equipment. notes: 4

1. Sulfidation corrosion, also known as sulfidic corrosion,

5 is a damage mechanism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F.6 This damage mechanism causes pipe walls to gradually thin over time. Sulfidation corrosion is common in crude oil distillationiii where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide,iv

1. The reaction between sulfur and iron produces a layer of iron sulfide scale

are available to react with steel piping and equipment. Process variables that affect corrosion rates include the total sulfur content of the oil, the sulfur species present, flow conditions, and the temperature of the system. Virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled. v on the inside surface of piping.7

i Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 3.1.1.5, November 2009. This reaction can be compared to that of oxygen and iron which also produces a scale, commonly known as rust. The type of scale formed by sulfidation corrosion is dependent upon the components contained in the steel. Certain scales formed are protective and actually reduce the reaction rate between sulfur compounds and iron, minimizing sulfidation corrosion ii API RP 939-C is one of several relevant American Petroleum Institute recommended practices and standards under evaluation by the CSB as part of this investigation. To the casual observer API RP 939-C appears to obligate the industry to take significant actions. However, the CSB concluded it was written to be permissive so that industry compliance with specific provisions would not be required. The complete findings from this evaluation will be included in the CSB’s Final Report. iii Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). iv Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. v Scale is a nonmetallic layer on the surface of metals and is often a result of corrosion.

Chevron Richmond Refinery Interim Investigation Report April 2013

17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD rates. For instance, sulfidation corrosion affecting steel alloys containing greater than two weight percent (wt. %) chromium produces a protective scale that inhibits the reaction between the iron and sulfur compounds, thereby reducing corrosion rates.i With increasing percentages of chromium, the reaction is further slowed, greatly diminishing corrosion rates.8,ii For example, stainless steel (an 18 wt. % chromium alloy) is nearly 15 times more resistant to sulfidation corrosion than 9-Chrome (a 9 wt. % chromium alloy).9 Conversely, sulfidation corrosion rates are significantly higher in steels containing very little chromium. Carbon steel, the Chevron 4- sidecut line material of construction, was manufactured with a maximum concentration of 0.40 % chromium.10 The scale formed on carbon steel is less protective and allows continued reaction between the sulfur compounds and iron.11

1. In addition to its inherently faster rate of sulfidation corrosion when compared with higher

chromium steels, carbon steel also experiences significant variation in corrosion rates due to variances in silicon content, a component used in the steel manufacturing process. Carbon steel piping containing silicon content less than 0.10 wt. % can corrode at accelerated rates, Thus, carbon steel corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels. 12

i At greater than two wt. % chromium, sulfur compounds react with the steel to form FeCr2S4 scale. This scale provides more protection than the FeS scale that forms on carbon steel piping. See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008. up to sixteen times faster than carbon steel piping containing higher percentages of silicon as shown in Figure 8. This figure shows how carbon steel corrosion rates can greatly vary depending on silicon content. ii It has also been found that chromium “poisons” the decomposition of sulfur compounds to hydrogen sulfide which also slows down the sulfidation corrosion rate. See Couper, A.S. “High Temperature Mercaptan Corrosion of Steels.” 19th Annual Conference of the National Association of Corrosion Engineers. Pages 396t-401t, New York: March 1963.

Chevron Richmond Refinery Interim Investigation Report April 2013

18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 8. This graph shows how corrosion rates increase in carbon steel containing decreasing percentages of silicon. This information can be found in Annex C of API RP 939- C.i

1. The refining industry has been aware of increased rates of sulfidation corrosion in low-silicon

carbon steel piping since as early as 1974,

13 Sulfidation corrosion has caused severe fires and fatalities in the refining industry, primarily because it causes corrosion over a relatively large area, so failures tend to involve ruptures or large leaks rather than pinhole leaks. It can be insidious in that moderately high corrosion rates can go undetected for years before failure. Finally, process changes that increase the temperature or sulfur content can creep up over time and nearly 40 years before the August 6, 2012, incident and two years before the Chevron crude unit was constructed. Prior to the incident, Chevron documented its understanding of the significant consequences of sulfidation corrosion. This is reflected in Chevron’s Corrosion Prevention and Metallurgy Manual, which states:

i The y-axis of this figure is in units of mils per year (mpy). A “mil” is 1/1000 inch. Silicon Content (Weight %)

Chevron Richmond Refinery Interim Investigation Report April 2013

19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD multiply corrosion rates so that what was thought to be a low corrosion rate system becomes corrosive enough to fail before the increased corrosion rate is recognized.

1. Carbon steel piping is manufactured to meet certain specifications, including American Society

for Testing and Materials (ASTM) A53B,14 ASTM A106,15 and API 5L.16 ASTM A53B and API 5L do not contain minimum silicon content requirements for carbon steel piping,17

1. In the mid 1980s, pipe manufacturers began to simultaneously comply with all three

manufacturing specifications (ASTM A53B, ASTM A106, and API 5L) when manufacturing carbon steel piping. The majority of carbon steel piping purchased following this time period likely has a minimum of 0.10 wt. % silicon content. However, piping purchased and installed prior to the mid-1980s could still contain low silicon components that are susceptible to high, variable sulfidation corrosion rates. while ASTM A106 requires the piping to be manufactured with a minimum silicon content of 0.10 wt. %. As a result, manufacturers have used different levels of silicon in the carbon steel pipe manufacturing process. Thus, depending on the manufacturing specification for carbon steel susceptible to sulfidation corrosion, corrosion rates could vary depending on the silicon content within the steel.

1. Over 95 percent of the 144 refineries in operation in the U.S., including the Chevron Richmond

Refinery,i were built before 1985,18

1. The Chevron Richmond Refinery 4-sidecut piping circuit containing the 52-inch component that

failed was constructed of ASTM A53B carbon steel, which had no minimum specification for silicon content. Post-incident testing of samples of the 4-sidecut piping from the Chevron Richmond Refinery identified silicon content ranging from 0.01 wt. % to 0.2 wt. %. Of twelve samples taken from the 8-inch and 12-inch 4-sidecut line, six had a silicon concentration of less than 0.10 wt. %. The 52-inch pipe component that ruptured on the day of the incident had a silicon content of only 0.01 wt. %. The elbow component directly upstream of the 52-inch component that failed had a silicon concentration of 0.16 wt. % and showed considerably less thinning (Figure 9). and thus before piping manufacturers began producing carbon steel in compliance with all three manufacturing specifications. Therefore, the original carbon steel piping in these refineries is likely to contain varying percentages of silicon content and may experience highly variable sulfidation corrosion rates.

i The Chevron Richmond Refinery was constructed in 1902.

Chevron Richmond Refinery Interim Investigation Report April 2013

20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 9. 4-sidecut piping sample (E-017-8) analyzed by Anamet Labs showing the relative thickness of low silicon piping on the left and the high silicon piping on the right. The ruptured pipe component (left) contained 0.01 % silicon and the upstream elbow component (right) contained 0.16 % silicon.19

The initial nominal thickness of this piping was 0.322- inch.

Chevron Richmond Refinery Interim Investigation Report April 2013

21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Sulfidation Corrosion Inspection Techniques

1. As evidenced by the chemical analysis performed on the Chevron 4-sidecut piping post-incident,

carbon steel piping components within a single circuiti can contain varying percentages of silicon, resulting in a large variation in sulfidation corrosion rates by component. Historically, sulfidation corrosion monitoring techniques required the measurement of pipe thickness at only a minimal number of permanent Condition Monitoring Locations (CMLs)ii along the piping. These CMLs are most frequently placed on elbows and fittings.iii However, due to details of the manufacturing process, carbon steel pipe fittings generally contain high percentages of silicon.20 When measurements are only taken at high-silicon containing fittings, the measurements can fail to identify high corrosion rates within a pipe circuit caused by low-silicon components. At the Chevron Richmond Refinery, the 4-sidecut piping had a total of 24 CMLsiv

1. Determining silicon content in existing carbon steel piping and equipment in the field is a

difficult undertaking. To properly characterize the silicon content in each component in a piping circuit, every component must be inspected. This is known as 100 percent component inspection. Two techniques are currently used to determine silicon content in existing carbon steel piping circuits with unknown chemical composition: performing chemical analysis and pipe wall thickness measurements of every component. on piping and fittings. The CSB found that there were no CMLs placed on the low silicon piping component that failed. Chevron identified accelerated corrosion in the 52-inch component in a 2002 inspection. However, no CML was added to ensure future monitoring, and the 52-inch component was not inspected again. Instead, the CSB found that Chevron relied on inspection data gained primarily from high silicon pipe-fitting components, such as elbow components. This inspection data did not reflect the corrosion rates of the lower-silicon components of the 4- sidecut piping. Relying on the limited inspection data from the CMLs on the high silicon components, Chevron management denied multiple recommendations to replace the 4-sidecut line. As illustrated by the Chevron incident, inspection techniques alone may not accurately identify the most aggressive corrosion rates throughout an entire circuit of carbon steel piping. Low-silicon components can remain uninspected and unidentified until failures such as the August 6, 2012, Chevron incident occur. As will be discussed below, upgrading metallurgy is a more effective means of managing sulfidation corrosion.

i A piping circuit is a length of pipe and the fittings associated with a particular process service that operate at similar conditions. A circuit usually begins and ends at either a branch or a piece of process equipment such as a vessel or a pump. Reference to piping by circuits allows piping to be grouped conveniently by proximity and operating service. Piping circuits may also be referred to as piping runs. ii A condition monitoring location (CML) is a designated area where periodic thickness examinations are conducted. Each CML represents as many as four inspection locations located circumferentially around the pipe. CMLs are also referred to as thickness monitoring locations (TMLs). CML was historically referred to as corrosion monitoring locations (CMLs) and that terminology is sometimes still used within the industry. iii A fitting is a piping component usually associated with a change in direction or diameter. iv Many of these CMLs were added during the 2011 turnaround.

Chevron Richmond Refinery Interim Investigation Report April 2013

22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. Many field-portable instruments used for positive material identification cannot adequately

identify silicon content.21 If original manufacturing quality assurance datai are not available, as is generally the case with older plants, then chemical verification requires destructive testing. Metal shavings must be taken from each carbon steel piping component for chemical analysis in a laboratory.22

1. Carbon steel components containing low concentrations of silicon can also potentially be

identified by performing thickness measurements of every component within a carbon steel circuit. This method requires that the insulation be removed for access to the piping so that each individual piping component can be sampled and verified. 23 This practice is only useful if the piping circuit has been exposed to sulfidation corrosion for a long enough time period so that variances in corrosion rate caused by differences in silicon content may be detected. Chemical analysis is therefore the most accurate technique to identify low-silicon carbon steel components. As with chemical analysis, the thickness measurement method requires that each individual piping component be identified by removing insulation (so every weld seam can be located), a time consuming and costly undertaking, or by using non-destructive examination techniques. Thickness measurements on high temperature piping typically can only be done accurately and safely during unit turnarounds.ii

1. API Recommended Practice 939-C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion

Failures in Oil Refineries describes the challenges faced when attempting to thoroughly inspect carbon steel lines susceptible to sulfidation corrosion. The recommended practice states that older ASTM A53 piping, such as the Chevron piping that failed on August 6th, creates a “major inspection challenge” Although these various methods were available to detect the location of the field welds, Chevron had not used them to identify the 4-sidecut pipe segment locations. 24 and that “unless the refinery is fortunate enough to have located an inspection point on that particular [low silicon] section of pipe or fitting, it is very difficult to detect the thinning component.”25 It states that in some applications, carbon steel will appear to be adequate based on measured corrosion rates until failure occurs at some undocumented or unidentified low-silicon component.26

1. Unlike silicon concentration, the chromium concentration of steel can easily be verified in the

field using portable positive material identification instruments. In addition, steel alloys containing at least 9 wt. % chromium are more resistant to sulfidation corrosion and do not run the risk of extreme variations in corrosion rates within components in the same piping circuit.

iii

i Manufacturing quality assurance data, also known as mill data, provides the chemical composition of the steel.

This makes alloys with higher chromium content an inherently safer choice in high temperature ii A “turnaround” is a scheduled shutdown of a process unit to perform maintenance, repairs, upgrades, and inspection of process equipment. iii The protective scale, FeCr2S4, begins to be the dominant scale formed in steels containing a chromium content of five wt. %. The 5Cr steel alloy can be manufactured to contain anywhere from 4% to 6% chromium. Thus, “the sulfidation corrosion rate can vary dramatically in 5Cr steels even in the same operating environment.” See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008.

Chevron Richmond Refinery Interim Investigation Report April 2013

23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD sulfidation corrosion environments.i As shown in the Modified McConomy Curvesii from API RP 939-C (Figure 10), 9-Chromeiii corrodes 15 times faster than stainless steel,iv and carbon steelv corrodes 125 times faster than stainless steel.27

Figure 10. Modified McConomy Curves from API RP 939-C.

i Steels with higher chromium content are inherently safer than carbon steel with respect to sulfidation corrosion. However, analysis is still required to ensure that the best material of construction is selected. ii Modified McConomy Curves are the set of curves API RP 939-C uses to predict sulfidation corrosion rates versus temperature for several steel alloys. iii 9-Chrome contains 9 wt. % chromium. iv Stainless steel contains 18 wt. % chromium. v ASTM A53B carbon steel contains a maximum of 0.40 wt. % chromium. 100.0

Chevron Richmond Refinery Interim Investigation Report April 2013

24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Chevron Sulfidation Corrosion Knowledge and Expertise

1. Figure 11 shows a timeline of Chevron’s key sulfidation events. Chevron technical staff has

considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. This recommended practice, first published in 2009, was developed under Chevron leadership. At the approximate time of publication of API RP 939-C, Chevron Energy Technology Company (Chevron ETC)i

created an internal document on the subject of sulfidation corrosion. Chevron ETC metallurgists released a formal report dated September 30, 2009 (nearly 3 years prior to the incident) to Chevron refinery-based reliability managers and chief inspectors entitled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries. Figure 11. Chevron’s key sulfidation events between 1974 and 2013.

i The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that provides technology solutions and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013)

Chevron Richmond Refinery Interim Investigation Report April 2013

25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. Sulfidation experts acknowledged in the Chevron ETC report that, “Until now, Chevron has not

directly addressed the risk of low Si[licon] carbon steel…”i Sulfidation corrosion failures are not common in Chevron or in the industry but they are of great concern because of the comparatively high likelihood of blowout or catastrophic failure […] . This can happen because corrosion occurs at a relatively uniform rate over a broad area so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition the process fluid is often above its autoignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. […] [S]everal case histories of sulfidation corrosion failures that have occurred in Chevron or in the industry several of which are blowouts. and that the report lays out a program that “seeks to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic failure from sulfidation corrosion and calls out Chevron’s need for action: This Chevron ETC report specifically recommends that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 100 percent component inspection program was not implemented at the Richmond refinery prior to the August 6, 2012 incident. The Chevron ETC report defines a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4-sidecut stream placed it in the highest priority for inspection.

1. Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the

potential consequence of sulfidation failures. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut piping. The newsletter states: Sulfidation corrosion failures … are of great concern because of the comparatively high likelihood of “blowout” or catastrophic failure. This typically happens because corrosion occurs at a relatively uniform rate over a broad area, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition, the process fluid is often above its autoignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents have reinforced the need for revised inspection strategies and a robust PMI (Positive Materials Identification) program.

i A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident.

Chevron Richmond Refinery Interim Investigation Report April 2013

26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, established in 2009, was not implemented at Richmond; therefore, the thin-walled low silicon 4- sidecut piping component remained in service until it catastrophically failed on August 6, 2012.

1. Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise

regarding sulfidation corrosion. They educated personnel and advocated for identification and control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. These individuals did not participate in the crude unit Process Hazard Analysis (PHA)i and did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.ii

i A process hazard analysis is a hazard evaluation to identify, evaluate, and control the hazards involved in a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section 5189. Process Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental Release Prevention Program and the federal EPA Risk Management Program.

ii The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown.

Chevron Richmond Refinery Interim Investigation Report April 2013

27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Other Significant Sulfidation Occurrences

1. The refining industry has experienced numerous sulfidation corrosion failures, primarily in

piping.28 API RP 939-C identifies 45 sulfidation corrosion failures, one third of which were found to have occurred in carbon steel piping containing low levels of silicon.29

1. The August 6, 2012, Chevron Richmond Refinery 4-sidecut pipe rupture was not the first

sulfidation corrosion-related incident to occur at a Chevron refinery. In 1988, a low silicon carbon steel (0.02 wt. % silicon) piping component failed at the Chevron’s former El Paso Refinery

i

1. In 2002, the Chevron Salt Lake City Refinery experienced a fire when process piping failed as a

result of sulfidation corrosion in a low silicon ASTM A53 carbon steel piping component. Chevron communicated the incident throughout the company in a technical newsletter. Chevron experts found that despite regular monitoring of the line for 30 years in compliance with industry standards, their inspection program failed to prevent the failure. Corrosion rates at the unmonitored failure location were found to be five times greater than corrosion rates at the monitored piping locations. The monitored locations were constructed of high silicon ASTM A106 piping (Figure 12). Chevron also found that in the years preceding the failure, both the temperature in El Paso, Texas. In addition, two sulfidation corrosion incidents occurred at the Chevron Pascagoula refinery in Pascagoula, Mississippi: one in 1993 and one in 1988 on a low- silicon carbon steel component. ii

i The El Paso Refinery is now owned by Western Refining. and hydrogen sulfide concentration in the process had been increasing. Each of these factors increased corrosion rates and contributed to the failure. In 2003, following this incident, Chevron experts recommended that refineries inspect every piping component (100 % component inspection) in all high-risk piping systems: those operating above 550 °F and containing hydrogen sulfide. ii The temperature in the line had been increased by over 170 °F throughout the life of the unit. During the two years prior to failure, temperatures of the line exceeded the measurement capabilities of the temperature measurement device and so the actual temperature increase cannot be determined.

Chevron Richmond Refinery Interim Investigation Report April 2013

28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 12. Schematic of failed piping from the Chevron Salt Lake Refinery. Similar to the Chevron Richmond Refinery incident, the failed piping contained low amounts of silicon and corroded significantly faster than adjacent piping components.

1. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron

Richmond Refinery crude unit resulting in a CWS Level 3 alert, initiating a shelter-in-place for the surrounding community. A carbon steel piping spooli failed catastrophically during operation (Figure 13). The carbon steel piping contained a low percentage of silicon (<0.005 wt. %). The process fluid ignited, injuring a nearby worker. Chevron informed Contra Costa Health Services’ Hazardous Materials Programii

i A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. (Contra Costa County) in a letter that the metallurgy had been upgraded following this incident as an inherently safer solution. However, the CSB learned that this upgrade was limited to only the immediate piping spool that failed. The inherently safer, more corrosion resistant metallurgy was not implemented more broadly in crude unit high temperature service as a result of this incident. ii Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. Failed piping component that resulted in the 2007 Richmond crude unit fire. This carbon steel piping was found to contain less than 0.005 percent silicon.

1. Following the August 6, 2012, incident, personnel at the Chevron El Segundo, California,

refinery, a near duplicate of the Richmond refinery, inspected their refinery’s crude unit 4- sidecut piping. Significant thinning was discovered in the line; the piping from the atmospheric crude column to the pumps was removed and substituted with 9-Chrome, an upgraded and inherently safer material of construction.

1. On November 9, 2009, the Silver Eagle refinery in Woods Cross, Utah, experienced a

catastrophic piping failure due to sulfidation corrosion in a 10-inch pipe, while conducting a temporary operation at higher than normal operating temperature. The pipe was located on the

Chevron Richmond Refinery Interim Investigation Report April 2013

30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD bottom of a reactor in the de-waxing unit. The failed pipe released hydrogen which subsequently exploded, damaging over 100 homes in the nearby neighborhood.

1. On October 6, 2011, an explosion and fire resulted from a catastrophic piping failure at a

Canadian refinery in Regina, Saskatchewan, injuring 52 workers. The piping component that failed was substantially thinner than neighboring components. Prior to the incident, the company’s inspection data indicated that wall thickness in the overall piping system was within acceptable limits. However, the specific component that failed was not inspected. Although Canadian authorities are still investigating, metallurgical testing has indicated that hydrogen sulfide corrosion contributed to the catastrophic failure.

1. In February 2012, the BP refinery crude unit in Cherry Point, Washington, suffered a failure due

to sulfidation corrosion, causing a large fire. This incident demonstrates that even when applying inherently safer concepts to reduce the potential for major hazards, it is still vital to fully understand all processes and piping configurations and incorporate a rigorous inspection program. The piping that failed was constructed of 9-Chrome. The line was used only during start-up operations and otherwise remained in-service and non-flowing. Such lines that do not have regular process flow yet remain in contact with process fluids are commonly referred to as “dead legs.” The failure location was a high-point in the piping connected to the top of an operating process line. Hydrogen sulfide evolved from the process fluid and collected in the 9- Chrome piping. The concentrated vapor-phase hydrogen sulfide severely corroded the 9- Chrome, causing the failure. CMLs were located on adjacent elbow components; however, no CMLs were placed on the straight-run piping component where the failure occurred. The Cherry Point sulfidation failure demonstrates that even with more corrosion-resistant, inherently safer metallurgy, failure from sulfidation corrosion still may occur if piping is not effectively inspected or piping configurations are not adequately evaluated. In addition it is important to conduct a thorough analysis to determine the best material of construction for the process conditions.

Chevron Richmond Refinery Interim Investigation Report April 2013

31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Process Hazard Analysis

1. Chevron personnel analyze numerous deviationsi
2. Sometimes referred to as a corrosion review, a damage mechanism hazard review analyzes risks

presented by all process failure mechanisms such as corrosion and cracking. Common process failure mechanisms are described in API 571: Damage Mechanisms Affecting Fixed Equipment in the Refining and Petrochemical Industries. for each portion of a process when conducting a Process Hazard Analysis (PHA). These include conditions such as changes in flow and temperature and pressure extremes. Specifically of interest, one of the deviations analyzed was “leak/rupture” of the particular vessel or pipe. For each deviation, the team’s responsibility was to identify causes, consequences, safeguards, and recommendations. The 4-sidecut line was analyzed in the most recent crude unit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added). 30 Such a review ensures that potential hazards caused by process conditions, process materials, and external mechanisms are properly identified, analyzed, and systems are put in place to control or eliminate the hazard. Despite Chevron knowledge and expertise of potential damage mechanisms (such as sulfidation corrosion), the CSB found these hazards are only identified in a PHA if the participants conducting the PHA happen to have personal knowledge of the relevant mechanism. The Chevron PHA teams do not typically seek assistance from corrosion experts.ii The inclusion of a damage mechanism hazard review as part of the PHA is not required by the state of California, the California Division of Occupational Safety and Health (Cal/OSHA),iii Contra Costa County, the City of Richmond,iv

i Deviations using guide words (such as no, more, less, as well as) and process parameters (such as flow, pressure, temperature) are analyzed in PHAs. See Center for Chemical Process Safety (CCPS). “Guidelines for Hazard Evaluation Procedures.” 2nd ed., Page 132, 1992. or Chevron standards. Because Chevron does not conduct, and is not required to conduct, a formal damage mechanism hazard review, damage mechanisms are only identified when the PHA team happens to have some knowledge of the mechanism. As a result, many damage mechanisms which occur in various processes are not properly addressed. ii The Crude Unit Business Improvement Network (BIN) Leader, a crude unit expert, reviews portions of the PHA with the PHA team. However, this review did not identify the potential for sulfidation corrosion failures in the 4- sidecut piping. A rigorous review of corrosion and damage mechanisms present in the crude unit was not performed during the PHA process. iii The state of California, under an agreement with the federal Occupational Safety and Health Administration, or OSHA, operates an occupational safety and health program in accordance with Section 18 of the Occupational Safety and Health Act of 1970. See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed April 17, 2013). The Department of Industrial Relations administers the California Occupational Safety and Health Program, commonly referred to as Cal/OSHA. The program applies to all public and private sector places of employment in the state, with some exceptions. See http://www.dir.ca.gov/dosh/dosh1.html (accessed April 17, 2013). iv The City of Richmond adopted an ordinance on Industrial Safety, Richmond Municipal Code Chapter 6.43 (also known as the RISO), on December 18, 2001, “for the purposes of protecting public health and safety by prevention of accidental release of hazardous materials and to assure protection of the environment.” Richmond Municipal Code §6.43.040 (February 5, 2013). There are two facilities, including Chevron, that are located in the City of Richmond and subject to this ordinance. More information about the RISO is provided later in the report.

Chevron Richmond Refinery Interim Investigation Report April 2013

32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. During a hazard analysis process such as a PHA, the evaluation team has to determine the

likelihood of a hazardous consequence occurring. Then the team must identify safeguards which will reduce the risk of the hazard to an acceptable level. A recognized methodology for consistently and objectively making these determinations could include the use of quantitative, semi-quantitative, or qualitative tools.31 Chevron does not employ a prescribed methodology for determining the likelihood that an incident will occur or whether a safeguard will be effective. Instead, Chevron relies upon the judgment of the people on the PHA team, who base their conclusions upon their collective experiences, beliefs, and areas of expertise. In its 2009 crude unit PHA, Chevron simply cited non-specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.i

1. Following the August 6th incident, Cal/OSHA inspected the Chevron facility and issued

citations. Only one citation related to PHAs, and it was not associated with evaluating the effectiveness of safeguards. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude unit. The citation stated “The Employer [Chevron] failed to perform an effective Process Hazard Analysis [PHA] of the crude unit. Specifically, it failed to identify, evaluate, and control potential hazards caused by upstream and downstream units that provide and receive feed from the crude unit.” The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel piping could have been recommended. 32

i Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. Had the Cal/OSHA regulation required documentation of the effectiveness of safeguards, Chevron would have been obligated to conduct this analysis and Cal/OSHA inspectors could rely on the regulation for support during inspections.

Chevron Richmond Refinery Interim Investigation Report April 2013

33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Operational Changes

1. The original design of the 4-sidecut circuit included equipment which had the effect of removing

dissolved hydrogen sulfide, the most aggressive sulfur compound associated with sulfidation corrosion, from the 4-sidecut light gas oil process fluid. As a result, the 4-sidecut equipment was effective in reducing the sulfidation corrosion rate. This allowed the 4-sidecut equipment to be constructed of carbon steel. In 1991, this 4-sidecut equipment was taken out of service. No management of changei

1. Crude oil feedstock used at the Chevron Richmond Refinery is obtained from a variety of

different sources that are blended before processing. These various crudes have different compositions, such as varying sulfur compounds and concentrations. These crudes can have differing corrosion effects on process equipment and piping. There is an increasing trend in crude oil refining to process less expensive “opportunity crudes” because they can provide significant cost savings to the company. (MOC) was performed to analyze the effect of the elimination of this hydrogen sulfide-removing equipment on 4-sidecut corrosion rates. Such an MOC would have ensured that the increase in sulfur concentration on the carbon steel 4-sidecut piping was reviewed prior to removing the equipment. ii However, these crudes may contain more undesirable characteristics such as high sulfur content, high naphthenic acid content, or very heavy hydrocarbons33

i Management of change requires that employers have procedures to manage changes to process chemicals, technology, equipment, and procedures. The procedures must address the technical basis for the change, the impact on safety and health, and training required for employees affected by the change. that a refinery may not have been originally designed to process. Refinery equipment may not be the proper material of construction to achieve the design life of the equipment when exposed to the different operating conditions. Additional mitigation may be needed to reduce risk. In 1984, the Chevron Richmond Refinery crude oil feed contained approximately 85 volume % Alaskan North Slope (1 wt. %) crude oil. As the refinery began running more high-sulfur content crudes, the sulfur content in the 4-sidecut line steadily increased (Figure 14), as discussed below. ii Crude oil costs can account for up to 90% of the operating costs in a refinery. See Qu, Dingrong, Xiaohui Liu, Xiu Jiang, Zhenggui Lan, and Guangbin Shan. “Setting Critical Operational TAN and Sulfur Level for Crude Distillation Units.” Corrosion 2011 Conference & Expo. Paper No. 11362. NACE International, 2011.

Chevron Richmond Refinery Interim Investigation Report April 2013

34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 14. Graph shows the percentage increase from 1984 values of the sulfur content in the 4-sidecut.

1. When Chevron introduces a new crude, an MOC is generated to evaluate the potential impact on

the refinery.i

1. The CSB found that increased Chevron Richmond usage of non-domestic crude feed stock over

time resulted in higher sulfur content in the process fluid passing through the 4-sidecut piping. Specifically, the percentage of sulfur in the Richmond refinery crudes increased nearly 85% between 1984 and 2012, including a significant jump of 32% from 1998 to 1999. This increase in sulfur content corresponded with a simultaneous increase in the usage of non-domestic crude feed at the Richmond refinery. While Chevron stayed under its established crude unit design basis for total wt. % sulfur of the blended feed to the crude unit, the sulfur composition significantly increased over time. Historic data indicates that the sulfur in the 4-sidecut stream has increased from 0.8 to 1.6 wt%. This increase in sulfur composition likely increased corrosion rates in the 4-sidecut line. Chevron did not conduct an MOC analyzing the impact that increases in sulfur composition would have on corrosion in the crude unit. Chevron also did not change its corrosion monitoring programs in response to the increased sulfur content.

i Chevron MOCs on new crudes considered general operational issues but did not analyze corrosion effects from sulfidation corrosion.

Chevron Richmond Refinery Interim Investigation Report April 2013

35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. Sulfidation corrosion rates increase in piping circuits as temperature and sulfur content increase.

Accordingly, the 4-sidecut sulfidation corrosion rate increased between 1984 and 2012 due to the increase in sulfur content in the line. The CSB found that for the 26-year period from the installation of the piping in 1976 through 2002, the 52-inch 4-sidecut component had lost approximately 33 percent of its wall thickness. From the single inspection of the 52-inch component in 2002 to the incident in 2012 – just ten years – an additional 57 percent of the original component nominal wall thickness was lost near the rupture location due to sulfidation corrosion.i

1. API RP 939-C states that refinery feed stock changes reduce the relevance of past inspection

data when predicting future corrosion rates: In addition to the sulfur content increase, the 4-sidecut draw temperature increased from 625 °F in 1992 to 680 °F in 2002. Corrosion rates and remaining life calculations based on past sulfur content and temperatures may not accurately reflect current corrosion rates if process conditions have changed. Inspection based on historical corrosion rates may be too infrequent to detect an increase in corrosion caused by adverse changes in process conditions, potentially leading to equipment failure. Oil refineries that processed a consistent diet of a particular crude oil or crude blend could often base future predictions on past experience. However, over the past 20+ years, global economics have resulted in many refineries processing tens of different crudes in any given year; thus, minimizing the accuracy, or even feasibility, of predictions based on historical data. Additionally, the verification of the actual corrosion rate experienced while processing a specific crude oil is very difficult.34

1. API 570 Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping

Systems, the API standard for inspecting piping, recommends companies to incorporate process changes into inspection programs. The standard states:

The owner/user is … responsible for implementing an effective MOC process that will review and control changes to the process and to the hardware. An effective MOC process is vital to the success of any piping integrity management program in order that the inspection group will be able to anticipate changes in corrosion or other deterioration variables and alter the inspection plan to account for those changes. The MOC process shall include the appropriate materials/corrosion experience and expertise in order to effectively forecast what changes might affect piping integrity. The inspection group shall be involved in the approval process for changes that may affect piping integrity.

i The 4-sidecut 52-inch component had an original wall thickness of 0.322 inches. Metallurgical analysis found the thinnest portion of the 52-inch 4-sidecut component was 0.03 inches.

Chevron Richmond Refinery Interim Investigation Report April 2013

36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Changes to the hardware and the process shall be included in the MOC process to ensure its effectiveness [emphasis added].35 Chevron failed to comply with the requirements of API 570 when it did not conduct an MOC to thoroughly evaluate the change of increasing sulfur weight percentage in crude oil feed and to assess how it might affect corrosion rates within the 4-sidecut piping circuit. After the August 6, 2012, incident, Cal/OSHA inspected the Chevron Richmond Refinery and issued citations.

i Chevron Sulfidation Corrosion Inspection and Mitigation However, Cal/OSHA did not issue any citations for failing to perform an MOC when sulfur composition in the crude oil feed was increased.

1. In the ten years prior to the incident, a small number of Chevron personnel with knowledge and

understanding of sulfidation corrosion made at least six recommendations (listed in the following six paragraphs and included in Figure 15) to increase inspections or upgrade the metallurgy in the 4-sidecut piping. The recommendations made by these personnel were not implemented by Chevron management.

Figure 15. Key events at the Richmond refinery between 1998 and 2013.

i Cal/OSHA citations issued January 30, 2013.

Chevron Richmond Refinery Interim Investigation Report April 2013

37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. In August 2002, a Chevron Richmond Refinery employee performed a study analyzing

sulfidation corrosion rates in the crude unit and identifying potentially vulnerable areas. The employee discovered that the 4-sidecut operating temperature had been increased and concluded that this increase would cause more hydrogen sulfide to evolve, leading to increased sulfidation corrosion rates. As a result of these findings, the employee recommended increased inspection of the 4-sidecut piping and noted that this piping might need to be upgraded from carbon steel to 5-Chrome, a steel alloy that is more resistant to sulfidation corrosion. In 2002, proactively following up on this study, the crude unit inspector conducted additional piping inspection and identified accelerated corrosion in the 52-inch 4-sidecut component. The inspector recommended upgrading this piping during the next shutdown in 2007. In the inspector’s 2002 accomplishments, Chevron management acknowledged this effort to prevent a significant incident; it was characterized as “a save.” However, during the 2007 turnaround the recommendation was not implemented, and because a CML was not added to the inspection program, the 52-inch component was not inspected after 2002.

1. In February 2006, a team consisting of a materials and corrosion engineer, an inspector, a

process engineer, a metallurgist, and a design engineer issued a Corrosion Mitigation Plan for the Chevron Richmond Refinery crude unit. The report specifically identified the 4-sidecut piping to be at risk for high temperature sulfidation corrosion. The report described that low silicon carbon steel can corrode faster than carbon steel manufactured with higher silicon content, and recommended that 100 percent inspection be performed on the 4-sidecut line using continuous monitoring technology. During the 2007 crude unit turnaround, continuous monitoring probes were only installed on a segment of the 4-sidecut line that did not include the 52-inch component that ultimately failed. The 100 percent inspection recommended in the 2006 Corrosion Mitigation Plan was not performed.

1. During the 2007 turnaround, the crude unit inspector recommended that the refinery upgrade the

entire 4-sidecut piping with 5-Chrome. The recommendation was based on findings obtained during the 2002 crude unit turnaround, where the crude unit inspector found that the 52-inch 4- sidecut component had lost one-third of its wall thickness due to corrosion. However, after evaluation, this recommendation was not accepted by the turnaround planning team. Basing its decision on limited inspection data, Chevron determined that the 8-inch portion of the 4-sidecut piping that ran from the atmospheric column to the pump, the portion which included the 52- inch component, had sufficient wall thickness to last to the next turnaround scheduled for Fall 2011.i

i This decision was made without reinspecting or evaluating the thickness of the thinned 52-inch component identified in 2002 that prompted the recommendation. The piping downstream of the pump, which operates at a higher pressure, was determined not to have sufficient wall thickness to last to the next turnaround. This piping was removed and replaced with 9-Chrome, an upgraded and inherently safer metallurgy. The 52- inch component of the 8-inch piping between the atmospheric column and the pump was not replaced during the 2007 turnaround even though it had been identified as thinned in 2002.

Chevron Richmond Refinery Interim Investigation Report April 2013

38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Furthermore, a permanent CML was not placed on the 52-inch component, and it was not entered into the inspection database. As a result, the component was not inspected again.

1. In September 2009, Chevron ETC corrosion experts released a formal technical report

discussing sulfidation corrosion and the specific issues associated with carbon steel, including the potential for high corrosion rates in carbon steel piping containing low percentages of silicon. In its report, Chevron ETC issued recommendations for inspection and provided guidelines for prioritizing piping circuits susceptible to sulfidation corrosion so that high-risk lines could be evaluated first. It was recommended that 100 percent component thickness testing be completed on all high priority lines one time to identify thin, low-silicon components to establish a baseline of corrosion rate and risk for failure. Following the release of the report, the Chevron Richmond Refinery materials group completed the risk-ranking of the carbon steel piping in the Richmond Lube Oil Project (RLOP) and in the crude unit, two units known to be susceptible to sulfidation corrosion. The group identified the crude unit 4-sidecut line as a high risk line per the report ranking guidance. Instead of completing the 100 percent component inspection, the 4-sidecut was recommended for replacement with 9-Chrome. However, the replacement recommendation was denied because the available, limited inspection data indicated the piping would last until the next turnaround. Subsequently, the alternative 100 percent component inspection was also never performed.

1. Five months prior to the incident in March 2012, a Chevron corporate review of Richmond

identified that inspection of all carbon steel components susceptible to sulfidation corrosion was not being performed at the Richmond refinery. In addition to identifying that CMLs were not in the proper locations, this corporate review found that critical inspection recommendations were being submitted to the shutdown planning process, but were being denied. Chevron corporate identified that Richmond refinery leadership needed to review and implement the 2009 Chevron ETC report recommendations.

1. Chevron conducts “Intensive Process Reviews” prior to turnarounds. This process involves

knowledgeable individuals including Business Improvement Network leaders, process engineers, metallurgical engineers, design engineers, and turnaround planners. The purpose of the review is to identify key unit issues that should be addressed and repaired during the unit turnaround. Prior to the 2011 crude unit turnaround, Chevron personnel conducted an Intensive Process Review of the crude unit and specifically recommended that the 4-sidecut carbon steel piping “should be upgraded to 5 Cr [5-Chrome]… due to sulfidation.” Although the Intensive Process Review identified sulfidation problems in the 4-sidecut line, this activity was ineffective. The 4-sidecut piping was not upgraded during the 2011 crude unit turnaround.

1. In preparation of the work list for the 2011 crude unit turnaround, the crude unit inspector and

crude unit metallurgist recommended that the 4-sidecut line be replaced with an upgraded metallurgy, 9-chrome, the metallurgy recommended in the Chevron new construction guidelines for piping in high temperature and high sulfur service. The recommendation was based on the

Chevron Richmond Refinery Interim Investigation Report April 2013

39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD high priority ranking of the 4-sidecut line, corrosion history, and both Chevron and industry recommended best practice. However, the turnaround management team determined that the inspection data available for the 4-sidecut piping, from CMLs on elbow components which are less prone to sulfidation corrosion, did not support a material upgrade during the 2011 turnaround.i, ii

i This decision was made without reinspecting or evaluating the thickness of the 52-inch component identified in 2002. The lack of data on the more susceptible 4-sidecut straight-run piping components was not considered.

ii A portion of the 4-sidecut 12-inch line was replaced during the 2011 turnaround with carbon steel due to thinning caused by sulfidation corrosion.

Chevron Richmond Refinery Interim Investigation Report April 2013

40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Inherently Safer Systems

1. The Center for Chemical Process Safety (CCPS) is a corporate membership organization that

identifies and addresses process safety needs within the chemical, pharmaceutical, and petroleum industries.36 Chevron is a corporate member of CCPS.37 The CCPS book Inherently Safer Chemical Processes, 2nd ed. defines inherently safer design as the process of identifying and implementing inherent safety in a specific context that is permanent and inseparable.38 In the book Guidelines for Engineering Design for Process Safety, 2nd ed., CCPS states “inherently safer design solutions eliminate or mitigate the hazard by using materials and process conditions that are less hazardous.”39

1. Inherently safer technologies are relative; a technology can only be described as inherently safer

when compared to a different technology with regard to a specific hazard or risk.

40 A technology may be inherently safer with respect to one risk but not safer from another risk. For this reason, it is important to carry out a comprehensive, documented hazard analysis to determine the individual and overall risks in a process and assess how the risks can be effectively minimized to control hazards. An inherently safer systems review details a list of choices offering various degrees of inherently safer implementation. The review should include risks of personal injury, environmental harm, and lost production, as well as evaluating economic feasibility.41

1. It is simpler, less expensive, and more effective to introduce inherently safer features during the

design process of a facility rather than after the process is already operating.

42

1. After a 2007 incident caused by a pipe failure in the Richmond refinery crude unit, Chevron

implemented an “Inherently Safer Solution” by upgrading the piping to metallurgy that was less susceptible to sulfidation corrosion. However, the change was implemented intuitively without a supporting inherent safety review or failure mechanism hazard review to provide a detailed documented technical rationale for the metallurgy selection. Without such a review, the material selected cannot be analyzed to determine if it is the best inherently safer solution for the process in order to minimize risk. Process upgrades, rebuilds, and repairs are additional opportunities to implement inherent safety concepts. Conducting a comprehensive hazard review to determine risks and identify ways to eliminate or reduce risks is an important step in implementing an inherently safer process. Chevron training programs on inherently safer systems reflect this approach, stating “we have the greatest opportunity to eliminate or minimize hazards during the development phase of new projects or major revamps of existing facilities.”

Chevron Richmond Refinery Interim Investigation Report April 2013

41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. Following the August 6, 2012, incident, the 4-sidecut piping circuit at the Richmond refinery

was upgraded from carbon steel to 9-Chrome.i However, Chevron did not produce a documented inherently safer hazard review before commencing the rebuild of the crude unit. The crude unit at the Chevron El Segundo refinery is nearly identical in construction and design to the Richmond refinery crude unit. Chevron informed the CSB that piping downstream of the 4-sidecut pumps in the 4-sidecut piping circuit at the El Segundo refinery was upgraded in 2001ii

1. An effectiveness ranking of techniques used to control hazards and the risk they represent can be

described as a hierarchy of controls. The further up the hierarchy, the more effective the risk reduction achieved (Figure 16). All concepts in the hierarchy of controls should be included in the process of risk assessment and reduction. Upgrading metallurgy to a more corrosion resistant material may be a high ranking, inherently safer choice for certain corrosion mechanisms, such as sulfidation corrosion. Holding other variables constant, upgrading the material of construction may reduce the severity of corrosion and the likelihood of a failure.

from carbon steel to stainless steel. As stated previously, after the August 6, 2012, Richmond incident, the 4-sidecut piping upstream of the 4-sidecut pumps at the El Segundo refinery was upgraded from carbon steel to 9-Chrome. Had a comprehensive inherently safer systems review been conducted at the Richmond refinery following the August 6th incident, a different metallurgy, such as stainless steel which was installed at the Chevron El Segundo Refinery, may have been identified as inherently safer than 9-Chrome with respect to sulfidation corrosion.

Figure 16. Hierarchy of controls. The boxes reflect inherently safer controls from left to right, based on Process Plants: A Handbook for Inherently Safer Design Second Edition; Kletz, Trevor Amyotte, Paul; CRC Press 2010.

1. Chevron employees have recommended implementing inherently safer designs through the

MOC process, incident investigations, technical reports, and recommendations from employees in the past. However, the CSB has not identified any documented, thorough analysis of the proposed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. For example, following the discovery of significant 4-sidecut piping sulfidation corrosion in 2002, a Chevron inspector issued the following recommendation to replace the piping in the 2007 turnaround:

i After the 2012 incident, the Richmond refinery stated that stainless steel was susceptible to chloride stress corrosion cracking and should not be used. ii Chevron verbal estimate for date of piping installation. No MOC was conducted to review and document this change.

Chevron Richmond Refinery Interim Investigation Report April 2013

42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD The #4 sidecut piping from C-1100 to P-1149/A to E-1113 was RT (x- ray) inspected for hot H2S [sulfidation] corrosion. The piping is actively corroding, particularly on the section on the discharge line from the pumps near the exchanger; the line upstream of the P-1149/A pumps is corroding as well. Corrosion rates indicate that the piping has 4 years of remaining life until the refinery throwaway thickness of 0.14” [inch] is reached. The carbon steel piping is currently running at temperatures between 650 °F on the pump suction line to 641 °F on the line just before E1113; the upper limit for carbon steel piping in this service is 550 °F. A materials upgrade to 5 chrome would raise the upper limit to between 650-750 °F. Additionally, the ABCR piping loop from the same sidecut draw line off of the column to P-1148/A to E-1111 is also carbon steel and operates at the same temperatures, rendering the ABCR piping system to E-1111 susceptible to hot H2S corrosion as well. INFORMATION Replace the existing #4 sidecut piping noted above from C-1100 through P-1149/A to E1113 and P-1148/A to E-1111 (approximately 700’[feet] of 12”, 10”, 8” and 6”piping, plus some 4”and 3” at the P-1149/P-1148 suction/discharge headers). Upgrade the pipe material from carbon steel to 5 chrome. Recommendation To implement this recommendation, Chevron initiated an MOC in 2006 to replace the piping during the 2007 Turnaround. However, the MOC supporting documents had a narrowed scope to only replace the section of piping from P-1149/A pumps to the E-1113 heat exchanger because Chevron reduced the work scope during the 2007 turnaround planning process. The Description of Change in the MOC stated: Existing line is carbon steel in a hot service that operates in the range where high temperature sulfadation [sic] occurs. The line has been uti inspected and found to be nearing tminii Contradicting this Description of Change detailing a replacement of the entire 4-sidecut piping circuit, the MOC Summary Review and attached documentation only authorized replacement of the piping from the P-1149’s to E-1113. The MOC states: requiring replacement. Due to the higher temperature 9CR [9-Chrome] would be the prefered [sic] material.

i UT is an abbreviation used to indicate ultrasonic thickness testing inspection technique. ii Tmin is an abbreviation used to indicate minimum required piping wall thickness.

Chevron Richmond Refinery Interim Investigation Report April 2013

43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 4 S/C piping has been operating hotter in recent years. The hotter temperatures 550 °F are in the high temperature sulfadation [sic] range. Additionally the section of 4 S/C piping from P-1149' s to E-1113 has been found to be nearing tmin. The section of pipng [sic] from P-1149’s to E-1113 will be replaced with 9 Cr [9-Chrome] piping. As a result, the portion of the piping containing the 52-inch component that failed on August 6th remained in service. Although the recommendation was intended to more broadly apply inherently safer materials of construction, the final implementation by the MOC limited the application of this more corrosion resistant metallurgy.i

1. In 2007, the Chevron Richmond Refinery conducted training to teach employees about the

importance of complying with the City of Richmond’s Industrial Safety Ordinance (RISO) Again, the inherently safer, more corrosion resistant, metallurgy was not implemented more broadly in crude unit high temperature service. Other examples are discussed above in the section entitled Chevron Sulfidation Corrosion Inspection and Mitigation. ii inherent safety guidance. The training states “we should always strive to implement inherently safer strategies to the greatest extent feasible.” However, Chevron did not regularly or rigorouslyiii apply inherently safer design strategies in opportunities including PHAs, MOCs, incident investigation recommendations, and during turnarounds.iv

1. Chevron uses an inherently safer design checklist

v

i As discussed earlier, only the section of piping downstream of the pumps was replaced with 9-Chrome. for PHAs to meet inherently safer systems analysis requirements of the RISO. The checklist, provided by Contra Costa County, is intended to aid identification of opportunities to implement inherently safer design during the PHA process. The checklist was intended to stimulate discussion and analysis of potential opportunities to implement inherently safer design. Contra Costa County’s guidance on the IST checklist states that some items may need to be reviewed by a team that is outside the PHA team in order to involve people with the required expertise. Chevron utilized the Contra Costa County inherently safer technologies checklist (IST Checklist) during the 2009 crude unit PHA. ii The RISO will be discussed in more detail in the Regulatory Oversight section below. iii Chevron does not utilize inherent safety guidewords or checklists during the MOC or incident investigation process. Inherently safer guidewords help direct the inherently safer review process. Examples of guidewords include minimization, substitution, moderation, and simplification. These words may be applied to materials, product inventory, process controls, process piping, and siting, among others. See Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes – A Life Cycle Approach.” 2nd ed., Table 8.3, 2009. iv As stated in the Regulatory Oversight section below, Chevron is only required to conduct inherently safer design strategies during PHAs and for the construction of new processes. v Contra Costa County’s guidance document entitled “Attachment C: Inherently Safer Systems Checklist” is provided as a tool for facilities to utilize during the PHA process. The actual use of the checklist is not required. See http://cchealth.org/hazmat/pdf/iso/attachment_c.pdf (accessed April 17, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD However, only three permissively wordedi inherently safer system recommendations were made, none of which addressed sulfidation corrosion or piping metallurgy. In addition, Chevron performed the checklist analysis using the same individuals who conducted the PHA despite Contra Costa County’s guidance to involve other personnel with additional expertise. Performing a superficial analysis, Chevron failed to adequately consider inherently safer systems like improved metallurgy for corrosion resistance. For instance, the checklist prompted: “Use corrosion resistant material?” In response, Chevron stated that “vessel specifications and piping classifications include a conservative wall thickness and an appropriate corrosion allowance for each service.” No mention is given to improving metallurgy to reduce corrosion. There is also no documented analysis regarding potential materials with enhanced corrosion resistance. There was no documentation of the inherently safer technologies analysis, and no inherently safer alternatives were documented. The checklist as applied by Chevron was a “check-the-box” exercise. Chevron Richmond PHAs were thus not an effective means of driving inherent safety. The table below gives a sample of the IST checklist questions along with the associated Chevron responses.ii Contra Costa County Checklist Question

Chevron IST Analysis Use Corrosion resistant materials? Vessel specifications and piping classifications include a conservative wall thickness and an appropriate corrosion allowance for each service. Use smallest diameter piping? Piping sizes are the smallest possible for the capacity of the unit. Substitute less hazardous raw materials? Raw materials in use are of minimal hazard. Dilute hazardous raw materials? Raw materials currently dilute where applicable. Minimize off-site impacts? #4 Crude Unit is located at a distance from public areas. Easy operation of valves designed to prevent inadvertent error? In general, valves are arranged in a logical manner. Increasing wall strength? Piping classifications include a conservative wall thickness and an appropriate corrosion allowance for each service.

• Contra Costa County inspected the Chevron Richmond Refinery in 2011, auditing Chevron’s

implementation of the county’s inherently safer systems analysis requirements in the PHA process. The inspectors determined that Chevron’s PHAs “follows the requirements specified by … ISS [inherent safety systems] guidelines.” This approval by Contra Costa County i All began with “consider” and two began with “consider evaluating” which does not require any action by Chevron. ii The comprehensive list of IST checklist questions and Chevron’s corresponding answers are provided separately on the CSB website.

Chevron Richmond Refinery Interim Investigation Report April 2013

45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD conveyed to Chevron that the regulator considered that Chevron’s minimal analysis of opportunities to implement inherently safer design, its “check-the-box” exercise, was sufficient.

1. Effectively implementing inherently safer technology provides an opportunity for preventing

major chemical incidents. The August 6, 2012, incident at Chevron and other incidents43

1. It is essential that MOCs incorporate hazard analyses and the assessment of opportunities to

implement inherently safer systems. This process can be assisted through the use of guidewords to trigger the thought process. CCPS states that “by including inherent safety guidewords in a management of change program, the MOC protocol recognizes inherent safety as both a driving force for - and as an opportunity during - implementation.”

throughout the refining industry highlight the difficulty in preventing failure caused by sulfidation corrosion in low silicon carbon steel piping solely through inspection, a procedural safeguard that is low on the hierarchy of controls. Using inherently safer design concepts to avoid issues such as variation in corrosion rate in carbon steel piping due to hard-to-determine silicon content will reduce future similar failures in refineries. Chevron and other process plants’ implementation of inherently safer systems to the greatest extent feasible would provide a higher degree of protection from incidents like the one that occurred on August 6, 2012. 44

1. Layer of Protection Analysis (LOPA) is a well-recognized hazard analysis methodology that is

intended to determine if a sufficient number of safeguards or layers of protection exist to protect against a particular hazard or accident scenario.

45 As the potential consequence of a particular scenario increases, the number of safeguards or protection layers must increase to reduce the risk of the scenario to what is considered an acceptable or tolerable level.46 LOPA can be used to help an organization decide if the risk of a scenario or hazard has been reduced to a level that is “as low as reasonably practicable” (ALARP).47 ALARP is a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.48 By rigorously reviewing accident or hazard scenarios, evaluating the potential consequence of the scenario, and identifying the safeguards or layers of protection necessary to drive risk to as low as reasonably practicable, LOPA becomes an effective organizational tool for implementing a Process Safety Management (PSM) mechanical integrity program.49 LOPA also helps an organization decide which safeguards to focus on during operation, maintenance, and training.i, 50 In addition, the LOPA methodology includes provisions allowing an organization to determine the availabilityii and effectiveness of a safeguard or layer of protection in reducing the risk of a potential scenario.51

i Chevron is a member of CCPS and peer-reviewed the CCPS LOPA publication. See Center for Chemical Process Safety (CCPS). “Layer of Protection Analysis – Simplified Process Risk Assessment,” page xiv, 2001.

ii The probability that a system will be able to perform its designated function when required for use. Another term frequently used is Probability of Failure on Demand (PFD). Availability = 1 - PFD. See Center for Chemical Process Safety (CCPS), “Guidelines for Safe Automation of Chemical Processes,” page XIX, 1993.

Chevron Richmond Refinery Interim Investigation Report April 2013

46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Regulatory Oversight

1. The Contra Costa County Industrial Safety Ordinance (ISO) requires that regulated facilitiesi
2. The purpose of the ISO is to “prevent accidental release of hazardous chemicals; improve

accident prevention by soliciting participation from industry and the community; require industry to submit a Safety Plan; and conduct audits of the plan and inspections of the industrial plants.”

within the county implement safety programs to prevent chemical incidents. Since the ISO took effect in January 1999, Contra Costa County has continued to make improvements to the implementation of the prevention program’s elements. 52

1. Although the City of Richmond is located in Contra Costa County, the county does not have

jurisdiction over industrial facilities located within the city limits. Thus, the ISO is not enforceable within the City of Richmond. On December 18, 2001, the City of Richmond adopted its own industrial safety ordinance (RISO), based on the ISO.

ii, 53 The RISO covers the two facilities located within the City of Richmond: Chevron and General Chemical West Richmond Works.54 Pursuant to an agreement between the two parties, Contra Costa County inspects these two facilities and implements the RISO for the City of Richmond.55

1. The ISO and RISO contain identical provisions that address the use of inherent safety concepts.

Each defines “inherently safer systems” as “feasible alternative equipment, processes, materials, lay-outs and procedures meant to eliminate, minimize, or reduce the risk of a major chemical accident or release by modifying a process rather than adding external layers of protection.”

56 For all covered processes, the stationary source shall consider the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis and in the design and review of new processes and facilities. The stationary source shall select and implement inherently safer systems to the greatest extent feasible. If a stationary source concludes that an inherently safer system is not feasible, the basis for this conclusion shall be documented in meaningful detail.

Both regulations also require that: 57

i The ISO applies to oil refineries and chemical plants within the county jurisdiction that are required to submit a Risk Management Plan to EPA and are program level 3 stationary sources as defined by the California Accidental Release Prevention (CalARP) Program. There are seven facilities covered by the ISO, five of which are refineries. See

http://cchealth.org/hazmat/iso/ (accessed April 17, 2013). ii At the time of the August 6th incident, the RISO did not include amendments made to the ISO in 2006. The 2006 amendments required an expansion of human factors programs, expanded management of organizational change reviews, security vulnerability analyses, and safety culture assessments. These amendments were subsequently adopted by the City of Richmond in February 2013. See http://cchealth.org/hazmat/iso/ (accessed on April 9, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. The apparent intent of the ISO and RISO regulations is to require companies to evaluate their

processes in order to identify opportunities to implement inherently safer systems. However, the plain language contained within these regulations conflicts with this intent. Both regulations contain the following permissive language: “the stationary source shall consider the use of inherently safer systems…”58

1. The language within the ISO and RISO regulations also requires effective action to implement

inherently safer systems “to the greatest extent feasible.” This language does not require companies to conduct a comprehensive analysis and implement inherently safer systems even where feasible. It only requires such an analysis be considered. The regulations allow companies to merely engage in an activity contemplating the potential use of inherently safer systems. 59 If an inherently safer system is not implemented, the regulations require that the basis for this decision be “documented in meaningful detail.” 60 However, these regulations do not require documentation supporting the adequacy of existing “inherently safer” 61

1. The inherently safer systems requirements of the ISO and RISO are only triggered by the

conduct of a PHA or the construction of a new process. claims. Chevron’s compliance with the RISO is indicative of this deficiency. In its inherently safer systems checklist, Chevron simply concluded that its systems were inherently safer to the extent that no modifications were necessary. However, the company offered no documentation to substantiate these claims. Had the ISO and RISO regulations required analysis of inherently safer systems regardless of what the site already had in place, Chevron may have implemented the inherently safer recommendations made by technical staff to replace the 4-sidecut with an inherently safer metallurgy. 62

1. The Contra Costa County PHA guidance document presents four categories of risk reduction:

Rebuilds, repairs, MOCs, and the implementation of incident investigation corrective actions do not require the analysis and application of inherently safer systems. i inherent, passive, active, and procedural (Figure 15).ii It states that all four categories should be used in the development of recommendations from process hazard analyses.63 It reiterates the CCPS statement that all may contribute to the overall safety of a process, but that inherent safety is the most effective.64 It goes on to state “The inherent and passive categories should be implemented when feasible for new processes and facilities and used during the review of Inherently Safer Systems for existing processes if these processes could cause incidents that could result in a Major Chemical Accident or Release.”65

i The guidance document uses CCPS definitions for the identified categories of risk reduction. This wording in the guidance ii Inherent risk reduction involves eliminating the hazard by using materials and process conditions that are non- hazardous. Passive risk reduction is defined as minimizing the hazard through process and equipment design features that reduce the frequency or consequence of the hazard without active functioning of any device. Active risk reduction includes using controls, alarms, safety instrumented systems, and mitigation systems to detect and respond to process deviations from normal operation. Procedural risk reduction achieves the lowest level of risk reduction and involves using policies, operating procedures, training, administrative means, emergency response, and management approaches to prevent incidents and minimize the effects of an incident.

Chevron Richmond Refinery Interim Investigation Report April 2013

48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD document demonstrates the importance Contra Costa County places on risk reduction and prevention such as metallurgy upgrades; however, as a guidance document, it is non-mandatory.

1. The California Division of Occupational Safety and Health (Cal/OSHA) has jurisdiction over

employee safety in California.66 Cal/OSHA is a division of the California Department of Industrial Relations and has operated a state plan industrial health and safety program since 1973 under a delegation from the U.S. Occupational Safety and Health Administration (OSHA). Cal/OSHA conducts inspections of California workplaces in response to industrial accidents, safety complaints, or as part of an inspection program targeting specific industries.67 Consideration of inherently safer processes is not currently a required component of any Cal/OSHA (or federal OSHA) standard or regulation.i

1. The State of California has promulgated process safety regulations similar to OSHA

68 for the prevention or minimization of the consequences of the accidental release of acutely hazardous chemicals.69 These regulations require that covered employers perform a PHA to identify, evaluate and control hazards involved in the process using recognized methodologies.70

1. California regulations, however, do not provide for a specific review of the effectiveness of the

proposed safeguards to control the hazards identified in the PHA using recognized methodologies such as Layers of Protection Analysis (LOPA).

71

1. The Energy Institute, an industry technical working group

Additionally, California regulations do not have any requirements for the use of inherently safer systems analysis and the hierarchy of controls for establishing safeguards for identified process hazards. Cal/OSHA, like federal OSHA, also does not require damage mechanism hazard reviews as part of the PHA process. ii organized in the United Kingdom (UK), with contributions from regulators including the UK’s Health and Safety Executive (HSE),iii as well as other entities,iv developed a document in 2008v that provides guidance on damage mechanism hazard reviews in the UK’s offshore petrochemical industry. The guidance states that effective management of corrosion will contribute to equipment integrity and reduce risk from safety and environmental hazards.72 In addition, during the design of a process, a corrosion review can be used to eliminate risks and achieve inherent safety.73

i This is also the case for US EPA Risk Management Program and the California Accidental Release Prevention Program regulations. The guidance also iiThe Energy Institute is the leading chartered professional membership body supporting individuals and organizations across the energy industry. With a combined membership of over 13,500 individuals and 300 companies in 100 countries, it provides an independent focal point for the energy community and a powerful voice to engage business and industry, government, academia and the public internationally. See http://www.energyinst.org/about-us (accessed April 17, 2013). iii HSE is an independent regulator that is tasked with securing the health, safety and welfare of workers within the UK. See http://www.hse.gov.uk/aboutus/index.htm (accessed April 17, 2013). iv Chevron Energy Technology Company (ETC) was one of roughly 30 entities recognized in the guidance document as providing contributions to the institute that were “key to the development of this publication…”. See http://www.energyinstpubs.org.uk/pdfs/815.pdf (accessed April 17, 2013). v Ibid.

Chevron Richmond Refinery Interim Investigation Report April 2013

49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD notes that damage mechanism hazard reviews should provide a structured framework for identifying risks associated with corrosion and developing suitable risk reduction measures.74 These reviews should cover failure mechanisms including, but not limited to corrosion, environmental cracking, erosion, and mechanical damage, such as vibration induced fatigue.75 Finally, this guidance states that a formal, documented quantitative and logic based assessment should be used when conducting corrosion reviews.76

1. Under a rule issued by the U.S. Environmental Protection Agency (EPA),

77 a facility with a tank, drum, pipe, or other processi that contains an extremely hazardous toxic or flammable substance listed at 40 CFR §68.130 in an amount above the “threshold quantity” specified for that substance, is required to conduct a hazard assessment as well as develop a prevention program and an emergency response program. These requirements are documented in a Risk Management Plan (RMP) that is submitted to EPA. Covered facilities must implement the RMP and update their RMPs periodically or when certain changes occur. The goal of EPA’s Risk Management Program is to prevent accidental releases of substances that can cause serious harm to the public and the environment from short-term exposures, and to mitigate the severity of releases that do occur.78

1. The EPA RMP program provisions build on the planning and preparedness groundwork laid by

the Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA). EPCRA establishes requirements for federal, state, and local governments, as well as industry, regarding emergency planning and “Community Right-to-Know” reporting on hazardous toxic chemicals. EPCRA “help[s] increase the public’s knowledge and access to information on chemicals at individual facilities, their uses, and releases into the environment.”

79 According to the U.S. EPA’s Chemical Emergency Preparedness and Prevention Office,ii Both EPCRA and the CAA [Clean Air Act] section 112(r) Risk Management Program encourage communication between facilities and the surrounding communities about chemical safety and chemical risks. Regulatory requirements, by themselves, will not guarantee safety from chemical accidents. Information about hazards in a community will allow local emergency officials and the public to work with industry to prevent accidents. transparency between industry and the public will improve community safety: 80

i “Process” means “any activity involving a regulated substance including any use, storage, manufacturing, handling, or on-site movement of such substances, or combination of these activities…” 40 CFR §68.3 (1997).

ii In 2004, the U.S. EPA’s Chemical Emergency Preparedness and Prevention Office was merged with the Superfund Emergency Response Program and Oil Spill Prevention Program to form the Office of Emergency Management, or OEM. OEM works with other EPA partners, federal, state, and local agencies, and industry to prevent accidents and maintain and provide superb response capabilities. See http://www.epa.gov/oem/about.htm (accessed April 17, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD The CCPS also notes that governments and advocacy organizations have been successful in driving performance improvement by using public disclosure to make safety information available to the public.81

1. Under the RMP program’s hazard assessment requirement, a facility must prepare a worst-case

release scenario analysis

82 and complete a five-year accident history.83 A covered facility must also develop and implement an emergency response program that includes procedures for informing the public and local agencies about accidental releases and procedures and measures for emergency response after an accidental release.84

1. Workforce involvement is a key element of process safety and effective chemical accident

prevention. In the Center for Chemical Process Safety publication, Guidelines for Risk Based Process Safety, it lists workforce involvement as one of 20 essential management systems necessary to reduce process safety risks and prevent chemical accidents. Officials and the public, including local emergency planning committees (LEPCs) can use this information to understand the chemical hazards in the community and then work with industry to address and mitigate those hazards. With both EPCRA and the Risk Management Program, the regulatory purpose and substantive provisions emphasize the importance of transparency, sharing of process safety data, and public participation to prevent chemical accidents. The CSB notes that post-incident, during the decision-making related to piping repairs to the crude unit, the public, worker representatives, regulators, and governmental bodies played a key role driving transparency, accountability, and improved risk reduction. 85 …workers are potentially the most knowledgeable people with respect to the day-to-day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their unique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise. CCPS states that: 86 This CCPS publication discusses general areas of workforce involvement in risk assessments, inspections, audits, and performance reviews. The CCPS notes that participation leads to empowerment, management responsiveness, and process safety performance improvement.

87 The OSHA PSM Standard emphasizes the importance of participation by workers and their representatives. It requires employers to develop a written plan of action, consult with employees, and make available all process safety information. 88 In previous investigation reports, the CSB has identified that workers and their representatives play a very important role in major incident prevention. For example, in the BP Texas City oil refinery investigation report, the CSB recommended that BP and the United Steelworkers International Union (USW) establish a joint program to report incidents and near misses, and to ensure that recommendations made during investigations were implemented. The CSB also recommended

Chevron Richmond Refinery Interim Investigation Report April 2013

51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD that API and the USW work together to develop a safety standard addressing leading and lagging process safety indicators. i

1. In July 2012, the CSB held a public hearing on process safety indicators

ii to explore how companies and regulators use process safety metrics to manage risks and drive continuous safety improvements. During this hearing the CSB stated that, following the 2005 BP Texas City accident, both the CSB and Baker Paneliii

1. Process safety management systems are critical for reducing process safety incidents. Process

safety indicators are a significant element of these systems. Indicators measure the strengths and weaknesses of process safety management systems, to achieve and maintain safe and reliable operations. reports noted the lack of focus by BP on process safety and inadequate performance measurement indicators. The CSB also noted that one goal of process safety indicators is to drive continuous process safety improvement, and that regulators can utilize these indicators to focus inspections, audits, and investigations. 89 Properly selected and managed indicators will identify the successes and point out the flaws of the system.90

1. In 2008, the CCPS published a guidance document for the development of leading

iv and laggingv process safety indicators to assist industry in avoiding catastrophic chemical incidents.91 While process safety indicators are an important tool for major accident prevention, the simple activity of identifying and recording process safety metrics will not drive process safety improvement. CCPS notes that these metrics must be “collected, analyzed, communicated, understood, and acted upon.”92

1. The UK HSE has published a guidance document to help chemical and major hazard industries

develop process safety indicators. HSE states that:

Most systems and procedures deteriorate over time, and system failures discovered following a major incident frequently surprise senior managers, who sincerely believed that the controls were functioning as designed. Used effectively, process

i Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc… ii See http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed April 17, 2013). iii See http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pd fs/Baker_panel_report.pdf (accessed April 12, 2013). iv Leading indicators are measurements that predict future performance to ensure that safety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 20. 2010. v Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety metric. See Center for Chemical Process Safety (CCPS), “Guidelines for Process Safety Metrics,” 2010; Page 20.

Chevron Richmond Refinery Interim Investigation Report April 2013

52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD safety indicators can provide an early warning, before catastrophic failure, that critical controls have deteriorated to an unacceptable level. 93

1. The public can play an important role in monitoring safety management systems. In its recent

guidelines, the CCPS promoted the sharing of process safety indicators with the public:

Sharing performance metrics and results broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics and performance public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating process safety successes also demonstrates to employees and the public that positive change can be, and are being, made within an organization. 94

Chevron Richmond Refinery Interim Investigation Report April 2013

53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Recommendations Under 42 U.S.C. 7412(r)(6)(C)(ii), the U.S. Chemical Safety and Hazard Investigation Board is charged with “recommending measures to reduce the likelihood or the consequences of incidental releases and proposing corrective steps to make chemical production, processing, handling and storage as safe and free from risk of injury as possible ….” The CSB makes recommendations based on the findings and conclusions of the investigation. Recommendations are made to parties that can affect change to prevent future incidents, which may include the company, contractors, industry organizations responsible for developing good practice guidelines, regulatory bodies, and/or organizations that have the ability to broadly communicate lessons learned from the incident, such as trade associations or professional societies. Chevron U.S.A (Urgent) 2012-03-I-CA-R1 At all Chevron U.S. refineries, engage a diverse team of qualified personnel to perform a documented damage mechanism hazard review. This review shall be an integral part of the Process Hazard Analysis cycle and shall be conducted on all PSM-covered process piping circuits and process equipment. The damage mechanism hazard review shall identify potential process damage mechanisms and consequences of failure, and shall ensure safeguards are in place to control hazards presented by those damage mechanisms. Analyze and incorporate into this review applicable industry best practices, Chevron Energy Technology Company findings and recommendations, and inherently safer systems to the greatest extent feasible. 2012-03-I-CA-R2 At all California Chevron U.S. refineries, report leading and lagging process safety indicators, such as the action item completion status of recommendations from damage mechanism hazard reviews, to the federal, state, and local regulatory agencies that have chemical release prevention authority.

Chevron Richmond Refinery Interim Investigation Report April 2013

54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Mayor and City Council, City of Richmond, California 2012-03-I-CA-R3 Revise the Industrial Safety Ordinance (ISO) to require that Process Hazard Analyses include documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards intended to control hazards will be effective. This process shall use established qualitative, quantitative, and/or semi-quantitative methods such as Layers of Protection Analysis (LOPA). 2012-03-I-CA-R4 Revise the Industrial Safety Ordinance (ISO) to require the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new processes, process unit rebuilds, significant process repairs, and in the development of corrective actions from incident investigation recommendations. 2012-03-I-CA-R5 Ensure the effective implementation of the damage mechanism hazard review program (2012-03-I-CA- R1 and 2012-03-I-CA-R2), so that all necessary mechanical integrity work at the Chevron Richmond Refinery is identified and recommendations are completed in a timely way.

Chevron Richmond Refinery Interim Investigation Report April 2013

55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Board of Supervisors Contra Costa County, California 2012-03-I-CA-R6 Revise the Industrial Safety Ordinance (ISO) to require that Process Hazard Analyses include documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards intended to control hazards will be effective. This process shall use established qualitative, quantitative, and/or semi-quantitative methods such as Layers of Protection Analysis (LOPA). 2012-03-I-CA-R7 Revise the Industrial Safety Ordinance (ISO) to require the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new processes, process unit rebuilds, significant process repairs, and in the development of corrective actions from incident investigation recommendations. 2012-03-I-CA-R8 Monitor and confirm the effective implementation of the damage mechanism hazard review program (2012-03-I-CA-R1 and 2012-03-I-CA-R2), so that all necessary mechanical integrity work at the Chevron Richmond Refinery is identified and recommendations are completed in a timely way.

Chevron Richmond Refinery Interim Investigation Report April 2013

56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD California State Legislature, Governor of California 2012-03-I-CA-R9 Revise the California Code of Regulations, Title 8, Section 5189, Process Safety Management of Acutely Hazardous Materials, to require improvements to mechanical integrity and process hazard analysis programs for all California oil refineries. These improvements shall include engaging a diverse team of qualified personnel to perform a documented damage mechanism hazard review. This review shall be an integral part of the Process Hazard Analysis cycle and shall be conducted on all PSM-covered process piping circuits and process equipment. The damage mechanism hazard review shall identify potential process damage mechanisms and consequences of failure, and shall ensure safeguards are in place to control hazards presented by those damage mechanisms. Require the analysis and incorporation of applicable industry best practices and inherently safety systems to the greatest extent feasible into this review. 2012-03-I-CA-R10 For all California oil refineries, identify and require the reporting of leading and lagging process safety indicators, such as the action item completion status of recommendations from damage mechanism hazard reviews, to state and local regulatory agencies that have chemical release prevention authority. These indicators shall be used to ensure that requirements described in 2012-03-I-CA-R9 are effective at improving mechanical integrity and process hazard analysis performance at all California oil refineries and preventing major chemical incidents.

2012-03-I-R11 Establish a multi-agency process safety regulatory program for all California oil refineries to improve the public accountability, transparency, and performance of chemical accident prevention and mechanical integrity programs. This program shall:

1. Establish a system to report to the regulator the recognized methodologies, findings, conclusions

and corrective actions related to refinery mechanical integrity inspection and repair work arising from Process Hazard Analyses, California oil refinery turnarounds and maintenance-related shutdowns;

1. Require reporting of information such as damage mechanism hazard reviews, notice of upcoming

maintenance-related shutdowns, records related to proposed and completed mechanical integrity work lists, and the technical rationale for any delay in work proposed but not yet completed;

Chevron Richmond Refinery Interim Investigation Report April 2013

57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. Establish procedures for greater workforce and public participation including the public reporting

of information; and

1. Provide mechanisms for federal, state and local agency operational coordination, sharing of data

(including safety indicator data), and joint accident prevention activities. The California Department of Industrial Relations will be designated as the lead state agency for establishing a repository of joint investigative and inspection data, coordinating the sharing of data and joint accident prevention activities. 2012-03-I-CA-R12 Require that Process Hazard Analyses required under California Code of Regulations, Title 8, Section 5189 Section (e) include documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards intended to control hazards will be effective. This process shall use established qualitative, quantitative, and/or semi-quantitative methods such as Layers of Protection Analysis (LOPA). 2012-03-I-CA-R13 Require the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new process, process unit rebuilds, significant process repairs and in the development of corrective actions from incident investigation recommendations. 2012-03-I-CA-R14 Monitor and confirm the effective implementation of the damage mechanism hazard review program (2012-03-I-CA-R9 and 2012-03-I-CA-R10), so that all necessary mechanical integrity work at all California Chevron Refineries is identified and recommendations are completed in a timely way.

Chevron Richmond Refinery Interim Investigation Report April 2013

58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD The U.S. Environmental Protection Agency 2012-03-I-CA-R15 Jointly plan and conduct inspections with Cal/OSHA, California EPA and other state and local regulatory agencies with chemical accident prevention responsibilities to monitor the effective implementation of the damage mechanism hazard review and disclosure requirements under 2012-03-I-CA-R9 and R10 above.

The Board of Supervisors, Contra Costa County, California, 2012-03-I-CA-R16; The Mayor and City Council, City of Richmond, California, 2012-03-I-CA-R17; The California Air Quality Management Divisions, 2012-03-I-CA-R18; The U.S. Environmental Protection Agency, 2012-03-I-CA-R19; and The California Environmental Protection Agency, 2012-03-I-CA-R20;

Participate in the joint regulatory program described in recommendation 2012-03-I-CA-R11. This participation shall include contributing relevant data to the repository of investigation and inspection data created by the California Department of Industrial Relations and jointly coordinating activities.

Chevron Richmond Refinery Interim Investigation Report April 2013

59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Additional Issues Currently Under Investigation The following section highlights additional issues which the CSB has identified to date in its investigation of the Chevron Richmond Refinery fire and major hydrocarbon release that occurred on August 6, 2012. These issues relate to the ongoing CSB investigation of the management and regulation of health and safety at refineries. The CSB final report will make additional recommendations consistent with this interim report and will present additional detailed findings and analyses in a final report on the incident, to be released later in 2013. Regulatory Oversight The CSB noted in its BP Texas City (BPTC) Final Investigation Report (issued in March 2007) the importance of having a well-resourced, competent regulator consisting of individuals with the necessary training, education, and experience to conduct planned comprehensive and robust inspections of facilities with the goal of preventing catastrophic accidents. In a 1992 compliance directivei the federal Occupational Safety and Health Administration (OSHA) stated that the primary enforcement model for the Process Safety Management of Highly Hazardous Chemicals (PSM) standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) inspections to help prevent catastrophic accidents.95 Spurred in part by the CSB’s recommendations, OSHA issued the Petroleum Refinery Process Safety Management National Emphasis Program (NEP) on June 7, 2007. However, the CSB report noted that for the 10-year period prior to the Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. Regular planned inspections appropriately emphasize the prevention of accidents that are potentially catastrophic. Issuing fines and prosecuting companies post-incident are not acceptable substitutes for prevention. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by developing more highly trained and experienced inspectors to conduct more comprehensive inspections similar to those under OSHA’s PQV program at facilities presenting the greatest risk of a catastrophic accident. ii The NEP was a federal program that established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard, 29 CFR §1910.119.96 Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and uses a more global approach to identify compliance deficiencies…,”97 the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standard…[which] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, interview employees, and verify implementation for specific processes, equipment, and procedures.”98

i Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new regulation. While the CSB called for an ongoing comprehensive inspection ii Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to complete NEP inspections under the original CPL 03-00-004.

Chevron Richmond Refinery Interim Investigation Report April 2013

60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD program, inspections being conducted pursuant to the NEP were terminated in 2011. The CSB recommendation to OSHA remains Open.i OSHA State Plan States

ii were strongly encouraged but not required to implement the NEP. California’s Division of Occupational Safety and Health (Cal/OSHA) did not adopt the NEP “because of its dedicated PSM Unit.”99 Cal/OSHA informed the CSB that federal OSHA approved this decision in 2007. In lieu of conducting NEP inspections, Cal/OSHA’s PSM Unit has conducted and continues to conduct a full range of programmed, accident, complaint, and referral inspections of PSM-covered facilities in the state of California pursuant to the California Labor Code, Title 8 regulations, and Cal/OSHA’s Policy and Procedures (P&P) Manual C-17 “Process Safety Management,”iii Between 2006 and August 6, 2012, Cal/OSHA conducted three planned inspections of the Chevron Richmond facility, totaling only 150 inspector hours of effort. None of these inspections resulted in citations or fines. In contrast, according to statistics provided by OSHA, federal NEP refinery inspections conducted between 2007 and the end of 2011 lasted roughly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehensiveness between the planned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA and other OSHA State Plan States. to ensure these facilities are complying with PSM requirements. The safety case is a rigorous prescriptive and goal-setting regulatory regime that is highlighted by its adaptability and requirements for continuous improvements in risk reduction for high hazard industrial facilities. The approach is used widely overseas but is not used currently for U.S. process industries. The CSB is currently examining whether the implementation of the safety case regime could be a more effective regulatory tool for Cal/OSHA in its effort to ensure that California refineries are identifying and controlling hazards and ultimately driving risk to as low as reasonably practicable (ALARP). Utilizing the safety case requires effective implementation by an independent, competent, well-funded regulator. Experience and competence of the regulator in technical areas such as chemical engineering, human factors, and process safety are necessary to provide effective auditing and regulatory oversight for prevention. To ensure effective implementation of the safety case, industry standards and guidelines must be rigorous and up-to-date as well. The CSB notes that relevant and applicable industry standards and guidelines – such as API RP 939-C – currently contain voluntary and permissive language. The CSB will be examining the need for more effective good practice standards and guidelines containing the necessary requirements to prevent catastrophic accidents.

i Open - Awaiting Response or Evaluation/Approval of Response (O - ARE/AR) - The recipient has not submitted a substantive response, or the evaluation by CSB staff of a response is pending, or the Board has not yet acted on staff recommendation of status. ii Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs. iii Issued June 6, 1994. Revised August 1, 1994 and May 19, 2007.

Chevron Richmond Refinery Interim Investigation Report April 2013

61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD In addition to the issues discussed above, the CSB will also be examining the need for the reporting of leading and lagging process safety indicators to the regulator; the regulator’s effective use of these process safety indicators; workforce and stakeholder involvement in regulatory oversight of refineries; and the thoroughness of Contra Costa County’s safety auditing of the Chevron facility. Emergency Planning and Reporting According to information provided by Contra Costa Emergency Medical Services, 15,213 individuals sought emergency medical attention between August 6 and August 23, 2012, due to the Chevron refinery major hydrocarbon release and fire. CSB Investigation Team members visited local hospitals the week of the incident to better understand the impact on the surrounding community. Officials at Doctor’s Medical Center (DMC) in San Pablo, California, informed the CSB that in the days following the incident they were inundated with emergency room visits and found it difficult to handle the influx due to a lack of funding and staffing. Officials at both DMC and Kaiser Permanente Hospital (KP) in Richmond told the CSB that they lacked specific knowledge of the chemicals released as a result of the incident, complicating efforts to evaluate and treat individuals. The California Code of Regulations (CCR) requires that owners and operators of hazardous waste facilities make “arrangements to familiarize local hospitals with the properties of hazardous waste handled at the facility and the types of injuries or illnesses which could results from fires, explosions, or releases at the facility.”100 Following the incident, Contra Costa County’s Community Warning System (CWS) notified the surrounding community of a hazardous material incident and ordered a shelter-in-place (SIP). The CWS uses sirens, the news media, and phone calls to residents in order to initiate the SIP. Contra Costa County issued the SIP on August 6, 2012, at 6:38 pm for the cities of Richmond, San Pablo, and North Richmond, California, and lifted the SIP later that evening at 11:12 pm. However, the CSB has learned that some phone calls notifying residents of the SIP did not occur until over four hours after the release. The CSB is currently evaluating ways to ensure that hospitals have the information necessary to properly evaluate and treat individuals that may be exposed to releases from facilities in Contra Costa County. It is essential that responders, community residents, and hospitals in the areas surrounding industrial facilities be aware of what hazardous materials exist at these facilities, what specific chemicals are released into the community in the event of an incident, and what is known about the potential acute and chronic health impacts. The CSB will be analyzing ways to strengthen current regulations and policies to ensure there is proper emergency planning and reporting for industrial facilities in Contra Costa County and the state of California.

Chevron Richmond Refinery Interim Investigation Report April 2013

62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Emergency Response OSHA provides guidance on emergency response in its Hazardous Waste Operations and Emergency Response standard, known as HAZWOPER, under 29 CFR §1910.120 (p) and (q). Under 29 CFR §1910.120(q)(6), the HAZWOPER standard contains requirements for training and qualification of all individuals involved in emergency response related to their roles and responsibilities. Good safety practice dictates that individuals responding to emergencies should have the technical knowledge to give input into shutdown decisions, set up an incident command structure, establish boundary limits, and evaluate the “hot zone.” Access to the hot zone must be strictly limited to personnel with higher degrees of specific training, experience, and appropriate personal protective equipment; all others must be removed to a safe location away from chemical hazards. Hot zone boundaries must be established to anticipate the possible escalation of releases and the positioning of firefighting equipment such as fire trucks. The CSB will be looking at the sufficiency of regulatory requirements, industry standards, and good practices, in addition to evaluating emergency response decision-making following the leak and subsequent pipe rupture (including the training and qualification of responders) to determine whether improvements are needed in these areas. Safety Culture The Center for Chemical Process Safety (CCPS) defines process safety culture as the “combination of group values and behaviors that determines the manner in which process safety is managed.”101 The CSB notes that on August 6, 2012, following discovery of the leak on the 4-sidecut piping, Chevron hoped to forestall a shutdown by installing a leak repair clamp. As the CSB noted in its BP Texas City Report, safety culture can be influenced by management changes, historical events, and economic pressures. After reviewing evidence and decisions made relating to materials of construction and mechanical integrity within the crude unit at the Chevron refinery, as well as the response to the leak on August 6, 2012, the CSB has determined that issues relating to safety culture are relevant to this incident. The CSB will examine the Chevron Richmond Refinery’s approach to safety, its safety culture and any organizational deficiencies, to determine how to best prevent future incidents. i Chevron’s mechanical integrity management system has not been fully successful in detecting and replacing deteriorated piping components prior to failure, resulting in the company’s frequent use of leak repair clampsii

i Chevron’s leak repair clamp vendor was called out to the scene of the leak to help determine potential clamping options. to externally stop process fluid leaks. Chevron’s reliance on such clamps to mitigate process piping component leaks identifies serious questions about its mechanical integrity program. The CSB determined that Chevron ii Leak repair clamps are mechanical devices designed and installed to stop a leak from a piping component such as piping, valves, flanges, and instrumentation. These devices are typically intended to provide a temporary repair while a process continues operation until a plant shutdown takes place and a permanent repair can be made.

Chevron Richmond Refinery Interim Investigation Report April 2013

63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD has more than 100 clamps on hydrocarbon and other process piping components at the Richmond refinery. The leak repair clamp is typically relied upon to prevent further leaking until the next unit turnaround, when the deteriorated piping component can be repaired. However, Cal/OSHA citations following the August 6, 2012, fire in the crude unit identified that Chevron has not always replaced these clamps during unit turnarounds and these devices then remain in service significantly longer than originally intended. The CSB determined that Chevron has leak repair clamps in place on piping components containing hazardous flammable process fluids including applications where the process material is above the autoignition temperature. Some of these leak repair clamp applications are in locations where a permanent repair would not have required a unit shutdown. The CSB will further evaluate the frequent use of leak repair clamps by Chevron and the potential that the deviance of a weak mechanical integrity management system has been normalized.i

i Normalization of deviance is a long-term phenomenon in which individuals or work teams gradually accept a lower standard of performance until the lower standard becomes the norm. It is typically the result of conditions slowly changing and eroding over time. See Center for Chemical Process Safety (CCPS), Recognizing Catastrophic Incident Warning Signs in the Process Industries, Page 4. 2012.

Chevron Richmond Refinery Interim Investigation Report April 2013

64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD BY THE U.S. Chemical Safety and Hazard Investigation Board

Rafael Moure-Eraso

Chair

Mark Griffon

Member

Beth Rosenberg

Member

Date of Approval April __, 2013.

Chevron Richmond Refinery Interim Investigation Report April 2013

65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD References

• Chevron U.S.A. Inc. "30 Day Follow-Up Notification Report." September 5th, 2012.
• KTVU roof cam footage. See http://www.ktvu.com/videos/news/ktvu-timelapse-exclusive-timelapse-

video-of-smoke/vdCJ7/ (accessed April 10, 2013).

• Anamet, Inc. "Metallurgical Evaluation of Samples from the Chevron U.S.A. Inc., Richmond #4 Crude

Unit 8-Inch and 12-Inch 4-Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for: The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013.

• API RP 939-C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.”

1st ed., Section 4, May 2009.

• Ibid at Section 3.1.6.
• Ibid at Section 6.2.2.1.
• NACE International Task Group 176. "Overview of Sulfidic Corrosion in Petroleum Refining." NACE

International Publication 34103. Item No. 24222, 2004.

• API RP 939-C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.”

1st ed., May 2009.

• Ibid.
• ASTM Standard A53/A53M-12. "Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-

Coated, Welded and Seamless." 2012.

• Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature

Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008.

• API RP 939-C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.”

1st ed., Section 6.2.3.2, May 2009.

• API Publication 943. “High-Temperature Crude Oil Corrosivity Studies.” September 1974.
• ASTM Standard A53/A53M-12. "Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-

Coated, Welded and Seamless." 2012.

• ASTM Standard A106/A106M–11."Standard Specification for Seamless Carbon Steel Pipe for High-

Temperature Service." 2011.

• API Specification 5L. "Specification for Line Pipe." 45th ed., December 2012.
• ASTM Standard A53/A53M-12. "Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-

Coated, Welded and Seamless." 2012.

• http://www.eia.gov/tools/faqs/faq.cfm?id=29&t=6 (accessed February 14, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Anamet, Inc. "Metallurgical Evaluation of Samples from the Chevron U.S.A. Inc., Richmond #4

Crude Unit 8-Inch and 12-Inch 4-Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for: The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013.

• API RP 939-C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries."

1st ed., Section 7.1.5, May 2009.

• Ibid.
• Ibid.
• Ibid.
• Ibid at Section 9.
• Ibid at Section 7.1.5.
• Ibid at Section 6.2.3.2.
• Ibid at Section 7.1.5.
• Ibid at Section 9.
• Ibid at Section 9.
• API RP 571. “Damage Mechanisms Affecting Fixed Equipment in the Refining Industry.” 2nd ed.,

April 2011.

• Center for Chemical Process Safety (CCPS). “Layer of Protection Analysis – Simplified Process Risk

Assessment.” 2001.

• Division of Occupational Safety and Health, State of California, Citation of Notification of Penalty,

Inspection Number 314331877, CSHO ID A0572, Citation 4 Item 1, January 30, 2013.

• http://www.opportunitycrudes.com/marketupdates/index.php?topics=opcrudetypes (accessed

February 14, 2013).

• API RP 939-C. “Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries."

1st ed., Section 4, May 2009.

• API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping

Systems." 3rd ed., Section 4.3.1.2, November 2009.

• www.aiche.org/ccps/about (accessed February 14, 2013).
• www.aiche.org/ccps/community/members (accessed February 14, 2013).
• Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes – A Life Cycle

Approach.” 2nd ed., Section 2.2, 2009. Chevron Richmond Refinery Interim Investigation Report April 2013

67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Ibid at Section 5.1.1.
• Ibid at Section 5.2.
• Ibid at Page 184.
• Kletz, Trevor, and Paul Amyotte. “Process Plants: A Handbook for Inherently Safer Design.” 2nd

ed., Section 1.1, Page 14, 2010.

• API RP 939-C. “Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries."

1st ed., May 2009.

• Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes – A Life Cycle

Approach.” 2nd ed., Page 21, 2009.

• Ibid at Page 11.
• Ibid.
• Ibid at Page 26.
• Ibid at Page 46.
• Ibid at Page 27.
• Ibid at Page 26.
• Ibid at Page 80
• http://cchealth.org/hazmat/iso/faq.php (accessed February 14, 2013).
• City of Richmond Municipal Code Chapter 6.43, RISO. December 18, 2001.

http://www.ci.richmond.ca.us/archives/66/113%20N.S.%20amending%20Richmond%20Municipal %20Code%20Chapter%206.43%20to%20improve%20industrial%20safety-conformed.pdf (accessed April 11, 2013).

• http://cchealth.org/hazmat/iso/ (accessed April 11, 2013).
• City of Richmond Municipal Code Chapter 6.43, RISO. Section 6.43.060 “Administration” December

18, 2001. http://www.ci.richmond.ca.us/archives/66/113%20N.S.%20amending%20Richmond%20 Municipal%20Code%20Chapter%206.43%20to%20improve%20industrial%20safety-conformed.pdf (accessed April 11, 2013).

• Contra Costa County, California, Ordinance Code. Title 4 – Health and Safety. Division 450 –

Hazardous Materials and Wastes. Chapter 450-8: Risk Management. Section 450-8.014 “Definitions” (2010). http://library.municode.com/index.aspx?clientId=16286 (accessed February 15, 2013). See also City of Richmond Municipal Code §6.43.050(g) (February 5, 2013).

• Ibid at Section 450-8.016 subpart (d)(3) “Process Hazard Analysis/Action Items.” See also City of

Richmond Municipal Code §6.43.090(d)(3) (February 5, 2013). Chevron Richmond Refinery Interim Investigation Report April 2013

68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Ibid.
• Ibid.
• Ibid.
• Ibid.
• Ibid.
• Contra Costa County Industrial Safety Ordinance Guidance Document. Section D: Process Hazard

Analysis / Action Items. Subpart D.1.3. Process Hazard Analysis Recommendations and Mitigations. Published June 15, 2011. http://cchealth.org/hazmat/pdf/iso/section_d.pdf (accessed March 20, 2013).

• Ibid at Subpart D.1. Inherently Safer Systems.
• Ibid.
• http://www.dir.ca.gov/dosh/enforcementpage.htm (accessed February 15, 2013).
• Ibid.
• 29 CFR §1910.119 – Process Safety Management of Highly Hazardous Chemicals (2002).
• California Code of Regulations. Title 8. Section 5189 - Process Safety Management of Acutely

Hazardous Materials http://www.dir.ca.gov/title8/5189.html (accessed February 15, 2013).

• Ibid at (e)(1).
• Layer of Protection Analysis: Simplified Process Risk Assessment. Center for Chemical Process

Safety of the American Institute of Chemical Engineers. 2001.

• Energy Institute. “Guidance for Corrosion Management in Oil and Gas Production and Processing.”

Section 1.1, May 2008.

• Ibid at Section 4.2.
• Ibid.
• Ibid at Section 1.2.3.
• Ibid at Section 4.3.
• 40 CFR Part 68, known as the “Chemical Accident Prevention Provisions.”
• U.S. Environmental Protection Agency, “General Guidance on Risk Management Programs for

Chemical Accident Prevention (40 CFR Part 68).” Page i. March 2009. http://www.epa.gov/oem/docs/chem/Intro_final.pdf (accessed April 3, 2013).

• http://www.epa.gov/oem/content/lawsregs/epcraover.htm (accessed April 3, 2013).

Chevron Richmond Refinery Interim Investigation Report April 2013

69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Chemical Emergency Preparedness and Prevention Office, “RMPs Are on the Way! How LEPCs and

Other Local Agencies Can Include Information from Risk Management Plans in Their Ongoing Work.” November 1999. http://www.epa.gov/osweroe1/docs/chem/lepc-rmp.pdf (accessed April 17, 2013).

• Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 103. 2010.
• 40 CFR §68.25. 1999.
• 40 CFR §68.42. 1999.
• 40 CFR §68.95(a)(1) 1996.
• Center for Chemical Process Safety (CCPS). “Guidelines for Risk Based Process Safety.” Page liv.
• Ibid at Page 124.
• Ibid at Page 125.
• 29 CFR §1910.119 (c) 2012.
• Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 109. 2010.
• Ibid.
• Process Safety Leading and Lagging Metrics …You Don’t Improve What You Don’t Measure,

http://www.aiche.org/ccps/resources/overview/process-safety-metrics/recommended-process-safety- metrics (accessed April 12, 2013). 92.Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 97. 2010. 93.Health and Safety Executive (HSE), Developing Process Safety Indicators a Step-by-Step Guide for Chemical and Major Hazard Industries, HSE Guidance Series/HSG Series, HSG254, Page 4. 2006. 94.Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 109. 2010.

1. OSHA Instruction CPL 02-02-045 (1992). Updated in 1994.
2. CPL 03-00-004, Section VII. Federal Program Change. 2007.
3. Ibid at Section X(D)(1).
4. Ibid.
5. Department of Industrial Relations, Division of Occupational Safety and Health, California, Process

Safety Management District Office. “Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012.”

1. 22 CCR §66265.32(a)(4)(2004).

Chevron Richmond Refinery Interim Investigation Report April 2013

70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Center for Chemical Process Safety (CCPS). “Guidelines for Risk Based Process Safety.” 2007.

FD06451 ｜ 2012_美国_Chevron Richmond 炼油厂 火灾 - Chevron Richmond Refinery Fire__最终报告_3.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所：化工/石化 ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

REGULATORY REPORT

REPORT NO. 2012-03-I-CA DECEMBER 2013 DRAFT FOR PUBLIC COMMENT CHEVRON RICHMOND REFINERY PIPE RUPTURE AND FIRE

CHEVRON RICHMOND REFINERY #4 CRUDE UNIT RICHMOND, CALIFORNIA AUGUST 6, 2012

Chevron Richmond Refinery Regulatory Report December 2013

2 DRAFT FOR PUBLIC COMMENT

Chevron Richmond Refinery Regulatory Report December 2013

3 DRAFT FOR PUBLIC COMMENT Table of Contents Table of Contents .......................................................................................................................................... 3  Acronyms and Abbreviations ....................................................................................................................... 5  1.0  Executive Summary ......................................................................................................................... 7  1.1  Incident Summary ............................................................................................................................ 7  1.2  Interim Report .................................................................................................................................. 7  1.3  Background ...................................................................................................................................... 9  1.4  Key Findings .................................................................................................................................. 10  1.5  Regulatory Conclusions ................................................................................................................. 12  1.6  Recommendations .......................................................................................................................... 13  2.0  Introduction .................................................................................................................................... 14  3.0  The Safety Case Regulatory Regime ............................................................................................. 20  3.1  Introduction .................................................................................................................................... 20  3.2  Initial Safety Case Implementation ................................................................................................ 21  3.2.1  United Kingdom .................................................................................................................... 21  3.2.1.1  Onshore .......................................................................................................................... 21  3.2.1.2  Offshore ......................................................................................................................... 23  3.2.2  Global Analysis of Safety Case Implementation .................................................................. 26  3.2.2.1  Australia ........................................................................................................................ 26  3.2.2.1.1  Offshore ................................................................................................................. 26  3.2.2.1.2  Onshore .................................................................................................................. 27  3.2.2.2  Norway .......................................................................................................................... 27  3.2.2.3  The United States........................................................................................................... 28  3.2.2.3.1  OSHA PSM Standard ............................................................................................ 29  3.2.2.3.2  U.S. Environmental Protection Agency Risk Management Program .................... 32  3.2.2.3.3  Safety Case in the United States ............................................................................ 34  4.0  Key Features of an Effective Safety Case Regulatory Regime ...................................................... 36  4.1  Duty Holder Safety Responsibility, including a Written Case for Safety ...................................... 37  4.2  Continuous Risk Reduction to ALARP ......................................................................................... 39  4.3  Adaptability and Continuous Improvement ................................................................................... 43  4.4  Active Workforce Participation ..................................................................................................... 51  4.5  Process Safety Indicators that Drive Performance ......................................................................... 55 

Chevron Richmond Refinery Regulatory Report December 2013

4 DRAFT FOR PUBLIC COMMENT 4.6  Regulatory Assessment, Verification, and Intervention ................................................................ 59  4.7  Independent, Competent, Well-Funded Regulator ........................................................................ 63  5.0  Oversight of Petroleum Refineries in California ........................................................................... 67  5.1  Cal/OSHA ...................................................................................................................................... 67  5.1.1  Background Information ....................................................................................................... 67  5.1.2  Analysis ................................................................................................................................. 73  5.1.2.1  ALARP .......................................................................................................................... 73  5.1.2.2  Adaptability and Continuous Improvement ................................................................... 75  5.1.2.3  Process Safety Indicators ............................................................................................... 77  5.1.2.4  Inspections ..................................................................................................................... 77  5.1.2.5  Workforce Participation ................................................................................................ 78  5.1.2.6  Funding and Regulator Competency ............................................................................. 80  5.2  U.S. Environmental Protection Agency ......................................................................................... 82  5.2.1  Risk Management Plan (RMP) Program ............................................................................... 82  5.2.2  Implementation of the RMP Program ................................................................................... 83  5.3  Unified Program ............................................................................................................................ 84  5.3.1.1  Contra Costa County Hazardous Materials Programs ................................................... 84  5.3.1.1.1  CalARP .................................................................................................................. 85  5.3.1.1.2  Industrial Safety Ordinance ................................................................................... 86  5.3.1.1.3  City of Richmond Industrial Safety Ordinance ..................................................... 87  5.3.1.2  Analysis ......................................................................................................................... 87  6.0  Conclusion ..................................................................................................................................... 89  7.0  Recommendations .......................................................................................................................... 90  References ................................................................................................................................................... 93  Appendix A: Significant Petroleum Refinery Incidents in 2012 ............................................................... 96  Appendix B: Regulatory Comparison Table ............................................................................................ 101  Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach ... 104 

Chevron Richmond Refinery Regulatory Report December 2013

5 DRAFT FOR PUBLIC COMMENT Acronyms and Abbreviations ALARA

As Low As Reasonably Achievable ALARP

As Low As Reasonably Practicable ALJ

Administrative Law Judge ANPRM

Advance Notice of Proposed Rulemaking APA

Administrative Procedure Act API

American Petroleum Institute ASARP

As Safe As Reasonably Practicable AST

Aboveground Storage Tank BSEE

Bureau of Safety and Environmental Enforcement CA

Competent Authority CAA

Clean Air Act CAAA

Clean Air Act Amendments CalARP

California Accidental Release Prevention Cal/EPA

California Environmental Protection Agency Cal/OSHA

California Division of Occupational Safety and Health CCHMP

Contra Costa Health Services’ Hazardous Materials Program CCPS

Center for Chemical Process Safety CCR

California Code of Regulations CERCLA Comprehensive Environmental Response, Compensation, and Liability Act CFR

Code of Federal Regulations CIMAH

Control of Industrial Major Accident Hazards COMAH

Control of Major Accidents Hazards Regulations CSB

U.S. Chemical Safety and Hazard Investigation Board CSHO

Compliance Safety and Health Officer CUPA

Certified Unified Program Agency EA

Environment Agency EPA

U.S. Environmental Protection Agency ETC

Chevron Energy Technology Company FSA

Formal Safety Assessment FY

Fiscal Year GAO

U.S. Government Accountability Office HSC

California Health and Safety Code HSE

Health and Safety Executive HTHA

High Temperature Hydrogen Attack ISO

Industrial Safety Ordinance ISOM

Isomerization LOHP

Labor Occupational Health Program

Chevron Richmond Refinery Regulatory Report December 2013

6 DRAFT FOR PUBLIC COMMENT MOC

Management of Change MOOC

Management of Organizational Change NASA

National Aeronautics and Space Administration NEP

National Emphasis Program NOHSC

Australia National Occupational Health and Safety Commission NOPSEMA Australian National Offshore Petroleum Safety and Environmental Management Authority NPRM Notice of Proposed Rulemaking NRC U.S. Nuclear Regulatory Commission OERI Operational Excellence and Reliability Intelligence OIAC HSE Offshore Industry Advisory Committee OIG Office of Inspector General OMB Office of Management and Budget OSHA

U.S. Occupational Safety and Health Administration OSHAct

Occupational Safety and Health Act PHA

Process Hazard Analysis PHMSA Department of Transportation, Pipeline and Hazardous Materials Safety Administration PQV Program Quality Verification PSA Petroleum Safety Authority PSI Process Safety Information PSLA Petroleum Submerged Lands Act PSLG Process Safety Leadership Group PSM Process Safety Management RAGAGEP Recognized and Generally Accepted Good Engineering Practices RFI Request for Information RISC Risk-Informed Safety Case RISO City of Richmond Industrial Safety Ordinance RLOP Richmond Lube Oil Plant RMP Risk Management Plan RP Recommended Practice SEPA Scottish Environmental Protection Agency SFAIRP So Far As Is Reasonably Practicable SOP Standard Operating Procedure UK

United Kingdom USCG

U.S. Coast Guard USW

United Steelworkers Union WIG

Workforce Involvement Group

Chevron Richmond Refinery Regulatory Report December 2013

7 DRAFT FOR PUBLIC COMMENT 1.0 Executive Summary 1.1 Incident Summary On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, (“the Chevron Richmond Refinery”) experienced a catastrophic pipe failure in the #4 Crude Unit (“the crude unit”). The pipe, a 52- inch long carbon steel piping component of the #4 sidecut line, ruptured and released flammable, hydrocarbon process fluid, which partially vaporized into a large vapor cloud that engulfed 19 Chevron employees and ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition of the flammable portion of the vapor cloud and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of particulates and vapor traveling across the Richmond, California area. Approximately 15,000 people from the surrounding area sought medical treatment due to the release. 1.2 Interim Report The CSB released an Interim Report on the Chevron incident in April 2013 (“the Interim Report”), which highlighted technical findings and safety system deficiencies. Testing conducted on the ruptured pipe determined that it had experienced extreme thinning near the rupture location due to sulfidation corrosion.1 Sulfidation corrosion is a damage mechanism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F.2 This damage mechanism3 causes pipe walls to gradually thin over time, and is common in crude oil distillation4 where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide,5 are available to react with steel piping and equipment. The Interim Report noted that virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled.

The Interim Report noted a number of causal safety system deficiencies that highlight regulatory gaps relating to major accident prevention at California petroleum refineries. For example, in conducting its process hazard analysis6 (PHA) of the crude unit, which was required under California’s Process Safety

1 Carbon steel piping corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels, including stainless steel. 2 For an electronic copy of the CSB Chevron Interim Report see http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 24. 2013). 3 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 3.1.1.5, November 2009. 4 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 5 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. 6 A process hazard analysis (PHA) is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section 5189, Process

Chevron Richmond Refinery Regulatory Report December 2013

8 DRAFT FOR PUBLIC COMMENT Management (PSM) standard,7 Chevron did not conduct a rigorous review of corrosion and damage mechanisms present in the crude unit, and did not identify sulfidation corrosion as a hazard. As such, Chevron did not effectively address inherent safety or implement effective controls to prevent sulfidation corrosion, including those controls proposed by Chevron’s technical group. Although both the California and federal PSM standards require that hazards be identified, evaluated, and controlled, there is no further discussion of how far to reduce risks, and there is no requirement to address the effectiveness of controls or to use the hierarchy of controls. Therefore, this type of analysis was not required to be conducted, and Chevron was never cited post-incident for failing to evaluate the effectiveness of safeguards.

In another example, despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction through the Management of Change (MOC) process, incident investigations, technical reports, and employee recommendations, Chevron repeatedly failed to implement those proposed recommendations. Chevron’s 2006 MOC analysis limited application of those recommendations to only a small section of the pipe. As a result, the portion of the pipe that failed on the August 6th incident remained in service until the incident. As there is no requirement to implement effective recommendations or control hazards under the MOC element, it is essentially an activity-based requirement. Chevron was not cited for narrowing the scope of the MOC, despite its disregard of internal recommendations. The CSB concluded in its Interim Report that Chevron did not regularly or rigorously apply inherently safer technology, which provides an opportunity for preventing major accidents, in its PHAs, MOCs, incident investigation recommendations, or during turnarounds.

The CSB made safety recommendations in the Interim Report to a number of entities, including the California State Legislature, the U.S. Environmental Protection Agency, and Contra Costa County. The Board recommended that the California State Legislature require California petroleum refineries to perform damage mechanism hazard reviews, to identify and report leading and lagging process safety indicators, to document recognized methodologies, rationale, and conclusions used to claim that safeguards intended to control hazards will be effective, and to document their inherently safer systems analysis and the hierarchy of controls in establishing safeguards for process hazards, with the goal of driving risk of major accidents to as low as reasonably practicable, or ALARP. These concepts, introduced in the Interim Report and highlighted in the recommendations, are the basic building blocks for the implementation of the safety case regime, a regulatory scheme that will be discussed in great detail in the following report.

The CSB concluded its Interim Report by highlighting additional issues that were still under investigation, including emergency planning and reporting, emergency response, safety culture, and regulatory oversight of petroleum refineries in California. The following report fulfills the CSB’s commitment to examine whether the implementation of the safety case regulatory regime could be a more effective regulatory tool to achieve major accident prevention for California petroleum refineries. The reader will find additional issues, arguments, and counterarguments regarding the safety case regulatory regime addressed in Appendix C of this report.

Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental Release Prevention Program and the federal EPA Risk Management Program. 7 Under 8 CCR §5189 (e). https://www.dir.ca.gov/title8/5189.html (accessed September 25, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

9 DRAFT FOR PUBLIC COMMENT 1.3 Background Although both the federal and California PSM standards, respectively, were intended to be goal-setting or performance-based, 8,9 in practice they appear to function primarily as reactive and activity-based10 regulatory schemes that require extensive rulemaking to modify. As a result, the federal and California PSM standards have become static in the face of advancing best practices and technology, with the emphasis placed on the completion of a task or activity rather than achievement of continuous risk reduction.11 Many regions around the world such as the UK, Australia, and Norway have acknowledged similar deficiencies and have implemented regulatory regimes consisting of both prescriptive12 and goal- setting elements that require duty holders13 to demonstrate to the regulator through rigorous reviews and audits that they have reduced risks to as low as reasonably practicable, or ALARP. This is referred to as the safety case regulatory regime.14 The safety case regulatory regime is a rigorous prescriptive and goal- setting regulatory approach applied globally both onshore and offshore. It is highlighted by its adaptability and requirements for continuous improvement in risk reduction for high hazard industrial facilities. A written case for safety, known as the safety case report, is generated by the duty holder and is generally rigorously reviewed, audited, and enforced by highly technically competent inspectors with skill sets familiar to those employed by the industries they oversee. Despite this global shift, the US has persisted in the use of a more activity-based regulatory scheme that lacks the ability to adapt to advancing technology and recently developed industry standards, and which has failed to adequately engage companies and their employees in continuous improvement and risk reduction with similarly-skilled inspectors.

8 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 9 See Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and Explanation of the Final Rule (March 4, 1992). https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed August 13, 2013). 10 Activity-based standards and regulations require the mere completion of an activity and do not focus on the effectiveness of major accident prevention or risk reduction. 11 As will be discussed below, certain sections of the PSM standard have elements of a performance-based regulatory approach. 12 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 13 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 14 Norway’s offshore regulatory regime is not referred to as the safety case regime, but it does contain many of the same elements as the safety case regime, with some differences in style, substances, and implementation.

Chevron Richmond Refinery Regulatory Report December 2013

10 DRAFT FOR PUBLIC COMMENT 1.4 Key Findings Technical

In the ten years prior to the incident, highly knowledgeable and experienced Chevron technical staff repeatedly recommended that inspectors perform 100 percent component inspections on high temperature carbon steel piping susceptible to sulfidation corrosion. These recommendations were not implemented by Chevron management.15

Chevron technical staff recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past recommendations from employees. However, Chevron failed to implement proposed inherently safer recommendations prior to the incident. For example, an inspection recommendation to upgrade piping to 9-Chrome was made, but the MOC to implement the recommendation narrowed the scope, allowing the 52-inch component that failed to remain in service.

In January 2007, a failure due to sulfidation corrosion caused a fire in the Chevron Richmond Refinery crude unit, initiating a shelter-in-place for the surrounding community. A carbon steel piping spool16 failed catastrophically during operation. Chevron informed Contra Costa Health Services’ Hazardous Materials Program17 in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, this upgrade was limited to only the immediate piping spool that had failed. The inherently safer, more corrosion resistant metallurgy was not implemented more broadly in the crude unit as a result of this incident.

Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. However, they had limited practical influence to implement their recommendations. They did not participate in the most recent crude unit PHA, and they did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.18

The 2009 crude unit PHA did not identify corrosion as a potential cause of a leak or rupture in piping. The PHA cited non-specific, judgment-based qualitative safeguards to reduce risk, such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.19 The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards

15 These recommendations are discussed in detail in paragraphs 44 through 51 of the Chevron Interim Report. 16 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. 17 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). 18 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown. 19 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment.

Chevron Richmond Refinery Regulatory Report December 2013

11 DRAFT FOR PUBLIC COMMENT been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel piping could have been recommended.

Regulatory

Following the August 6th incident, California’s Division of Occupational Safety and Health (Cal/OSHA) inspected the Chevron facility and issued citations. Only one citation was related to PHAs; and it was not associated with evaluating the effectiveness of safeguards. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude unit. Had the California PSM standard required documentation of the effectiveness of safeguards, Chevron would have been obligated to conduct this analysis and Cal/OSHA inspectors could rely on the regulation for support during inspections.

There is a significant discrepancy in the compensation between the California regulators and the Chevron Richmond Refinery personnel they interact with. The California regulators also lack the technical staff with the necessary skills, knowledge, and experience to provide sufficient direct oversight of petroleum refineries in California.

The CSB has noted a considerable problem with significant and deadly incidents at petroleum refineries over the last decade. In 2012 alone, the CSB tracked 125 significant process safety tincidents at US petroleum refineries. Seventeen of these took place in California.

Under the existing regulatory regimes for onshore petroleum refineries in the US and California, such as the PSM and RMP programs, there is no requirement to reduce risks to ALARP. For example, under both PSM and RMP an employer must “control” hazards when conducting a process hazard analysis (PHA) of a covered process. However, there is no requirement to address the effectiveness of the controls or the hierarchy of controls. Thus, a PHA that meets the regulatory requirements may inadequately identify or mitigate major hazard risk. In addition, there is no requirement to submit PHAs to the regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed safeguards.

In the last decade, the CSB has made a number of process-safety related recommendations to OSHA and EPA in its investigation reports and studies (e.g. Motiva, BP Texas City, and Reactive Hazards). However, none of the regulatory recommendations have been implemented, and there have been no substantive changes made to the PSM and RMP regulations to improve the prevention of major accidents.

Available data from Norway and the United Kingdom (UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime.20

Regulatory approaches similar to the safety case regulatory regime, which require risk reduction to ALARP or equivalent, have been implemented in the nuclear sector by the Nuclear Regulatory Commission (NRC) and the aerospace sector by NASA.

20 Norway’s indicator data is discussed in Section 4.5. The UK data is discussed in Appendix C.

Chevron Richmond Refinery Regulatory Report December 2013

12 DRAFT FOR PUBLIC COMMENT

1. Independent studies of the safety case in the UK have identified improvements to safety performance

from the safety case regulatory regime and a variety of stakeholders, including major oil companies, have shown support of the safety case.21 1.5 Regulatory Conclusions The existing regulatory regimes for onshore petroleum refineries in the US and California:

Rely on a safety and environmental management system framework that is primarily activity-based rather than goal-based risk reduction to as low as reasonably practicable (ALARP) or equivalent.

Are static, unable to adapt to innovation and advances in the management of major hazard risks.

Place the burden on the regulator to verify compliance with the regulations rather than shifting the burden to industries by requiring duty holders to effectively manage the risks they create and ensure regulator acceptance of their plans for controlling those risks.

Do not effectively incorporate lessons learned from major accidents; nor do they have the regulatory authority to require duty holders to address newly-identified safety issues as a result of such incidents.

Do not effectively collect or promote industry use of major accident performance indicators to drive industry to reduce risks to ALARP.

Do not require the use or implementation of inherently safer systems analysis or hierarchy of controls.

Do not effectively involve the workforce in hazard analysis and prevention of major accidents.

Do not provide the regulator with the authority to accept or reject a company’s hazard analysis, risk assessment, or proposed safeguards; and

Do not employ the requisite number of staff with the technical skills, knowledge, and experience to provide sufficient direct safety oversight of petroleum refineries.

21 See Sections 2.0, 3.2.12, and 3.2.2.3. Also see FAQ 4.

Chevron Richmond Refinery Regulatory Report December 2013

13 DRAFT FOR PUBLIC COMMENT 1.6 Recommendations As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized below, to the following recipients:

California State Legislature, Governor of California

Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory framework for petroleum refineries in the state of California based on the principles of the “safety case” framework.

Occupational Safety and Health Administration

As part of your response to Executive Order 13650, develop questions and evaluate issues raised from the findings and conclusions in this report concerning the safety case regime.

Section 7.0 details the recommendations.

Chevron Richmond Refinery Regulatory Report December 2013

14 DRAFT FOR PUBLIC COMMENT 2.0 Introduction

Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction of the thousands of industrial and chemical facilities that exist in the US, the CSB has seen a great number of serious and deadly incidents at refineries over the last decade.

In March 2005, the BP Texas City Refinery suffered one of the worst industrial accidents in recent US history, when overfill of a distillation column resulted in an explosion and fire that led to 15 fatalities, another 180 injuries, and the issuance of a shelter-in-place order that required 43,000 people to remain indoors. Houses were damaged as far as three-quarters of a mile away from the refinery. In a 2006 statement, former CSB Chairwoman Carolyn Merritt said that while BP did make some safety improvements before the March 2005 explosion, “the focus of many of these initiatives was on improving procedural compliance and reducing occupational injury rates, while catastrophic safety risks remained…”22 In November 2009, an explosion at the Silver Eagle Refinery damaged over 100 homes in a nearby subdivision in Woods Cross, Utah. At a public meeting to discuss the incident, former CSB Chairman John Bresland called on refineries to improve their safety performance, stating: The frequency of accidents in US refineries is very troubling. These accidents cost lives, inflict serious injuries and can harm communities. They also earn scrutiny from government regulators; in the past few weeks a refinery in Texas drew the largest OSHA fine in history, more than US $80 million, for alleged process safety violations. I call on all refineries to redouble their commitment to safer operations and safer communities. The current rate of accidents in refineries is not sustainable and it is not acceptable.23 On the five-year anniversary of the BP Texas City explosion in March 2010, Chairman Bresland continued to relay his concern regarding refinery safety, noting that “refinery accidents…continue to occur with dismaying frequency…[and] will only stop when every refinery has made the financial and human commitment to sound process safety management.”24 Yet just ten days later, seven workers were fatally injured at the Tesoro refinery in Anacortes, Washington, following the catastrophic failure of a heat exchanger. Again, Chairman Bresland pointed out the alarming frequency of refinery incidents, stating that “if the aviation industry had the same number and types of incidents as the refining industry, I don’t think people would be flying too much.”25 In 2012 alone, the CSB tracked 125 significant26 process safety incidents at US petroleum refineries, which are listed in Appendix A. Seventeen of these took

22 Scrutiny Finds BP Safety Troubles. http://usatoday30.usatoday.com/money/industries/energy/2006-10-30-bp- blast-findings_x.htm (accessed September 5, 2013). 23US Refineries Commitment to Safety Called Into Question. http://www.engineerlive.com/content/22354 (accessed September 5, 2013). 24 http://www.csb.gov/statement-from-csb-chairman-john-bresland-on-5th-anniversary-of-fatal-bp-texas-city-2005- explosion/?pg=18 (accessed September 5, 2013). 25Refinery Tragedies All Too Common. See http://seattletimes.com/html/localnews/2011518449_safetysunday04m.html (accessed September 5, 2013) 26 These incidents were reported to the Department of Energy and/or the National Response Center and examined by the CSB’s Incident Screening Department.

Chevron Richmond Refinery Regulatory Report December 2013

15 DRAFT FOR PUBLIC COMMENT The CSB tracked 125 significant petroleum refinery incidents in the US in 2012. place in California, including a major release of 8,614 pounds of highly toxic hydrogen sulfide at the Chevron Richmond Refinery on August 2, 2012, just four days prior to the incident. Of the 15 major accidents that the CSB is currently investigating, six occurred in petroleum refineries. These include two separate explosions at the Silver Eagle refinery in Woods Cross, Utah, which resulted in injuries and offsite consequences, the heat exchanger rupture at the Tesoro refinery in Anacortes, Washington, which resulted in seven fatalities, and a series of equipment failures at CITGO’s refinery in Corpus Christi, Texas, involving highly toxic hydrogen fluoride. The U.S. Environmental Protection Agency (EPA) has also documented 234 recordable accidents at petroleum refineries between 2000 and 2010, which is more than any other industry, including the much larger sector of chemical manufacturing, which EPA documented as having 218 recordable accidents.27

The CSB concludes that the continuing occurrence of refinery accidents demonstrates the pressing need to examine the current regulatory structure in place in the US and, in light of the Chevron incident, in the state of California for petroleum refineries. There have been a number of positive developments in the wake of the Chevron incident that demonstrate California’s prime opportunity to lead the nation in implementing changes to improve safety and health in the refining industry. In the Fall of 2012 following the Chevron incident, California Governor Jerry Brown created the California Interagency Working Group on Refinery Safety (“the working group”), charged with improving cooperation among agencies, including the U.S. Environmental Protection Agency (EPA), Cal EPA, California’s Division of Occupational Safety and Health (Cal/OSHA), and Contra Costa County, with the goal of improving safety at California’s petroleum refineries and preventing major accidents.

The working group began its initiative by commissioning the Labor Occupational Health Program28 (LOHP) to conduct “listening panels” throughout California, enabling community members to meet with working group members to discuss their concerns surrounding refineries. LOHP convened a series of meetings and conference calls with labor unions, community-based organizations, fire agencies, and environmental health groups between November 6, 2012, and March 18, 2013. Dr. Michael P. Wilson, the Director of LOHP, documented his findings and recommendations regarding refinery safety in a summary report entitled Refinery Safety in California: Labor, Community and Fire Agency Views, which was released on June 4, 2013.29 In the report, Dr. Wilson quoted Swiss Re’s finding that the US has experienced financial losses from refinery incidents that are three times that of industry counterparts in countries within the “EU cluster,”30 a gap which continues to grow due in part to the US refining

27 Matthiessen, Craig. EPA Risk Management Program: An Overview of the EPA Risk Management Program and Inherently Safer Processes. NAS-MIC Bayer Public Meeting Power Point Presentation; May 24, 2011; p 20. 28 LOHP is a public service program for the Center for Occupational and Environmental Health at UC Berkeley’s School of Public Health. LOHP seeks “to reduce occupational injury, illness and death by protecting the health and safety of workers worldwide.” For more information, see http://www.lohp.org/ (accessed July 8, 2013). 29 Dr. Wilson released an initial draft of the summary report on March 27, 2013. He then released a revised copy of the summary report on June 4, 2013. See http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 30 The countries in the EU cluster are all of Europe, Singapore, South Korea, Japan, Saudi Arabia, Gulf States and Egypt.

Chevron Richmond Refinery Regulatory Report December 2013

16 DRAFT FOR PUBLIC COMMENT industry’s “pushing…mode of operation”, its “compliance-driven focus on safety”, and “a ‘detached’ workforce….”31

Dr. Wilson reiterated a number of the findings contained in the CSB’s Interim Report on the Chevron incident, including the “striking lack of attention on the part of the Richmond Chevron refinery to maintenance and metallurgy upgrades…,” and the Chevron Richmond Refinery’s failure to implement a recommended 100% component inspection program for high-risk piping. He also stated that California’s refineries are able to operate without demonstrating competence in health, safety, and environmental performance to a regulatory agency or to the public, and as such recommended that California establish a regulatory approach similar to that of the safety case regulatory regime, a rigorous prescriptive32 and goal- setting33 regulatory regime used widely by other regions throughout the world such as the United Kingdom (UK) and Australia to regulate high hazard industrial facilities. It is highlighted by its adaptability and requirements for continuous improvements in risk reduction, and shifts the burden to the industry to demonstrate its competence in health and safety to the regulator. The regime is overseen by highly competent, well-funded regulators that rigorously audit facilities for compliance with the written safety case report and good industry practice.

On July 11, 2013, the working group released a draft report entitled Improving Public and Worker Safety at Oil Refineries,34 which the CSB has recognized as an important step forward in improving petroleum refinery safety and environmental performance both in California and nationally. The report outlined the process of adopting several of the CSB‘s recommendations from its Interim Report on the Chevron incident, including requiring refineries to implement inherently safer systems and conduct damage mechanism hazard reviews. Furthermore, the report announced the creation of an Interagency Refinery Task Force within the California Environmental Protection Agency (Cal/EPA) by September 1, 2013, aimed at facilitating information sharing and improving coordination of oversight and enforcement activities among regulatory agencies. The CSB also welcomed the report’s recommendation for California to study the safety case regulatory approach.

In addition to the work being done by the working group, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at least 15 new positions in

31 Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013; pp 5 and 6. Citing Zirngast, Ernst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT- EXTRACT. Risk Engineering Services, Swiss Re. http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 32 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 33 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 34 See http://www.calepa.ca.gov/Publications/Reports/2013/Refineries.PDF (accessed September 25, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

17 DRAFT FOR PUBLIC COMMENT Cal/OSHA’s Process Safety Unit, which enforces the California Process Safety Management (PSM) standard throughout the state.35

The Chevron incident also spurred the formation of the City of Richmond’s Collaborative on Refinery Safety and Community Health (“the collaborative”), which was launched on January 30, 2013, and is led by Dr. Wilson. The collaborative, whose members include the United Steelworkers36 (USW) Local 5, the USW International, Communities for a Better Environment,37 and LOHP,38 was launched after a preliminary exploratory meeting held on January 23, 2013, which was convened by LOHP and attended by CSB Board Members and the CSB Chevron Investigation Team. The collaborative advocates for community and worker safety, better transparency, and environmental health, and has already made recommendations to the working group to improve emissions reporting and require more thorough assessments of pipe corrosion damage at oil refineries.39

On October 10, 2013, the collaborative formally responded in a memo to the July 2013 draft report issued by the Interagency Working Group on Refinery Safety (Improving Public and Worker Safety at Oil Refineries). In the memo, the collaborative stated its support for the working group’s findings and recommendations. The collaborative also issued its own recommendations and highlighted 12 principles as being important to the development of effective regulatory policy in California. These principles include linking regulatory non-compliance to an operator’s license to operate and integrating meaningful participation in decision-making by workers and communities.40 The collaborative also noted in the memo that it supported “shifting the ‘burden of proof’ of safety from public agencies to the industry, as is required in the ‘Safety Case’ approach…”41

The CSB noted in its Chevron Interim Report the important role of transparency between industry and the public in improving health and safety for the facility and the surrounding communities. Following the Chevron incident the collaborative, worker representatives, regulators, and governmental bodies played a key role in driving transparency, accountability, and improved risk reduction during the decision-making process related to crude unit piping repairs. The CSB recommended to the California State Legislature in the Interim Report to establish a multi-agency process safety regulatory program for all California petroleum refineries to further improve public accountability and transparency by establishing a system to

35 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 36 The USW is the largest industrial union in North America and has approximately 1.2 million active and retired members in the US, Canada, and the Caribbean. For more information see http://www.usw.org/ (accessed July 17, 2013). 37 Communities for a Better Environment is an “environmental justice organization[s]” in California which has the mission of “build[ing] people’s power in California’s communities of color and low income communities to achieve environmental health and justice by preventing and reducing pollution and building green, health and sustainable communities and environments.” See http://www.cbecal.org/about/mission-vision/ (accessed August 14, 2013). 38 Other members of the collaborative include the BlueGreen Alliance (a coalition of labor unions and environmental groups that advocate for a green economy and safer workplaces), the National Resources Defense Council, and the Asian Pacific Environmental Network. 39 See http://richmondconfidential.org/2013/02/20/labor-and-environmental-groups-join-forces-on-refinery-issues/ (accessed July 9, 2013). 40 Refinery Action Collaborative. Initial Response of the Collaborative to the Findings & Recommendations of The July 2013 Draft Report of the Interagency Working Group on Refinery Safety, Governor Jerry Brown. October 10, 2013; p 10. 41 Ibid at 7.

Chevron Richmond Refinery Regulatory Report December 2013

18 DRAFT FOR PUBLIC COMMENT report to the regulator methodologies, findings, conclusions, and corrective actions related to refinery mechanical integrity inspection and repair work arising from California petroleum refinery PHAs, turnarounds, and maintenance-related shutdowns. This system would require reporting of information such as damage mechanism hazard reviews, establish procedures for greater workforce and public participation, and provide mechanisms for federal, state, and local agency operational coordination, sharing of data, and joint accident prevention activities. California is actively working to implement this recommendation through the creation of the Interagency Refinery Task Force mentioned above.

The positive and productive developments that have taken place in the wake of the Chevron incident strongly suggest that California has a unique opportunity to implement changes to improve safety and health in the refining industry that can serve as a model to the rest of the country.

It is also important to note that a growing dialogue has emerged throughout the US surrounding the need to improve the regulation of hazardous materials and processes in the US, to which the CSB has been an important contributor. The CSB first examined the safety case in its 2002 investigation report entitled Improving Reactive Hazard Management42 as a potentially effective alternative framework for the regulation of reactive hazards. The CSB noted that successful implementation of this “comprehensive” regulatory approach required a competent and experienced regulator. In December 2010, the CSB held a public hearing in Washington, DC on the Regulatory Approaches to Offshore Oil and Gas Safety, where internationally recognized experts in industrial safety and accident analysis provided important testimony on managing risks offshore.43 Much of this testimony supported the implementation of the safety case as a model for regulating major hazards, both onshore and off. For example, a Shell Oil Company representative testified that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers44 and controls. In July 2012, the CSB held an additional public hearing on Safety Performance Indicators.45 A number of international regulators testified on the regulator’s ability under the safety case to drive continuous improvement in the oil and gas industry. Finally, on July 25, 2013, the CSB held a public meeting to discuss the U.S. Occupational Safety and Health Administration’s (OSHA) failure to implement a number of key CSB safety recommendations made to OSHA in the last decade to revise and improve its Process Safety Management (PSM) standard and to issue a new combustible dust standard.

On January 18, 2011, President Obama issued Executive Order 13563,46 which called for improvements in the nation’s regulatory system to promote predictability and reduce uncertainty and to use the best,

42 A full copy of the report is available at http://www.csb.gov/improving-reactive-hazard-management/ (accessed July 10, 2013). 43 For a copy of the transcript from the CSB Public Hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, see http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed August 14, 2013). 44 A barrier is a “technical, operational and/or organizational element[] which individually or collectively reduce[s] opportunities for specific error, hazard or accident to occur, or which limits its harm/drawbacks.” Petroleum Safety Authority. Safety Status & Signals, 2012-2012; 2013; p 31. 45 For the proceedings of the CSB Public Hearing on Safety Performance Indicators see http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 46 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.archives.gov/federal-register/executive- orders/2011.html (accessed July 10, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

19 DRAFT FOR PUBLIC COMMENT most innovative, and least burdensome tools for achieving regulatory ends. Specifically, it directed that agencies review existing and proposed standards and regulations to ensure they effectively protect “public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”47 Finally, the order emphasized that to the extent feasible, regulations and standards should specify performance objectives rather than the behavior or manner of compliance that regulated entities must adopt, and be adopted through a process that involves public participation. As a result of this Executive Order, OSHA, the Bureau of Safety and Environmental Enforcement (BSEE), the U.S. Environmental Protection Agency (EPA), the Department of Transportation’s Pipeline and Hazardous Materials Safety Administration (PHMSA), and the U.S. Coast Guard (USCG) solicited views from the public and stakeholders regarding opportunities to address improving efficiency and effectiveness of safety and environmental regulations and standards in the oil and gas industry.48 These five agencies then convened an expert forum49 in September 2012 in Texas City, Texas, to explore the benefits of implementing goal or performance-based regulatory models such as the safety case in the oil and gas industry, and ways to advance the use of such models in the US. The forum included a discussion of the safety case regulatory regime as a performance-based regulatory model, and industrial safety and accident analysis expert Dr. Andrew Hopkins spoke in support of that model.

The CSB has utilized a broad range of expert testimony and research to gain a comprehensive understanding of regulatory models for onshore and offshore oil and gas facilities in countries around the world, and, in light of this investigation, the state of California. This report highlights the significant attributes of the safety case regime that together result in a more effective regulatory approach to process safety and risk reduction. It also provides a detailed contrast of the safety case regulatory model to the existing regulatory structures in the US and California, and makes recommendations to improve California’s regulatory oversight of its petroleum refineries and to promote a broader national dialogue on the safety case regulatory approach.

47 Ibid. 48 For more information see https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed July 10, 2013). 49 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed August 13, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

20 DRAFT FOR PUBLIC COMMENT 3.0 The Safety Case Regulatory Regime 3.1 Introduction Throughout modern history, major industrial accidents have been catalysts for significant regulatory reform, as countries around the world strive to mitigate risk and improve the safety of their facilities and processes in order to protect human health and the environment. According to industrial safety and accident analysis expert Dr. Andrew Hopkins, “[d]isasters…offer an unparalleled opportunity to study the workings of an organisation and to identify where things are going wrong.”50 Around the world, many of these large-scale incidents have resulted in sweeping changes to legislation surrounding industrial safety and health. These changes replace prescriptive, compliance-based regulations with goal-setting regulations supplemented by prescriptive requirements that support adaptability, require duty holders51 to demonstrate to the regulator that they have driven risks to as low as reasonably practicable (ALARP) or equivalent, and provide the regulator with the tools to drive continuous improvement among major hazard facilities.52 A majority of these regulatory regimes are referred to as the safety case, which Dr. Hopkins defines as: a case which the operator of a hazardous facility makes to the regulator, setting out how safety is to be managed. It must include details of the hazard identification process, the hazards which have been identified and the procedures which have been set in place to control them. The system remains self-regulatory in principle but rather than the facility being left to its own devices by the regulator it must convince the regulator that its strategy for managing safety is satisfactory [emphasis added]. Under any safety case regime, facility operators are expected to adopt best practice risk management.53 The safety case regulatory regime is much more than a written report; it shifts risk management responsibility to the company and its employees and provides for rigorous review and oversight by a technically competent regulator to ensure effective implementation. The remaining portions of Section 3 will introduce major accidents that have occurred around the world and discuss the history behind the global development and implementation of the safety case regulatory

50 Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999; p 1. 51 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 52 Major hazard facilities are workplaces that store, handle or process large quantities of hazardous material. Incidents at such facilities have the potential to cause serious damage to employees, people in surrounding areas, and the environment. See http://www.pc.gov.au/__data/assets/pdf_file/0018/82350/21-appendixd.pdf (accessed May 9, 2013). 53 Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online]; p 7. http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%20presentati on/Lonford%20talk.PDF (accessed May 8, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

21 DRAFT FOR PUBLIC COMMENT approach on and offshore. Section 4.0 will then highlight major attributes of the safety case regulatory approach. The US regulatory model will also be introduced and discussed throughout these sections to allow for comparisons between the different approaches. Finally, Section 5.0 will discuss the regulation of petroleum refineries in California specifically, including Chevron. The report concludes with important recommendations focused on improving the regulatory oversight of California’s 15 refineries, and encouraging OSHA, industry, labor, and others to work together to improve the regulation of petroleum refineries throughout the US. 3.2 Initial Safety Case Implementation 3.2.1 United Kingdom 3.2.1.1 Onshore Two major onshore incidents in the 1970s helped spark legislative reform focused on major accident prevention and risk reduction for onshore major hazard facilities. A large dioxin54 release in Seveso, Italy, in 1976, which injured hundreds of individuals, led the European Commission55 to adopt legislation in 1982 known as the Seveso Directive, aimed at the prevention and control of major industrial accidents.56 Following the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, and the Sandoz chemical plant fire near Basel, Switzerland, which injured 14 individuals and released nearly 30 tons of pesticides into the Rhine River, turning it red, the Seveso Directive was amended and replaced in 1996 with the Seveso II Directive.57 The regulation requires owners or operators of facilities that contain threshold quantities of listed substances to submit safety reports to a competent authority (CA) within a Member State of the European Commission for its review and acceptance.58 These reports must demonstrate to the CA that major-accident prevention policies, safety management systems, and internal emergency plans have been created and implemented.59 The regulation also requires owners or operators to “prove to the competent authority…that he has taken all measures necessary as specified in this Directive.”60

54 The term Dioxin refers to a family of toxic chemicals. They have been characterized by EPA as likely to be human carcinogens and are anticipated to increase the risk of cancer at background levels of exposure. See http://www.epa.gov/pbt/pubs/dioxins.htm (accessed June 17, 2013). 55 The European Commission consists of 27 Commissioners and “represents the interests of the EU [European Union] as a whole. It proposes new legislation to the European Parliament and the Council of the European Union, and it ensures that EU law is correctly applied by member countries.” http://ec.europa.eu/atwork/index_en.htm (accessed May 6, 2013). 56 See http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 57 The Seveso Directive was adopted in 1982 and was amended twice, in 1987 and 1988. On December 9, 1996, the Seveso II Directive was adopted and replaced the original Seveso Directive. The Seveso III Directive was then adopted on July 4, 2012, and became effective on August 13, 2012. Member States must implement Seveso III by June 1, 2015. http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 58See http://ec.europa.eu/environment/seveso/legislation.htm (accessed May 6, 2013). 59 Seveso II Directive, Article 9 (1996). Available at http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013). 60 Seveso II Directive, Article 5, Paragraph 2 (1996). Available at http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

22 DRAFT FOR PUBLIC COMMENT The COMAH Regulations require covered onshore facilities in the UK to “take all measures necessary to prevent major accidents and limit their consequences to people and the environment.” The HSE interprets this duty as the equivalent of reducing risks to as low as reasonably practicable, or ALARP. On June 1, 1974, the Flixborough Works of Nypro (UK) Limited experienced a massive cyclohexane vapor cloud explosion, killing 28 workers and injuring 36 workers and hundreds of members of the public offsite. This incident along with the Seveso incident led to the Seveso Directive in 1982, and this was converted into legislation in the United Kingdom (UK) via the Control of Industrial Major Accident Hazards (CIMAH) 1984 Regulations. The Control of Major Accidents61 Hazards Regulations (COMAH) replaced CIMAH in April 1999 to conform to the updated Seveso II Directive. The Health and Safety Executive62 (HSE), the Environment Agency63 (EA), and the Scottish Environmental Protection Agency64 (SEPA) are considered to be the UK’s CA responsible for the enforcement of these regulations. A key feature differentiating these two regulations is the increasing emphasis from the operator having to “describe” the safety systems in CIMAH to being required to “demonstrate” their adequacy in COMAH.65 The COMAH regulations apply to all onshore facilities that have sufficient quantities of dangerous substances as listed in Schedule 166 of the regulations.67 The general duty for all duty holders of facilities covered under the COMAH regulations is to “take all measures necessary to prevent major accidents and limit their consequences to people and the environment.”68 The HSE interprets this duty as the equivalent of reducing risks69 to “as low as reasonably practicable,” or ALARP.70,71,72 Duty holders are required to

61 The COMAH regulations define “major accident” as “an occurrence (including in particular, a major emission, fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances…” COMAH Regulations, Part 1, Regulation 2 (2005). 62 HSE is an independent regulator, and “act[s] in the public interest to reduce work-related death and serious injury across Great Britain’s workplaces.” See http://www.hse.gov.uk/aboutus/ (accessed May 7, 2013). According to the HSE’s Enforcement Policy Statement, the HSE’s purpose is “to protect the health, safety and welfare of people at work, and to safeguard others, mainly members of the public, who may be exposed to risks from the way work is carried out.” http://www.hse.gov.uk/pubns/hse41.pdf (accessed May 7, 2013). 63 EA is an Executive Non-departmental Public Body responsible for protecting the environment and promoting sustainable development. For more information see http://www.environment-agency.gov.uk/default.aspx (accessed July 17, 2013). 64 SEPA is Scotland’s environmental regulator, aimed at protecting and improving the environment. For more information see http://www.sepa.org.uk/ (accessed July 17, 2013). 65 COMAH Regulations. Schedule 4, Part 1. Purpose of safety reports is to “1. demonstrate[e] that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2; 2. Demonstrate[e] that major accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for persons and the environment; 3. Demonstrate[e] that adequate safety and reliability have been incorporated into the – (a) design and construction, and (b) operation and maintenance, of any installation and equipment and infrastructure connected with its operation which are linked to major accident hazards within the establishment…” (2005). 66 Available at http://www.legislation.gov.uk/uksi/1999/743/schedule/1/made (accessed June 17, 2013). 67 COMAH Regulations, Part 1, Regulation 3 (2005). 68 COMAH Regulations, Part 2, Section 4 (2005). 69 HSE describes “risk” as “the likelihood that a hazard will actually cause its adverse effects, together with a measure of the effect.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 70 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed May 15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

23 DRAFT FOR PUBLIC COMMENT prepare a safety report that “demonstrate[s] to the CA that all measures necessary for the prevention and mitigation of major accidents have been taken.”73 These reports must contain information for the CA to review and analyze, including a policy on preventing and mitigating major accidents; a management system for implementing that policy that complies with good practice;74 an effective method for identifying any major accidents that might occur; and measures to prevent and mitigate major accidents.75 To assist operators with reducing risks to ALARP, HSE publishes guidance documents that contain good practice guidelines and standards and that discuss what constitutes good practice.76 3.2.1.2 Offshore The international offshore energy sector experienced several catastrophic incidents in the 1980s, including the Alexander Kielland77 incident in Norway in 1980 which resulted in 123 fatalities, and the Piper Alpha78 incident in the UK in 1988, which fatally injured 167 workers. These incidents initiated offshore regulatory changes focused on risk reduction and control that were modeled after the CIMAH regulations.

71 The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974. It requires employers to ensure that risks to employees and others are reduced “so far as is reasonably practicable,” or SFAIRP. Health and Safety at Work etc. Act, Part I, Section 2 (1) and (2) (1974). HSE has interpreted that SFAIRP duties call for the same set of tests to be applied as duties to reduce risks “as low as reasonably practicable,” or ALARP. According to HSE, “”the two terms mean essentially the same thing and at their core is the concept of ‘reasonably practicable’;…” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 72 According to HSE, the concept of “reasonably practicable” “involves weighing a risk against the trouble, time and money needed to control it. Thus, ALARP describes the level to which [they] expect to see workplace risks controlled.” This allows HSE to “set goals for duty-holders, rather than being prescriptive; HSE’s policy is that any proposed regulatory action should be based on what is reasonably practicable.” According to HSE, in most situations, deciding whether the risks are ALARP involves a “comparison between the control measures a duty- holder has in place or is proposing and the measures [they] would normally expect to see in such circumstances i.e. relevant good practice. ‘Good practice’ is defined as ‘those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.’… Once what is good practice has been determined, much of the discussion with duty-holders about whether a risk is or will be ALARP is likely to be concerned with the relevance of the good practice, and how appropriately it has been (or will be) implemented.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 73COMAH Regulations, Schedule 4, Part 1 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 74 HSE defines “good practice” as “those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.” HSE, “Assessing compliance with the law in individual cases and the use of good practice,” May 2003. Available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 75 COMAH Regulations, Schedule 4, Part 2 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 76 Such as HSE’s “Guidance for the topic assessment of the major accident hazard aspects of safety cases,” published in April 2006, and HSE’s “Assessing compliance with the law in individual cases and the use of good practice,” May 2003, available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 77 The Alexander Kielland was a drilling rig built to house offshore workers in the North Sea. During a storm, it suffered a catastrophic failure that caused it to capsize. The incident resulted in 123 fatalities. 78 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the platform. This incident became the deadliest accident in the history of the offshore industry.

Chevron Richmond Refinery Regulatory Report December 2013

24 DRAFT FOR PUBLIC COMMENT Following the Piper Alpha incident, the UK Secretary of State for the Department of Energy ordered that a public inquiry be held to determine the circumstances surrounding the incident.79 The Secretary directed Lord Cullen, a Senator of the College of Justice in Scotland, to hold the inquiry and report to the Secretary “the circumstances of the accident and its cause together with any observations and recommendations which he thinks fit to make with a view to the preservation of life and the avoidance of similar accidents in the future.”80 The result was The Public Inquiry into the Piper Alpha Disaster (“the Cullen Report”), an extensive report released in October 1990. The report called into question the adequacy of the detailed prescriptive regulatory regime that existed at the time of the incident81 for offshore oil and gas operations, and listed 106 recommendations to revamp offshore safety regulation in the UK, 57 of which the HSE was responsible for overseeing.82 The Cullen Report found that the operating company (Occidental Petroleum, a US company), “did not possess any system which ensured that such remote, but potentially disastrous, events were subjected to systematic scrutiny…[and] there was for major projects no comprehensive system of safety assessment and management did not appear to appreciate fully the contribution which it could make.”83 The report noted that there was a need for a formal safety assessment (FSA), “an assessment essentially equivalent to the Safety Case,”84 which “involves the identification and assessment of hazards over the whole life cycle of a project…[because]…the combinations of potential hardware and human failures are so numerous that a major accident hardly ever repeats itself…[and] [a] strategy for risk management must [] address the entire spectrum of possibilities.”85 In his analysis, Lord Cullen noted that the current offshore regulations were prescriptive in nature rather than goal-setting, and that this had the effect of hampering operators’ flexibility and stifling innovation.86 He stated that “one of the reasons for adopting the goal-setting approach was to make regulations that were more flexible, so that changing technology could be accommodated without the need for new legislation.”87 Lord Cullen pointed to the CIMAH Regulations, discussed above, as a forward-looking regulatory model, which required onshore major hazard installation operators to “provide HSE with a written report on the safety of the installation…commonly called the Safety Case.”88 Lord Cullen noted

79 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iii. 80 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iv. 81Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 27. 82 Oil &Gas UK. Piper Alpha: Lessons Learnt; 2008; p 2. 83 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 275. 84 Lord Cullen describes the Safety Case as “a means by which an operator demonstrates to itself the safety of its activities…[and] as the basis for the regulation of major hazard activities…” Ibid at 276-277. 85 Ibid. 86 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 339. 87 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 364. 88 Ibid at 276.

Chevron Richmond Refinery Regulatory Report December 2013

25 DRAFT FOR PUBLIC COMMENT that the safety case “is a means by which an operator demonstrates to itself the safety of its activities…[and] also serves as the basis for the regulation of major hazard activities.”89 Lord Cullen concluded that an FSA “is an essential element in a modern safety regime for major hazard installations…that this FSA should take the form of a Safety Case…[and that] [t]he regime should have as its central feature demonstration of safe operation by the operator.”90 He recommended that a safety case regulatory regime be implemented offshore for both fixed and mobile installations as it already was for onshore major hazard installations, that it be complemented by other regulations dealing with specific features, that the safety case contain goal-setting regulations, and that it be part of a continuing dialogue between the operator and the regulatory body.91 Lord Cullen recommended the implementation of safety regulations requiring the owner or operator of every fixed and mobile installation operating in UK waters to submit a safety case to HSE. In response, the UK established the Offshore Installations (Safety Case) Regulations in 1992.92 The primary goal of these Regulations was “to reduce the risks from major accident hazards to the health and safety of the workforce employed on offshore installations or in connected activities.”93 Oil & Gas UK, 94 the main UK offshore oil industry trade association whose members include the major oil companies that operate in the Gulf of Mexico (such Shell and Exxon), has expressed strong support for the safety case regime. In its response to the European Commission’s published draft legislative proposals to modify offshore safety case regulations, Oil & Gas UK noted that those proposals would undermine the “proactive, flexible and responsive approach to managing risks, borne out of the lessons learnt from Piper Alpha as well as the evolving nature of the offshore oil and gas business itself.”95 In the wake of the Macondo incident in the Gulf of Mexico, the UK government directed Professor Geoffrey Maitland of Imperial College London to lead an independent review of the offshore safety case regime in the UK.96 In the report stemming from the review, which highlighted strengths of the safety case regime as well as recommendations for improvement, Professor Maitland commended the UK’s “‘goal-setting’ safety regime and its ability to foster innovation and continuous improvement in process integrity…”97 and noted that the UK authorities, including the HSE, are held in high regard by both the UK operators and international observers.98

89 Ibid at 276 and 277. 90 Ibid at 282. 91 Ibid at 283 and 284. 92 The 1992 Regulations have since been replaced by the Offshore Installations (Safety Case) Regulations 2005, which were effective as of April 6, 2006. The objective of the revisions in 2005 was “to improve the effectiveness of the regulations whilst at the same time reducing the burden of three yearly resubmissions.” Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. 93 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

94 See http://www.oilandgasuk.co.uk/aboutus/aboutus.cfm (accessed December 10, 2013). 95 Oil & Gas UK. European Commission Proposed Regulation on Offshore Safety and Related Issues: Oil & Gas UK Position Paper. November 2011; p 1. http://www.oilandgasuk.co.uk/ProposedEURegulation.cfm (accessed December 10, 2013). 96 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed December 10, 2013). 97 Ibid at 3. 98 Ibid at 3.

Chevron Richmond Refinery Regulatory Report December 2013

26 DRAFT FOR PUBLIC COMMENT 3.2.2 Global Analysis of Safety Case Implementation 3.2.2.1 Australia 3.2.2.1.1 Offshore Following the Piper Alpha disaster in 1988, the then Australian Commonwealth Minister for Resources at the time, Senator Peter Cook, formed a Consultative Committee on Safety in the Offshore Petroleum Industry to advise him on safety issues surrounding offshore operations in Australia. In 1991, the Committee released its Report of the Consultative Committee on Safety in the Offshore Petroleum Industry.99 In the report, the Committee examined the circumstances, causes, and recommendations described in both the Cullen Report and Esso Australia’s100 investigation report on a fire that occurred on the Tuna platform in April 1989 in Bass Strait that injured four individuals. The Committee noted that while there were many differences between the two incidents, they “both demonstrated the need for greater attention to the management of safety in a number of areas of offshore operations.”101 They pointed to the safety case as an important regulatory concept that should be applied to oil and gas operations in Australian waters, and concluded by recommending that the safety case concept described by Lord Cullen and carried out onshore by the Seveso Directive and CIMAH regulations be adopted for Australian offshore petroleum operations.102 It would “require the operator of a facility to formally document how safety is to be managed within the facility, [and] [] demonstrate that the major hazards of the installation have been identified and appropriate controls provided…”103 The Committee also recommended the implementation of both prescriptive and “objective” regulations.104 At that time, offshore petroleum safety was the joint responsibility of the Commonwealth and the States/Northern Territory. Following this inquiry, new Commonwealth regulations were created: for example, Schedule 8 on “Occupational Health and Safety” was added to the Petroleum Submerged Lands Act (PSLA) in 1992 to require safety cases to be developed for all offshore petroleum facilities. The Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 set out the requirements for the contents of offshore safety cases. The operator of an offshore petroleum facility must submit a safety case for review and acceptance to the Australian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA), the Australian Commonwealth Statutory Agency charged with regulating the health and safety, structural integrity, and environmental management of all offshore petroleum facilities in Australian Commonwealth waters, and in coastal waters where State powers have been reduced. NOPSEMA accepts a safety case “if it is satisfied that the arrangements set out in the document demonstrate that the risks will be reduced to…ALARP.”105

99 See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 100 Esso was an oil and gas company in Australia that was sold to Mobil Oil Corporation in 1990. It is now part of Exxon Mobil. See http://www.exxonmobil.com/Australia-English/PA/about_who_history_esso.aspx (accessed May 8, 2013). 101 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 2. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 102 Ibid at 25. 103 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 3. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 104 Ibid. 105 See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July 15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

27 DRAFT FOR PUBLIC COMMENT 3.2.2.1.2 Onshore In 1998, Esso Australia’s gas plant at Longford in Victoria suffered a major release and fire caused by cold temperature embrittlement due to a process upset and lack of engineering support for diagnosis, which resulted in two fatalities, eight additional injuries, and cut the State of Victoria’s gas supply for two weeks causing major industrial disruption and workforce stand downs. While the safety case at this time was required for offshore operations in Australia, onshore facilities like the Longford plant were subject only to prescriptive provisions contained within the Victoria Occupational Health and Safety Act 1985. In its report on the incident, the Royal Commission concluded that all major hazard facilities in Victoria should be required to develop and submit a safety case to the appropriate regulatory authority. In 1996, Australia’s National Occupational Health and Safety Commission106 (NOHSC) recommended the safety case be adopted for all major onshore hazard facilities in Australia, and in 2002 NOHSC established a National Standard for the Control of Major Hazard Facilities and a National Code of Practice for the Control of Major Hazard Facilities.107 The Standard states that operators of major hazard facilities “shall provide the relevant public authority with a safety report…” that, among other things, identifies the type, relative likelihood and consequences of major accidents that might occur, and provides details of the safety management system (SMS) for that facility.108 In addition, operators of major hazard facilities must identify all major hazards and the risks associated with those hazards, and minimize each risk “so far as practicable.”109 According to the Australian Safety and Compensation Council’s 2004 Annual Situation Report for the National Standard for the Control of Major Hazard Facilities, all Australian jurisdictions were expected to have the standard in place before the end of 2005, roughly three years after its inception.110 3.2.2.2 Norway Following the capsizing of the Alexander Kielland111 in 1980, Norway moved in a direction similar to the European Commission and developed performance-based regulations focused on major accident

106 In 1985 The National Occupational Health and Safety Commission (NOHSC) was established as a tripartite body to develop, facilitate and implement a unified national approach to occupational health and safety in Australia. On January 1, 2006, NOHSC was replaced by the Australian Safety and Compensation Council (ASCC). On March 31, 2009, the ASCC was abolished and replaced with Safe Work Australia. Safe Work Australia was established by the Safe Work Australia Act 2008 with the authority to help develop policy to improve worker health, safety, and compensation across Australia. It does not regulate work health and safety laws; rather it develops national policy. See http://www.safeworkaustralia.gov.au/sites/swa/about/pages/about (accessed May 8, 2013). 107 National standards are documents which prescribe preventative action to avert occupational deaths, injuries and diseases; national codes of practice are documents prepared for the purpose of advising employers and workers of acceptable ways of achieving national standards. National Standard for the Control of Major Hazard Facilities [NOHSC: 1014(2002)], p 2. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/271/NationalStandard_ControlMajo rHazardFacilities_NOHSC_1014-2002_PDF.pdf (accessed May 8, 2013). 108 Ibid at 13. 109 Ibid at 12. 110Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004; p1. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationReport_2004. pdf (accessed May 8, 2013). 111 The Alexander Kielland was a flotel for housing workers. A total of 212 people were on board when it capsized near the Edda platform in the Ekofisk area of the North Sea on March 27, 1980. As a result of this incident, 123 individuals lost their lives and only 89 survived.

Chevron Richmond Refinery Regulatory Report December 2013

28 DRAFT FOR PUBLIC COMMENT prevention. Although the country did not adopt the safety case regulatory regime per se, the current regulatory approach implements many similar elements. Currently in Norway, the Petroleum Safety Authority112 (PSA) regulates safety for activities at onshore and offshore major hazard facilities, and requires the responsible party113 to reduce risk “to the extent possible,” and “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”114 This concept is akin to ALARP whereby companies choose the solutions and barriers that have the greatest risk-reducing effect, provided the costs are not significantly disproportionate to the risk reduction achieved.115 However, unlike the UK and Australia, PSA regulations do not require the submission of a safety case report by the operator of a facility, although facilities are still expected to develop them and make them available to the regulator upon request for auditing purposes. Rather, PSA “supervises” industry, as explained in the following: Supervision involves much more than audits offshore or on land. It embraces the total contact between the regulator and the regulated. It covers everything which gives the PSA the necessary basis to determine whether the companies are accepting their responsibility to operate acceptably in all phases. Supervisory activities include investigations, considering consent applications and meetings with the industry.116 As will be discussed below, because the safety case regulatory approach requires the regulator to conduct detailed assessments of safety case reports and auditing of facilities against the safety case, its implementation requires substantial funding to support and maintain a sufficient number of highly experienced and competent staff. 3.2.2.3 The United States Despite this international shift to the safety case regime and even though major oil companies that operate globally both onshore and offshore have expressed their support for the safety case regime,117 the US has

112 The Petroleum Safety Authority (PSA) is “the regulatory authority for technical and operational safety and for the working environment.” PSA was created in 2004 as a result of a government decision to split the Norwegian Petroleum Directorate (NPD) into two parts. See http://www.ptil.no/main-page/category9.html (accessed May 8, 2013). 113 PSA defines a “responsible party” as “[t]he operator and others participating in activities covered by these regulations, without being a licensee or owner of an onshore facility.” Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 6(a). Definitions. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 114 PSA. Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 11, Risk Reduction Principles. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 115 Ibid. 116 http://www.ptil.no/supervision/what-is-supervision-article8519-88.html (accessed June 3, 2013). 117 Shell Geelong Refinery Plant Manager Huck Poh has stated, “As a Major Hazard Facility, Shell Geelong Refinery and Lara Terminal is required to submit a Safety Case for assessment by Safe Work Victoria. This document is a summary of that Safety Case and explains the potential impact of the facility on our neighbours and the community. We take a systematic approach to managing safety and preventing incidents that place our people, our neighbours, the Geelong community, the environment and our facilities at risk. This is reflected in our Safety Management System and the approach that has been undertaken for the development and review of the Safety Case. Shell is committed to achieving continuous Health, Safety, Security and Environment (HSSE) performance improvement. There are ongoing review and revision activities to ensure our analyses remain relevant and reflect

Chevron Richmond Refinery Regulatory Report December 2013

29 DRAFT FOR PUBLIC COMMENT persisted in the use of a more activity-based regulatory scheme that does not contain a specific risk reduction target and that lacks the ability to adapt to advancing technology and recently developed industry standards. Due to the major potential hazards present in onshore and offshore oil and gas operations, these sectors should have in place adaptable safety regimes that adequately engage companies and their employees in continuous improvement and risk reduction. As the CSB has devoted extensive time and resources to studying and analyzing the regulation of offshore oil and gas facilities in the US as a result of its Macondo incident investigation, this report will focus on the regulation of onshore oil and gas operations in the US and California. On October 23, 1989, a massive explosion and fire occurred at the Phillips 66 Company’s Houston Chemical Complex in Pasadena, Texas, resulting in 23 fatalities and injuring more than 130. In response, the U.S. Department of Labor issued a report to the President and declared, among other things, that the U.S. Occupational Safety and Health Administration (OSHA) would “expedite completion of its rulemaking requiring employers to implement comprehensive chemical process safety management plans for hazardous chemical processes.”118 Sparked by a number of serious accidents, including the Phillips 66 incident and the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, OSHA published in the Federal Register (55 FR 29150) on July 17, 1990, a proposed standard containing requirements for the management of hazards associated with processes using highly hazardous chemicals.119 Soon after, the Clean Air Act (CAA) Amendments (CAAA) of 1990 were adopted by Congress, which resulted in the creation of the CSB and authorized the first federal regulations specifically designed to prevent major chemical accidents that threaten workers, the public, and the environment: OSHA’s Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency’s (EPA’s) Risk Management Program. 3.2.2.3.1 OSHA PSM Standard Section 304 of the CAAA mandated that OSHA develop “a chemical process safety standard designed to protect employees from hazards associated with accidental release of highly hazardous chemicals in the workplace.”120 OSHA responded by adopting 29 CFR §1910.119 Process Safety Management of Highly

the current status of operations and our risk reduction measures are consistent with latest industry practice. This commitment to continuous improvement is reflected in the Shell HSSE Policy and supported by our HSSE results.” See http://s04.static-shell.com/content/dam/shell-new/local/country/aus/downloads/geelong/safety-case- summary.pdf p3. (accessed December 10, 2013). Esso Longford Plant Manager Monte Olson has stated that “[t]he Safety Case is a systematic and comprehensive review of our operations and processes which includes the identification of potential major incidents that could occur, assesses the risks associated with these major incidents and demonstrates the controls we have in place to manage these risks to as low as reasonably practicable.” See http://www.exxonmobil.com/Australia-English/PA/Files/publication_Longford_Safety_Case_2013.pdf p5. (accessed December 10, 2013) 118 Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990; p ix. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013). 119 Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section 1 – I. Background (March 4, 1992). See http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 10, 2013). 120 Clean Air Act Amendments of 1990. Section 304(a). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

30 DRAFT FOR PUBLIC COMMENT Hazardous Chemicals (PSM standard) in 1992. This standard applies to a process121 involving a chemical at or above the listed threshold quantity (also known as a highly hazardous chemical), or flammables in a quantity of 10,000 pounds or more.122 It contains 14 elements with broad requirements to implement management systems, identify and control hazards, and prevent “catastrophic releases of highly hazardous chemicals.” While the PSM standard was intended to be performance-based and does contain some goal- setting elements, a majority of the standard is activity-based, and there is no general duty requirement under the PSM standard to reduce risks to a certain extent or prevent catastrophic accidents. As will be discussed at length in Section 4.3, the PSM standard has essentially remained stagnant since its inception in 1992. According to Center for Chemical Process Safety (CCPS), the PSM standard has resulted “in a minimum cost, compliance-based approach to managing process safety… ‘If [it] isn’t a regulatory requirement, I’m not going to do it!’”123 A key provision of the PSM standard is the process hazard analysis (PHA) of covered processes. 124 PHA requirements include a review of the process to identify, evaluate, and control the hazards, and an evaluation of the consequences of failure of those controls.125,126 The PHA required by the OSHA PSM standard is an example of a goal-setting requirement in that it allows for a variety of hazard analysis methodologies to be performed to satisfy the requirement. However, the element is activity-based in that completing a PHA for each covered process and updating it at least every five years is satisfactory. The regulator is not responsible for evaluating the effectiveness of controls or safeguards, and there is no requirement to reduce risks to a certain extent such as ALARP. Thus, the resulting PHA that meets the regulatory requirements of “controlling” hazards may actually inadequately identify or mitigate the hazards. In addition, there is no requirement for employers to submit their PHAs to the regulator for review. In most cases, this means the regulator will not review these PHAs until there is a significant process accident, a complaint, or a (rare) planned inspection.

Another key element of the PSM standard, the Management of Change (MOC) provision, requires the development of written procedures “to manage changes to process chemicals, technology, equipment, and procedures…”127 The procedures must consider, among other things, the technical basis for a proposed change and its potential impact on safety and health.128 Historically, the MOC requirement has been

121 The PSM standard defines “process” as “any activity involving a highly hazardous chemical including any use, storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 29 CFR §1910.119(b) (1992). 122 29 CFR §1910.119(a)(1) (1992). This standard also applies to the manufacture of explosives and pyrotechnics in any quantity [29 CFR §1910.109(k)(2) & (3)]. 123 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 124 A Process hazard analysis is a thorough, orderly, systematic approach for identifying, evaluating, and controlling hazards of processes involving highly hazardous chemicals. The employer must perform an initial process hazard analysis on all processes covered by the PSM standard and all process hazard analyses must be updated and revalidated, based on their completion date, every five years. See http://www.osha.gov/doc/outreachtraining/htmlfiles/psm.html (accessed May 10, 2013). 125 29 CFR §1910.119(e) (1992). 126 The other elements of the PSM standard are process safety information, operating procedures, employee participation, training, contractor safety, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning and response, and compliance audits. The 14th “element” is mainly a requirement that maintaining trade secrecy not interfere with an employer’s compliance with the other 13 elements. 127 29 CFR §1910.119(l)(1) (1992). 128 Id at (l)(2)(i) and (ii) (1992).

Chevron Richmond Refinery Regulatory Report December 2013

31 DRAFT FOR PUBLIC COMMENT treated and enforced as an activity-based requirement as well. For example, when the BP Texas City refinery explosion and fire occurred on March 23, 2005, all 15 fatalities and many of the 180 injuries occurred in or around nine contractor trailers that were sited near process areas and as close as 121 feet to the isomerization (ISOM) unit where the incident occurred. The refinery had been using trailers as temporary office spaces for several years. The refinery addressed facility siting for trailers during its 2004 MOC for an upcoming 2005 turnaround. The MOC form indicated that a double-wide mobile office trailer would be temporarily sited in the open area between the ISOM and naphtha desulfurization units (NDU) for use during the upcoming turnaround, to be removed at the end of April 2005. However, the MOC did not analyze siting hazards; rather the MOC team attached a drawing showing the proposed interior configuration of the trailer and measured its location from the catalyst warehouse.129 In early 2005, eight other trailers were sited between the ISOM and NDU without even conducting an MOC. The CSB pointed out in its Urgent Recommendations stemming from the Texas City incident that these trailers could have been easily relocated to less hazardous sites, and BP did so following the incident.130 Despite this fact, BP’s siting policy considered that utilizing trailers in this way posed little or no danger to occupants, which conformed with the American Petroleum Institute’s (API) Recommended Practice (RP) 752, Management of Hazards Associated with Location of Process Plant Buildings.

Although the MOC failed to identify or analyze hazards stemming from siting trailers so close to process areas, OSHA did not cite BP for conducting a poor MOC following the incident, as merely completing the MOC satisfied the requirements of the PSM standard. As it would have been very practical to move the trailers to a safer location, a regulator under the safety case regulatory regime would have the ability to require BP to do just that to reduce risks to ALARP.

The OSHA PSM standard includes requirements for two of its 14 elements – mechanical integrity and process safety information (PSI) – to comply with recognized and generally accepted good engineering practices, or RAGAGEP.131 RAGAGEPs are technologically focused, with no emphasis on organizational, human factors, or culture-based measures. OSHA developed the mechanical integrity RAGAGEP requirement to “make sure that process equipment is inspected and tested properly, and that the inspections and tests are performed in accordance with appropriate codes and standards.”132 OSHA has recognized a number of practices, guidelines, and standards as RAGAGEPs, including the American Society of Civil Engineers (ASCE), Design of Blast Resistant Buildings in Petrochemical Facilities, the

129 To learn more about the PHA and MOC processes relating to the BP Texas City Refinery, see the CSB BP Texas City Final Investigation Report at http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 24. 2013). 130 See CSB Urgent Trailer Siting Recommendations at http://www.csb.gov/assets/1/19/BP_Recs_2.pdf (accessed October 24. 2013). 131 RAGAGEPs “are engineering, operation, or maintenance activities based on established codes, standards, published technical reports or recommended practices (RP) or a similar document. RAGAGEPs detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a vessel, inspecting a storage tank, or servicing a relief valve.” OSHA Instruction CPL 03-00-004. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed August 13, 2013). 132 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals, Section 3, Title III. Summary and Explanation of the Final Rule, 1992. Available at http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 6, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

32 DRAFT FOR PUBLIC COMMENT Department of Defense, TMS-1300 Structures to Resist the Effects of Accidental Explosions, and the American Petroleum Institute (API) Recommended Practice (RP) 520: Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries.133 Unlike other regulators such as the HSE, OSHA has not compiled a comprehensive list of good practices, or RAGAGEPs, for companies to utilize during operations, and the CSB has only identified two OSHA Letters of Interpretation regarding implementation of RAGAGEP in PSM. According to CCPS, “[o]rganizations lack a thorough understanding of recognized and generally accepted good engineering practices and are inconsistent in interpreting and applying them.”134 In addition, key PSM elements such as PHA, incident investigation, and MOC do not reference RAGAGEP, and have not kept up to date with good practice guidelines, including CCPS’ Guidelines for Risk Based Process Safety, which addresses 20 PSM elements for process safety, including human factors, workforce involvement, and safety culture.

Historically, OSHA has primarily enforced135 RAGAGEP reactively, and may cite companies for violations of RAGAGEPs following an incident. For example, following the BP Texas City Refinery incident, OSHA issued BP hundreds of citations, some of which covered BP’s willful violations of API 520 and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, both considered by OSHA to be RAGAGEPs. Following the Chevron incident, California’s Division of Occupational Safety and Health (Cal/OSHA) issued Chevron two willful citations for allegedly not complying with API RP 939(c), Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries and Chevron’s own internal corrosion mitigation plan as RAGAGEPs (this will be discussed in greater detail in Section 5.1.2.2).

1. 2.2.3.2 U.S. Environmental Protection Agency Risk Management Program

Section 301(r) of the CAAA called for EPA to develop regulations related to the prevention and detection of accidental releases for regulated substances, including requiring owners or operators of stationary sources that have regulated substances present to prepare and implement a “risk management plan to detect and prevent or minimize accidental releases of such substances from the stationary source…”136 The risk management plan would require a “hazard assessment to assess the potential effects of an accidental release of any regulated substance.”137 In 1996, EPA promulgated the Risk Management Program regulations at 40 CFR Part 68, which went into effect in 1999.

133 All three are cited in OSHA Letter of Interpretation. Applicability of the PSM standard’s mechanical integrity requirements to refinery structures, February 1, 2010. http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=27443 (accessed June 6, 2013). 134 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 135 An exception to this would be OSHA’s NEP that was implemented from 2007 to 2011, where OSHA inspectors cited to RAGAGEP following NEP audits. 136 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 137 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii)(I). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

33 DRAFT FOR PUBLIC COMMENT The EPA’s Risk Management Program requires facilities that contain more than the threshold quantity of any of the 77 listed toxic chemicals or 63 flammable substances138 to prepare and submit to the regulating agency emergency contact information, descriptions of processes and hazardous chemicals onsite, an accident history, and worst-case release scenarios.139 The regulation defines three different Program levels (Program 1, 2, or 3) based on a process unit’s potential for impact to the public and the requirements to prevent accidents.140 Program 3 processes are subject to additional, more stringent requirements to prevent accidents similar to those of the OSHA PSM standard. Program 3 facilities must implement elements of a prevention program, including: process safety information (PSI), PHA, standard operating procedures (SOPs), training, mechanical integrity, compliance audits, incident investigations, MOC, pre-startup reviews, employee participation, and hot work permits. These prevention program elements are based primarily on the OSHA PSM standard, and much of the language contained in each element is identical to the PSM standard. As such, the Risk Management Program regulations contain the same RAGAGEP requirements for mechanical integrity and PSI as the OSHA PSM standard for covered facilities. For example, 40 CFR §68.48 requires an owner or operator to “ensure that the process is designed in compliance with recognized and generally accepted good engineering practices [RAGAGEP].”141 Like OSHA, the EPA is able to cite facilities for failure to comply with RAGAGEP following an incident, but does not maintain a list of RAGAGEPs for reference.

Finally, each covered facility must submit a risk management plan (RMP) to EPA for all covered processes142 and update and resubmit these plans at least once every five years, or whenever a major accident occurs or the emergency contact information changes. Completing and submitting the RMP satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed by the EPA, rendering this another activity-based requirement for a covered facility. There is no approval of the RMP by the EPA, and there is no additional duty on the facility to implement what it says it is doing in the RMP, unlike the safety case regulatory regime.

Any facility with one or more covered processes must include in its RMP an executive summary the registration for the facility; the certification statement; a worst-case scenario for each process involving flammables or toxics; the five-year accident history for each process; information concerning emergency response at the facility; at least one alternative release scenario analysis for each regulated toxic substance or flammable; a summary of the prevention program for each Program 2 process; and a summary of the prevention program for each Program 3 process.143

The CSB found in its BP Texas City Investigation Report that as of March 2007, the RMP regulation had focused primarily on reviewing the submitted RMPs and required updates by covered facilities. The EPA

138According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements of this part no later than the latest of the following dates…” 139 See 40 CFR §68.12. General Requirements. 140 See 40 CFR §68.10. Applicability. 141 40 CFR §68.48(b) (1999). Additionally see 40 CFR §68.56 (d) which requires the owner or operator‘s inspection and testing procedures to “follow recognized and generally accepted good engineering practices.” 142 40 CFR §68.150 (1999). 143 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

34 DRAFT FOR PUBLIC COMMENT The NRC and NASA both implement safety case regulatory approaches in the US to regulate their respective highly hazardous activities. Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk144 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.145 The EPA OIG also noted that of the 296 uninspected high-risk facilities managed by EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.146

1. 2.2.3.3 Safety Case in the United States

In contrast to its mainly activity-based regulation of hazardous chemicals, including oil and gas operations, the US has adopted a more goal-based regulatory approach for its nuclear and aeronautics and space science sectors. The U.S. Nuclear Regulatory Commission (NRC) was an early adopter of goal or performance-based regulation, which it defines as “[a] regulatory approach that focuses on desired, measureable outcomes, rather than prescriptive processes, techniques, or procedures…[and] leads to defined results without specific direction regarding how those results are to be obtained.”147 According to the NRC, performance-based regulations permit licensees to “have flexibility to determine how to meet the established performance criteria in ways that encourage and reward improved outcomes.”148 The NRC’s Reactor Oversight Process, the means by which it achieves its mission of public health and safety in commercial nuclear power plant operations, is its primary performance-based regulation.149 It uses seven “cornerstones,” such as mitigating systems and barrier integrity, to monitor three performance areas (reactor safety, radiation safety, and security safeguards).150 Licensee performance data, inspection plans, quarterly assessments, and assessment and inspection responses are tied to each performance area and several cross-cutting objectives, such as worker involvement and human performance.151 Licensees are permitted to choose the precise methods they use to meet overarching performance goals, which are guided by their duty to reduce risks to as low as

144 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 145 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 146 Ibid. 147 See NRC Glossary, available at http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-based- regulation.html (accessed June 10, 2013). 148 US NRC NUREG/BR-0303. Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 149 http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html#example (accessed June 13, 2013). 150 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 151 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

35 DRAFT FOR PUBLIC COMMENT reasonably achievable, or ALARA.152,153 The NRC has stated that this flexibility is one of the main reasons that its regulatory philosophy encourages continuous improvement.154

The National Aeronautics and Space Administration (NASA) has the goal of implementing a safety system that is “as safe as reasonably practicable,” or ASARP,155 which it considers to be closely related to ALARP. NASA relies on a risk-informed safety case, or RISC,156 to ensure that the system’s safety objectives, goals, and thresholds have been achieved, and that safety risk is as low as possible within reasonable impacts on cost, schedule, and performance.157

152 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 153 ALARA “means making every reasonable effort to maintain exposures to radiation as far below the dose limits in this part as is practical consistent with the purpose for which the licensed activity is undertaken, taking into account the state of technology, the economics of improvements in relation to state of technology, the economics of improvements in relation to benefits to the public health and safety, and other societal and socioeconomic considerations, and in relation to utilization of nuclear energy and licensed materials in the public interest.” 10 CFR §20.1003 (2007). 154 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf 155 NASA defines ASARP as “a fundamental principle of adequate safety. A determination that a system is ASARP entails weighing its safety performance against the sacrifice needed to further improve it. The system is ASARP if an incremental improvement in safety would require a disproportionate deterioration of system performance in other areas.” NASA/SP-2010-580, NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts for Implementation; November 2011; p 5. http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20120003291_2012003429.pdf (accessed June 10, 2013). 156 NASA defines RISC as “a structured argument, supported by a body of evidence that provides a compelling, comprehensive and valid case that a system is or will be adequately safe for a given application in a given environment. This is accomplished by addressing each of the operational safety objectives that have been negotiated for the system, including articulation of a roadmap for the achievement of safety objectives that are applicable to later phases of the system life cycle. The term ‘risk-informed’ is used to emphasize that a determination of adequate safety is the result of a deliberative decision making process that necessarily entails an assessment of risks and tries to achieve a balance between the system’s safety performance and its performance in other areas.” Ibid at 13. 157 Ibid at xiii.

Chevron Richmond Refinery Regulatory Report December 2013

36 DRAFT FOR PUBLIC COMMENT 4.0 Key Features of an Effective Safety Case Regulatory Regime

Following the Macondo disaster, the National Commission on the Macondo Oil Spill and Offshore Drilling158 made a recommendation in its Report to the President159 for the US to “develop a proactive, risk-based performance approach specific to individual facilities, operations and environments, similar to the ‘safety case’ approach in North Sea.”160 Despite the major potential hazards that are present in both onshore and offshore oil and gas operations, the safety case regime has not been implemented in the US for either sector. The US has instead implemented for major hazards at onshore facilities a more activity- based approach, resulting in static regulations such as the PSM and RMP regulations that have not seen significant improvements161 since their inception, despite advances in technology and good industry practice. According to Dr. Hopkins and other renowned experts in the field, it is essential for an effective major accident prevention safety regime to take the form of a safety case, with adaptable goal-setting regulations that facilitate innovation and sustainability, and that drive industry to continuously improve and reduce risks to ALARP. To accomplish this, the regime must utilize sufficient numbers of highly competent personnel to effectively collect or promote industry use of process safety indicators162 and to provide knowledgeable oversight of industry operations. The CSB has determined that there are several key features of an effective major accident prevention regulatory approach such as the safety case regime:  Duty Holder Safety Responsibility, including a Written Case for Safety  Continuous Risk Reduction to ALARP  Adaptability and Continuous Improvement  Active Workforce Participation  Process Safety Indicators that Drive Performance  Regulatory Assessment, Verification, and Intervention; and an  Independent, Competent, Well-Funded Regulator As will be discussed in Section 5, California’s patchwork of regulations does not effectively implement these features, which are also illustrated in the figure below. Section 4 provides a detailed discussion of these features.

158 President Barack Obama established the National Commission on the BP Macondo Oil Spill and Offshore Drilling through Executive Order 13543 on May 21, 20130 to examine the facts and circumstances concerning the root causes of the Macondo explosion and fire. For more information see http://www.oilspillcommission.gov/page/about-commission (accessed June 17, 2013). 159 Available at http://www.oilspillcommission.gov/final-report (accessed June 17, 2013). 160 National Commission on the BP Macondo Oil Spill and Offshore Drilling. Report to the President: Deep Water, The Gulf Oil Disaster and the Future of Offshore Drilling; January 2011; 252. 161 OSHA did implement changes to 29 CFR §1910.106, creating a new Hazard Communication Standard. However, no changes have been made that impact the management of process safety under PSM. See https://www.osha.gov/dsg/hazcom/ (accessed August 6, 2013). 162 Process safety indicators are also referred to as performance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc.

Chevron Richmond Refinery Regulatory Report December 2013

37 DRAFT FOR PUBLIC COMMENT

Figure 1. Safety Case Attributes. 4.1 Duty Holder Safety Responsibility, including a Written Case for Safety Under the safety case regulatory regime, each individual company is responsible for the safety of each hazardous facility. The onus is on the duty holder163 to prove to the regulator that the company’s processes, methodologies used to assess risks, and reasoning for choosing one control over another have substantially reduced risks to as low as reasonably practicable (ALARP), or equivalent. The duty holder

163 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). These entities may include operators, contractors, and subcontractors. According to NOPSEMA, the idea is that those who create the risk must manage it. See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

38 DRAFT FOR PUBLIC COMMENT The written safety case report is an evergreen document that must be reviewed and revised so that it reflects the existing hazards. is required to prepare a written case for safety164 (“safety case report”) that identifies the hazards and risks and describes how they will be reduced to ALARP. The HSE has noted that the safety case report “demonstrates that the duty holder has arrangements in place which, if implemented, are capable of achieving compliance with legal objectives set out in other [] regulations…[and] provides a comprehensive core document that can be used as a check by both the duty holder and HSE that the accepted risk control measures and the health and safety management systems are in place and operate as they should.”165 The HSE has also stated: [t]he principal matters to be demonstrated in a safety case are that: a) the management system is adequate to ensure compliance with statutory health and safety requirements; and for management of arrangements with contractors and sub-contractors, b) that adequate arrangements have been made for audit and for audit reporting, [and] c) that all hazards with the potential to cause a major accident have been identified, their risks evaluated, and measures have been, or will be, taken to control those risks to ensure that the relevant statutory provisions will be complied with.166 The safety case report must also demonstrate “how inherently safer design concepts have been applied in the design decisions taken.”167 This principle applies to all stages of the installation’s life cycle, and includes materials selection and managing corrosion in the design. It is also important to note that safety case reports are meant to be evergreen documents that reflect continuous improvement in risk reduction. For onshore operations in the UK, the duty holder is required to review the safety case report during the construction of a new facility, whenever new facts or technical knowledge about safety matters become known, or whenever the operator makes a change to the safety management system that could have significant impacts on the prevention of major accidents.168 The duty holder must revise the safety report to ensure that it “remains up to date and continues to provide an accurate representation of the major accident hazards…and the measures in place to control them.”169 According to HSE guidance

164 The HSE defines “safety case” as “a document that gives confidence to both the duty holder and HSE that the duty holder has the ability and means to control major accident risks effectively. It provides an extra level of regulatory control on top of regulations such as the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 (PFEER) and the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR), justified by the major accident potential of the offshore activities within scope.” HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 6. 165 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed November 13, 2013).

166 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 167 Ibid at 16. 168 COMAH Regulations, Part 3, Regulation 8 (1) (a)(b) and (c) (1999). 169 The Competent Authority. Revised guidance for operators of top tier COMAH establishments. Review and revision of COMAH safety reports. December 2009; p 5. http://www.hse.gov.uk/comah/report-review.pdf (accessed November 26, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

39 DRAFT FOR PUBLIC COMMENT on the offshore Safety Case Regulations, safety case reports are “intended to be living documents, kept up to date and revised as necessary during the operational life of the installation.”170 In order for the facility to begin operation or remain in operation, the regulator must “accept” 171 the facility’s safety case report; however, the regulator’s acceptance of a safety case does not license the facility or installation as “fit,”172 nor does it shift the duty of risk control and reduction away from the facility owner or operator and onto the regulator; rather, the duty of major accident prevention and risk reduction to ALARP remains with the duty holder throughout the life of the facility. Following the regulator’s acceptance of the safety case report, the duty holder must ensure that the installation is operated in conformity with the management system and other provisions described in the safety case.173 In the US, facilities commence operation before they are inspected or evaluated for complying with PSM or RMP regulations. In fact, the CSB has investigated incidents where the employer disputed tthat its process was covered by the PSM standard or RMP. Regulators do not evaluate and approve PHAs or other hazard reviews and do not have the authority to license specific facilities for operation, based on the adequacy of their process safety programs. If an operating facility contains processes covered by PSM, the facility must complete mostly activity-based regulatory requirements at least once every five years. Under the PSM standard the employer has no general duty to continually reduce risk or prevent the occurrence of a catastrophic accident. RMP-covered facilities must submit fairly high-level information exhibiting compliance with RMP requirements at least once every five years. While the regulator ensures the RMP has been filed and contains the required sections, there is no analysis of the effectiveness of controls identified in the RMP to mitigate hazards. 4.2 Continuous Risk Reduction to ALARP As discussed above, a majority of the safety case regimes implemented globally impose a duty on owners or operators of covered facilities on and offshore to reduce risks to ALARP or equivalent. The Center for Chemical Process Safety (CCPS) defines ALARP as “a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.”174 This principle provides the regulator with the main foundation on which to accept or reject a safety case report. In essence, the regulator ultimately determines whether ALARP has been achieved through the authority to accept or reject the safety case report. An advantage

170 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

171 “Acceptance requires satisfaction with the duty holder’s approach to identifying and meeting health and safety needs…HSE ‘accepts’ the validity of the described approach as being capable, if implemented as described, of achieving the necessary degree of risk control, but HSE does not confirm the outcomes of that approach.” Therefore, “HSE will accept a safety case or a revision…when duty holders demonstrate and describe specified matters to HSE’s satisfaction. Acceptance will be based on HSE’s judgment that the arrangements and measures described in the safety case taken as a whole are likely to achieve compliance if implemented as described. To give acceptance HSE does not need to be satisfied that compliance will be achieved…” Ibid at 6. 172 TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996; p 8. 173 Ibid at 7. 174 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., 2009; p 46.

Chevron Richmond Refinery Regulatory Report December 2013

40 DRAFT FOR PUBLIC COMMENT Risk reduction to ALARP requires at least a demonstration of relevant good practice. The regulator may require the duty holder to implement additional controls if they result in further risk reduction. of ALARP as opposed to a prescriptive or activity-based approach is that ALARP should result in the continuous reduction of risk and is not predicated on a specific risk acceptance target.175 In reviewing the safety case report, the regulator may accept the application of relevant good practice as a sufficient demonstration of ALARP.176 As the HSE notes, “the measures in place to prevent or limit major accidents should be described in the safety report and be at least to ‘relevant good practice.’”177 According to Dr. Hopkins, the duty of ALARP “provides leverage for the regulator…[i]f an operator wishes to adopt a procedure or a standard that falls short of good or best practice, the regulator can reject it on the grounds that it does not reduce the risk as low as reasonably practicable.”178 As noted above, regulators such as HSE provide guidance on what is considered good practice, and publish documents containing good practice standards to assist operators with applying this concept. However, the duty holder must make the case for the standard or practice being utilized, and the regulator may determine that applying good practice alone is not sufficient to demonstrate that risks have been reduced to ALARP. In addition, if there is no directly applicable rule or standard, operators still have a duty to manage risk, and they therefore must maintain a reasonable level of risk awareness that goes beyond mere compliance.179 This raises a safety case regime above the compliance mentality of a more activity-based regime, such as PSM, and requires the duty-holder and the regulator to continuously ask whether there are other measures that would be effective in further reducing risks. The UK HSE provides ample guidance on determining what is considered to be ALARP, and many British courts have interpreted the concept as well. In the 1949 case Edwards v. National Coal Board, decided by the Court of Appeal, Judge Asquith wrote: ‘Reasonably practicable’ is a narrower term than ‘physically possible’ and seems to me to imply that a computation must be made by the owner, in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other; and that if it be shown that there is a gross disproportion between them – the risk being insignificant in relation to the sacrifice – the defendants discharge the onus on them.180 While some critics in the US have argued that the determination of ALARP is strictly a quantitative risk assessment (QRA) calculation that is not sufficiently protective, the CSB has found that the evaluation of ALARP has evolved, as the HSE now allows reliance upon qualitative assessments, QRA, and semi-

175 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed December 9, 2013). 176 HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013). 177HSE. Guidance on ALARP Decisions in COMAH. http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed November 26, 2013). 178 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 179 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 180 Edwards, [1949] 1 K.B. at 704.

Chevron Richmond Refinery Regulatory Report December 2013

41 DRAFT FOR PUBLIC COMMENT quantitative risk assessments to determine ALARP.181 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”182 and “[i]dentification of possible further measures that could be applied to lower the risk.”183 The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”184 In Norway, PSA requires companies to “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”185 PSA regulations require companies to choose the solutions that offer the best results, provided the costs are not significantly disproportionate to the risk reduction achieved.186 In Australia, the NOPSEMA enforces the Offshore Petroleum and Greenhouse Gas Storage Act 2006 and its regulations, which imposes a duty of care on the operator of a facility to “take all reasonably practicable steps” to ensure the facility is safe and all work and other activities are “carried out in a manner that is safe and without risk to the health of any person at or near the facility.”187 NOPSEMA explains that to achieve ALARP, the company “has to show, through reasoned and supported arguments, that there are no other practical measures that could reasonably be taken to reduce risks further.”188 In the US, the NRC has “gradually revised its original scheme, giving an increasing importance to the ‘economic and social factors’, in particular the involvement of all ‘stakeholders’ (authorities, management, staff, public) in the ALARA process.”189 For the regulator, the focus for whether ALARA

181 Center for Chemical Process Safety (CCPS) guidance on risk assessment implies that as the predicted consequence of potential hazard scenarios increases, the level of analytical detail should also increase. Risk assessment approaches range in order of increasing analytical detail from qualitative, to semi-quantitative, to quantitative. Qualitative risk assessment is the simplest approach where judgments about consequence, likelihood, and the tolerability of risk are made on a subjective basis using the knowledge and experience of team members and may not be consistently applied within an organization. Semi-quantitative risk assessment is the second level of analytical detail, where organizations develop and provide to team members predetermined risk matrices and guidance for establishing numerical consequence and frequency levels. This approach is of greater value to team members as based upon their collective experience; the team typically has a sense of how frequently an event might occur and how great the potential consequence may be within the predetermined ranges. Layer of protection analysis (LOPA) is a semi-quantitative form of risk assessment, using order of magnitude categories for evaluating frequency, consequence, and adequacy of safeguards. Quantitative risk assessment involves the highest level of analytical detail and typically involves specialized expertise to perform. Complex models are commonly developed to evaluate frequency, consequence, and the effectiveness of safeguards in a quantitative risk assessment. Such approaches are typically standardized to minimize result variability within an organization and even between organizations in countries where a quantitative risk assessment is mandated by regulatory authorities. Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009. 182 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 183 Ibid at 8. 184 Ibid at 8. 185 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations). Section 11, Risk Reduction Principles. http://www.ptil.no/framework- hse/category403.html (accessed November 26, 2013). 186 Ibid. 187 Offshore Petroleum and Greenhouse Storage Act 2006, Volume 3, Schedule 3, Clause 9. http://www.comlaw.gov.au/Details/C2012C00148/Html/Volume_3#_Toc315688204 (accessed October 30, 2013). 188 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 189 Fasso, Alberto, and Rokni, S. Operational Radiation Protection in High Energy Physics Accelerators. Implementation of ALARA in Design and Operation of Accelerators. May 2009; p 6.

Chevron Richmond Refinery Regulatory Report December 2013

42 DRAFT FOR PUBLIC COMMENT has been achieved is on “processes, procedures, and judgments.”190 The duty holder must ensure that choices made to achieve ALARA are “fully documented together with the criteria which have brought to those choices. When the criteria are qualitative, it is more likely that subjective judgments play a large role, but those judgments must be equally recorded.”191 There is no corresponding duty to reduce risks to ALARP in the PSM standard or RMP program. Rather, these regulations require that facilities “control” identified hazards, with no further dialogue on how far the operator must go to control those hazards. Neither the facility nor the regulator is required to determine whether more could be done to control hazards or reduce risks to comply with these regulations, and this may result in the implementation of insufficient controls relating to a hazard. While OSHA and the EPA do rely on general duty standards when implementing the PSM standard and the RMP program, these duties do not drive onshore companies toward reducing the risks of their activities to ALARP, and instead are utilized as enforcement tools typically after an incident has occurred, meant to cover those activities not specifically regulated. These standards may also be used by OSHA or EPA to cite a company for not following a specific RAGAGEP for 2 of the 14 process safety elements - mechanical integrity and PSI. OSHA enforces section 5(a) of the Occupational Safety and Health Act (OSHAct), which states the following:

(a) Each employer – (1) shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees; (2) shall comply with occupational safety and health standards promulgated under this act…192 Section 5(a)(1), also known as OSHA’s General Duty Clause, has been described as a “catch-all” provision meant to fill gaps in OSHA law for recognized unregulated hazards.193,194 In order for OSHA to issue a General Duty Clause violation, the hazard must be recognized, the employer must have failed to keep the workplace free of the hazard to which his or her employees were exposed, a practical method must be available to correct the hazard, and the hazard must be causing or likely to cause death or serious injury.195 This duty would thus only apply if the absence or failure of one control in a series of controls makes an accident likely to occur (emphasis added).

190 Ibid at 6. 191 Ibid at 6 and 7. 192 29 U.S.C. §654(a)(1) and (2) (2004). 193 Morrison, Kyle W. The General Duty Clause: What is it, how does OSHA use it and what should employers know? Safety + Health [Online]; May 1, 2011. http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 194 According to the National Safety Council, General Duty Clause violations make up only about 1.5 percent of total violations issued annually by OSHA. Available at http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 195 Ibid.

Chevron Richmond Refinery Regulatory Report December 2013

43 DRAFT FOR PUBLIC COMMENT On the other hand, in a safety case regulatory regime, the regulator proactively reviews identified hazards and risk reduction strategies proposed by the operator to ensure that risks are being reduced to ALARP. The regulator may require the installation of an absent control if such a control is considered good industry practice, or if it goes further in reducing risks to ALARP. This is a key feature of the safety case approach in preventing major accidents. Under the CAA, the General Duty Clause requires owners and operators “to identify hazards which may result from such releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.”196 Similar to OSHA, the EPA can use its General Duty Clause enforcement authority to create legally binding requirements or enforce actions for hazards that have not been specifically regulated. The EPA can use this authority proactively (before an incident) or reactively (following an incident), and can enforce the clause where it finds the possibility of imminent and substantial endangerment.197 According to EPA guidance on the RMP program, because it is the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” this may require steps to be taken “beyond those specified in the risk management program rule.”198 While this principle appears to be similar to ALARP requirements of the safety case, in practice whether this is done is not subject to regulation or review. In addition, it is permissive in that it uses the word “may.” Nothing additional, such as ALARP, is required. This will be addressed below in more detail in the discussion of implementation of the EPA RMP program in California. 4.3 Adaptability and Continuous Improvement A key strength of the safety case regulatory regime is that it provides the regulator with the tools to drive continuous improvement among facilities and ensure risks have been reduced to ALARP or equivalent, rather than focusing on compliance with activity-based regulatory requirements. Although complying with good practice may achieve ALARP, the regulator also has the ability under this regime to require facilities to go above and beyond good practices and standards to achieve ALARP without requiring rulemaking. The Baker Panel199 noted in its 2007 report (the Baker Report) on BP and its process safety performance following the 2005 BP Texas City disaster that an effective process safety management system builds upon an “improvement cycle” that “should include, in practice, continuous reduction of process risk and improvements in safety performance according to some measurable criteria.”200

196 42 U.S.C. §7412(r)(1) (1990). 197 42 U.S.C. §7412(r)(9) (1990). 198 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 199 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013). 200 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166.

Chevron Richmond Refinery Regulatory Report December 2013

44 DRAFT FOR PUBLIC COMMENT The Baker Panel defined “continuous improvement” as  improving controls for process hazards, including process safety knowledge and competence of workers;   improving process safety leadership of supervisors;   improving process engineering to identify and then design to remove or mitigate the effects of process hazards;   going beyond legal compliance to best practices to reduce risks;   going beyond mere compliance with internal standards, but learning from operating experiences, incident and near miss investigations, hazard studies, audits, and other assessments to improve those internal standards; and   identifying and implementing not only those external standards that must be observed, but also those that represent best practices that can lead to process safety excellence.201  An independent review conducted of the Australian offshore safety case regime in 2000 echoes the importance of continuous improvement in process safety management, stating that “critical to the successful implementation of a safety case regime is the achievement of a qualitative shift in industry and regulatory safety cultures from the minimalist compliance of the prescriptive regime to the philosophy of best practice and continuous improvement.”202 Recently, Lord Cullen addressed the importance of adaptability as well, when he spoke at the 2013 Oil & Gas UK Piper 25 offshore safety conference in Aberdeen, Scotland.203 In his keynote speech, Lord Cullen quoted the Maitland panel, which examined the UK offshore safety regime after the Macondo incident, noting that “safety cases should be living documents [emphasis added] central to the way facilities are operated, with contents widely understood.”204 As changes to regulatory requirements necessitate an extensive, lengthy rulemaking process in the US,205 process safety-related regulations can remain static for decades, while industry standards (many of which are voluntary under the current US system), technologies, and improved procedures and practices continue to change and advance, and new chemicals come into production. In light of major accidents that have occurred, such as the BP Texas City explosion and fire which resulted in 15 fatalities, and the

201 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 202 Department of Industry, Science and Resources; Offshore Safety and Security, Petroleum and Electricity Division. Australian Offshore Petroleum Safety Case Review: Report of the Independent Review Team. 2000; p 33. 203 In June 2013, Oil & Gas UK held a large offshore safety conference in Aberdeen, which marked the 25th anniversary of the Piper Alpha disaster. For more information see http://www.oilandgasuk.co.uk/events/Piper25.cfm?frmAlias=/Piper25/ (accessed September 16, 2013). 204 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013). 205 5 U.S.C. Chapter 5, sections 511-599, also known as the Administrative Procedure Act, or APA, requires that federal agencies seeking to promulgate a rule or regulation submit to a lengthy notice and comment rulemaking process that includes publishing the proposed rule making in the Federal Register; providing the public with at least 30 days to participate in the rulemaking process by submitting written comments or data, and then discussing the public comments and providing a rationale for accepting or rejecting them. The OSHAct Section 6(b) specifies the procedures OSHA must use to promulgate, modify, or revoke its standards (29 U.S.C. §655(b)). These procedures include publishing the proposed rule in the Federal Register, providing interested persons an opportunity comment, and holding a public hearing upon request.

Chevron Richmond Refinery Regulatory Report December 2013

45 DRAFT FOR PUBLIC COMMENT Motiva Enterprises sulfuric acid tank explosion, which fatally injured one worker and injured eight others, the CSB has made a number of key recommendations to OSHA and the EPA to revise the PSM and RMP regulations, respectively. However, agencies have failed to implement these recommendations and these regulations have remained static despite the important lessons learned from these incidents. In addition, the OSHA PSM standard’s Appendix A, which contains a list of toxic and reactive highly hazardous chemicals and the threshold quantity for each, was originally created using a number of older sources, including the EPA’s “Extremely Hazardous Substance List,” the 1982 Seveso Directive, the 1984 CIMAH regulations, and others. A number of these sources have been revised, updated, and amended throughout the years, while Appendix A has not. In fact, no chemicals have been added to either the PSM or the RMP programs since the rules were initially adopted in the 1990s, even as numerous serious process incidents occurred involving chemicals that were not listed. The U.S. Government Accountability Office (GAO) published a 2012 report on OSHA’s standard setting abilities, which noted that between 1981 and 2010, OSHA took anywhere from 15 months to 19 years to develop and issue 58 significant safety and health standards (averaging seven years).206 According to the report, OSHA reasoned that it must evaluate technological and economic feasibility of a potential standard using data gathered by visiting worksites in industries that will be affected, on an industry-by- industry basis.207 This was described as “an enormous undertaking because, for example, it requires visits to multiple worksites.”208 In addition, Executive Order 12866209 requires that federal agencies, including OSHA, provide an assessment of the potential overall costs and benefits for significant rules to the Office of Management and Budget (OMB). OSHA will typically be required under the Small Business Regulatory Enforcement Fairness Act of 1996210 to initiate a panel process to receive and consider input from representatives of affected small businesses, which could take eight months or more.211 Only OSHA, the EPA, and the Consumer Financial Protection Bureau are subject to this requirement.212 Finally, the OSHAct directs courts to review OSHA’s standards using a more stringent legal standard than the Administrative Procedure Act’s (APA) “arbitrary and capricious” test213 when reviewing

206 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

207 Ibid at 6. The Supreme Court has held that the OSHAct requires that standards be both technologically and economically feasible. Am. Textile Mfrs. Inst. V. Donovan, 452 U.S. 490, 513 n. 31 (1981). Also see United Steelworkers v. Marshall, 647 F. 2d 1189, 1301 (D.C. Cir. 1980), quoted in AFL-CIO v. OSHA, 955 F. 2d 962, 980 (11th Cir. 1992). Assessing feasibility on an industry-by-industry basis requires that the agency research all applications of the hazard being regulated, as well as the expected cost for mitigating exposure to that hazard, in every industry. 208 Ibid at 6. 209 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.whitehouse.gov/sites/default/files/omb/inforeg/eo12866/eo12866_10041993.pdf (accessed June 12, 2013). 210 5 U.S.C. §609(b), (d) (1996). 211 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

212 5 U.S.C. §609(d) (1996). 213 Pursuant to the APA, agency decisions may be set aside only if “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. §706(2)(A). There is abundant case law that discusses this standard. Courts have held that a court “may reverse under the arbitrary and capricious standard only if the agency has relied on factors that Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise. See Greater Yellowstone Coalition v. Lewis, 638 F. 3d 1143, 1148 (9th Cir. 2010) (as amended) (relaying on The Lands Council

Chevron Richmond Refinery Regulatory Report December 2013

46 DRAFT FOR PUBLIC COMMENT OSHA’s standards;214 an OSHA standard may only be upheld if it is supported by “substantial evidence in the record considered as a whole.”215 According to the GAO report, OSHA officials claim this more stringent standard (known as the “substantial evidence” standard) requires a higher level of scrutiny by the courts and as a result, OSHA staff must conduct a large volume of detailed research in order to understand all industrial processes involved in the hazard being regulated, and to ensure that a given hazard control would be feasible for each process.216 The GAO also found that although OSHA has the ability to address urgent hazards by issuing emergency temporary standards, the agency has not used this authority since 1983 because of the difficult hurdles the agency faces in presenting the evidence necessary to meet the statutory requirements.217 In summary, all of these extensive rulemaking constraints have resulted in OSHA’s failure to undertake many standard revisions or improvements. In Spring 2013, OSHA announced its new regulatory agenda, which stated that one of the things OSHA plans to consider is revising the PSM standard to “address gaps in safety coverage.”218 Potential revisions include “expanding coverage and requirements for reactivity hazards,” which the CSB addressed in its 2002 report entitled “Improving Reactive Hazard Management,”219 and “expanding the scope of paragraph (j) to cover the mechanical integrity of any safety-critical equipment…”220 However, OSHA has proposed changes to the PSM standard before, with no action ultimately being taken. On April 27, 1998, OSHA announced that it was considering issuing an Advance Notice of Proposed Rulemaking221 (ANPRM) “to address issues related to reactive chemicals raised by the explosion of a chemical plant in

v. McNair, 537 F.3d 981, 987 (9th Cir. 2008) (en banc), overruled on other grounds by Winter v. Natural Res. Def. Council, 555 U.S. 7 (2008)). 214 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

215 29 U.S.C. §655(f). 216 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

217 OSHA must demonstrate that workers are exposed to grave danger and establish that an emergency temporary standard is necessary to protect workers from that grave danger. OSHA is also required to replace an emergency temporary standard with a permanent standard within six months using the requirements laid out in OSHAct 6(b). Ibid at 11. 218 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 219 In this report, the CSB recommended to OSHA that it amend the PSM standard “to achieve more comprehensive control of reactive hazards that could have catastrophic consequences.” The report is available at http://www.csb.gov/assets/1/19/ReactiveHazardInvestigationReport.pdf (accessed September 17, 2013). The recommendations start on page 89 of the report. 220 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 221 Most federal agencies develop rules through “informal rulemaking.” Under the Administrative Procedure Act, or APA, informal rulemaking requires a publication of a “Notice of Proposed Rulemaking” (NPRM) in the Federal Register; opportunity for public participation by submission of written comments; consideration by the agency of the public comments and other relevant material; and publication of a final rule not less than 30 days before its effective date, with a statement explaining the purpose of the rule. Under the APA, an agency may publish an Advance Notice of Proposed Rulemaking (ANPRM) when the agency wants to test out a proposal or solicit ideas before it drafts its NPRM. For more information see http://www.foreffectivegov.org/node/226 (accessed September 17, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

47 DRAFT FOR PUBLIC COMMENT Lodi, New Jersey in 1995.”222,223 On May 14, 2001, OSHA clarified its intent to publish an ANPRM “to address the need to add reactive chemicals that are not currently covered by PSM…”224 On December 3, 2001, however, the entry on reactives was withdrawn from the rulemaking agenda.225 Following the devastating ammonium nitrate explosion on April 17, 2013, in West, Texas, which resulted in at least 14 fatalities and mass destruction in the town of West, CSB Chairperson Moure-Eraso urged both OSHA and the EPA to expand their standards to include reactive chemicals and hazards such as ammonium nitrate.226 On July 25, 2013, the CSB held a public meeting in Washington, DC to discuss the status of key open recommendations the CSB has made to OSHA over the last decade to revise its PSM standard and create a new combustible dust standard. These recommendations, which include revising the PSM standard to require MOC reviews for organizational changes such as mergers and acquisitions that may impact process safety, and ensuring PSM coverage for atmospheric storage tanks that could be involved in a potential catastrophic release, have stemmed from major CSB investigations including its BP Texas City, Motiva, ConAgra, Kleen, Imperial Sugar, and Hoeganaes investigations, as well as its Combustible Dust Study.227 OSHA’s failure to implement these recommendations, which can be attributed to its lack of rulemaking activities over the last decade, led the CSB to reclassify seven key open recommendations as “Open-Unacceptable.” The CSB also adopted the OSHA Combustible Dust Standard recommendation as a CSB “Most Wanted Chemical Safety Improvement.” OSHA formally responded and cited to the GAO report discussed above, noting that on average, it takes OSHA seven years to issue a standard, a process that is only getting longer. Hence, OSHA reserves rulemaking for “widespread and serious hazards.” Needed petroleum refinery and chemical process safety improvements may never fall under this category. OSHA noted at the meeting that it will be utilizing a Request for Information228 (RFI) to aid in the revision of its PSM standard, which will contain questions aimed at addressing a number of issues that have developed in the 21 years since the PSM standard was promulgated in 1992. This is an important opportunity to enhance the dialogue on implementation of the safety case regulatory approach to enhance process safety management and risk reduction in the US. OSHA’s ability to adapt to process safety-related new or revised codes, standards, technology, and lessons learned is mainly limited to RAGAGEP requirements, which OSHA included in the mechanical

222 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13792 (accessed September 17, 2013). 223 This incident took place on Friday, April 21, 1995, at a chemical facility occupied by Napp Technologies. The explosion and fire resulted in five fatalities. 224 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16776 (accessed September 17, 2013). 225 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed September 17, 2013). 226 In a 2002 study entitled Improving Reactive Hazard Management, the CSB made recommendations to OSHA and the EPA to expand their regulations to include reactive chemicals and hazards. To date, neither agency has acted on the recommendations. See http://www.csb.gov/in-safety-message-csb-chairperson-rafael-moure-eraso- calls-for-regulatory-coverage-of-reactive-chemicals-following-the-west-fertilizer-explosion-and-fire-/ (accessed September 23, 2013). 227 For more information on this meeting, see http://www.csb.gov/events/csb-public-meeting-to-vote-on-key-safety- recommendations-and-initiate-most-wanted-program/ (accessed July 29, 2013). 228 An RFI is a tool used by a federal agency to help it develop a proposed rule. Federal agencies generally use RFIs when they want public input on whether a new rule or changes to an existing rule are needed, and comments on what course the agency should take should it decide to move forward. More information available at http://www.dol.gov/regulations/participate.htm (accessed July 29, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

48 DRAFT FOR PUBLIC COMMENT integrity and PSI elements of its PSM standard in part to “provide flexibility for the employer to choose the frequency which would provide the best assurance of equipment integrity.”229 OSHA meant for RAGAGEP to include “both appropriate internal standards and applicable codes and standards…”230 However, the concept of RAGAGEP only applies to 2 of the 14 PSM standard elements (mechanical integrity and PSI), only addresses equipment and mechanical integrity, and is usually utilized by OSHA as a mechanism to issue citations to companies post-incident. In addition, OSHA has had difficulty enforcing RAGAGEP citations. In a recent OSHA Review Commission proceeding, Secretary of Labor v BP Products North America, Inc., & BP-Husky Refining, LLC,231 and United Steelworkers Local 1-346, the Administrative Law Judge (ALJ) vacated OSHA RAGAGEP citations issued to BP for violations of 29 CFR §1910.119(d)(3)(ii)232 for failure to comply with a specific RAGAGEP, holding that OSHA impermissibly adopted a specific RAGAGEP, thereby diminishing the performance aspect of the RAGAGEP requirements contained within the OSHA PSM standard. The ALJ concluded that by citing to only one specific RAGAGEP, OSHA impermissibly adopted a prescriptive standard; in the ALJ’s view, OSHA should have acknowledged other possible RAGAGEPs for BP to comply with, including BP’s own internal standards. If upheld, this ruling may limit OSHA’s ability to utilize RAGAGEP as a means of requiring companies to implement industry good practices in the future.233 The cumbersome rulemaking process and lack of flexibility that has resulted in stagnant and static OSHA standards can be contrasted with the structure of the safety case regulatory regime, which facilitates adaptability and enables the regulator to improve industry safety performance and practices without requiring a major rule change. The safety case essentially provides the regulator with the tools to recognize more rigorous standards and practices that exist and drive a company to implement those practices to further reduce risks, as well as work with industry to improve existing standards and practices if necessary. It also enables companies to implement new, more efficient or safer technologies that do not necessarily meet strict prescriptive regulations, but that drive risk reduction. This adaptability is illustrated by the HSE’s recommendations following the 2004 Buncefield incident. On December 11, 2004, a number of explosions occurred at Buncefield Oil Storage Depot in Hemel Hemptstead, Hertfordshire, England following the overfilling of a gasoline tank. Over 40 people were injured and there was significant offsite damage to homes and businesses. An independently chaired Major Incident Investigation Board led by Lord Newton of Braintree was set up to investigate the incident. Between 2006 and 2008 the Board issued a number of reports and recommendations. In the report issued in March 2007 entitled “Recommendations on the design and operation of fuel storage sites,” the Board highlighted the adaptability of the existing regulatory regime by noting that the recommendations to improve standards and revise guidance should not require actual changes to the law, because the existing legal framework was “sufficient to ensure that necessary improvements are put in

229 57 Fed. Reg. 6390-6391 (1992). 230 Ibid at 6390-6391. 231 BP Products North America, Inc. operates a refinery in Oregon, Ohio. BP-Husky is a joint venture with a business interest in the refinery. 232 29 CFR 1910.119(d)(3)(ii) requires the employer to document that equipment complies with RAGAGEP. 233The Occupational Safety and Health Review Commission is scheduled to review the decision.

Chevron Richmond Refinery Regulatory Report December 2013

49 DRAFT FOR PUBLIC COMMENT place.”234 The Board followed by making its first recommendation of the report, to the COMAH CA and operators of Buncefield-type sites to develop and agree on a methodology to determine safety integrity level (SIL) requirements for overfill prevention systems, which takes account of, among other things, nearby resources or populations.235 The Board also recommended that the sector “develop guidance to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs.”236 Another key recommendation was made to the CA to “ensure that safety reports submitted under the COMAH Regulations contain information to demonstrate that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for control and environmental protection engineering systems.”237 Finally, the Board recommended in this report that the “sector agree with the Competent Authority on a system of leading238 and lagging239 performance indicators for process safety performance…” based on HSE’s guidance on Developing process safety indicators.240 Spurred by recommendations made surrounding the Buncefield incident, the BP Texas City incident, and the BP Grangemouth incident,241 the COMAH CA developed an Operational Delivery Guide entitled “COMAH Competent Authority Workstream 2e: Process safety performance indicators,”242 which was “designed to continue the promotion and development of site level process safety performance indicators (PSPIs) as part of the monitoring arrangements for an effective process safety management system at major hazard sites.”243 The guide states that by the end of March 2013 all “Buncefield-type” sites would “have effective monitoring of process safety performance in place and that site specific leading and lagging performance indicators have been developed…”244 and that by the end of 2015 “all major hazard establishments and duty holders will measure their performance on the control of major hazard risks by way of key leading and lagging performance indicators.”245 It lays out in detail a six-step process for implementing a process safety measurement system; how inspectors will assess a duty holder’s performance; and adds that full implementation of this program could take between 18 months and two and a half years from when the initial introduction takes place – all without requiring any fundamental changes to the COMAH regulations themselves.

234 Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007; p 3. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013). 235 Ibid at 8. 236 Ibid at 15. 237 Ibid at 19. 238 Leading indicators are measurements that predict future performance to ensure that safety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics; October 2009; p 20. 239 Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety metric. Ibid at 20. 240 Ibid at 13. 241 Between May 29 and June 10, 2000, three incidents occurred at the BP Grangemouth Petrochemical Complex in Scotland, which is one of the largest of the 950 COMAH sites in the UK. 242 Available at http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed May 21, 2013). 243 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 3. 244 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 6. 245 Ibid at 3.

Chevron Richmond Refinery Regulatory Report December 2013

50 DRAFT FOR PUBLIC COMMENT The COMAH CA Investigation Team noted in its publication summarizing the conclusions of the Buncefield investigation that following the incident, the CA, industry and trade unions worked together to “drive forward high standards at fuel storage sites…[which] has resulted in agreement on improved standards of safety and environmental protection for all UK sites storing large volumes of gasoline and to systematically upgrade sites to meet these standards…”246 In another example following the Buncefield incident, the Board recommended significantly higher standards than were generally in place in the sector. For example, the Board recommended that fuel storage tanks be fitted with automatic overfill protection equipment that would cut off supply if an overfill event occurs, rather than continuing to rely on operators to interrupt flow manually in the case of an event. In response, the UK Petroleum Industry Association and the Tank Storage Association adopted the recommendation, and the British government announced that it would require all sites to move to fully automatic shutdown systems on tanks storing gasoline. The Process Safety Leadership Group (PSLG) was formed to help develop the details of the new rule, and to “meet the need for an effective framework for interaction between industry, trade unions and the COMAH Competent Authority (CA)…”247 As will be discussed in the next section, workforce involvement is a key element of an effective safety case regulatory regime. In 2009, HSE published the PSLG’s work in a document entitled Safety and Environmental Standards for Fuel Storage Sites. The document lays out precisely which tanks must utilize automatic overfill protection equipment, and also allows for duty holders to demonstrate technical reasons as to why automatic overfill protection would not be appropriate by “prepar[ing] a robust demonstration that alternative measures are capable of achieving an equivalent ALARP outcome to an overfill protection system that is automatic…”248 This document in essence was developed as an industry good practice, and compliance with its requirements would likely ensure that the duty holder is complying with the law and reducing risks to ALARP.249 This can be contrasted with an even larger release of gasoline and a subsequent explosion that occurred in the 2009 tank overfill at the Caribbean Petroleum Corporation near San Juan, Puerto Rico. This incident severely damaged surrounding buildings and impacted moving vehicles. This incident has not resulted in any re-evaluation of safety rules by the EPA or OSHA, despite the fact that tank terminals largely fall outside the PSM and RMP program regulations, (let alone the more rigorous requirements of a major hazard safety case regulatory regime, as practiced in the UK). These post-Buncefield examples highlight one of the most important attributes of the safety case regulatory approach: it is a regulatory framework that implements a balance of goal-setting and prescriptive elements which enable the regulator to drive facilities to continuously improve practices aimed at reducing risks to ALARP, without having to adhere to the extensive and time-consuming rulemaking requirements that exist in the US. This flexibility and adaptability encourages facilities to focus on improving practices and technology rather than on completing activity-based requirements, which can have the effect of stifling innovation and technological advancement.

246 The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011; p 3. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013). 247 Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 2009; p 7. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 248 Ibid at 29. 249 For a detailed discussion of rule-compliance and the safety case, see Hopkins, Andrew. Risk-management and rule-compliance: Decision-making in hazardous industries; Safety Science 49 (1011) 110-120.

Chevron Richmond Refinery Regulatory Report December 2013

51 DRAFT FOR PUBLIC COMMENT Critics argue that because there have been significant industry problems with the maintenance of safety critical equipment and aging equipment in the UK, 250 the safety case regime is not operating effectively. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferral of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters. However, the HSE has worked to make improvements to these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.251 The same year, the HSE published a report intended to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,252 which provides an overview of ageing plant mechanisms and their management. This document presents analysis and findings for loss of containment incidents to demonstrate how aging plant equipment may be a factor. The HSE has been able to take this type of programmatic proactive approach in the UK thanks to the safety case regime’s adaptive nature, which is lacking in the US both on and offshore. This is positive evidence of a competent and effective regulator with the capability under the safety case regime to identify and proactively address industry gaps in safety performance. 4.4 Active Workforce Participation As the CSB noted in its Interim Report on the Chevron incident, workforce participation is a key element of process safety and effective major accident prevention. In one of its publications, the Center for Chemical Process Safety (CCPS) lists workforce involvement as one of 20 essential management components necessary to reduce process safety risks and prevent chemical accidents.253 According to CCPS, …workers are potentially the most knowledgeable people with respect to the day-to-day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their unique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise.254 This CCPS publication discusses general areas of workforce involvement in risk assessments, inspections, audits, and performance reviews, and notes that participation leads to empowerment, management responsiveness, and process safety performance improvement. 255 The OSHA PSM standard requires employers to consult with employees and their representatives on the conduct and development of PHAs and on the development of the 13 remaining PSM elements, and to develop a written plan of action

250 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf, (accessed August 28, 2013). 251 The UK launches Key Programmes to address poor performance in specific areas. Access the report entitled Key Programme 4 (KP$): Ageing and life extension at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013). 252 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 253 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv. 254 Ibid at 124. 255 Ibid at 125.

Chevron Richmond Refinery Regulatory Report December 2013

52 DRAFT FOR PUBLIC COMMENT regarding the implementation of the employee participation required under this section.256 During facility inspections, OSHA inspectors must request and evaluate these written plans of action regarding the implementation of employee participation as well as interview employees and their representatives to verify that the employer is satisfying the requirements.257 In previous investigation reports, the CSB has identified that workers and their representatives play a very important role in major incident prevention. For example, as will be discussed in the next section on performance indicators, the CSB recommended in the BP Texas City investigation report that BP and the United Steelworkers Union (USW) establish a joint program to report incidents and near misses, and to ensure that recommendations made during investigations were implemented. The CSB also recommended that API and the USW work together to develop a safety standard addressing leading and lagging process safety indicators.258 However, representatives from the USW have stated to the CSB that it is a constant struggle for workers and their representatives to have a voice or play a role in the management of safety in US petroleum refineries. The law in the UK also requires employers to consult with their employees or their safety representatives on health and safety matters. The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996 set out the legal framework for such consultation and worker involvement at both unionized and non-unionized onshore facilities.259 However, these regulations go further than the OSHA PSM standard in that they provide for the election of safety representatives by the workers to serve many health and safety-related functions, including investigating complaints and accidents and carrying out inspections. In his keynote speech at the Oil and Gas UK Piper 25 conference mentioned in Section 4.3, Lord Cullen stated that the safety representative positions have “important functions, such as the power to carry out investigations and reporting safety concerns to management, without fear of recrimination,” noting that they “help[] reinforce the principle that each employee is responsible for his own safety.”260 The regulations also require employers to establish a safety committee when one is requested by at least two health and safety representatives. The 1996 regulations require employers to consult with employees not represented by safety representatives under the 1977 Regulations on a number of health and safety-related matters, such as the introduction of any measure which may substantially affect their health and safety at work, the planning and organization

256 29 CFR §1910.119(c) (2012). 257 See OSHA CPL 02-02-045. Process Safety Management of Highly Hazardous Chemicals – Compliance Guidelines and Enforcement Procedures. September 13, 1994. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=1558&p_table=directives (accessed September 6, 2013). 258 Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators, performance measures, indicators, etc… 259 The 1977 regulations apply to workplaces where the employer recognizes trade unions and trade unions are recognized for collective bargaining purposes. Regulations available at http://www.legislation.gov.uk/uksi/1977/500/contents/made (accessed September 4, 2013). The 1996 regulations apply to workplaces where employees are not in a trade union and/or the employer does not recognize the trade union, or the trade union does not represent those employees not in the trade union. Regulations available at http://www.legislation.gov.uk/uksi/1996/1513/contents/made (accessed September 4, 2013). 260 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

53 DRAFT FOR PUBLIC COMMENT of health and safety training, and the health and safety consequences of introducing new technology.261 The law in the UK protects employees from being penalized for taking part in health and safety consultation.262 The UK’s existing regulations and policies regarding worker involvement offshore were developed and strengthened as a result of the Piper Alpha incident. In the Piper Alpha Report, Lord Cullen emphasized the importance of workforce involvement in safe operations, and noted that a safety committee system is “the most visible instrument for the involvement of the workforce in safety.”263 He concluded by recommending that “the regulatory body, operators and contractors should support and encourage the involvement of the offshore workforce in safety.”264 HSE developed guidance in response to Lord Cullen’s recommendations entitled Play your part! How offshore workers can help improve health and safety, intended to encourage workforce participation offshore.265 The most current version of this guidance document, which was prepared by the Workforce Involvement Group (WIG),266 located within HSE’s Offshore Industry Advisory Committee (OIAC),267 utilizes good practice and examples of successful workforce involvement in improving health and safety with the goal of assisting operators, contractors, safety representatives, and others in effectively utilizing workforce involvement in their workplaces. It encourages companies to facilitate workforce involvement by providing information, improving communication at all levels, good training, and ensuring that all workers are represented in the decisions that affect them.268 The Piper Alpha incident also resulted in the swift development of the SI971 Offshore Regulations (Safety Representatives and Safety Committees) Regulations 1989 (“the SI971 Regulations”), which provide for the nomination and election of safety representatives and require offshore installations to establish safety committees.269270 The HSE has published a guidance document entitled A guide to the

261 See HSE. Consulting employees on health and safety: A brief guide to the law. 2013. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 4, 2013). 262 See Employment Rights Act 1996. Section 44. Health and safety cases. http://www.legislation.gov.uk/ukpga/1996/18/section/44 (accessed September 4, 2013). 263 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 301. 264 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 392. 265 See HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 266 The WIG’s mission is to improve safety “by stimulating lateral learning and best practice across the offshore industry through involvement of the whole workforce.” It looks at ways to increase worker involvement in health and safety matters offshore and is chaired by HSE. For more information see http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig.htm (accessed June 17, 2013). 267 The OIAC is a tripartite committee that includes members representing employers, employees, unions, trade associations and other government departments. It is focused solely on the offshore sector. More information is available at http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/information.htm (accessed June 17, 2013). 268 HSE. Play your part! How offshore workers can help improve health and safety; 2013; p 4. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 269 Under Regulation 16, safety representatives are responsible for investigating potential hazards and incidents, examining causes of accidents, investigating complaints by any member of his or her constituency relating to occupational health and safety, representing members of the workforce in consultations on the offshore installation with inspectors, and consulting constituency members on any matters arising out of the Regulation. Under Regulation 17, a safety representative may inspect any part of the offshore installation or its equipment either on a regular basis or following an incident. According to HSE, “this can be of great benefit to the duty holder because it brings an independent look at health and safety factors from the workforce viewpoint. Workers are in the front line

Chevron Richmond Refinery Regulatory Report December 2013

54 DRAFT FOR PUBLIC COMMENT Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989271 designed to assist duty holders, employers, installation managers, safety representatives, safety committee members and all members of the workforce in the offshore industry with what the regulations require and what must be done to comply with them. The document explains that although the primary responsibility for health and safety resides with the duty holder, “all members of the workforce must play their part if risks are to be eliminated or minimized.”272 It also emphasizes the importance of training of safety representatives, which enables them to effectively represent workers and fulfill their responsibilities and functions under these Regulations. In April 2010, HSE launched an inspection project to examine the effectiveness of the SI971 Regulations and the effectiveness of those regulations, as well as to collect examples of best practice to present to the offshore industry.273 Forty-one inspections were completed in a six-month period on offshore installations operated by 25 different duty holders. The project helped focus on the power of safety representatives and how to strengthen their ability to effectively perform their duties. It also was well received by the safety representatives, as it gave them encouragement and recognition, and sent a message to management on the importance of SI971 and the key role of safety representatives and committees in workplace health and safety. The HSE has placed great emphasis and importance on the role of worker involvement and consultation in improving workplace health and safety and reducing major accidents on and offshore. In June 2009, HSE launched a new strategy entitled Be part of the solution, which lists workforce involvement as one of its main priorities, and the agency has published a significant amount of guidance on worker involvement and consultation on its website.274 The Norwegian Working Environment Act addresses the rights and duties of safety representatives and committees in Norway. It applies to nearly all workers in Norway, including onshore and offshore oil workers. The Act provides for the election of government recognized safety representatives whose duty is to “safeguard the interests or employees in matters of the working environment.”275 These representatives have the right to information, consultation, and participation in inspections.276 They also have the right to halt unsafe work until the regulator decides when the work may continue.277

and are often well placed to see problems and put forward practical suggestions.” HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989; 2012; p 20. http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 270 Under Regulation 22, safety committees are responsible for reviewing the system of constituencies so as to ensure adequate representation of the workforce on health and safety matters, reviewing training of safety representatives, reviewing the frequency of safety committee meetings and the circumstances under which they may be called, and considering causes of accidents and making recommendations to the installation manager. 271Third edition published in 2012. Available at http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 272 Ibid at 7. 273 See HSE. Offshore workforce involvement and consultation: Compliance Inspection Project. Available at http://www.hse.gov.uk/offshore/si971.pdf (accessed September 4, 2013). 274 See http://www.hse.gov.uk/involvement/hsrepresentatives.htm (accessed September 4, 2013). 275 Act Relating to Working Environment, Working Hours and Employment Protection, Etc. (Working Environment Act). December 2012. Section 6-1. Obligation to elect safety representatives. 276 Ibid at Section 6-2. Duties of safety representatives. 277 Ibid at Section 6-3. The safety representative’s right to halt dangerous work.

Chevron Richmond Refinery Regulatory Report December 2013

55 DRAFT FOR PUBLIC COMMENT A tripartite system consisting of active and equal participation from the regulator, workforce, and industry, is necessary for effective safety case implementation. A fundamental element in effective safety management for major accident prevention is active and equal participation from the regulator, industry, and labor. Each entity provides unique and essential insights, and removing the participation of these entities removes a critical voice in health and safety matters. In the UK and Norway, tripartite systems consisting of industry, the regulator, and the workforce have been established to deal with safety and health issues at the highest levels beyond just site workforce representation. The CSB investigation staff has had extensive discussions with worker representatives who have voiced their opinions on their systems to the CSB. Roy Furre, a Representative from the Norwegian Union of Energy Workers, spoke at the CSB’s 2010 public hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, and stated that the Norwegian working environment and the accompanying petroleum regulations empower unions and safety delegates in all phases of the petroleum activities.278 He also noted that the Norwegian petroleum regulations require that all necessary information about risks and decisions be given to the workers’ representatives.279 During the CSB’s public hearing on Safety Performance Indicators in July 2012, Jake Molloy, the Regional Organizer for the National Union of Rail, Maritime and Transport Workers in the UK, stated that the input of workers is “crucial” in major accident prevention and that “if the people operating these systems and delivering these results are unable for any reason to tell you what the true picture is, everything else is worthless.”280 When speaking at a “Step Change for Safety” Conference in Aberdeen, Scotland, on September 5, 2012, Mr. Molloy noted that attending the public hearing in Houston was “eye opening” and that hearing about the US system was like a “walk back in time.”281 4.5 Process Safety Indicators that Drive Performance As the CSB noted in both its July 2012 public hearing on Safety Performance Indicators and its Chevron Interim Report, leading and lagging process safety indicators help drive continuous process safety improvement, as long as regulators utilize these indicators to focus inspections, audits, and investigations, and organizations focus attention on them in a way that makes a difference. Process safety indicators are a significant element of process safety management systems. They measure the strengths and weaknesses of these systems to achieve and maintain safe and reliable operations282 and, if properly defined, collected and used, can identify the successes and flaws of the system.283 Lagging indicators are a “form of reactive monitoring”284 that includes events such as major spills, fires, or gas releases. Leading indicators, on the other hand, are a “form of active monitoring,”285 and are

278 CSB. Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety. December 15, 2010; p 300. http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed December 10, 2013). 279 Ibid at 300. 280 CSB. Public Hearing: Safety Performance Indicators. July 23, 2013; p 143. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed December 10, 2013). 281 http://www.youtube.com/watch?v=-xDzb4x8t_c (accessed December 10, 2013). 282 CCPS. Guidelines for Process Safety Metrics; October 2009; p 109. 283 Ibid. 284 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 285 Ibid.

Chevron Richmond Refinery Regulatory Report December 2013

56 DRAFT FOR PUBLIC COMMENT described as events that do not result in severe consequences and usually address safety system performance, such as deviations from safe operating limits or timely maintenance on safety critical equipment.286 Leading indicators “can be considered as measures of process or inputs essential to deliver the desired safety outcome.”287 The general thinking globally is that if companies rely primarily on lagging indicator data, which is retrospective, they are not effectively managing process safety to ensure major accidents are prevented. According to HSE, “[t]oo many organizations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly.”288 Rather, facilities must identify critical controls to monitor and set leading indicators against each one to show that the system is operating as intended. The HSE was one of the earliest regulators to adopt process safety indicators regulations. In 1995, the agency began requiring companies to report health and safety data, and then published annual reports based on those statistics. In 2006, the HSE developed a step-by-step guidance document entitled Developing process safety indicators289 to assist industry. The guide establishes and discusses in detail six main steps necessary to implement a process safety measurement system, including developing leading and lagging indicators. It also defines leading and lagging indicators for each of the controls in the risk control system. According to Jake Molloy, “It is our firm belief that the most influential and effective schemes using indicators to measure improvements and major accident prevention are those initiatives generated by our regulator, the Health and Safety Executive [HSE].”290 As discussed in the previous section, a number of large incidents, including BP Texas City and BP Grangemouth, have highlighted the need for the chemical and other major hazard sectors to demonstrate that risks are being adequately controlled. In response to recommendations stemming from such incidents, the COMAH CA developed an Operational Delivery Guide in 2010 on process safety performance indicators setting out four stages to aid facilities in the development of process safety indicators. The document sets out a goal that by the end of 2015 major hazard establishments and duty holders will measure their safety performance and control of risk by way of key leading and lagging performance indicators. Following the 2005 BP Texas City incident, BP developed company-wide process safety indicators, and now includes process safety metrics in performance contracts for its US refinery managers.291 However, existing guidance in the US pertaining to safety performance indicators does not adequately aid companies in managing major hazards onshore. The CSB has noted that in virtually every incident it investigates in the US, process safety indicators are either not used at all or not used effectively.292 Millions of workplaces around the US primarily measure their safety performance using OSHA

286 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 83. 287 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/priced/hsg254.pdf (accessed October 30, 2013). 288 Ibid at 1. 289 Full title is Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; first published in 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 290 Molloy Testimony. CSB Indicators Public Hearing Transcript; July 24, 2012; p 139. 291 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 84. 292 Donald Holmstrom. CSB Indicators Public Hearing Transcript; July 24, 2012; p 13.

Chevron Richmond Refinery Regulatory Report December 2013

57 DRAFT FOR PUBLIC COMMENT recordable injury and illness rates, which include slips, trips, and falls. While collecting this type of data is also necessary in hazardous operations, it is not sufficient. Injury rates do not depict the effectiveness of a high hazard facility’s process safety management program.293 For example, the CSB noted in its BP Texas City investigation that BP’s personal injury metrics were described as being at the best level on record; yet, around this same time, in March 2005, BP Texas City experienced the devastating 15-fatality incident, which resulted from a progressive erosion of process safety performance that was not reflected in injury statistics. Following the BP Texas City incident, a number of key recommendations were made to strengthen guidance on indicators in the US. For example, the Baker Panel294 issued a report (the Baker report) that recommended the incorporation of safety indicators to measure safety performance, and stated: The Panel believes that relying exclusively or predominantly on lagging indicators to assess process safety performance is ill-advised. … BP’s reliance on lagging, after-the-fact indicators of process safety performance rather than leading, predictive measures…impaired BP’s ability to measure, monitor and detect deteriorating or degraded process safety conditions and performance… This failure to use a set of effective performance metrics that includes leading indicators increased the likelihood that the organisation would identify the need for improvements or additional controls only after something had gone wrong.295 The Baker Panel also noted that it was not enough just to develop process indicators: these indicators needed to be meaningful to the company. As such, the Baker Panel also recommended that “a significant proportion of total compensation of refining line managers and supervisors [be] contingent on satisfactorily meeting process safety performance goals…”296 In its final investigation report on the incident, the CSB made a recommendation to API and USW to jointly lead development of a consensus standard for leading and lagging process safety indicators to drive performance improvements in the prevention of major incidents. API responded by issuing RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries. However, this voluntary standard, which defines a framework of four tiered indicators that incorporate the concepts of lagging to leading measures, has significant shortcomings, as the CSB described in a two-day public hearing on Safety Performance Indicators that was held in July 2012. The CSB analysis found that the ability of RP 754 to drive performance improvement and inform key stakeholders will be hampered by

293 Ibid. 294 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013).

295 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 194. 296 Ibid at 251.

Chevron Richmond Refinery Regulatory Report December 2013

58 DRAFT FOR PUBLIC COMMENT PSA’s analysis of indicator data showed a decreasing trend in the number of reported hydrocarbon leaks offshore between 2007 and 2010.  lagging indicators with insufficient statistical rigor needed to allow for trending or incremental performance improvements;  the lack of well-defined standardized and normalized leading indicators that are needed for comparison among sites, corporations, or to national averages;  weak employee protection requirements; public reporting requirements that will be ineffective to adequately inform stakeholders; and  the lack of broadly based consensus in the standard’s development process.297 As a result, in 2012 the CSB Board designated the response to the CSB’s recommendation as “open- acceptable,”298 meaning that the recommendations recipient is moving in the right direction, but more remains to be done. The CSB also noted in the Chevron Interim Report the important role the public plays in monitoring safety management systems, and referenced CCPS as promoting the sharing of process safety indicators with the public: Sharing performance metrics and results broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics and performance public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating process safety successes also demonstrates to employees and the public that positive change can be, and are being, made within an organization.299 The Petroleum Safety Authority (PSA) in Norway provides annual reports to the public on its website assessing indicators it has collected directly from offshore and onshore major hazard facilities since 2000 and 2006, respectively. The PSA utilizes the indicators data found in these reports to identify critical safety areas that must be targeted for improvement in order to prevent near misses and accidents.300 The onshore report, Risk level in the petroleum industry, Onshore facilities,301, 302 includes a description and explanation of the indicators collected and analysis of these data. In this report PSA notes a decreasing trend in the number of reported hydrocarbon leaks on offshore production

297 CSB Public Hearing: Safety Performance Indicators. July 23-24, 2012; p 26. http://www.csb.gov/events/csb- public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 298 For more information on recommendations status designations, see http://www.csb.gov/recommendations/faq/#5 (accessed June 21, 2013). 299 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics. 2010; p 109. 300 PSA. Trends in Risk Level: Summary Report 2012 – Norwegian Continental Shelf. 2012; p 1. 301 See http://www.ptil.no/publications/category175.html?ptil_md_art_list-select_group=Category-233. The CSB had the 2010 version of the onshore report translated into English. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17,

1. (accessed September 17, 2013).

302 The corresponding report discussing offshore indicator data is entitled Trends in Risk Level. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 2013.

Chevron Richmond Refinery Regulatory Report December 2013

59 DRAFT FOR PUBLIC COMMENT facilities between 2007 and 2010.303 However, it is too soon for PSA to assess trends in the onshore indicators data, because the time period for onshore data collection has been relatively short and there are fewer data points with only eight facilities onshore. The PSA also indicated that it will take time for the onshore data to improve as indicators are refined, but recognized that the same approach has already yielded good results in the offshore sector.304 Additional information on data and trends based on safety case regime implementation are provided in Appendix C. 4.6 Regulatory Assessment, Verification, and Intervention To effectively oversee covered facilities and enforce safety case regulations, technically competent regulators review and assess305 safety case reports and utilize preventative inspections and audits to effectively intervene before high-risk activities commence. According to the HSE, “[t]he assessment process is only a part of the COMAH regime and examines at face value the factual information and examines arguments and demonstrations contained in the report against the requirements of the regulations.”306 The HSE places great emphasis during the assessment phase on the adoption of inherently safer designs307 and notes that “[m]ajor accident hazards should be avoided or reduced at source through the application of principles of inherent safety.”308 Conclusions on the adequacy of the safety case report are developed at the end of the assessment process, and, if deficiencies are found, an intervention strategy for the facility is developed to addresses those deficient measures. According to the HSE, assessment of a safety case report or document “is not a discrete activity but leads to further action under the intervention plan for the operator at that establishment.”309 Intervention by the regulator ensures that the facility and its operations are consistent with information provided in the safety case report, and that there are robust systems in place to “reduce the likelihood of hazards and to mitigate their consequences until the associated risks are ALARP.”310311 Under the safety case regulatory regime, the regulator has the authority to accept the safety case report or reject it and require additional measures to further reduce risks. Preventative inspections and audits by a technically competent regulator can also result in deep challenges to industry, which does not typically happen under PSM or RMP. In the UK, the COMAH regulations authorize the CA to

303 PSA. Risk level in the petroleum industry, Onshore facilities. 2010; p 80. 304 Ibid. 305 According to the HSE, the “assessment reviews the documentary evidence in the report and further documentation, as appropriate, which is referred to in the report or requested by the assessor.” HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013). 306 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 9. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 307 Ibid at 30. 308 HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013). 309 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 4. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 310 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 311 According to HSE, essential considerations to ensure ALARP are “the scope of hazard elimination, the adoption of inherently safer designs, whether good practice has been, or is to be adopted, [and] the application of risk- reducing measures where relevant good practice is not yet established.” Ibid at 30 and 31.

Chevron Richmond Refinery Regulatory Report December 2013

60 DRAFT FOR PUBLIC COMMENT The safety case regulatory regime provides the regulator with the tools to accept or a reject a safety case report. organize an adequate system of inspections of establishments or other measures of control appropriate to the type of establishment concerned…[that are] sufficient for a planned and systematic examination of the systems being employed at the establishment, whether of a technical, organisational or managerial nature, so as to ensure…(a) that the operator can demonstrate that he has taken appropriate measures to prevent major accidents; (b) that the operator can demonstrate that he has provided appropriate means for limiting the consequences of major accidents both inside and outside the establishment; (c) that the information contained in any report sent to the competent authority by the operator of the establishment adequately reflects the conditions in the establishment…312 The CSB noted in its BP Texas City Final Investigation Report that in the UK, HSE inspectors thoroughly inspect high hazard facilities annually, and all COMAH-covered facilities are inspected every five years. For the approximately ten petroleum refineries in the UK, detailed planned inspections (ranging from 80 to 150 days) are conducted annually for each refinery by a multidisciplinary team (regulatory inspectors, process safety, mechanical engineering, electrical and instrumentation, and human factors specialists).313 On its website, HSE lists its offshore priorities as safety case assessment;314 verification;315 inspection; investigation; and enforcement.316 In its business plan for 2012-2015, HSE set out a goal of assessing 72 safety cases onshore and 100 safety cases offshore for 2013 and 2014.317 The work required to be conducted to assess a safety case both on and offshore is very resource-intensive (a typical new offshore safety case assessment requires anywhere from 100 to 300 hours of work), and demands that the regulator hire and retain individuals with significant oil and gas experience, specifically in areas such as process safety, human factors, engineering, and organizational performance. In Australia, the Offshore Petroleum and Greenhouse Gas Storage Act 2006 authorizes NOPSEMA to conduct planned inspections of offshore installations to ensure compliance with the Act.318 NOPSEMA notes that planned inspections “are a critical examination of aspects of a facility, its systems and

312 COMAH Regulations 1999 Part 6, Regulation 19(1) and (2). 313 The CSB. Investigation Report: BP Texas City Refinery Explosion and Fire. March 2007; p 205. http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 29, 2013). 314 An owner or operator (i.e. the duty holder) is required to submit a safety case to HSE for each offshore installation. HSE then assesses the safety case using both regulations and HSE’s “Assessment Principles for Offshore Safety Cases (APOSC) and must accept it before an installation can operate. See http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed July 31, 2013). 315 Duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to put in place and keep under continual review a verification scheme by which assurance is obtained from an independent competent person (ICP) that safety critical elements and the PFEER (Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) specified plant are suitable and remain suitable for the life of the installation. For more information see http://www.hse.gov.uk/offshore/verification.htm (accessed July 31, 2013). 316 See http://www.hse.gov.uk/offshore/priorities.htm (accessed July 15, 2013). 317 HSE. HSE Business Plan 2012-15; June 2012; p 14. http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). 318 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Sections 600 and 601. See http://www.comlaw.gov.au/Series/C2006A00014 (accessed July 15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

61 DRAFT FOR PUBLIC COMMENT operations with information obtained from the facility safety case.”319 Subjects of planned inspections include risk control measures related to either a Major Accident Event320 or Occupational Health and Safety controls, or both. NOPSEMA states that it conducts at least two per year for each normally manned offshore installation.321 NOPSEMA distinguishes between two types of planned inspections: field-based inspections, which focus on implementation of control measures described in a facility’s safety case, and themed audits, which deal with inspection of organizational issues by following a common theme to direct lines of questioning.322 In a 1992 compliance directive,323 OSHA stated that the primary enforcement model for the PSM standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) inspections.324 These inspections consist of three parts: determining if the elements of a PSM program are in place; evaluating if the programs comply with the requirements of the standard; and verifying compliance with the standard through interviews, data sampling, and field observations. However, OSHA does not make planned inspections, which have the most opportunity for prevention, a high priority. Rather, OSHA lists its inspection priorities as 1) imminent danger situations; 2) fatalities and catastrophes; 3) complaints; 4) referrals; 5) follow-ups; and 6) planned inspections.325 The CSB does not consider reacting to catastrophic or potentially catastrophic incidents and issuing fines on the part of the regulator to be effective substitutes for preventative inspections and audits – especially for high hazard facilities where catastrophic incidents are possible. The CSB noted in its BP Texas City Final Investigation Report that for the 10-year period prior to the Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by developing more highly trained and experienced inspectors to conduct more comprehensive inspections, such as the PQV audits envisioned in the 1992 directive, at facilities presenting the greatest risk of a catastrophic accident. The intent of the recommendation was to establish a permanent, ongoing planned comprehensive inspections program. Spurred in part by the CSB’s recommendations, OSHA issued the Petroleum Refinery Process Safety Management National Emphasis Program (NEP) on June 7, 2007.326 The NEP was a federal program that established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard. Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and

319 NOPSEMA. Inspection Policy; p 2. http://www.nopsema.gov.au/assets/document/N-02000-PL0025- Inspection.pdf (accessed July 15, 2013). 320 Australia’s Offshore Petroleum and Greenhouse Gas Storage Regulations 2009 define an MAE as “an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of person at or near the facility.” Chapter 1.5. See http://www.comlaw.gov.au/Details/F2009L04578/Html/Text#param5 (accessed July 15, 2013). 321 For more information, see http://www.nopsema.gov.au/safety/inspections/ (accessed July 15, 2013). 322 For more information, see http://www.nopsema.gov.au/assets/document/N-02000-PL0025-Inspection.pdf (accessed July 15, 2013). 323 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new regulation. 324 OSHA Instruction CPL 02-02-045 (1994). 325 “OSHA Fact Sheet: OSHA Inspections,” available at http://www.osha.gov/OshDoc/data_General_Facts/factsheet-inspections.pdf (accessed on May 20, 2013). 326 Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to complete NEP inspections under the original CPL 03-00-004.

Chevron Richmond Refinery Regulatory Report December 2013

62 DRAFT FOR PUBLIC COMMENT uses a more global approach to identify compliance deficiencies…,” the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standard…[which] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, interview employees, and verify implementation for specific processes, equipment, and procedures.”327 The NEP inspections were meant to be more targeted and efficient than PQV inspections. However, the inspections being conducted pursuant to the NEP were terminated in 2011 partly because they were very time-consuming and resource-intensive. OSHA has publicly stated328 that NEP inspection hours were roughly 40 times greater than average OSHA inspection hours. OSHA described the NEP as its most effective emphasis program in its history, citing a disturbing number of issues and subsequent citations. In 1999, EPA established an audit329 program to help ensure compliance with the RMP. The audits were intended to provide an independent verification of the information in the RMP and include on-site inspections. Under these requirements, the implementing agency (EPA or a correlating state agency) must “periodically audit” RMPs to review their adequacy and require revisions when necessary to ensure compliance. 330 Between fiscal years (FY) 2010 and 2012, each EPA Region responsible for implementing the RMP program was mandated by EPA to perform inspections331 at five percent of the total number of regulated facilities in the regions, and a certain percentage of these facilities were required to be high-risk.332 In FY 2010, regions were to conduct 10 percent of the inspections at high-risk facilities, and in FYs 2011 and 2012, 25 percent at high-risk facilities.333 Although EPA has acknowledged that “full compliance with the Risk Management Program regulations cannot be determined without on-site or independent verification of all or part of the information

327 CPL 03-00-004, Section X(D)(1). 2007. 328 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation made at CSB Public Hearing on Process Safety Indicators; July 20, 2012. http://www.csb.gov/UserFiles/file/Barab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). Also see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013). 329 Within Part 68, the term “audit” refers to the process that implementing agencies may use to verify the quality of the RMP submitted to EPA and require revisions when necessary to ensure compliance. RMP audits will generally involve on-site verification of a facility’s underlying risk management program. Section 68.220 of the RMP rule requires implementing agencies to select facilities for audits based on specific criteria, and to follow a specific process for resolving audit findings prior to any enforcement action. See EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 330 40 CFR §68.220 (1999). 331 RMP inspections “are different from audits in that facilities are not necessarily selected for inspection based on Part 68 regulatory criteria, and inspections can lead directly to implementing agency enforcement actions for regulatory violations. Also, RMP inspections always involve on-site verification activities.” See EPA, “Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r).” January 2011; page 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 332 Criteria used to determine high-risk includes the number of people in the footprint (if it is more than 100,000); accidental releases reported in the RMP; the hazard index (percentage of chemical quantity above threshold and number of chemicals onsite); and the number of Program Levels 2 or 3. US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March 2013. See http://www.condorearth.com/files/08- Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 2013). 333 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 7. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

63 DRAFT FOR PUBLIC COMMENT submitted in an RMP[,]”334 the EPA has not effectively implemented the audit and inspection elements of the Risk Management Program. As mentioned above in Section 3.2.2.3.2, the EPA Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk335 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.336 The EPA OIG also noted that of the 296 uninspected high-risk facilities managed by EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.337 4.7 Independent, Competent, Well-Funded Regulator As noted by NOPSEMA, a safety regulator “provides ‘independent’ assurance to society, governments and industry that companies have identified the risks to health and safety and have put appropriate measures in place to control these risks.”338 To ensure that companies are managing risks and employing the best available standards and technologies, the regulator must be independent,339 well-resourced, and retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess companies’ safety case reports and performance. Without independent and competent examinations, the safety case report becomes a meaningless document in terms of controlling risk and preventing major accidents. Offshore regulators in the UK and Australia also utilize independent third party specialist safety companies recognized by the regulator. Third party inspectors review important aspects of the safety case, such as safety critical elements340 and performance standards.341 Third party inspections, however, do not take the place of rigorous inspections by the regulator.

334 EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 335 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 336 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 337 Ibid. 338 See http://www.nopsema.gov.au/safety/safety-case/safety-case-approach/ (accessed May 31, 2013). 339 You will find a more detailed discussion of regulator independence in the CSB’s upcoming Macondo Final Investigation Report. 340 The UK HSE requires offshore installations to define “safety critical elements,” which are the technical barriers in place for the prevention, detection, control, and mitigation of major accident risks. Lauder, Bob. Major Hazard (Asset Integrity) Key Performance Indicators in use in the UK Offshore Oil and Gas Industry. Paper at the CSB Indicators Public Hearing. July 24, 2012. 341 In the UK, duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to “put in place and keep under continual review a verification scheme by means of which assurance is obtained from an independent competent person (ICP) that safety critical elements and PFEER [Offshore Installations ) Prevention of Fire and Explosion, and Emergency Response] specified plant are suitable and remain suitable for the lifetime of the installation.” See http://www.hse.gov.uk/offshore/verification.htm (accessed November 14, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

64 DRAFT FOR PUBLIC COMMENT As of June 2012, the HSE employed roughly 3,300 staff, of which 1,381were front-line inspectors,342 whose responsibilities include conducting preventative inspections of roughly 950 COMAH facilities throughout the UK. The HSE employs roughly 105 inspectors to inspect approximately 300 offshore installations, in effect a one to three ratio. As such, the HSE, with a budget of roughly $472 million,343 has the authority to offer higher specialist salaries to attract and retain more experienced, competent personnel. According to information obtained from the HSE, in 2011 and 2012 their onshore specialist inspector pay ranged from $85,806 to $102,344, and their offshore inspector pay ranged from $134,387 to $148,423 at the highest grade and $116,288 to $131,499 at the next highest grade.344 A safety case regime requires regulators to conduct preventative facility inspections and audits against the safety case to ensure that specified controls are functioning as intended. Regulators must be capable of interacting as equals with company risk managers when conducting these inspections. Former HSE staff have communicated to the CSB that HSE seeks new employees with good communication skills in addition to education and experience, as the job of a safety case regulator requires encouraging companies to aspire to make safety improvements that they may not want to make. One message that current and former HSE staff have repeated is that the industry believes having competent regulatory staff adds significant value to their business.345 In any country, competent offshore regulatory staff can persuade companies to manage risks in a rigorous manner, knowing that if not done properly, their risk management practices will be challenged.346 This competence is also essential for companies’ confidence in the accuracy of the regulatory staff’s advice, inspections, and citations. According to a literature review on the safety case in the UK, “[s]ome companies see as positive the requirement to have ‘someone external to the company keeping you on your toes by regularly asking if you have done all you can,’ and that it ‘forces you to convince yourself’ that you have covered all the risks.”347 In the US, the federal government has used extensive resources to retain the best available talent to focus on health and safety oversight of US commercial and defense nuclear facilities.348 For instance, many nonsupervisory technical staff at the US Nuclear Regulatory Commission349 (NRC) and the Defense

342 HSE. The Health and Safety Executive Annual Report and Accounts 2011/12; July 2012; p 30. http://www.hse.gov.uk/aboutus/reports/1112/ar1112.pdf (accessed June 3, 2013). 343 For 2013/2014, HSE’s budget is listed as 308.1 £million. HSE recovers approximately 40 percent of its costs through income mainly in the nuclear, offshore, and chemical sectors, and the remainder is funded from Grant-in- Aid pursuant to the Health and Safety at Work etc. Act 1974, and fee for intervention (FFI).343 See HSE, “HSE Business Plan 2012-15,” July 2012; page 17. Available at http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021-forex.html (accessed June 4, 2013). 344 Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021- forex.html (accessed June 4, 2013). 345 Based on conversations between the CSB staff and Mange Ognedal (Norway PSA), Ian Whewell (the UK HSE), Peter Wilkinson (Australia NOPSEMA), and John Clegg (Australia NOPSEMA). 346 Peter Wilkinson, Manager Review Implementation Team, Offshore Safety Section, Australia Department of Industry, Tourism and Resources, Presentation to the National Research Centre for Occupational Health and Safety, ANU (May 15, 2002). 347 Vectra Group Limited. Literature Review on the Perceived Benefits and Disadvantages of UK Safety Case Regimes; 2003; p 40. 348 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 349 Presentation by NRC Executive Director Bill Borchardt, January 2011.

Chevron Richmond Refinery Regulatory Report December 2013

65 DRAFT FOR PUBLIC COMMENT Nuclear Facilities Safety Board are paid at the top of the General Schedule pay schedule.350 Virtually all technical staff at the Defense Nuclear Facilities Safety Board hold technical master’s degrees and approximately 25 percent hold doctoral degrees.351 The federal government has a unique category of non-executive positions that involve high-level research and development in the physical, biological, medical, or engineering sciences, or a closely-related field.352 These are known as “Scientific or Professional” positions, and they are classified above the highest general schedule pay level.353 These special salary authorizations contribute to the technical agencies’ ability to compete with private industry to recruit and retain highly competent staff. The NRC also has a type of funding mechanism that ensures that the agency’s budget adequately covers its regulator activities, as the NRC is required by law to recover at least 90 percent of its budget through licensing and inspection fees.354 Another method by which the NRC is able to attract and retain competent technical staff is its extensive training programs. For new inspection staff, the NRC requires a series of courses, assessments, and simulation, all of which takes approximately two years to complete.355 Inspectors must have a bachelor’s degree in engineering or a degree in a relevant scientific field and Professional Engineer certification.356 The agency operates a technical training center in Chattanooga, Tennessee, with various control room simulators that mirror licensees’ facilities. The NRC staff is expected to sufficiently understand this equipment so that they are able to conduct sufficient audits and investigations.357 Before he or she is fully qualified to conduct inspections, inspector candidates must be recommended by the NRC inspector qualification board and certified by the regional administrator or division director.358 As will be discussed in greater detail under Section 5.0, at the time of the Chevron incident, a majority of the regulators responsible for oversight of Chevron and other petroleum refineries in California did not have sufficient, sustainable funding or staffing to oversee major accident prevention activities. An effective safety case regulatory system would necessitate that the California industry regulator be well- resourced and retain a sufficient number of competent, well-trained and experienced staff to critically assess a company’s safety case. The overall knowledge and expertise of the regulator must at a minimum match that of industry in order for the regulator to successfully assess a company’s safety case with the ultimate goal of preventing major accidents.

350 $123,758 to $155,500 per year in 2012 in Washington, DC. See https://www.opm.gov/oca/12tables/html/dcb.asp (accessed May 15, 2013). 351 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 352 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 353 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 354 Section 6101 “NRC User Fees and Annual Charges,” Omnibus Budget Reconciliation Act, Pub. L. 103-66. 107 Stat. 312 (Aug. 10, 1993). 355 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) at 4, available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed May 28, 2013). 356 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001 357 See, e.g., http://www.iaea.org/ns/tutorials/regcontrol/regbody/reg2124.htm (accessed May 28, 2013). 358 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf

Chevron Richmond Refinery Regulatory Report December 2013

66 DRAFT FOR PUBLIC COMMENT

Chevron Richmond Refinery Regulatory Report December 2013

67 DRAFT FOR PUBLIC COMMENT 5.0 Oversight of Petroleum Refineries in California

In California, there currently exists a patchwork of primarily activity-based federal, state, and local laws and regulations aimed at preventing harmful releases of hazardous materials at facilities such as petroleum refineries. This regulatory framework does not foster continuous improvement by driving companies to reduce risks of their hazardous activities to ALARP, nor does it have the requisite number of regulatory staff with the skills, knowledge, and experience to provide sufficient oversight. 5.1 Cal/OSHA 5.1.1 Background Information Section 18 of the OSHAct359 encourages states to develop and implement their own job safety and health programs. Twenty-five states (including California), Puerto Rico and the Virgin Islands currently implement OSHA-approved State Plans.360 States must set job safety and health standards that are “at least as effective as” comparable federal standards; most adopt standards that are identical to the federal standards.361 California was certified as an OSHA State Plan state on August 12, 1977.362 California’s Division of Occupational Safety and Health (Cal/OSHA) administers the California Occupational Safety and Health Program. A PSM District Office363 within Cal/OSHA enforces California’s PSM standard, which is established under Title 8, Section 5189 of the California Code of Regulations (CCR) and entitled Process Safety Management of Acutely Hazardous Materials.364,365 The PSM District Office is comprised of seven inspectors, known as Associate Safety Engineers, and one District Manager to regulate nearly 1,700 PSM-covered facilities in California, including 15 petroleum refineries. Only one of these individuals has a technical background, with a degree in Chemical Engineering. Appendix B of this report summarizes the key differences between the federal and California PSM standards and the safety case regulatory regime. A more detailed analysis of those differences will be provided in the remainder of Section 5.1.

The CSB in its Interim Report identified a number of weaknesses of Chevron’s process safety performance. In many of these causal issues, Chevron was not required to perform at a more effective level by the existing California PSM regulations. In Table 1 below, the CSB identifies the causal issues or findings, which highlight the gaps in the California and federal PSM regulations, and how each issue is more effectively managed in the safety case regulatory regime. In this section of the report, some of these examples will be examined in relation to key features of an effective regulatory approach such as the

359 29 U.S.C. §667 (2004). 360 These are referred to informally as OSHA State Plans. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs 361 29 U.S.C. §667 (c)(2) (2004). Also see http://www.osha.gov/dcsp/osp/faq.html (accessed May 13, 2013). 362 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed June 17, 2013). 363 The California PSM District Offices were established in 2001 after the February 1999 Tosco refinery incident in which four workers were fatally injured following the ignition of a highly flammable material during a turnaround operation. In January 2012 the two district offices were combined into one PSM District Office. 364 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed May 13, 2013). 365 8 CCR §5189 (2012).

Chevron Richmond Refinery Regulatory Report December 2013

68 DRAFT FOR PUBLIC COMMENT safety case. More information on these causal findings can also be found in the CSB Chevron Interim Report.

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** MOC Inspection recommendation to upgrade pipe to 9- Chrome not implemented. The MOC to implement the recommendation narrowed the scope allowing the 52- inch component that failed to remain in service. Implementation of 9- Chrome could have prevented the incident.366 MOC element requires implementation of written procedures to manage changes that shall address the impact of the change on health and safety; however the element is activity based and there is no requirement to implement effective recommendations or control hazards. There is no requirement in the MOC element to consider inherent safety. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Description of MOC procedures and demonstration of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Implementation of the concept of inherent safety is required.367

 Unless otherwise noted, California and federal PSM requirements are nearly identical. ** Regulatory regimes such as offshore in Norway have many attributes of the safety case regulatory regime but are not called the safety case regulatory regime. 366 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 41 and 42. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 367 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report December 2013

69 DRAFT FOR PUBLIC COMMENT Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** MOC Chevron conducted MOCs to evaluate proposed changes to crude feed that introduced higher sulfur concentration. However, Chevron failed to thoroughly evaluate the change of increasing sulfur weight percentage in crude oil feed and to assess how it might affect corrosion rates within the 4-sidecut piping circuit. Cal/OSHA did not issue any citations for failing to consider the impact of corrosion in the MOC process when sulfur composition in the crude oil feed was increased.368 MOC element is activity- based rather than performance based and requirements in RAGAGEP such as API 570369 do not apply to the MOC element of PSM. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Duty holder must identify in the safety case report the standards that they are using to reduce risk such as API 570. The implementation of those standards can be enforced by the regulator to achieve ALARP. PHA In its 2009 crude unit PHA, Chevron simply cited non- specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances. The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. While the PHA element requires addressing the control of hazards, it does not require addressing the effectiveness of the controls or using the hierarchy of controls. For example, the standard would not require the use of improved metallurgy or inherent safety to mitigate corrosion hazards. Cal/OSHA did not cite Chevron for this issue. Requires the use of the most effective practical safeguards to achieve ALARP. The safety case requires the use of inherently safer design and the hierarchy of controls.370

368 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 34, 35 and 36. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 369 API 570. Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems. November 2009. 370 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report December 2013

70 DRAFT FOR PUBLIC COMMENT Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** PHA The 4-sidecut line was analyzed in the most recent crude unit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping. Damage mechanism hazard reviews are not required by the PSM regulation. The process hazard analysis element does not require consideration of RAGAGEP such as API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. Cal/OSHA did not cite Chevron for this issue. For example in the UK the HSE has worked with the industry to develop guidance on damage mechanism hazard reviews in the UK's offshore petrochemical industry. The implementation of best practice standards referenced by a duty holder’s safety case report may be enforced by the regulator to achieve ALARP. Incident Investigations Chevron made recommendations following its investigation of sulfidation incidents at Richmond, Salt Lake City and Pascagoula refineries requiring 100 percent component inspection in high risk piping systems. These recommendations were not implemented in the Richmond refinery crude unit prior to the incident. In 2007 Chevron identified the inherently safer solution of improved metallurgy to prevent sulfidation corrosion but only applied it to the crude unit small spool piece that failed. Neither California nor federal PSM regulations require root cause investigations or recommendations to be developed as the result of incident investigations. While California does require taking action to prevent reoccurrence, (goes beyond federal OSHA) it does not drive risk to ALARP. Cal/OSHA did not cite Chevron for this issue. Federal PSM does not require the development of recommendations or the prevention of future incidents. Investigation of incidents is required to demonstrate legal compliance with framework legislation. ALARP requirement would require remedial action including cross- company learning from incident investigations. HSE can require safety case duty holder compliance with investigation report recommendations (e.g. Buncefield Report- “determine SIL level requirements for overfill protection”).

Chevron Richmond Refinery Regulatory Report December 2013

71 DRAFT FOR PUBLIC COMMENT Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Mechanical Integrity Chevron was instrumental in the development of API RP 939-C, which suggests ("should") but does not require ("shall") that 100 percent component inspection be performed. API states that the use of "shall" denotes minimum requirements in the use of the standard - API RP 939- C has no minimum requirements (no substantive "shalls" are used in the recommended practice). The mechanical integrity element of PSM requires that for inspection and testing procedures, employers follow RAGAGEP. However, API RP 939-C has no minimum requirements. Nonetheless, Cal/OSHA cited Chevron for failure to follow API RP 939-C under this mechanical integrity provision. In the federal regulatory context, this approach has been called into question by the recent administrative law judge decision in BP Products. This case is scheduled for review by the full commission. In a safety case regime, the regulator can reject the use of weak and inadequate standards referenced in a safety case report (by rejecting the report) and can require more rigorous performance to achieve ALARP.

Chevron Richmond Refinery Regulatory Report December 2013

72 DRAFT FOR PUBLIC COMMENT Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Inherent Safety Chevron employees have recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past employee recommendations. However, the CSB has not identified any documented, thorough analysis of the proposed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. Had Chevron implemented these recommendations, the incident could have been prevented. Neither California nor federal PSM regulations require the use or implementation of inherent safety. Cal/OSHA did not cite Chevron for this issue. In its Interim Report, the CSB made a recommendation to the California legislature and the Governor of California to use inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. Safety case requires the implementation of inherently safer systems analysis.371 Regulator Enforcement Despite numerous safety system deficiencies the Cal/OSHA regulator failed to identify these issues prior to the incident. Cal/OSHA conducted three planned inspections prior to the incident that resulted in no citations or fines. The CSB determined Cal/OSHA lacked sufficient resources and numbers of highly qualified inspectors. California is adding 15 additional inspectors to its PSM unit. The Governor's Interagency Task Force on Refinery Safety will be proposing to implement additional recommendations from their draft report. A key feature of the safety case is a rigorous review of the safety case report that may be accepted or rejected by the regulator. Preventative audits of covered facilities are regularly performed by technically competent, well resourced regulators.

371 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report December 2013

73 DRAFT FOR PUBLIC COMMENT Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Workforce Involvement The workers in previous loss of containment incidents raised concerns about the level of corrosion in the Crude and RLOP incidents, but their concerns were not effectively addressed prior to the August 6, 2012, incident. The workforce participation element requires an employer to develop a written plan to "ensure employee participation in process safety management.” including "consultation with employees and their representatives on the conduct and development of the elements of process safety management...” However, development of a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company's safety management system such as PHAs, MOCs, and investigation activities. Safety case sets out a legal framework for the participation of employees on health and safety-related matters, the election of safety representatives, and the establishment of safety committees to serve health and safety related functions. Workforce participation practices are documented by the duty holder and submitted to the regulator.

Table 1. CSB Causal Findings.

1. 1.2

Analysis 5.1.2.1 ALARP Unlike the OSHAct, the California Occupational Safety and Health Act does not have a General Duty Clause. Rather, Section 5189 was established to “eliminate to a substantial degree, the risks to which employees are exposed in petroleum refineries, chemical plants and other facilities.”372 By focusing on the significant reduction of risk, this language supports the principle of ALARP, which requires a showing by the company that “there are no other practical measures that could reasonably be taken to reduce risks further.”373 However, this section, which lays out the “scope and purpose” of the regulation, is not an enforceable element of the regulation that is subject to citations, and the remaining PSM regulation elements do not lead in practice to that result. Rather, California’s PSM standard has remained activity-based, with many activity-based elements almost identical to the federal PSM standard. For example, an employer must “perform a hazard analysis [PHA] appropriate to the complexity of the

372 8 CCR §5189 (a) (2012). 373 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

74 DRAFT FOR PUBLIC COMMENT process for identifying, evaluating, and controlling hazards involved in the process...”374 The PHA must address hazards of the process; engineering and administrative controls applicable to the hazards and their relationships; consequences of failure of these controls; facility siting; human factors; a qualitative evaluation of a range of the possible safety and health effects of the failure of controls on facility employees; and the identification of any previous incident which had a likely potential for catastrophic consequences in the workplace.”375 This language does not support the principle of ALARP, and makes no mention of risk or continuous improvement in any way. As a result, PHAs satisfy the California PSM regulatory requirement by merely listing safeguards; there is no requirement to evaluate or document the effectiveness of these safeguards, or to show that the safeguards in place are effectively reducing risks. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron cited in its 2009 crude unit PHA non-specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.376 The effectiveness of these safeguards was neither evaluated nor documented. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation- induced failure of carbon steel piping could have been recommended. In addition, while the 4-sidecut line was analyzed in this PHA, corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added). A corrosion review, also referred to as a damage mechanism hazard review, analyzes hazards presented by all process failure mechanisms such as corrosion and cracking. This type of review, while considered to be good practice,377 is not required by the PSM regulations either federally or in California, and as such the CSB made a recommendation in its Interim Report to require these in future California PHAs. Under a safety case regulatory regime, the regulator has the ability to drive industry to adapt new technologies and safer practices as soon as they are developed; new rulemaking is not required for immediate improvements, because companies are obligated to continually work toward specified performance goals such as reducing risks to ALARP. Therefore, under a safety case regulatory regime the regulator could require these types of reviews to be conducted to reduce risk without requiring additional legislation. Cal/OSHA does not typically review a company’s PHA as part of its routine oversight of process safety management unless there is a specific complaint, accident, or targeted inspection. Nor does it “accept” a company’s PHA and proposed hazard mitigations. Therefore, prior to the August 2012 incident, Cal/OSHA inspectors did not require any additional information or analysis to be provided in the Chevron crude unit PHA. Highlighting the reactive nature of the PSM standard, Cal/OSHA inspected the Chevron facility post-incident and issued 17 citations related to the incident and eight additional citations, with a total proposed fine of nearly $1 million. Only one citation related to PHAs, and it was not associated with evaluating the effectiveness of safeguards or failure to control the 4-sidecut corrosion hazard. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units

374 8 CCR §5189 (e)(1) (2012). 375 8 CCR §5189 (e)(2) (A) through (G) (2012). 376 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. 377 API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, describes common process failure mechanism and is considered to be good practice for analyzing risks presented by process failure mechanisms such as corrosion and cracking.

Chevron Richmond Refinery Regulatory Report December 2013

75 DRAFT FOR PUBLIC COMMENT associated with the crude unit. This again highlights the lack of a requirement for Chevron to demonstrate that risks have been reduced to ALARP, or for Chevron to provide this type of analysis to Cal/OSHA to review.

1. 1.2.2

Adaptability and Continuous Improvement

Of the 25 Cal/OSHA citations mentioned above, two were issued to Chevron for its failure to follow API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries as RAGAGEP. This voluntary API standard will be discussed in greater detail in the CSB’s Final Investigation Report on the Chevron incident. However, it is important to note for purposes of this report that API RP 939-C is a permissive, voluntary standard merely intended to provide guidance to industry personnel on how to address sulfidation corrosion in petroleum refining operations. Existing safety guidelines use words “shall” and “should” to denote either requirements or recommendations. API RP 939-C does not use the word “shall”; as such, it contains no requirements for industry. While the regulator in a safety case regulatory regime has the authority to analyze and challenge the requirements of API RP 939-C with the goal of driving continuous improvement and risk reduction (note the Buncefield examples discussed in Section 4.3), in the present case Cal/OSHA utilized the voluntary practice as an opportunity to issue a citation to Chevron post-incident. Cal/OSHA did not analyze API RP 939-C to determine whether its provisions are sufficient to reduce risks and manage hazards. It also remains to be seen whether this citation will be upheld considering the permissive language contained within the standard. Chevron has investigated a number of sulfidation incidents at its refineries over the years, including Richmond, Salt Lake City, and Pascagoula. Figure 2 shows a timeline of Chevron’s key sulfidation events. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron Richmond Refinery crude unit resulting in a CWS Level 3 alert, injuring one worker and initiating a shelter-in-place for the surrounding community. As a result of these investigations, Chevron made internal recommendations to require 100 percent component inspections in high-risk piping systems. However, these recommendations were not implemented in the Richmond Refinery crude unit prior to the incident, highlighting a lack of learning from previous incidents by Chevron.

Chevron Richmond Refinery Regulatory Report December 2013

76 DRAFT FOR PUBLIC COMMENT

Figure 2. Chevron's key sulfidation events between 1974 and 2013.

In addition, as a result of the January 2007 incident, Chevron informed Contra Costa Health Services’ Hazardous Materials Program378 (CCHMP) in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, the CSB learned that this upgrade was limited to only the immediate piping spool379 that failed. Cal/OSHA also did not require Chevron to update the crude unit PHA to address the findings from this incident. Under a safety case regulatory regime, the regulator would work with the company to improve its practices following such an incident. The company would also be required to update its safety case report to address these corrosion hazards and demonstrate how the company has reduced risks to ALARP. The CSB also noted in its Chevron Interim Report that despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction, Chevron’s 2006 Management of Change (MOC) analysis limited the application of those recommendations. Instead of replacing the entire piping segment identified by the original recommendation, the 2006 MOC considered only the replacement of a small section. Although the recommendation was intended to more broadly apply inherently safer materials of construction, the final implementation under the 2006 MOC limited the application of this more corrosion resistant

378 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). CCHSHMP also implements the CalARP and ISO programs, which will be discussed in greater detail later on. 379 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits.

Chevron Richmond Refinery Regulatory Report December 2013

77 DRAFT FOR PUBLIC COMMENT metallurgy.380 As the mere completion of an MOC and the implementation of any action item satisfy the California PSM standard requirements, regardless of its adequacy or effectiveness, Cal/OSHA did not evaluate the MOC or cite Chevron for narrowing the scope of the MOC, despite its disregard of internal recommendations. Neither the California nor the federal PSM standards allow citations for inadequate MOCs. In addition, RAGAGEP does not apply to the MOC PSM element. This can be contrasted with the safety case regulatory regime in the UK, where the HSE includes the adoption of inherently safer designs as an essential consideration for determining whether a duty holder has reduced risks to ALARP.381 The HSE also notes that the guidance to COMAH Regulation 4, (the COMAH General Duty provision) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”382 5.1.2.3 Process Safety Indicators As the CSB has noted in its BP Texas City Investigation Report, Chevron Interim Report, and Section 4.5 of this report, process safety indicators are a significant element of process safety management systems and are critical for reducing process safety incidents. A major goal of process safety indicators is to drive continuous process safety improvement. Regulators can utilize these indicators to focus inspections, audits, and investigations.

Federally and in the state of California, neither the PSM standard nor the RMP rule require companies to utilize or report process safety indicators. Chevron voluntarily utilizes both leading and lagging indicators internally in its US petroleum refineries, in a system called Operational Excellence and Reliability Intelligence (OERI), which tracks 26 different process safety indicators. OERI was implemented in May 2009. However, Chevron is not required to report the status of its indicators to California regulators. Nor is Chevron held accountable to use the indicators to drive performance or continuous improvement. As a result, in its Interim Report, the CSB made a recommendation to the California State Legislature to identify and require the reporting of leading and lagging process safety indicators to state and local regulatory agencies, with the goal of improving mechanical integrity and process hazard analysis performance at all California petroleum refineries, and preventing major chemical incidents. 5.1.2.4 Inspections As noted in Section 4.6, safety case regulators utilize preventative inspections and audits to monitor compliance with legislation and to ensure that the facility and its operations are consistent with information provided in the safety case. However, like federal OSHA, California regulations require Cal/OSHA to prioritize accident, complaint, and referral-based inspections over planned inspections. As such, Cal/OSHA’s inspection program of the nearly 1,700 PSM-regulated facilities in California,

380 As discussed in the Interim Report, only the section of piping downstream of the pumps was replaced with 9- Chrome. 381 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 382 Ibid at 8.

Chevron Richmond Refinery Regulatory Report December 2013

78 DRAFT FOR PUBLIC COMMENT including 15 petroleum refineries, 383 has been reactive in nature rather than proactive to maximize prevention. OSHA State Plan states384 were strongly encouraged but not required to implement the federal Petroleum Refinery NEP. Cal/OSHA did not adopt the NEP “because of its dedicated PSM Unit.”385 Between 2006 and August 6, 2012, the Cal/OSHA PSM District Office conducted only three planned inspections of the Chevron Richmond facility, totaling only 150 inspector hours of effort. Cal/OSHA has acknowledged that these were not PQV inspections, as envisioned in its mission statement and in the federal PSM compliance directive. None of these inspections resulted in citations or fines. According to statistics provided by OSHA, federal NEP refinery inspections conducted between 2007 and the end of 2011 required roughly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehensiveness between the planned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA and other OSHA State Plan States. The federal NEP, which represented a more robust and intensive inspection program, was terminated in 2011 due to the stated great demand on OSHA resources. 5.1.2.5 Workforce Participation Like the federal PSM standard, California’s PSM standard provides for workforce participation in a company’s process safety management program. 8 CCR §5189 (p) requires an employer to develop a written plan to “ensure employee participation in process safety management” including “consultation with employees and their representatives on the conduct and development of the elements of process safety management…”386 However, developing a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company’s process safety management systems. In its investigation of the Chevron incident, the CSB noted that the Chevron Richmond Refinery workforce and its representatives, the United Steelworkers (USW), had expressed concerns regarding sulfidation corrosion and broader workplace safety issues, but were not consistently listened to by Chevron managers, and their concerns regarding corrosion were not adequately acted upon. In November 2011, Cal/OSHA investigated a complaint of unsafe working conditions during the fourth quarter Richmond Lube Oil Plant (RLOP) turnaround at the Richmond Refinery. The RLOP receives feedstock from the crude unit where the August 6th incident occurred and has similar sulfidation corrosion concerns. During the shutdown of the RLOP, a fire occurred at one of the RLOP furnaces. According to Cal/OSHA’s inspection report, Chevron employees told Cal/OSHA that “OPERATORS GET IGNORED.” Many of the employees were concerned about increased corrosion they were finding during the turnaround, and believed that increased temperatures and throughput rates had an adverse effect on

383 Also see the California Labor Code Sections 6309 to 6315 (The California Occupational Safety and Health Act of 1973). 384 Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs. 385 Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety Management District Office. Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012. 386 8 CCR §5189(p)(1) (2012).

Chevron Richmond Refinery Regulatory Report December 2013

79 DRAFT FOR PUBLIC COMMENT equipment integrity. According to the interview notes, many operators had raised issues of corrosion in the RLOP to higher level supervisors to no avail; according to one, if you raise an issue a couple of times, “you get labeled a ‘pest.’” The CSB has not identified evidence indicating that Cal/OSHA took further action to respond to these concerns, and Cal/OSHA did not issue any citations as a result of its investigation.387 Post-incident, significant sulfidation corrosion was found in the RLOP and piping and equipment were replaced. The CSB found other significant evidence that increased workforce participation could have reduced the likelihood that unchecked corrosion would lead to the August 2012 incident. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron technical staff has considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. In 2009, Chevron Energy Technology Company (Chevron ETC)388 created an internal document on the subject of sulfidation corrosion. Chevron ETC metallurgists released a formal report dated September 30, 2009 (nearly 3 years prior to the incident) to Chevron refinery-based reliability managers and chief inspectors entitled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries. Sulfidation experts explained in the Chevron ETC report that, “[u]ntil now, Chevron has not directly addressed the risk of low Si[licon] carbon steel…”389 and that the ETC report introduced a program that “seeks to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic failure from sulfidation corrosion and calls out Chevron’s need for action. The Chevron ETC report specifically recommended that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 100 percent component inspection program was not implemented at the Richmond refinery prior to the August 6, 2012, incident. The Chevron ETC report defined a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4-sidecut pipe placed it in the highest priority for inspection. Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the potential consequence of sulfidation failures. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut piping. The newsletter stated: Sulfidation corrosion failures … are of great concern because of the comparatively high likelihood of ‘blowout’ or catastrophic failure. This typically happens because corrosion occurs at a relatively uniform rate over a broad area, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition, the

387 Post-incident, there were significant mechanical integrity improvements and piping replaced in the RLOP unit. 388 The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that provides technology solutions and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013) 389 A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident.

Chevron Richmond Refinery Regulatory Report December 2013

80 DRAFT FOR PUBLIC COMMENT process fluid is often above its auto ignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents have reinforced the need for revised inspection strategies and a robust PMI (Positive Materials Identification) program. The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, established in 2009, was not implemented at Richmond, and the thin-walled low silicon 4-sidecut piping component remained in service until it catastrophically failed on August 6, 2012. Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. They educated personnel and advocated for identification and control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. These individuals did not participate in the crude unit PHA and did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.390 Despite the history of sulfidation corrosion incidents and the recommendations by Chevron’s workforce to implement better inspection methodologies, Cal/OSHA did not evaluate these recommendations or determine whether Chevron management ensured that the hazards of this damage mechanism were addressed and mitigated in Chevron’s PHAs. In addition, Cal/OSHA issued no citations to Chevron post- incident regarding the failure to address sulfidation corrosion in its crude unit PHA. Finally, when Chevron employees raised concerns, Cal/OSHA did not effectively address them. The examples highlighted in this section speak to the need for California to develop more effective regulation similar to the UK legislation discussed in Section 4.4, to ensure strong workforce involvement in health and safety matters at petroleum refineries. This will not only help prevent incidents such as the one that occurred at Chevron, but it will also help improve communication and ensure that workers are represented in the decisions that affect them. 5.1.2.6 Funding and Regulator Competency Cal/OSHA has not received sufficient funding to employ a well-staffed, multi-disciplinary team capable of conducting thorough inspections of PSM-covered facilities in California. This is apparent when examining the lack of preventative, planned inspections of petroleum refineries being conducted by the PSM team in the state. In order for a safety regulatory regime to successfully regulate with the goal of major accident prevention, there must be a technically competent, well-resourced regulator in place to sufficiently review, scrutinize, and challenge the hazard identification and evaluation that has been conducted and controls that have been put in place to reduce risk, to help drive continuous improvement and ensure that risks are being controlled. It is not an acceptable outcome for society that petroleum refineries with the potential for catastrophic accidents be inspected only after an accident occurs or a complaint is filed.

390 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown.

Chevron Richmond Refinery Regulatory Report December 2013

81 DRAFT FOR PUBLIC COMMENT Compensation is one important factor for recruiting and retaining technically competent personnel. The CSB found that California regulators are significantly less compensated when compared to their industry counterparts. Based on information Chevron provided to the CSB, the average annual salary of refinery personnel who would interact with a California regulator performing an audit or safety inspection is $187,630. Table 2 below provides the 2012 salaries of California regulatory personnel that the CSB determined would likely perform a safety inspection or a hypothetical safety case assessment. These figures indicate a substantial compensation gap between the regulator and the regulated. A Cal/OSHA PSM team of associate safety engineers receive an average annual salary that is 46 percent lower than the refinery employees they would likely interface with during an inspection. EPA RMP inspectors receive an annual salary that is 33 percent lower than their facility counterparts and Contra Costa County accidental release prevention engineers and their supervisor are paid 48 percent less than these industry personnel.391

Entity Average Annual Salary Refinery Personnel $187,630 Cal/OSHA $100,536 Contra Costa County $96,875 EPA $125,000 Table 2. Average 2012 salary for individuals selected by the CSB as representative of the professional staff within each California regulator and of the refinery professional staff who interface with the regulators regarding audits or safety inspections at the Chevron Richmond Refinery. As noted in the introduction of this report, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a fee by March 31, 2014, to support an increase in funding and to pay for at least 15 new positions in Cal/OSHA’s PSM Unit.392 The CSB considers this to be a positive step towards improving process safety management in the state of California, as it will provide the team the opportunity to conduct more thorough inspections. However, it is imperative that these additional inspectors have the skills, knowledge, and experience to provide sufficient direct oversight over PSM- covered facilities. Despite the additional funding, there remains a longstanding salary cap on associate safety engineers within Cal/OSHA. This will continue to make it difficult for Cal/OSHA to consistently attract or retain the necessary talent and expertise to effectively oversee these facilities.

391 Compensation information is based on salary only. It does not take into account non-salary information such as bonuses, retirement programs, or benefit programs. 392 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

82 DRAFT FOR PUBLIC COMMENT 5.2 U.S. Environmental Protection Agency According to the EPA OIG, as of May 2012, only eight states and five local agencies had accepted full or partial RMP program delegation from EPA.393 As such, EPA regions directly implement the RMP program in most states. As no state agency has requested or received delegation to implement the RMP program within EPA Region 9, the federal EPA regional office is responsible for RMP program implementation for California as well as Arizona, Nevada, Hawaii, the Pacific Islands, and 148 Tribal Nations. 5.2.1 Risk Management Plan (RMP) Program As of March 2013, there were 1,137 RMP-covered facilities in Region 9: 957 in California; 118 in Arizona; 42 in Nevada; 16 in Hawaii; and four in Guam.394 The Chevron Richmond Refinery has many processes covered by the RMP rule, including Program 3 processes, 395 such as the crude unit. As such, Chevron is required to submit an RMP every five years to EPA Region 9, and EPA is expected to audit the facility against this RMP to ensure compliance. According to Chevron’s most recent RMP submitted to EPA Region 9 in October 2011, its crude unit contained 400,000 pounds of a flammable mixture of propane, pentane, butane, ethane, and methane, well above the 10,000-pound threshold quantity for flammables.396 EPA Region 9 employs four full-time and two part-time RMP inspectors to implement the RMP program for the roughly 1,100 RMP-covered facilities in the entire region. Region 9 staff informed the EPA OIG that to most effectively utilize their resources, they “place an additional focus on facilities in States, such as Arizona, that do not have their own risk management or accident prevention programs.397 The EPA’s mandates to conduct a certain number of inspections at high-risk facilities plus a lack of resources and staffing prevent the inspectors from fully auditing many of the petroleum refineries in each state; thus, the inspectors aim to visit each refinery every three years, where they pick one process to evaluate for two to three days. These inspectors target their inspections towards a specific industry issue during these visits. For example, when they last inspected Chevron in 2010, the inspectors focused on the issue of high temperature hydrogen attack (HTHA) due to the Tesoro incident398 that occurred in April 2010.

393 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 2. 394 US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March

1. See http://www.condorearth.com/files/08-Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14,

2013). 395 Processes not eligible for Program 1 and either subject to OSHA’s PSM standard or classified in one of ten specified North American Industrial Classification System (NAICS) codes are placed in Program 3, which imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and emergency response requirements. 396 EPA List of Regulated Chemicals and Threshold Quantities for RMP program available at http://www.epa.gov/R5Super/cepps/pdfs/rmp-listed-chemicals-200708.pdf (accessed May 17, 2013). 397 California has its own RMP program, called CalARP. See EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 23. 398 On April 2, 2010, a heat exchanger ruptured due to high temperature hydrogen attack, resulting in seven worker fatalities at the Tesoro Anacortes Refinery in Anacortes, Washington. The CSB is currently investigating this incident.

Chevron Richmond Refinery Regulatory Report December 2013

83 DRAFT FOR PUBLIC COMMENT 5.2.2 Implementation of the RMP Program In order for a safety regime to function well, there must be a competent, well-resourced regulator in place to implement the regime. However, the EPA Region 9 RMP group is extremely understaffed and under- resourced, as there are only six full-time inspectors to cover over 1,100 facilities across many states. Instead of fully inspecting or auditing petroleum refineries, the group is able to inspect one process at each refinery for two to three days every three years, which makes fully inspecting these facilities or auditing against the RMPs submitted by these facilities impossible. In addition, this group has other responsibilities beyond the RMP program, including the management of contracts, emergency prevention and preparedness training and outreach, and reporting violations under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). The CSB has learned that because this group has such limited resources, it hopes to delegate RMP inspection authority to other agencies throughout the region, as long as it maintains power to enforce violations. Like the federal and California PSM standards, the RMP regulations provide for workforce participation399 and require facilities to prepare a written plan of action regarding employee participation. It is the RMP program’s policy to invite employee representatives to participate in all parts of onsite inspections. EPA Region 9 RMP staff told the CSB, however, that the limited amount of time they were able to spend onsite at refineries made speaking with facility inspectors and operators a difficult task. They expressed that a lesson learned from the Chevron incident was that EPA RMP inspectors should commit more time onsite during facility inspections and audits, which will allow them more time to speak with workers to gain a better insight into how any issues within the facility are being addressed and resolved.400 As mentioned above, EPA guidance on the RMP program states that the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” may require steps to be taken “beyond those specified in the risk management program rule.”401 While this principle appears to be similar to ALARP requirements of the safety case, in practice this is not required, and whether this is done is not subject to regulation or review. Similar to the PSM standard, RMP regulations require each facility with Program 3 processes to conduct a PHA as part of its prevention program that is “appropriate to the complexity of the process…and[] identify, evaluate, and control the hazards involved in the process.”402 However, these regulations do not require facilities to include these analyses in the RMPs they submit to EPA. Rather, facilities with Program 2 or 3 processes are only required to include in the RMP very high-level, simplified information on their prevention programs and their PHAs. The Chevron Richmond Refinery’s most recent RMP submission from October 2011 included the following information on the PHAs for each relevant process: the date of the last PHA for that process; what technique was used; what major hazards were identified; what process controls were in use (i.e. automatic shutoffs, interlocks, alarms, emergency power); what mitigation systems were in use (i.e. dikes, fire walls, water curtain); what monitoring/detection systems were in use (i.e. process area detectors); date of the most recent review or

399 See 40 CFR §68.83 (2000). 400 This need for greater interface with worker is a professional opinion by EPA staff, but has not resulted in EPA policy modifications to ensure effective worker input in future inspections. 401 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 402 40 CFR §68.67(a) (1998).

Chevron Richmond Refinery Regulatory Report December 2013

84 DRAFT FOR PUBLIC COMMENT revision of training programs; and maintenance. Chevron included one paragraph entitled “E.5. General Accidental Release Prevention Program,” which stated that PSM is applied to the entire refinery, and the PSM program is documented in Refinery Instruction (RI)-360, “Richmond Refinery PSM Policy.” No additional information or analysis could be located concerning the identification or control of hazards, or risk reduction, as, unlike the safety case model, there is no requirement for the company to demonstrate to the regulator that it is effectively ensuring that the safety systems are functioning as intended. Under the EPA RMP program, there is no regulatory requirement to reduce risks to ALARP. In addition, there is no requirement to submit to the regulator detailed information relating to risk reduction or hazard assessments. Finally, the Region 9 EPA RMP inspection team does not have the resources to fully audit petroleum refineries and other high hazard facilities subject to the RMP program. As a result, the EPA RMP program is not comprehensive or rigorous enough to control major accident hazards and reduce risks. Instead, facilities submit high-level summary information providing evidence that the activity- based requirements contained within the RMP regulations have been completed by the facility. 5.3 Unified Program Chevron’s Richmond refinery was also subject to process safety regulatory requirements at the county and city level. The facility had to adhere to additional requirements above RMP and PSM, but these requirements were not sufficient to prevent the Chevron incident. The following sections will discuss those county and city requirements. In 1993, Chapter 418, Statutes of 1993 (Senate Bill 1082) established Chapter 6.11 of the California Health and Safety Code (HSC), which required the Secretary of the California Environmental Protection Agency (Cal/EPA) to adopt regulations creating a “unified hazardous waste and hazardous materials management” regulatory program, or Unified Program, by January 1, 1996, to consolidate and make consistent six existing hazardous materials and hazardous waste programs within the state.403 The Secretary of Cal/EPA was charged with ensuring that the Unified Program was established and implemented by a Certified Unified Program Agency, or CUPA, in all counties in California. Cal/EPA adopted the Unified Program regulations under Title 27, Division 1 of the California Code of Regulations, which integrated six existing programs: the Hazardous Waste Generator and Onsite Hazardous Waste Treatment programs; the Aboveground Storage Tank program; the Underground Storage Tank program; the Hazardous Materials Release Response Plans and Inventory program; the California Accidental Release Prevention (CalARP) program; and the California Uniform Fire Code.404 The CalARP program, which was created through Assembly Bill AB1889 with the goal of major accident prevention, will be discussed at greater length below. There are currently 83 CUPAs in the state of California that implement the Unified Program at a local level.405 5.3.1.1 Contra Costa County Hazardous Materials Programs The Chevron Richmond Refinery is located in the City of Richmond, within Contra Costa County. The local CUPA responsible for implementing the Unified Program in all areas of the country is the Contra

403 California Health and Safety Code §25404(b) (1993). Also see http://www.calepa.ca.gov/cupa/Reports/2002/ReimbAcct.pdf (accessed May 16, 2013). 404 27 CCR §15100 (a)(1) through (6) (1994). 405 See http://www.calepa.ca.gov/cupa/Documents/2012/FactSheet.pdf (accessed May 16, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

85 DRAFT FOR PUBLIC COMMENT Costa Health Services’ Hazardous Materials Programs (CCHMP).406 CCHMP is responsible for implementing the Unified Program in all areas of Contra Costa County. CCHMP implements two programs that are relevant to this investigation: the CalARP program and the City of Richmond Industrial Safety Ordinance (RISO). CCHMP also implements the county’s own Industrial Safety Ordinance (ISO), which covers seven facilities. CCHMP has five full-time engineers, known as accidental release prevention engineers, who are responsible for implementing these programs for the county. While all have technical degrees in engineering, only two of these engineers have past refinery experience. 5.3.1.1.1 CalARP The California Health and Safety Code Article 2 (Chapter 6.95, Sections 25531 – 25543.3) was amended effective January 1, 1997, to implement EPA’s RMP program at the state level through the creation of the CalARP program regulations. Modeled after EPA’s RMP program and California’s Risk Management and Prevention Plan, which was enacted in 1986, the CalARP regulations (Title 19, Chapter 4.5 of the CCR) were implemented with the goal of preventing accidental releases of substances that can cause serious harm to the public and the environment, minimizing damage caused by a release, and to satisfy community right-to-know laws.407 California is one of at least three states that implement a state RMP program without delegation of the federal program from EPA.408 The CalARP regulations, including PHA requirements, are essentially duplicative in nature to EPA’s RMP program, with a few exceptions: the list of toxic chemicals covered is 276 instead of 77; the threshold quantities of some chemicals are smaller; CalARP requires a seismic analysis; and there is more interaction with the public and other agencies.409 The CalARP regulations require that businesses that produce, handle, process, distribute, or store certain chemicals over a certain threshold quantity develop a Risk Management Plan (RMP) and submit the RMP to a local CUPA for review. Like the EPA RMP program, facilities with a Program 3 process must develop a management system that includes a PHA and emergency response program.410 State oversight authority and responsibility for the CalARP program is with the California Emergency Management Agency (Cal EMA).411 The CalARP regulations apply to roughly 45 facilities in Contra Costa County, including the Chevron refinery in Richmond. Each covered facility is required to submit an updated RMP to CCHMP at least once every five years.412 The group of CCHMP engineers reviews these plans and is required to

406 Contra Costa County’s Hazardous Materials program is responsible for responding to emergencies and monitoring hazardous materials in Contra Costa County. It is the duty of CCC to safeguard the Contra Costa County ecosystem from the release of hazardous materials and other pollutants. For more information see http://cchealth.org/hazmat/ (accessed May 21, 2013). 407 Information available at http://www.calema.ca.gov/HazardousMaterials/Pages/Accidental-Release-Prevention- (CalARP).aspx (accessed May 16, 2013). 408EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 20. 409 Information on differences between EPA’s RMP program and CalARP available at http://cchealth.org/hazmat/differences-rmp-calarp-iso.php (accessed May 16, 2013). 410 22 CCR §2735.5(f) (2004). 411Cal EMA is responsible for the coordination of overall state agency response to major disasters in support of local government. For more information see http://www.calema.ca.gov/Pages/default.aspx (accessed May 21, 2013). 412 22 CCR §2745.10(a)(1) (2004).

Chevron Richmond Refinery Regulatory Report December 2013

86 DRAFT FOR PUBLIC COMMENT “periodically audit RMPs”413 against the regulations to ensure compliance. This group has told the CSB that it audits each facility at least once every three years. It last audited Chevron in February 2011, and has been conducting another audit in October and November 2013. Although CCHMP is authorized to issue enforcement actions for violations uncovered during facility audits, in practice CCHMP engineers issue “ensure” action items that list the deficiencies and recommend improvements. They then work with the facility to make sure that these action items are implemented. CCHMP has rarely issued fines or citations to facilities for violations. If the engineers identify other gaps or areas for improvement that are not actual regulatory violations, they can issue “consider” action items, which are essentially suggestions to the facility for improvements that are not technically required to be implemented by the regulation. Whether these types of action items are issued is dependent upon the knowledge and experience of the engineer conducting the audit. Once CCHMP engineers have completed the audit, CCHMP issues a final audit report on the facility, which they also supply to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.1.2 Industrial Safety Ordinance The Contra Costa County Industrial Safety Ordinance (ISO) became effective January 15, 1999. Adopted as County Ordinance Chapter 450-8, the ISO expands on the CalARP program in Contra Costa County for facilities meeting the following criteria: 1) the facility is within an unincorporated area of the County; 2) the facility is either a petroleum refinery or chemical plant; 3) the facility is required to submit a Risk Management Plan (RMP) to the EPA and the Contra Costa County Health Service; and 4) the facility has at least one Program 3 process.414 Seven of the 45 CalARP facilities in the county are currently required to comply with the ISO requirements. The ISO was adopted to improve industrial safety by, among other things, requiring more comprehensive coverage of the whole facility rather than only certain processes; providing review, inspection, auditing and safety requirements more stringent than are currently in effect; requiring the development and implementation of a human factors program; and preventing and reducing the number, frequency and severity of accidental releases in Contra Costa County.415 Facilities subject to the ISO are essentially required to treat every process as subject to the CalARP Program 3 prevention program requirements. Covered facilities have additional requirements as well, including developing and implementing a human factors program, considering inherently safer technologies and systems for new and existing facilities or processes, submitting a safety plan to CCHMP, and conducting a Management of Organizational Change (MOOC) prior to changes in permanent staffing levels or reorganization in operations, maintenance, health and safety, or emergency response.416

413 22 CCR §2775.2(a) (2004). 414 See http://cchealth.org/groups/hazmat/industrial_safety_ordinance.php (accessed May 21, 2013). 415 Chapter 450-8.004(a)(1) through (10) ( 416 Information available at http://cchealth.org/groups/hazmat/industrial_safety_ordinance_risk_management.php (accessed May 22, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

87 DRAFT FOR PUBLIC COMMENT 5.3.1.1.3 City of Richmond Industrial Safety Ordinance On December 18, 2001, the City of Richmond adopted an Industrial Safety Ordinance (RISO) under Municipal Code Chapter 6.43 that was almost identical to the ISO. In February 2013, the City of Richmond Council amended the RISO to make it equivalent to the ISO. Chevron is one of two facilities subject to RISO requirements. Pursuant to an agreement with the City of Richmond, CCHMP implements and enforces the RISO within the city. Like the ISO, the RISO requires that a covered facility submit a safety plan to CCHMP that includes safety elements such as process safety information (PSI), operating procedures, mechanical integrity, employee participation, and management of change (MOC).417 CCHMP has posted a Safety Plan Guidance Document on its website to assist facilities in developing these plans. Each facility is also required to comply with safety requirements including performing PHAs, and must include a description of the manner of compliance with these in the safety plan.418 In performing a PHA, facilities are required to address the hazards of the process, identify any previous incident, identify controls applicable to the hazards, and identify consequences of failure of those controls, human factors, and a qualitative evaluation of a range of possible safety and health effects of failure of controls.419 The CCHMP engineers are required to review each facility’s safety plan as well as audit each facility to determine compliance with ISO or RISO. CCHMP engineers conduct the CalARP and ISO/RISO audits concurrently at each covered facility. CCHMP generally audits each facility once every three years. To aid in the auditing process, CCHMP engineers have entered all the CalARP program requirements into a database. They have taken each of these requirements and turned them into questions. When the engineers go onsite, they perform three main functions: 1) they identify and review any policy statement that directs how people should handle a particular piece of equipment; 2) they identify and review records of procedures, such as MOCs and permits; and 3) they randomly select and interview individuals about their familiarity with various aspects of different programs. If the engineers find a regulatory deficiency, they issue an ensure action item to the facility. Once the engineers have completed their facility audit, they issue a preliminary determination to the facility. The facility has 90 days to review the draft and provide a proposed remedy with specifics on how they it fix each deficiency, and the timeline. Once the report is finalized it goes out for public comment. Following public comment, it is issued to the facility and provided to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.2 Analysis Chevron submitted its most updated safety plan to CCHMP on February 25, 2013. Section 3.12 of the plan discusses PHAs and Action Items. Under this section, Chevron lists eight objectives of its PHAs, including identifying possible failures or releases, evaluating potential consequences, and proposing recommendations that would reduce the risks. Chevron also discusses its possible justifications for declining recommendations from PHAs, including the fact that an alternative measure would be sufficient, and that the recommendation may be infeasible. There was no additional information or

417 Richmond Municipal Code Section 6.43.090 (a) (2013). 418 Ibid at Sections (a) through (e) (2013). 419 Ibid at (d) (2013).

Chevron Richmond Refinery Regulatory Report December 2013

88 DRAFT FOR PUBLIC COMMENT analysis contained in this section concerning the identification or control of hazards, or risk reduction, as there is no requirement to do so. The RISO and CalARP regulations require that PHAs list controls and possible consequences of failure of those controls, but there is no specific requirement to include evaluations of the safeguards and controls in the PHA. As CCHMP engineers are only required to audit against the regulatory requirements, they would only examine the evaluation of safeguards if such an evaluation were performed and documented in the facility’s PHAs. As noted previously, Chevron’s most recent crude unit PHA ineffectively listed qualitative safeguards for corrosion and mechanical integrity. While CCHMP engineers are able to issue “consider” action items to the facility recommending actions above and beyond regulatory requirements, CCHMP engineers did not do this regarding Chevron’s Crude Unit PHA or its evaluation of safeguards. After reviewing CCHMP’s most recent audit of Chevron, the CSB could find nothing referring to sulfidation corrosion, reduction of risk, or safeguard evaluation. While CCHMP is able to utilize these “consider” action items to encourage facilities to go above and beyond regulatory requirements to reduce risk, CCHMP engineers have stated to the CSB that they do not make sufficient use of this mechanism. Rather, they tend to audit against the existing regulatory requirements to ensure compliance. Unlike the safety case regulatory approach, which requires a reduction of risk to ALARP or equivalent, facilities covered by RISO or ISO are only required to “consider [emphasis added] the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis [PHA] and in the design and review of new processes and facilities.”420 Despite multiple internal recommendations to replace its piping due to the risk of sulfidation corrosion, Chevron failed to replace the piping prior to the incident with an inherently safer material. Again, the CSB has not found evidence that CCHMP effectively encouraged Chevron to go above and beyond regulatory requirements by utilizing inherently safer systems to reduce risk. As emphasized repeatedly in this report, a regulatory regime is only as strong as its regulators, and must employ individuals with the requisite skills, knowledge, and experience to provide sufficient oversight over facilities. In the case of CCHMP, there are only five engineers for nearly 45 facilities in the county, and only two have previous refinery experience.421 In addition, while the CCHMP is funded mostly through CUPA fees, ISO fees, and other means of cost recovery, the engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which has experienced annual budget reductions in the millions.422 This has unnecessarily resulted in a decrease in the CCHMP engineers’ salaries and has made it extremely difficult for CCHMP to fill a current position that has been open over three years because of its inability to offer competitive salaries to attract its engineers. Overall, CCHMP suffers from a lack of resources and funding, limiting its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County.

420 City of Richmond Municipal Code §6.43.050(g) (February 5, 2013). 421 Two of the other engineers have chemical plant experience and have led or participated in refinery compliance audits in the past ten years.

Chevron Richmond Refinery Regulatory Report December 2013

89 DRAFT FOR PUBLIC COMMENT 6.0 Conclusion

This report has focused on seven aspects of the safety case regulatory approach that the CSB believes differentiate it from existing US and California process safety regulations: safety responsibility on the part of the facility; reduction of risk to ALARP; adaptability; workforce involvement; the effective use of process safety indicators; regulatory oversight; and an independent, competent, well-funded regulator. These attributes together enable industry and the regulator to ensure that facilities are developing and implementing comprehensive, robust safety management systems to prevent major accidents. Implementation of the safety case regulatory regime in California for petroleum refineries will require a commitment of extensive resources to fund a regulator that has the requisite skills, knowledge, and experience to ensure petroleum refineries in the state continually assess their practices and reduce risks to ALARP. However, the CSB believes that effective implementation of this regulatory approach will achieve greater major accident prevention in California and, in the process, provide greater protection for its workers and the public. The safety case provides the adaptability necessary to keep current with improving standards and advancing technology, without requiring lengthy and often unproductive rulemaking on the part of the regulator. With the safety case regulatory regime in place, a competent regulator will independently ensure that California refineries have taken all practical measures that can be reasonably taken to reduce risks. For example, the regulator would have the ability to work with these facilities to implement recommendations and lessons learned from significant petroleum refinery incidents throughout the world without requiring extensive rulemaking or legislation, as regulators have done post-incident in the UK, Norway, and Australia. If questions remain regarding the safety case regulatory regime after reading this report, see Appendix C for additional information and discussion. The safety case regulatory regime will require a full commitment and extensive effort by the California legislature, regulators, and California petroleum refineries. However, the CSB believes that this effort is necessary to ensure that California, like other regions around the world, is effectively managing process safety and risk, and in the process, preventing major accidents such as the August 6, 2012, Chevron pipe rupture and hydrocarbon release.

Chevron Richmond Refinery Regulatory Report December 2013

90 DRAFT FOR PUBLIC COMMENT 7.0 Recommendations Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer operations at California petroleum refineries and protecting workers and communities from future accidents, the CSB makes the following safety recommendations: California State Legislature, Governor of California 2012-03-I-CA-R21 Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory framework for petroleum refineries in the state of California based on the principles of the “safety case” framework in use in regulatory regimes such as those in the United Kingdom, Australia, and Norway, and as described in this report, with the following minimum components: a. A case for safety written by the duty holder that includes a systematic analysis and documentation of all major hazards and effective control methods implemented to reduce those risks as low as reasonably practicable (ALARP); b. A thorough review of the safety case report by technically competent regulatory personnel that requires modifications and improvements to the document as necessary prior to acceptance; c. Audits and preventative inspections by the regulator to verify effective implementation of safety case elements; d. A risk management approach that requires analysis and effective implementation of safeguards, using the hierarchy of controls, to protect people and the environment from major accident hazards. The effectiveness of the safeguards will be demonstrated through the use of leading and lagging process safety indicators; e. Ability to adapt and implement safety requirements in response to newly identified hazards, advances in technology, lessons learned from major accidents, and improved safety codes without the need for new rule-making; f. Determines when new or improved industry standards and practices are needed and initiates programs and other activities such as forums to prompt the timely development and implementation of such standards and practices; g. Uses a tripartite model where the regulator, the company, and workers and their representatives play an equal and essential role in the direction of preventing major accidents; h. A regulatory model and accompanying guidance based on the UK’s The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996, which set out the legal framework for the rights and responsibilities of workers and their representatives on health and safety-related matters, and the election of safety representatives and establishment of safety committees to serve health and safety-related functions. The elected representatives should have a legally recognized role that goes beyond consultation in activities such as the development of the safety case report, process hazard analysis, management of change, incident investigation, audits, and identification

Chevron Richmond Refinery Regulatory Report December 2013

91 DRAFT FOR PUBLIC COMMENT and effective control of hazards. The representatives should also have the authority to stop work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to address the safety concern. Workforce participation practices should be documented by the duty holder and submitted to the regulator; i. Requires reporting of information to the public such as a summary of the safety case report, a list of safeguards implemented and standards utilized to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards and management systems; j. An independent, well-funded, well-staffed, technically competent regulator; and k. A compensation system to ensure the safety case regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with California petroleum refineries.

2012-03-I-CA-R22 Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the state of California to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from operators and contractors to promote continuous safety improvements. At a minimum, this program shall: a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness of process safety management systems and safeguards for major accident prevention. Include leading and lagging indicators that are measureable, actionable, and standardized. Require that the reported data be used for continuous process safety improvement and accident prevention; b. Analyze data to identify trends and poor performers and publish annual reports with the data at facility and corporate levels; c. Require companies to publicly report required indicators annually at facility and corporate levels; d. Use process safety indicators (1) to drive continuous improvement for major accident prevention by using the data to identify industry and facility safety trends and deficiencies and (2) to determine appropriate allocation of regulator resources and inspections; and e. Be periodically updated to incorporate new learning from world-wide industry improvements in order to drive continuous major accident safety improvements in California.

Occupational Safety and Health Administration 2012-03-I-CA-R23 This report highlights significant advantages of the safety case regime over the existing Process Safety Management standard to prevent potentially catastrophic chemical accidents that are relevant to OSHA’s response to Executive Order 13650. In the development of the OSHA EO response, incorporate a written

Chevron Richmond Refinery Regulatory Report December 2013

92 DRAFT FOR PUBLIC COMMENT plan that includes the evaluation of issues raised from the findings, conclusions and recommendations in this report concerning the safety case regime.

Chevron Richmond Refinery Regulatory Report December 2013

93 DRAFT FOR PUBLIC COMMENT References

Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationRe port_2004.pdf (accessed May 8, 2013).

Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007.

Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013).

Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; October 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; March 2007.

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., December 2008.

Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990.

Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013).

EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009.

EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19,

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012.

Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online].

Chevron Richmond Refinery Regulatory Report December 2013

94 DRAFT FOR PUBLIC COMMENT http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%2 0presentation/Lonford%20talk.PDF (accessed May 8, 2013).

Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999;.

Hopkins, Andrew. The Meaning of “Safety Cas”e; February 2013.

HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations;

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013).

HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013).

HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013).

HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996.

The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

95 DRAFT FOR PUBLIC COMMENT Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013. Citing Zimgast, Erst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-EXTRACT. Risk Engineering Services, Swiss Re. http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

96 DRAFT FOR PUBLIC COMMENT Appendix A: Significant Petroleum Refinery Incidents in 2012 1. Tank failure at the ExxonMobil refinery in Beaumont, Texas on 11 January 2. Vessel pressure excursion at the Flint Hills refinery in St. Paul, Minnesota on 22 January 3. Hydrogen Sulfide release from mechanical integrity failure at the Northern Tier Energy refinery in St. Paul, Minnesota on 26 January 4. Sulfuric acid release from a mechanical integrity failure at the ConocoPhillips refinery in Wood River, Illinois on 27 January 5. Hydrogen Sulfide release from mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 31 January 6. Hydrocarbon and hydrogen fluoride release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 31 January 7. Sulfur dioxide and hydrogen sulfide release following a vessel pressure excursion at the Alon refinery in Big Spring, Texas on 1 February 8. Hydrocarbon release from a vessel pressure excursion at the ConocoPhillips refinery in Belle Chasse, Louisiana on 1 February 9. Benzene release from a mechanical integrity failure at the Husky refinery in Lima, Ohio on 16 February 10. Fire at the Tesoro refinery in Salt Lake City, Utah on 17 February 11. Fire at the BP refinery in Cherry Point, Washington on 17 February 12. Tank failure at the Shell refinery in Deer Park, Texas on 22 February 13. Tank failure at the Paulsboro refinery in Paulsboro, New Jersey on 23 February 14. Fire at the Citgo refinery in Corpus Christi, Texas on 24 February 15. Hydrogen Sulfide release from a mechanical integrity failure at the Flint Hills refinery in Rosemount, Minnesota on 28 February 16. Vessel pressure excursion at the Motiva refinery in St. Charles, Louisiana on 28 February 17. Benzene release from a mechanical integrity failure at the Chalmette refinery in Chalmette, Louisiana on 28 February 18. Crude oil release from a mechanical integrity failure at the Flint Hills refinery in North Pole, Alaska on 4 March 19. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 6 March 20. 1 worker was fatally injured and 2 other workers were burned at the Valero refinery in Memphis, Tennessee on 6 March 21. Fire during a hot work activity at the Tesoro refinery in Martinez, California on 7 March 22. Benzene release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 8 March 23. Heavy oil release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 13 March 24. Benzene release from a mechanical integrity failure at the Marathon refinery in Texas City, Texas on 14 March 25. Fire at the PBF Energy refinery in Delaware City, Delaware on 16 March 26. Hydrocarbon release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 19 March

Chevron Richmond Refinery Regulatory Report December 2013

97 DRAFT FOR PUBLIC COMMENT 27. Hydrocarbon release from a mechanical integrity failure at the Tesoro refinery in Anacortes, Washington on 23 March 28. Hydrocarbon release from a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 24 March 29. Fire at the ExxonMobil refinery in Billings, Montana on 25 March 30. Hydrogen fluoride release from a mechanical integrity failure at the BP refinery in Texas City, Texas on 27 March 31. Hydrocarbon release from a mechanical integrity failure at the Total refinery in Port Arthur, Texas on 11 April 32. Fire at the ConocoPhillips refinery in Rodeo, California on 13 April 33. Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 16 April 34. Crane fell over and damaged utility piping at the Citgo refinery in Lemont, Illinois on 17 April 35. Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 19 April 36. Fire at BP refinery in Texas City, Texas on 20 April 37. Hydrocarbon release from a mechanical integrity failure at the ConocoPhillips refinery in Sweeny, Texas on 24 April 38. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 8 May 39. 4 workers injured in fire at the Sinclair refinery in Sinclair, Wyoming on 8 May 40. Hydrocarbon release from a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 8 May 41. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 9 May 42. Fire at the Motiva refinery in Port Arthur, Texas on 12 May 43. Hydrogen sulfide release from a mechanical integrity failure at the CVR Energy refinery in Wynnewood, Oklahoma on 11 May 44. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 15 May 45. Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 17 May 46. Benzene and hydrogen sulfide release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 21 May 47. Fire at the Montana Refining Company refinery in Great Falls, Montana on 24 May 48. Hydrocarbon release from a mechanical integrity failure at the Valero refinery in Memphis, Tennessee on 25 May 49. 2 workers injured from a fire at the Sinclair refinery in Sinclair, Wyoming on 28 May 50. Propylene release from overpressure event at the PBF Energy refinery in Delaware City, Delaware on 29 May 51. Hydrocarbon release from a mechanical integrity failure at the Valery refinery in Houston, Texas on 31 May 52. Hydrogen and hydrocarbon release due to loss of containment event at the Shell refinery in Deer Park, Texas on 7 June

Chevron Richmond Refinery Regulatory Report December 2013

98 DRAFT FOR PUBLIC COMMENT 53. Hydrogen sulfide and hydrocarbon release due to flare failure at the Motiva refinery in Norco, Louisiana on 7 June 54. Fire at the Motiva refinery in Port Arthur, Texas on 9 June 55. Hydrocarbon release due to a mechanical integrity failure at the BP refinery in Texas City, Texas on 9 June 56. Fire at the ExxonMobil refinery in Torrance, California on 11 June 57. Fire at the Total refinery in Port Arthur, Texas on 13 June 58. Hydrogen sulfide release from a tank failure at the ConocoPhillips refinery in Rodeo, California on 15 June 59. Hydrocarbon release at the Shell refinery in Deer Park, Texas on 20 June 60. Fire at the BP refinery in Whiting, Indiana on 21 June 61. Hydrocarbon release due to a mechanical integrity failure at the Valero refinery in Corpus Christi, Texas on 23 June 62. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 25 June 63. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 28 June 64. Propane release due to a mechanical integrity failure at the Valero refinery in McKee, Texas on 28 June 65. Sulfuric acid release due to a mechanical integrity failure at the Chevron refinery in El Segundo, California on 2 July 66. Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Westlake, Louisiana on 14 July 67. Fire at the Citgo refinery in Corpus Christi, Texas on 16 July 68. Fire at the Valero refinery in Meraux, Louisiana on 22 July 69. Sulfuric acid release due to a mechanical integrity failure at the Sunoco Point Breeze refinery in Philadelphia, Pennsylvania on 22 July 70. Fire at the BP refinery in Whiting, Indiana on 23 July 71. Hydrocarbon and hydrogen fluoride release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 24 July 72. Fire at the HollyFrontier refinery in Tulsa, Oklahoma on 2 August 73. 8,614 lbs of hydrogen sulfide were released to the atmosphere due to a mechanical integrity failure on a compressor suction line at the Chevron refinery in Richmond, California on 2 August. 74. Hydrogen sulfide release from an overpressure event at the Valero refinery in Texas City, Texas on 5 August 75. Fire at the Sinclair refinery in Sinclair, Wyoming on 5 August 76. Fire at the Chevron refinery in Richmond, California on 6 August 77. Fire at the Shell refinery in Martinez, California on 13 August 78. Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Martinez, California on 14 August 79. 2 workers injured from a fire at the BP refinery in Whiting, Indiana on 14 August 80. Hydrogen sulfide release due to a mechanical integrity failure at the Phillips 66 refinery in Wood River, Illinois on 22 August

Chevron Richmond Refinery Regulatory Report December 2013

99 DRAFT FOR PUBLIC COMMENT 81. Fire at the Sinclair refinery in Sinclair, Wyoming on 24 August 82. Hydrocarbon release due to a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 25 August 83. Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 26 August 84. Hydrogen sulfide and propylene release due to a mechanical integrity failure at the ExxonMobil refinery in Beaumont, Texas on 29 August 85. Fire at the Phillips 66 refinery in Rodeo, California on 29 August 86. A high pressure excursion in a vessel resulted in a hydrocarbon release with offsite consequences at the Holly refinery in Woods Cross, Utah on 30 August 87. Worker injured following a fire at the Marathon refinery in Detroit, Michigan on 5 September 88. Chemical release with offsite consequences at the Marathon refinery in Detroit, Michigan on 8 September 89. Sulfuric acid release due to a mechanical integrity failure at the Tesoro refinery in Martinez, California on 10 September 90. Carbon monoxide and hydrogen sulfide release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 11 September 91. Hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 11 September 92. Hydrocarbon release due to a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 14 September 93. Unspecified leak at the Tesoro refinery in Martinez, California on 15 September 94. Hydrocarbon release due to a mechanical integrity failure at the PBF Energy refinery in Delaware City, Delaware on 21 September 95. Hydrogen sulfide release due to a mechanical integrity failure at the Motiva refinery in Norco, Louisiana on 24 September 96. 1 worker killed and another worker injured from an explosion at the CVR Energy refinery in Wynnewood, Oklahoma on 28 September 97. Fire at the Motiva refinery in Convent, Louisiana on 1 October 98. Hydrogen fluoride release at the Placid refinery in Port Allen, Louisiana on 1 October 99. Hydrogen sulfide release from a high pressure excursion at the Valero refinery in Port Arthur, Texas on 1 October 100. Fire at the ExxonMobil refinery in Baytown, Texas on 3 October 101. Vapor cloud release at the Hess refinery in Port Reading, New Jersey on 3 October 102. Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Rodeo, California on 8 October 103. Fire at the Citgo refinery in Corpus Christi, Texas on 9 October 104. Vapor cloud release with offsite impact from the Kern Oil refinery in Bakersfield, California on 17 October 105. Hydrocarbon and hydrogen sulfide release from a pressure excursion at the ExxonMobil refinery in Joliet, Illinois on 19 October 106. Hydrocarbon release due to a mechanical integrity failure at the Citgo refinery in Sulfur, Louisiana on 22 October

Chevron Richmond Refinery Regulatory Report December 2013

100 DRAFT FOR PUBLIC COMMENT 107. Hydrogen sulfide release at the Chalmette refinery in Chalmette, Louisiana on 23 October 108. Fire at the Tesoro refinery in Martinez, California on 21 October 109. Fire at the BP refinery in Texas City, Texas on 30 October 110. Fire at the Valero refinery in Port Arthur, Texas on 3 November 111. Benzene release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 8 November 112. Vapor release at the Tesoro refinery in Martinez, California on 8 November 113. Hydrogen sulfide release due to a mechanical integrity failure or a high pressure excursion at the Shell refinery in Martinez, California on 24 November 114. Hydrogen sulfide and hydrocarbon release at the Northern Tier Energy refinery in St. Paul Park, Minnesota on 27 November 115. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 1 December 116. Hydrogen fluoride release that killed one worker, injured 2 other workers and 7 emergency responders at the Valero refinery in Memphis, Tennessee on 3 December 117. Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 5 December 118. Hydrogen sulfide release at the Phillips 66 refinery in Wood River, Illinois on 8 December 119. Fire at the Motiva refinery in Port Arthur, Texas on 11 December 120. Benzene release due to a mechanical integrity failure at the Alon refinery in Big Spring, Texas on 11 December 121. Hydrocarbon release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 11 December 122. Hydrocarbon release at the Shell refinery in Anacortes, Washington on 12 December 123. Hydrogen sulfide release due to a pressure excursion at the PBF Energy refinery in Paulsboro, New Jersey on 14 December 124. Hydrocarbon and hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 15 December 125. Fire at the Motiva refinery in Port Arthur, Texas on 17 December Note -Incidents of hydrocarbon leaks into a cooling tower or releases to a flare system are not included in the above list.

Chevron Richmond Refinery Regulatory Report December 2013

101 DRAFT FOR PUBLIC COMMENT Appendix B: Regulatory Comparison Table OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime Scope Covered processes excluding oil and gas well drilling and servicing Covered processes excluding oil and gas well drilling and servicing Applies to offshore and onshore oil and gas operations Specific PSM/ Major Accident Focus Yes Yes Yes ALARP or Equivalent No No Yes Adaptability to New or Revised Codes, Standards, Technology, Hazard Information, Lessons Learned, etc. Limited to RAGAGEP –only addresses equipment and mechanical integrity (2 of 14 elements); RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Limited to RAGAGEP – only addresses equipment and mechanical integrity; RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Yes via safety case and supporting framework legislation PSM Indicators Req. No No Yes for Companies Competent Regulator 50% or more Engineers/PSM OSHA-some progress but no Cal/OSHA – some progress but no Yes Sufficient Funding for Competent Regulatory staff OSHA-No California is increasing funding to support additional staff on Cal/OSHA PSM team Yes Hazard Analysis Required – “shall identify, evaluate, and control the hazards involved in the process.” Required – “appropriate to the complexity of the process for identifying, evaluating, and controlling hazards involved in the process.” Is a specific aspect of SC and supporting framework regulation and is required for all onshore and offshore facilities. To meet legislative goal-setting requirements, a structured risk assessment including HA as appropriate is required from all “employers.”

Chevron Richmond Refinery Regulatory Report December 2013

102 DRAFT FOR PUBLIC COMMENT Incident Investigation Requires a report but activity- based; requires including “any recommendations resulting from the investigations” (what if there are none?); system required to “resolve the incident report findings and recommendation; no explicit requirement to prevent a similar occurrence or controlling hazards. Requires a report including “any recommendations resulting from the investigation.” System required to “establish a system to promptly address and resolve the report findings and recommendations and…implement the report recommendations in a timely manner, or take action to prevent a reoccurrence.” Investigation of incidents required to demonstrate legal compliance with framework legislation. ‘Reasonably practicable’ requirement would require remedial action and cross company learning from incident investigations. HSE can require SC duty holder compliance with investigation report recommendations (e.g. Buncefield Report-“determine SIL level requirements for overfill protection”) Management of Change Activity-based; the employer “shall establish and implement written procedures to manage changes;” “the procedures shall assure the following considerations are addressed…impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Activity-based: the employer “shall establish and implement written procedures to manage changes…;” “the procedures shall assure that the following are addressed prior to any change…technical basis for proposed change; impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Description of MOC procedures and demonstrations of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Workforce Participation “Employers shall develop a written plan of action regarding the implementation of the employee participation;” Employers shall consult with employees and their representatives on the conduct and development of PHAs and the other elements of PSM in this standard.” “Employer shall develop a written plan of action to ensure employee participation in process safety management;” includes employer consultation with employees and their representatives on the conduct and development of the elements of process safety management required by this section; and providing employees and their representatives with access to all information required to be developed by this section…” Provides for the election of protected safety representative positions and safety committees.

Chevron Richmond Refinery Regulatory Report December 2013

103 DRAFT FOR PUBLIC COMMENT Inherent Safety No No Yes

Chevron Richmond Refinery Regulatory Report December 2013

104 DRAFT FOR PUBLIC COMMENT Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach

1. Is it true that the safety case regulatory approach leads to self-regulation by industry?

Critics of the safety case regulatory approach have noted that this type of regulatory regime is likely to result in mere industry self-regulation.423 Critics have also noted that this is at least partly due to the fact that there is no will in the US to ensure that regulators have the tools, resources, and competence to effectively regulate workplaces. The CSB and those with experience in developing and implementing the safety case regulatory regime have repeatedly stated that the purpose of the safety case regulatory approach is to ensure that all hazards have been identified, evaluated, and controlled so that risks are reduced to as low as reasonably practicable, or ALARP. In simple terms, the safety case report is a series of claims as to how an installation is being safety operated. The real strength of the safety case regulatory regime is testing the validity of those claims through strategic intervention by competent, well-funded regulators. Advanced performance-based regulatory regimes in the United Kingdom (UK) and Norway, for example,424 incorporate a list of regulator-accepted standards and good practices that provide companies with the minimum performance that is expected. Companies must demonstrate that they meet or exceed those standards. Therefore, companies are aware of minimum performance expectations they must meet as they work to reduce risks to ALARP. If a competent regulator is not in place, then the safety case report equates to nothing more than a lifeless document sitting on a shelf, and the criticism of self-regulation becomes valid.

It is also important to point out that in a letter from the USW Local 5 to the CSB dated November 22, 2013, it was stated that “[t]he current system is truly a self regulated system, with the industry setting the rules, changing the rules, and monitoring themselves.” Individuals are noting that the current system in place has actually led to self-regulation despite the intent of the PSM standard and RMP program to be performance-based.

The CSB has also noted that post-incident criminal or civil enforcement is not an effective approach to prevent major accidents; rather than accepting the inevitability of catastrophic events, we should act to prevent them from happening. This sentiment has been shared by many members of Congress in the past year following serious incidents such as the Chevron pipe failure in Richmond, California, and the West Fertilizer explosion in West, Texas. As noted in this report, there is a movement in California to improve oversight of petroleum refineries – the Cal/OSHA PSM Unit is already receiving additional funding to help increase staffing numbers. There has also been increased dialogue in the US in recent years surrounding the regulation of the oil and gas industry and how to make improvements. As such, the support exists to not only shift the current activity-based regulatory structure to a more goal-based safety

423 See e.g. Rena Steinzor. Lessons from the North Sea: Should “Safety Cases” Come to America? Vol. 38: 417; 2011; p 439. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1735537 (accessed September 4, 2013). 424 Norway requires many similar aspects of a safety case regime offshore but there are differences in implementation and style and content of the regulations. The UK implements a safety case regime both onshore and offshore.

Chevron Richmond Refinery Regulatory Report December 2013

105 DRAFT FOR PUBLIC COMMENT case regulatory regime, but to also ensure that competent, well-funded regulators are in place to implement and enforce such a regime.

• How does the safety case regulatory regime in the US allow for changes to be made without requiring

rulemaking under the Administrative Procedure Act? The Administrative Procedure Act, or APA, was passed in 1947, and lays out the basic framework under which federal rulemaking is conducted. It defines “rule” as “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency…”425 “Rulemaking” is defined as the “agency process for formulating, amending, or repealing a rule.”426 Federal agencies often impact their specific area of jurisdiction by publishing rules promulgated through notice and comment rulemaking, or informal rulemaking, under the APA. Unfortunately, as this report discusses at length, the rulemaking process in the US is a cumbersome one, and some federal agencies, such as OSHA and the EPA, are subject to additional requirements and more stringent review standards that go above and beyond those contained in the APA. To avoid these additional burdens, many agencies provide further guidance to regulated parties through more informal means, such as answering questions and issuing policy statements, guidance, or opinion letters. Another way to lessen the burden on regulating agencies and their regulated entities is to adopt performance or goal-based regulations rather than prescriptive regulations. Performance-based standards state the objective or outcome to be achieved, such as risk reduction, without describing the specific means of obtaining that objective. This provides the regulated entities with the freedom and flexibility to work to achieve a stated goal, such as reducing risks to as low as reasonably practicable, or ALARP, through their chosen and preferred means.427 Performance-based standards also provide flexibility to the regulator; for example, in a safety case regulatory regime, should the regulator determine through assessment of the safety case report and/or inspection that the facility has not reduced risks to ALARP with regard to a specific hazard, he or she may require that the facility take additional steps to further reduce risk without needing to propose and adopt a new rule or regulation to address it. The regulator must accept the safety case report in order for the facility to operate.

The Regulatory Flexibility Act (RFA) was passed in 1980 during the Carter Administration. It requires agencies to prepare and make available for public comment regulatory flexibility analyses of proposed rulemaking, and also encourages agencies to consider alternatives to rulemaking, including “the use of performance rather than design standards…”428 Executive Order 13272 then directed federal agencies to establish procedures and policies to comply with the Act.429 Federal agencies have been encouraged to adopt performance-based standards in the US for decades. Recognizing the inefficient process of federal rulemaking in the US, President Clinton signed Executive Order 12866 in September of 1993, which, among other things, directed federal agencies to “identify and assess alternative forms of

425 5 U.S.C. §551(4) (2011). 426 5 U.S.C. §551(5) (2011). 427 Such as reliance upon qualitative assessments, quantitative assessments, semi-quantitative risk assessments, and good practice guidance. 428 5 U.S.C. §603(3) (2010). 429 Exec. Order No. 13272, 67 Fed. Reg. 159 (August 13, 2002). http://www.gpo.gov/fdsys/pkg/FR-2002-08- 16/pdf/02-21056.pdf (accessed September 24, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

106 DRAFT FOR PUBLIC COMMENT regulation…[and] specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt.”430 Executive Order 13563, entitled Improving Regulation and Regulatory Review, supplemented and reaffirmed Executive Order 12866 by ordering agencies to “identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of choice for the public.”431 Its stated goal was to “protect public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”432 Its seven guiding principles are as follows:  Increase predictability and reduce uncertainty;  Use and rely on best available science;  Ensure public participation and open exchange of ideas;  Use the most innovative and least burdensome tools;  Consider cost benefit analysis (quantitative and qualitative);  Ensure regulations are publicly available, consistent, written in plain language and easy to understand; and  Measure results and seek to improve actual results.433

The safety case regime aims to satisfy all of these principles.

California has adopted its own version of the APA, known as the California Administrative Procedure Act (CAPA) (California Government Code §11340 et seq.).434 Among its many requirements for California state agencies that adopt regulations, CAPA directs them to consider the substitution of performance standards for prescriptive standards.435 CAPA defines “performance standard” as “a regulation that describes an objective with the criteria stated for achieving the objective.”436

Federal agencies that are engaged in and responsible for regulating high hazards, such as NASA and the Nuclear Regulatory Commission (NRC), have adopted goal or performance-based standards that require risks to be reduced to “as safe as reasonably practicable” (ASARP) and “as low as reasonably achievable,” (ALARA), respectively. The OSHA Process Safety Management (PSM) standard also contains performance-based elements to some extent; for example, it provides regulated entities with flexibility in how to perform a process hazard analysis (PHA). However, it contains no risk reduction goals such as ALARP. This has resulted in an activity-based regulatory scheme that emphasizes completing activities, such as a PHA or a Management of Change (MOC) analysis, rather than actual risk reduction. Without a risk reduction goal such as ALARP in place, the PSM standard will not have the ability to successfully drive continuous improvement and adaptation of industry safety management advances.

430 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.archives.gov/federal- register/executive-orders/pdf/12866.pdf (accessed September 24, 2013). 431 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.gpo.gov/fdsys/pkg/FR-2011-01- 21/pdf/2011-1385.pdf (accessed September 24, 2013). 432 Ibid. 433 Ibid. 434 Available at http://www.oal.ca.gov/administrative_procedure_act.htm (accessed September 18, 2013). 435 California Government Code, §11340.1(a) (1995). 436 California Government Code, §11342.570 (1995).

Chevron Richmond Refinery Regulatory Report December 2013

107 DRAFT FOR PUBLIC COMMENT

1. Can the safety case regulatory approach work in the US when workforce involvement is emphasized

less than other regions and unionization rates are lower than other countries?

A majority of the workforce in California petroleum refineries is unionized, as the unionization rate for the 15 petroleum refineries in California is actually 73 percent,437 which is significantly higher than the 2012 rates for the US as a whole (11.1 percent), Australia (17.9 percent), the UK (25.8 percent), and Norway (54.7 percent).438 Despite a declining unionization rate in the UK, the region has developed strong onshore and offshore regulations that provide for the creation of protected safety representative positions and safety committees for unionized and non-unionized facilities. These positions are meant to create a healthier and safer workplace, and result in better decision-making regarding health and safety, increased productivity, higher workforce motivation, a stronger commitment to implementing decisions or actions (as employees have been actively involved in reaching these decisions), and greater cooperation and trust.439 The HSE has devoted extensive time and resources to ensuring employers are complying with these regulations and understand the importance and benefits of involving workers in health and safety-related matters.

The UK also has a standard establishing the minimum level of training that elected safety representatives offshore should receive to enable them to fully perform their functions as defined in the Safety Representatives and Safety Committees Regulations – SI 1989/971. This training standard, entitled the OPITO Approved Standard, was developed by an industry workgroup facilitated by OPITO.440 In June 2013, Det Norske Veritas (DNV)441 became accredited by OPITO to offer newly developed training courses to more than 2,000 elected safety representatives in the offshore industry. The training, which has been driven and supported by HSE, Oil and Gas UK, and the Offshore Industry Advisory Committee’s (OIAC’s) Workforce Involvement Group, consists of four separate Modules run over the course of eight days.442 The training covers topics such as Understanding and Identifying Major Accident Hazards and Investigating Incidents and Applying Root Cause Analysis.

The CSB recognizes HSE’s effort to improve workforce involvement through regulations, protected positions, and training, and has recommended in this report that California develop regulations and guidelines to establish similar protected safety positions to ensure effective workforce participation. The CSB believes the HSE model can also be effective in the US as these regulations require effective safety representation regardless of unionization rates.

437 In September 2013, the USW provided the CSB with a list of California petroleum refinery locations as of October 2012 and the existing unionization representation at those refineries. Of the 15 petroleum refineries operating in California as of October 2012, 11 of those were unionized, with USW providing the union representation at all 11 facilities. 438 For complete statistics on trade union density for countries around the world see http://stats.oecd.org/Index.aspx?QueryId=20167 (accessed September 5, 2013). 439 HSE. Consulting employees on health and safety: A brief guide to the law. 2013; p 2. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 5, 2013). 440 OPITO is an industry-owned non-profit that serves the needs of the oil and gas industry in the UK and around the world. See http://www.opito.com/ (accessed September 10, 2013). 441 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 442 http://www.marinelink.com/news/launches-offshore355749.aspx (accessed September 10, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

108 DRAFT FOR PUBLIC COMMENT

1. Has the safety case regulatory approach resulted in fewer major accidents?

Unfortunately, there have been few objective studies conducted on the impact of the safety case regulatory approach on safety performance onshore and offshore. In 1999, a report commissioned by the HSE (“the Aberdeen Report”) which evaluated the impact of the offshore Safety Case Regulations on offshore safety was published.443 One of the purposes of the study was to review published safety data for trends in offshore accidents and incidents from 1990 until 1997.444 Upon this review, it was determined there had been a decrease in accidents since the implementation of the offshore safety case regulations in the UK, but cautioned it was difficult to distinguish the effect of the safety case regulations from other industry activities such as the level and type of exploration and production activity, oil prices, and industry-led initiatives.445 The Aberdeen Report also cautioned about the difficulties in analyzing offshore data that also hold true for the more current data presented in Figure 3. The total number of accidents and incidents recorded can be affected by industry attitudes toward reporting, changes in how and what data is reported, and the decrease or increase in offshore activity. As stated in the Aberdeen Report, “[d]espite these cautions, accident statistics play an important role in the analysis of the state of safety in any industry, since accidents represent the ‘bottom line’ in safety. It is therefore important to analyze the trends, but to also take the drawbacks into consideration.”446 As discussed in this report, the reporting and analyzing leading process safety indicators is important to gain a better understanding of how safety management systems are functioning, and thus a better idea of how well the various regimes are managing hazards and mitigating risk. Statistics from the seven years covered by the Aberdeen Report indicated an overall decrease in reported accident rates in the UK and Norwegian databases up until 1994. From 1994 to 1997, both the UK and Norway reported a slight increase in the number of reported accidents.447 Norway did report a drop in 1997 from 1996. The decrease reported up until 1994 for the UK appeared to be independent of the offshore production activities as those levels had been on the increase during the same time period. Drilling in the UK decreased during the same time frame, making the cause for the decrease in reported drilling accidents unclear. More recent reviews of accident data indicate decreasing trends in accident statistics. The Presidential Oil Spill Commission noted the following in its report to the President on the Macondo disaster:

[f]rom 2004 to 2009, fatalities in the offshore oil and gas industry were more than four times higher per person-hours worked in U.S. waters than in European waters, even though many of the same companies work in both venues. This striking statistical discrepancy reinforces the view that the problem is not an inherent trait of the business itself, but rather

443 Evaluation of the Offshore Safety Legislative Regime—A study undertaken by AUPEC Ltd. For the Safety Policy Division, Health & Safety Executive, Ref: 8938/3714, June 1999. 444 Ibid at Ch 7. 445 Ibid at Ch 7, p 7-1. 446 Ibid at Ch. 7, p 7-11. 447 This was based on the number of accidents per million man hours for the two Continental Shelves (Ibid, Figure 7.8)

Chevron Richmond Refinery Regulatory Report December 2013

109 DRAFT FOR PUBLIC COMMENT depends on the differing cultures and regulatory systems under which members of the industry operate.448

In September 2013, Det Norske Veritas (DNV)449 released a position paper discussing necessary improvements to reduce risk of major offshore accidents, and noted in the report that “there are no good globally accepted metrics for major accident hazards…”450 However, DNV was able to point to UK HSE’s Hydrocarbon Releases Database System (HCR)451 in the North Sea to provide an example of improving safety performance trends.452 The HRC contains detailed voluntary information of over 4,000 hydrocarbon releases offshore from close to 300 installations since 1992. The HRC data, plotted in Figure 3, show the total number of releases to be on the decline. Classifying the severity of a release is based on agreed-upon criteria with the offshore industry.453 The UK has defined significant events to be those that, if ignited, have the potential to cause a major accident where multiple casualties could occur. The occurrence of any hydrocarbon release is undesirable because of the potential to escalate, and so reporting data from minor incidents has also been included in Figure 3 below.

Figure 3. Hydrocarbon releases in the North Sea reported to UK HSE as dangerous occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations.454

448 National Commission on the BP Deepwater Horizon Oil Spill. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President; January 2011; Ch 8 p 225. 449 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 450 DNV. Enhancing offshore safety and environmental performance: Key levers to further reduce the risk of major offshore accidents. 2013; p 5. http://www.dnv.com/industry/oil_gas/services_solutions/offshore_safety.asp (accessed September 10, 2013). 451 https://www.hse.gov.uk/hcr3/ 452 In its position paper, DNV cited data from 1996, but UK HSE has noted that the criteria for severity classification was refined in 1999 so data since that date is presented here. 453 Hydrocarbon Releases System Internet Help File, https://www.hse.gov.uk/hcr3/help/help_public.asp (accesses September 10, 2013) 454 RIDDOR – Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 became effective offshore on April 1, 1996, http://www.hse.gov.uk/riddor/ (accessed September 10, 2013) 0 50 100 150 200 250 Reported Releases Financial Year (April‐March)  2000/01 to 2012/13 Minor Significant Major Total

Chevron Richmond Refinery Regulatory Report December 2013

110 DRAFT FOR PUBLIC COMMENT It is important to note that major accidents are low-probability, high-consequence events, and as such they are difficult to measure. According to Dr. Andrew Hopkins, major accidents are more difficult to define than, say, a car accident, and they are rare, making it difficult to estimate the number of major accidents prevented.455 In addition, based on the data in existence, there is a continued need for improved data collection; key leading performance indicators development and implementation on a global scale would provide an improved glimpse into how safety is being managed for major accident prevention.

• The UK HSE has published reports456 showing significant industry problems with maintenance of

safety critical equipment, poor understanding of the potential impact of degrading plant and utility systems on safety critical elements, and lack of understanding of the role of asset integrity and the concept of barriers in major hazard risk control. Don’t these reports developed by the UK regulator demonstrate that the safety case is not effective and is not working? The CSB recognizes that there have been critiques of the safety case regime and its implementation. The CSB acknowledges that the safety case is not perfect and that no regulatory system will be perfect in its implementation. Some have noted the issue of aging equipment due to many issues, including the harsh conditions that exist in the North Sea. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferrals of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters, rather than anticipating worst-case scenarios. However, the safety case regime’s adaptive nature has been able to address these concerns. The HSE has recognized asset integrity management and the issue of ageing equipment as key issues to address in its inspection programs, and has developed internal processes and priorities for these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.457 The same year, the HSE published a report intended to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,458 which provides an overview of ageing plant mechanisms and their management and presents the findings of an analysis of loss of containment incidents to indicate the extent to which ageing plant equipment may be a factor. This type of programmatic proactive approach and information dissemination is lacking in the US both on and offshore. 455 Hopkins, Andrew. The Cost-Benefit Hurdle for Safety Case Regulation: A discussion paper prepared for the US Chemical Safety Board. Add Date, Page, and Link. 456 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf, (accessed August 28, 2013). 457 The report is available at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013). 458 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013).

Chevron Richmond Refinery Regulatory Report December 2013

111 DRAFT FOR PUBLIC COMMENT

1. How have other countries implemented the safety case regime? What challenges do the countries face

when transitioning to a safety case approach?

From the international safety case community, the CSB has found that when transitioning to a safety case regime there are many obstacles that may hinder the transition, such as:

 Major stakeholders not being committed to the process, unconvinced of the need;  Lack of understanding that the safety case regime is a “process” to be undertaken by the duty holder and the workforce to improve understanding of the hazards, risks, and their controls, and to put in place measures for continuous improvement, rather than just creation of a “document”;  Lack of sufficient funding by government and industry; and  Lack of the necessary legislative timetable.

The transition to a safety case regime has significant challenges for both the duty holder and the regulator, including:

 The safety case report could be treated as a check-the-box exercise;  Documented safety management system does not reflect reality;  Poor identification of hazards and risks;  Poor understanding of the performance of control systems;  Attempting to justify existing controls rather than to seek opportunity to improve;  Insufficient workforce involvement in the process;  The safety case process is under-resourced;  The safety case report is “inaccessible” so the report simply lives on the shelf;  The regulator does not use the safety case report to inform the inspection or audit;  Limited requirement for the reporting of accidents, dangerous occurrences and precursors resulting in lack of comprehensive performance data; and  The regulator is under-resourced, technically challenged, poorly trained, has poor systems and procedures, and is inconsistent.

In implementing the safety case regime, there should be regard for the regulatory principles and frameworks which represent best practice. The underlying principles are:

 The legislation and regulation should be fit for purpose, not simply superimposed on existing prescriptive regulation;  Regulation should be effective and efficient; and  Industry should move away from a culture of compliance with detailed prescriptive regulation to one of involving the workforce in understanding the hazards.

Some significant points worth noting from international experience in setting up the regulation are:

 Staff should be recruited against detailed job descriptions and should cover the full range of technical, management and regulatory requirements;

Chevron Richmond Refinery Regulatory Report December 2013

112 DRAFT FOR PUBLIC COMMENT  Pay rates and terms and conditions should be sufficient to attract highly qualified staff;  A competency framework needs to be developed reflecting the required knowledge, skills, and experience required to undertake;  Appropriate training programs must be in place;  An electronic dedicated safety case assessment procedure which captures the detail of the process to be followed and records the background to the decision-making process will be needed. This helps ensure good quality, consistent, and transparent assessment and provides a database of information which is used for future validation/topic facility inspections. It also provides a comprehensive record of the process which can be used in the event of an appeal against an assessment decision;  An accident and dangerous occurrence data base will be needed to store knowledge and data to provide reference information and the capacity to analyze trends; and  An emergency reporting and response process is necessary to ensure all significant events are properly logged and dealt with.

Chevron Richmond Refinery Regulatory Report December 2013

113 DRAFT FOR PUBLIC COMMENT

FD06452 ｜ 2012_美国_Chevron Richmond 炼油厂 火灾 - Chevron Richmond Refinery Fire__最终报告_5.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所：化工/石化 ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

REGULATORY REPORT

CHEVRON RICHMOND REFINERY PIPE RUPTURE AND FIRE

CHEVRON RICHMOND REFINERY #4 CRUDE UNIT RICHMOND, CALIFORNIA AUGUST 6, 2012

REPORT NO. 2012-03-I-CA OCTOBER 2014

Chevron Richmond Refinery Regulatory Report October 2014

[This page left intentionally blank.]

2

Chevron Richmond Refinery Regulatory Report October 2014

Table of Contents Table of Contents .......................................................................................................................................... 3 Acronyms and Abbreviations ....................................................................................................................... 5 1.0 Executive Summary ......................................................................................................................... 7 1.1 Incident Summary ............................................................................................................................ 7 1.2 Interim Report .................................................................................................................................. 7 1.3 Background ...................................................................................................................................... 9 1.4 Key Findings .................................................................................................................................. 10 1.5 Regulatory Conclusions ................................................................................................................. 12 1.6 Recommendations .......................................................................................................................... 13 2.0 Introduction .................................................................................................................................... 14 3.0 The Safety Case Regulatory Regime ............................................................................................. 21 3.1 Introduction .................................................................................................................................... 21 3.2 Initial Safety Case Implementation ................................................................................................ 22 3.2.1 United Kingdom .................................................................................................................... 22 3.2.1.1 Onshore .......................................................................................................................... 22 3.2.1.2 Offshore ......................................................................................................................... 25 3.2.2 Global Analysis of Safety Case Implementation .................................................................. 27 3.2.2.1 Australia ........................................................................................................................ 27 3.2.2.1.1 Offshore ................................................................................................................. 27 3.2.2.1.2 Onshore .................................................................................................................. 28 3.2.2.2 Norway .......................................................................................................................... 29 3.2.2.3 The United States........................................................................................................... 30 3.2.2.3.1 OSHA PSM Standard ............................................................................................ 31 3.2.2.3.2 U.S. Environmental Protection Agency Risk Management Program .................... 33 3.2.2.3.3 Safety Case in the United States ............................................................................ 35 4.0 Key Features of an Effective Safety Case Regulatory Regime ...................................................... 37 4.1 Duty Holder Safety Responsibility, including a Written Case for Safety ...................................... 38 4.2 Continuous Risk Reduction to ALARP ......................................................................................... 40 4.3 Adaptability and Continuous Improvement ................................................................................... 44 4.4 Active Workforce Participation ..................................................................................................... 53 4.5 Process Safety Indicators that Drive Performance ......................................................................... 58 3

Chevron Richmond Refinery Regulatory Report October 2014

1. 6 Regulatory Assessment, Verification, and Intervention ................................................................ 62
2. 7 Independent, Competent, Well-Funded Regulator ........................................................................ 66
3. 0

Oversight of Petroleum Refineries in California ........................................................................... 70 5.1 Cal/OSHA ...................................................................................................................................... 70 5.1.1 Background Information ....................................................................................................... 70 5.1.2 Analysis ................................................................................................................................. 76 5.1.2.1 ALARP .......................................................................................................................... 76 5.1.2.2 Adaptability and Continuous Improvement ................................................................... 78 5.1.2.3 Process Safety Indicators ............................................................................................... 80 5.1.2.4 Inspections ..................................................................................................................... 80 5.1.2.5 Workforce Participation ................................................................................................ 81 5.1.2.6 Funding and Regulator Competency ............................................................................. 83 5.2 U.S. Environmental Protection Agency ......................................................................................... 85 5.2.1 Risk Management Plan (RMP) Program ............................................................................... 85 5.2.2 Implementation of the RMP Program ................................................................................... 86 5.3 Unified Program ............................................................................................................................ 87 5.3.1.1 Contra Costa County Hazardous Materials Programs ................................................... 87 5.3.1.1.1 CalARP .................................................................................................................. 88 5.3.1.1.2 Industrial Safety Ordinance ................................................................................... 89 5.3.1.1.3 City of Richmond Industrial Safety Ordinance ..................................................... 90 5.3.1.2 Analysis ......................................................................................................................... 90 6.0 Conclusion ..................................................................................................................................... 92 7.0 Process Safety Management Reform at the Federal Level: A Path Forward ................................ 93 8.0 Recommendations .......................................................................................................................... 96 References ................................................................................................................................................. 100 Appendix A: Significant Petroleum Refinery Incidents in 2012 ............................................................. 103 Appendix B: Regulatory Comparison Table ............................................................................................ 108 Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach ... 111 Appendix D: CSB Staff May 2014 Response to the Board’s Motion to Postpone issued on January 15, 2014 .......................................................................................................................................................... 121

4

Chevron Richmond Refinery Regulatory Report October 2014

Acronyms and Abbreviations ALARA

As Low As Reasonably Achievable ALARP

As Low As Reasonably Practicable ALJ

Administrative Law Judge ANPRM

Advance Notice of Proposed Rulemaking APA

Administrative Procedure Act API

American Petroleum Institute ASARP

As Safe As Reasonably Practicable BSEE

Bureau of Safety and Environmental Enforcement CA

Competent Authority CAA

Clean Air Act CAAA

Clean Air Act Amendments CalARP

California Accidental Release Prevention Cal/EPA

California Environmental Protection Agency Cal/OSHA

California Division of Occupational Safety and Health CAPA

California Administrative Procedure Act CCHMP

Contra Costa Health Services’ Hazardous Materials Program CCPS

Center for Chemical Process Safety CCR

California Code of Regulations CERCLA Comprehensive Environmental Response, Compensation, and Liability Act CFR

Code of Federal Regulations Chevron ETC Chevron Energy Technology Company CIMAH

Control of Industrial Major Accident Hazards COMAH

Control of Major Accidents Hazards Regulations CSB

U.S. Chemical Safety and Hazard Investigation Board CSHO

Compliance Safety and Health Officer CUPA

Certified Unified Program Agency DIR

California Department of Industrial Relations DNV

Det Norske Veritas EA

Environment Agency EPA

U.S. Environmental Protection Agency FSA

Formal Safety Assessment FY

Fiscal Year GAO

U.S. Government Accountability Office HSC

California Health and Safety Code HSE

Health and Safety Executive HTHA

High Temperature Hydrogen Attack ISO

Industrial Safety Ordinance 5

Chevron Richmond Refinery Regulatory Report October 2014

ISOM

Isomerization LOHP

Labor Occupational Health Program MOC

Management of Change MOOC

Management of Organizational Change NASA

National Aeronautics and Space Administration NDU

Naphtha Desulfurization Unit NEP

National Emphasis Program NOHSC

Australia National Occupational Health and Safety Commission NOPSEMA Australian National Offshore Petroleum Safety and Environmental Management Authority NPRM Notice of Proposed Rulemaking NRC U.S. Nuclear Regulatory Commission OERI Operational Excellence and Reliability Intelligence OIG Office of Inspector General OMB Office of Management and Budget OSHA

U.S. Occupational Safety and Health Administration OSHAct

Occupational Safety and Health Act PHA

Process Hazard Analysis PHMSA Department of Transportation, Pipeline and Hazardous Materials Safety Administration PQV Program Quality Verification PSA Petroleum Safety Authority PSI Process Safety Information PSLA Petroleum Submerged Lands Act PSLG Process Safety Leadership Group PSM Process Safety Management QRA Quantitative Risk Assessment RAGAGEP Recognized and Generally Accepted Good Engineering Practices RFI Request for Information RISC Risk-Informed Safety Case RISO City of Richmond Industrial Safety Ordinance RLOP Richmond Lube Oil Plant RMP Risk Management Plan RP Recommended Practice SEPA Scottish Environmental Protection Agency SFAIRP So Far As Is Reasonably Practicable SOP Standard Operating Procedure UK

United Kingdom USCG

U.S. Coast Guard USW

United Steelworkers Union 6

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Executive Summary
2. 1

Incident Summary On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, (“the Chevron Richmond Refinery”) experienced a catastrophic pipe failure in the #4 Crude Unit (“the crude unit”). The pipe, a 52- inch long carbon steel piping component of the #4 sidecut line, ruptured and released flammable, hydrocarbon process fluid, which partially vaporized into a large vapor cloud that engulfed 19 Chevron employees and ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition of the flammable portion of the vapor cloud and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of particulates and vapor traveling across the Richmond, California area. Approximately 15,000 people from the surrounding area sought medical treatment due to the release. 1.2 Interim Report The CSB released an Interim Report on the Chevron incident in April 2013 (“the Interim Report”), which highlighted technical findings and safety system deficiencies. Testing conducted on the ruptured pipe determined that it had experienced extreme thinning near the rupture location due to sulfidation corrosion.1 Sulfidation corrosion is a damage mechanism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F.2 This damage mechanism3 causes pipe walls to gradually thin over time, and is common in crude oil distillation4 where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide,5 are available to react with steel piping and equipment. The Interim Report stated that virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled.

The Interim Report noted a number of causal safety system deficiencies that highlight regulatory gaps relating to major accident prevention at California petroleum refineries. For example, in conducting its process hazard analysis6 (PHA) of the crude unit, which was required under California’s Process Safety 1 With respect to the sulfidation corrosion damage mechanism that caused the Chevron incident, carbon steel piping corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels, including stainless steel. 2 For an electronic copy of the CSB Chevron Interim Report see http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 24. 2013). 3 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 3.1.1.5, November 2009. 4 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 5 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. 6 A process hazard analysis (PHA) is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section 5189, Process 7

Chevron Richmond Refinery Regulatory Report October 2014

Management (PSM) standard,7 Chevron did not conduct a rigorous review of corrosion and damage mechanisms present in the crude unit, and did not identify sulfidation corrosion as a hazard. As such, Chevron did not effectively address inherent safety8 or implement effective controls to prevent sulfidation corrosion, including those controls proposed by Chevron’s technical group. Although both the California and federal PSM standards require that hazards be identified, evaluated, and controlled, there is no further discussion of how far to reduce risks, and there is no requirement to address the effectiveness of controls or to use the hierarchy of controls.9 Therefore, this type of analysis was not required to be conducted, and Chevron was never cited post-incident for failing to evaluate the effectiveness of safeguards.

In another example, despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction through the Management of Change (MOC) process, incident investigations, technical reports, and employee recommendations, Chevron repeatedly failed to implement those proposed recommendations. Chevron’s 2006 MOC analysis limited application of those recommendations to only a small section of the pipe. As a result, the portion of the pipe that failed on the August 6th incident remained in service until the incident. As there is no requirement to implement effective recommendations or control hazards under the MOC element, it is essentially an activity-based requirement. Chevron was not cited for narrowing the scope of the MOC, despite its disregard of internal recommendations. The CSB concluded in its Interim Report that Chevron did not regularly or rigorously apply inherently safer technology, which provides an opportunity for preventing major accidents, in its PHAs, MOCs, incident investigation recommendations, or during turnarounds.

The CSB made safety recommendations in the Interim Report to a number of entities, including the California State Legislature, the U.S. Environmental Protection Agency, and Contra Costa County. The Board recommended that the California State Legislature require California petroleum refineries to perform damage mechanism hazard reviews, to identify and report leading and lagging process safety indicators, to document recognized methodologies, rationale, and conclusions used to claim that safeguards intended to control hazards will be effective, and to document their inherently safer systems analysis and the hierarchy of controls in establishing safeguards for process hazards, with the goal of driving risk of major accidents to as low as reasonably practicable, or ALARP. These concepts, introduced in the Interim Report and highlighted in the recommendations, are the basic building blocks for the implementation of the safety case regime, a regulatory scheme that will be discussed in great detail in the following report.

The CSB concluded its Interim Report by highlighting additional issues that were still under investigation, including emergency planning and reporting, emergency response, safety culture, and regulatory oversight of petroleum refineries in California. The following report fulfills the CSB’s Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental Release Prevention Program and the federal EPA Risk Management Program. 7 Under 8 CCR §5189 (e). https://www.dir.ca.gov/title8/5189.html (accessed September 25, 2013). 8 According to the Center for Chemical Process Safety (CCPS), “inherently safer design solutions eliminate or mitigate the hazard by using materials and process conditions that are less hazardous.” Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 5.1.1, 2009. 9 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a hierarchy of controls. The further up the hierarchy, the more effective the risk reduction achieved. 8

Chevron Richmond Refinery Regulatory Report October 2014

commitment to examine whether the implementation of the safety case regulatory regime could be a more effective regulatory tool to achieve major accident prevention for California petroleum refineries. The reader will find additional issues, arguments, and counterarguments regarding the safety case regulatory regime addressed in Appendix C of this report. 1.3 Background Although both the federal and California PSM standards, respectively, were intended to be goal-setting or performance-based,10,11 in practice they appear to function primarily as reactive and activity-based12 regulatory schemes that require extensive rulemaking to modify. As a result, the federal and California PSM standards have become static in the face of advancing best practices and technology, with the emphasis placed on the completion of a task or activity rather than achievement of continuous risk reduction.13 Many regions around the world such as the United Kingdom (UK), Australia, and Norway have acknowledged similar deficiencies and have implemented regulatory regimes consisting of both prescriptive14 and goal-setting elements that require duty holders15 to demonstrate to the regulator through rigorous reviews and audits that they have reduced risks to as low as reasonably practicable, or ALARP. This is referred to as the safety case regulatory regime.16 The safety case regulatory regime is a rigorous prescriptive and goal-setting regulatory approach applied globally both onshore and offshore. It is highlighted by its adaptability and requirements for continuous improvement in risk reduction for high hazard industrial facilities. A written case for safety, known as the safety case report, is generated by the duty holder and is generally rigorously reviewed, audited, and enforced by highly technically competent inspectors with skill sets familiar to those employed by the industries they oversee. Despite this global shift, the US has persisted in the use of a more activity-based regulatory scheme that lacks the ability to adapt to advancing technology and recently developed industry standards, and which has failed to adequately engage companies and their employees in continuous improvement and risk reduction with similarly-skilled inspectors. 10 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 11 See Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and Explanation of the Final Rule (March 4, 1992). https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed August 13, 2013). 12 Activity-based standards and regulations require the mere completion of an activity and do not focus on the effectiveness of major accident prevention or risk reduction. 13 As will be discussed below, certain sections of the PSM standard have elements of a performance-based regulatory approach. 14 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 15 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 16 Norway’s offshore regulatory regime is not referred to as the safety case regime, but it does contain many of the same elements as the safety case regime, with some differences in style, substances, and implementation. 9

Chevron Richmond Refinery Regulatory Report October 2014

1. 4

Key Findings Technical

In the ten years prior to the incident, highly knowledgeable and experienced Chevron technical staff repeatedly recommended that inspectors perform 100 percent component inspections on high temperature carbon steel piping susceptible to sulfidation corrosion. These recommendations were not implemented by Chevron management.17

Chevron technical staff recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past recommendations from employees. However, Chevron failed to implement proposed inherently safer recommendations prior to the incident. For example, an inspection recommendation to upgrade piping to 9-Chrome was made, but the MOC to implement the recommendation narrowed the scope, allowing the 52-inch component that failed to remain in service.

In January 2007, a failure due to sulfidation corrosion caused a fire in the Chevron Richmond Refinery crude unit, initiating a shelter-in-place for the surrounding community. A carbon steel piping spool18 failed catastrophically during operation. Chevron informed Contra Costa Health Services’ Hazardous Materials Program19 in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, this upgrade was limited to only the immediate piping spool that had failed. The inherently safer, more corrosion resistant metallurgy was not implemented more broadly in the crude unit as a result of this incident.

Chevron and Chevron Energy Technology Company metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. However, they had limited practical influence to implement their recommendations. They did not participate in the most recent crude unit PHA, and they did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.20

The 2009 crude unit PHA did not identify corrosion as a potential cause of a leak or rupture in piping. The PHA cited non-specific, judgment-based qualitative safeguards to reduce risk, such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.21 The effectiveness of these safeguards was neither evaluated nor 17 These recommendations are discussed in detail in paragraphs 44 through 51 of the Chevron Interim Report. 18 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. 19 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). 20 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown. 21 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. 10

Chevron Richmond Refinery Regulatory Report October 2014

documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel piping could have been recommended.

Regulatory

Following the August 6th incident, California’s Division of Occupational Safety and Health (Cal/OSHA) inspected the Chevron facility and issued citations. Only one citation was related to PHAs; and it was not associated with evaluating the effectiveness of safeguards. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude unit. Had the California PSM standard required documentation of the effectiveness of safeguards, Chevron would have been obligated to conduct this analysis.

There is a significant discrepancy in the compensation between the California regulators and the Chevron Richmond Refinery personnel they interact with. The California regulators also lack the technical staff with the necessary skills, knowledge, and experience to provide sufficient direct oversight of petroleum refineries in California.

The CSB has examined records that demonstrate a considerable problem with significant and deadly incidents at petroleum refineries over the last decade. The EPA has noted 234 recordable accidents at petroleum refineries between 2000 and 2010. This is more than any other industry despite the fact that the nation’s petroleum refineries make up only roughly one percent of the some 13,000 facilities covered by the EPA’s Risk Management Program. In 2007, OSHA stated that according to its IMIS (Integrated Management Information System) database, since May 1992, 36 fatality/catastrophe (FAT/CAT) incidents related to HHC releases in the refining industry occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. This number surpassed the combined total of the next three highest industries over the same period. In 2010, an OSHA official testified to a Congressional Subcommittee that over 20 major incidents resulting in injuries or fatalities across the country occurred between 2005 and 2010, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry. Finally, in 2012 alone, the CSB tracked 125 significant process safety incidents at US petroleum refineries. Seventeen of these took place in California.

Under the existing regulatory regimes for onshore petroleum refineries in the US and California, such as the PSM and RMP programs, there is no requirement to reduce risks to ALARP. For example, under both PSM and RMP an employer must “control” hazards when conducting a process hazard analysis (PHA) of a covered process. However, there is no requirement to address the effectiveness of the controls or the hierarchy of controls. Thus, a PHA that meets the regulatory requirements may inadequately identify or mitigate major hazard risk. In addition, there is no requirement to submit PHAs to the regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed safeguards.

11

Chevron Richmond Refinery Regulatory Report October 2014

The PSM standard does not effectively establish goals to prevent accidents or reduce risk. Only two of the 14 elements (PHA and mechanical integrity) of the PSM standard contain some goal-setting component.

In the last decade, the CSB has made a number of process-safety related recommendations to OSHA and EPA in its investigation reports and studies (e.g. Motiva, BP Texas City, and Reactive Hazards). However, none of the regulatory recommendations have been implemented, and there have been no substantive changes made to the PSM and RMP regulations to improve the prevention of major accidents.

Available data from Norway and the United Kingdom (UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime.22

Regulatory approaches similar to the safety case regulatory regime, which require risk reduction to ALARP or equivalent, have been implemented in the nuclear sector by the Nuclear Regulatory Commission (NRC) and the aerospace sector by NASA.

Independent studies of the safety case regulatory regime in the UK have identified improvements to safety performance from the safety case and a variety of stakeholders, including major oil companies, have shown support of the safety case.23

1. 5

Regulatory Conclusions The existing regulatory regimes for onshore petroleum refineries in the US and California:

Rely on a safety and environmental management system framework that is primarily activity-based rather than requiring goal-based risk reduction to as low as reasonably practicable (ALARP) or equivalent.

Are static, unable to adapt to innovation and advances in the management of major hazard risks.

Do not require that companies effectively manage the risks they create; nor do they require regulator evaluation of the effectiveness of safeguards or regulator acceptance of companies’ plans for controlling those risks.

Do not ensure continuous improvement by effectively incorporating lessons learned from major accidents; nor do they require companies to address newly-identified safety issues as a result of such incidents.

Do not effectively collect or promote industry use of major accident performance indicators to drive industry to reduce risks to ALARP.

22 Norway’s indicator data is discussed in Section 4.5. The UK data is discussed in Appendix C. 23 See Sections 2.0, 3.2.1.2, and 3.2.2.3. Also see FAQ 4. 12

Chevron Richmond Refinery Regulatory Report October 2014

Do not require the use or implementation of inherently safer systems analysis or hierarchy of controls.

Do not effectively involve the workforce in risk reduction and prevention of major accidents.

Do not provide the regulator with the authority to accept or reject a company’s hazard analysis, risk assessment, or proposed safeguards; and

Do not employ the requisite number of staff with the technical skills, knowledge, and experience to provide sufficient direct safety oversight of petroleum refineries.

1. 6

Recommendations As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized below, to the state of California:

California State Legislature, Governor of California

Enhance and restructure California’s process safety management (PSM) regulations for petroleum refineries by including the goal-setting attributes identified in this report for petroleum refineries in the state of California.

Mayor and City Council, City of Richmond, California

Establish or cause to be established a compensation system to ensure regulator capability in process safety oversight and policy development in Richmond, California.

Board of Supervisors Contra Costa County, California

Establish a compensation system to ensure regulator capability in process safety oversight and policy development in Contra Costa County, California.

Section 8.0 details the recommendations. 13

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Introduction

Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction of the thousands of industrial and chemical facilities that exist in the US, the CSB has seen a great number of serious and deadly incidents at refineries over the last decade.

In March 2005, the BP Texas City Refinery suffered one of the worst industrial accidents in recent US history, when overfill of a distillation column resulted in an explosion and fire that led to 15 fatalities, another 180 injuries, and the issuance of a shelter-in-place order that required 43,000 people to remain indoors. Houses were damaged as far as three-quarters of a mile away from the refinery. In a 2006 statement, former CSB Chairwoman Carolyn Merritt said that while BP did make some safety improvements before the March 2005 explosion, “the focus of many of these initiatives was on improving procedural compliance and reducing occupational injury rates, while catastrophic safety risks remained….”24

In November 2009, an explosion at the Silver Eagle Refinery damaged over 100 homes in a nearby subdivision in Woods Cross, Utah. At a public meeting to discuss the incident, former CSB Chairman John Bresland called on refineries to improve their safety performance, stating:

The frequency of accidents in US refineries is very troubling. These accidents cost lives, inflict serious injuries and can harm communities. They also earn scrutiny from government regulators; in the past few weeks a refinery in Texas drew the largest OSHA fine in history, more than US $80 million, for alleged process safety violations. I call on all refineries to redouble their commitment to safer operations and safer communities. The current rate of accidents in refineries is not sustainable and it is not acceptable.25 On the five-year anniversary of the BP Texas City explosion in March 2010, Chairman Bresland continued to relay his concern regarding refinery safety, noting that “refinery accidents…continue to occur with dismaying frequency…[and] will only stop when every refinery has made the financial and human commitment to sound process safety management.”26 Yet just ten days later, seven workers were fatally injured at the Tesoro refinery in Anacortes, Washington, following the catastrophic failure of a heat exchanger. Again, Chairman Bresland pointed out the alarming frequency of refinery incidents, stating that “if the aviation industry had the same number and types of incidents as the refining industry, I don’t think people would be flying too much.”27 24 Scrutiny Finds BP Safety Troubles. http://usatoday30.usatoday.com/money/industries/energy/2006-10-30-bp- blast-findings_x.htm (accessed September 5, 2013). 25US Refineries Commitment to Safety Called Into Question. http://www.engineerlive.com/content/22354 (accessed September 5, 2013). 26 http://www.csb.gov/statement-from-csb-chairman-john-bresland-on-5th-anniversary-of-fatal-bp-texas-city-2005- explosion/?pg=18 (accessed September 5, 2013). 27Refinery Tragedies All Too Common. See http://seattletimes.com/html/localnews/2011518449_safetysunday04m.html (accessed September 5, 2013) 14

Chevron Richmond Refinery Regulatory Report October 2014

On June 10, 2010, OSHA Deputy Assistant Secretary Jordan Barab testified before the Senate Committee on Health, Education, Labor and Pensions’ Subcommittee on Employment and Workplace Safety regarding worker safety in US energy production industries. Mr. Barab noted that OSHA had counted over 20 major incidents resulting in injuries or fatalities across the country that had occurred within the last five years, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry.28 According to Mr. Barab, “[t]his cycle of workers being hurt or killed because their employers failed to implement well-known safety measures points out major deficiencies in chemical process safety management in the nation’s refineries and, quite possibly, to systemic safety and health problems in the entire petrochemical industry.”29 According to OSHA’s compliance instruction document CPL-03-00-00430 on the OSHA Petroleum Process Safety Management National Emphasis Program (NEP) issued in 2007, Since the PSM standard was promulgated by OSHA in 1992, no other industry sector has had as many fatal or catastrophic incidents related to the release of HHC [highly hazardous chemicals] as the petroleum refining industry []. According to OSHA's IMIS [Integrated Management Information System] database, since May 1992, 36 fatality/catastrophe (FAT/CAT) incidents related to HHC releases in the refining industry have occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. The number of refinery FAT/CAT incidents surpasses the combined total of the next three highest industries over the same period (SIC 2899 Chemical Manufacturing, Not Elsewhere Classified (NEC) – 12 FAT/CATs; SIC 2869 Industrial Organic Chemical Manufacturing, NEC – 12 FAT/CATs; and SIC 2892 Explosive Manufacturing – 11 FAT/CATs).31 In 2012 alone, the CSB tracked 125 significant32 process safety incidents at US petroleum refineries, which are listed in Appendix A. Seventeen of these took place in California, including a major release of 8,614 pounds of highly toxic hydrogen sulfide at the Chevron Richmond Refinery on August 2, 2012, just four days prior to the incident. Of the 14 major accidents that the CSB is currently investigating, five occurred in petroleum refineries. These include two separate explosions at the Silver Eagle refinery in Woods Cross, Utah, which resulted in injuries and offsite consequences, and a series of equipment failures at CITGO’s refinery in Corpus Christi, Texas, involving highly toxic hydrogen fluoride. In May 2014, the CSB released its final 28 Jordan Barab’s Congressional testimony is available at http://www.dol.gov/ocia/congressionaltestimony/20100610_JBarab.htm (accessed January 7, 2014). 29 Ibid. 30 OSHA Instruction CPL 03-00-004. Petroleum Refinery Process Safety Management National Emphasis Program. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=3589#VIII (accessed January 7, 2014). 31 Ibid at Section VIII. 32 These incidents were reported to the Department of Energy and/or the National Response Center and examined by the CSB’s Incident Screening Department. The CSB believes that incidents that result in disruptions to the national energy supply, serious injuries, or receive high media attention are all significant. 15

Chevron Richmond Refinery Regulatory Report October 2014

investigation report on the heat exchanger rupture at the Tesoro refinery in Anacortes, Washington, which resulted in seven fatalities. The U.S. Environmental Protection Agency (EPA) has also documented 234 recordable accidents at petroleum refineries between 2000 and 2010. Despite the fact that the nation’s petroleum refineries make up only roughly one percent of the some 13,000 facilities covered by the EPA’s Risk Management Program, they accounted for more incidents in that time period than any other industry, including the much larger sector of chemical manufacturing, which EPA documented as having 218 recordable accidents.33

The CSB concludes that the continuing occurrence of refinery accidents demonstrates the pressing need to examine the current regulatory structure in place in the US and, in light of the Chevron incident, in the state of California for petroleum refineries. There have been a number of positive developments in the wake of the Chevron incident that demonstrate California’s prime opportunity to lead the nation in implementing changes to improve safety and health in the refining industry. In the Fall of 2012 following the Chevron incident, California Governor Jerry Brown created the California Interagency Working Group on Refinery Safety (“the working group”), charged with improving cooperation among agencies, including the EPA, Cal EPA, California’s Division of Occupational Safety and Health (Cal/OSHA), and Contra Costa County, with the goal of improving safety at California’s petroleum refineries and preventing major accidents.

The working group began its initiative by commissioning the Labor Occupational Health Program34 (LOHP) to conduct “listening panels” throughout California, enabling community members to meet with working group members to discuss their concerns surrounding refineries. LOHP convened a series of meetings and conference calls with labor unions, community-based organizations, fire agencies, and environmental health groups between November 6, 2012, and March 18, 2013. Dr. Michael P. Wilson, the former Director of LOHP,35 documented his findings and recommendations regarding refinery safety in a summary report entitled Refinery Safety in California: Labor, Community and Fire Agency Views, which was released on June 4, 2013.36 In the report, Dr. Wilson quoted Swiss Re’s finding that the US has experienced financial losses from refinery incidents that are three times that of industry counterparts in countries within the “EU cluster,”37 a gap which continues to grow due in part to the US refining industry’s “pushing…mode of operation”, its “compliance-driven focus on safety”, and “a ‘detached’ workforce….”38 33 Matthiessen, Craig. EPA Risk Management Program: An Overview of the EPA Risk Management Program and Inherently Safer Processes. NAS-MIC Bayer Public Meeting Power Point Presentation; May 24, 2011; p 20. 34 LOHP is a public service program for the Center for Occupational and Environmental Health at UC Berkeley’s School of Public Health. LOHP seeks “to reduce occupational injury, illness and death by protecting the health and safety of workers worldwide.” For more information, see http://www.lohp.org/ (accessed July 8, 2013). 35 Dr. Wilson now serves as Chief Scientist in the Office of the Director, California Department of Industrial Relations (DIR). DIR oversees state programs dedicated to protecting the health, safety, and economic security of California’s workers. 36 Dr. Wilson released an initial draft of the summary report on March 27, 2013. He then released a revised copy of the summary report on June 4, 2013. See http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 37 The countries in the EU cluster are all of Europe, Singapore, South Korea, Japan, Saudi Arabia, Gulf States and Egypt. 38 Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013; pp 5 and 6. Citing Zirngast, Ernst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT- 16

Chevron Richmond Refinery Regulatory Report October 2014

Dr. Wilson reiterated a number of the findings contained in the CSB’s Interim Report on the Chevron incident, including the “striking lack of attention on the part of the Richmond Chevron refinery to maintenance and metallurgy upgrades…,” and the Chevron Richmond Refinery’s failure to implement a recommended 100% component inspection program for high-risk piping. He also stated that California’s refineries are able to operate without demonstrating competence in health, safety, and environmental performance to a regulatory agency or to the public, and as such recommended that California establish a regulatory approach similar to that of the safety case regulatory regime, a rigorous prescriptive39 and goal-setting40 regulatory regime used widely by other regions throughout the world such as the United Kingdom (UK) and Australia to regulate high hazard industrial facilities. It is highlighted by its adaptability and requirements for continuous improvements in risk reduction, places the duty on industry to demonstrate its competence in health and safety to the regulator. The regime is overseen by highly competent, well-funded regulators that rigorously audit facilities for compliance with the written safety case report and good industry practice.

On July 11, 2013, the working group released a draft report entitled Improving Public and Worker Safety at Oil Refineries,41 which the CSB has recognized as an important step forward in improving petroleum refinery safety and environmental performance both in California and nationally. The report outlined the process of adopting several of the CSB‘s recommendations from its Interim Report on the Chevron incident, including requiring refineries to implement inherently safer systems and conduct damage mechanism hazard reviews. Furthermore, the report announced the creation of an Interagency Refinery Task Force within the California Environmental Protection Agency (Cal/EPA) by September 1, 2013, aimed at facilitating information sharing and improving coordination of oversight and enforcement activities among regulatory agencies. The CSB welcomed the report’s recommendation for California to study the safety case regulatory approach.

In addition to the work being done by the working group, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at least 15 new positions in Cal/OSHA’s Process Safety Unit, which enforces the California Process Safety Management (PSM) standard throughout the state.42

The Chevron incident also spurred the formation of the City of Richmond’s Refinery Action Collaborative (“the collaborative”), which was launched on January 30, 2013. The collaborative, whose EXTRACT. Risk Engineering Services, Swiss Re. http://coeh.berkeley.edu/people/apers_educ/docs/LOHPRefinery%20Safety.pdf (accessed December 30, 2013). 39 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 40 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 41 See http://www.calepa.ca.gov/Publications/Reports/2013/Refineries.PDF (accessed September 25, 2013). 42 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 17

Chevron Richmond Refinery Regulatory Report October 2014

members include the United Steelworkers43 (USW) Local 5, the USW International, Communities for a Better Environment,44 and LOHP,45 was launched after a preliminary exploratory meeting held in October

1. The collaborative advocates for community and worker safety, better transparency, and

environmental health, and has already made recommendations to the working group to improve emissions reporting and require more thorough assessments of pipe corrosion damage at oil refineries.46

On October 10, 2013, the collaborative formally responded in a memo to the July 2013 draft report issued by the Interagency Working Group on Refinery Safety (Improving Public and Worker Safety at Oil Refineries). In the memo, the collaborative stated its support for the working group’s findings and recommendations. The collaborative also issued its own recommendations and highlighted 12 principles as being important to the development of effective regulatory policy in California. These principles include linking regulatory non-compliance to an operator’s license to operate and integrating meaningful participation in decision-making by workers and communities.47 The collaborative also noted in the memo that it supported “shifting the ‘burden of proof’ of safety from public agencies to the industry, as is required in the ‘Safety Case’ approach….”48

The CSB noted in its Chevron Interim Report the important role of transparency between industry and the public in improving health and safety for the facility and the surrounding communities. Following the Chevron incident the collaborative, worker representatives, regulators, and governmental bodies played a key role in driving transparency, accountability, and improved risk reduction during the decision-making process related to crude unit piping repairs. The CSB recommended to the California State Legislature in the Interim Report to establish a multi-agency process safety regulatory program for all California petroleum refineries to further improve public accountability and transparency by establishing a system to report to the regulator methodologies, findings, conclusions, and corrective actions related to refinery mechanical integrity inspection and repair work arising from California petroleum refinery PHAs, turnarounds, and maintenance-related shutdowns.49 This system would require reporting of information such as damage mechanism hazard reviews, establish procedures for greater workforce and public participation, and provide mechanisms for federal, state, and local agency operational coordination, 43 The USW is the largest industrial union in North America and has approximately 1.2 million active and retired members in the US, Canada, and the Caribbean. For more information see http://www.usw.org/ (accessed July 17, 2013). 44 Communities for a Better Environment is an “environmental justice organization[s]” in California which has the mission of “build[ing] people’s power in California’s communities of color and low income communities to achieve environmental health and justice by preventing and reducing pollution and building green, health and sustainable communities and environments.” See http://www.cbecal.org/about/mission-vision/ (accessed August 14, 2013). 45 Other members of the collaborative include the BlueGreen Alliance (a coalition of labor unions and environmental groups that advocate for a green economy and safer workplaces), the National Resources Defense Council, and the Asian Pacific Environmental Network. 46 See http://richmondconfidential.org/2013/02/20/labor-and-environmental-groups-join-forces-on-refinery-issues/ (accessed July 9, 2013). 47 Refinery Action Collaborative. Initial Response of the Collaborative to the Findings & Recommendations of The July 2013 Draft Report of the Interagency Working Group on Refinery Safety, Governor Jerry Brown. October 10, 2013; p 10. 48 Ibid at 7. 49 Under the existing federal and California state PSM standards, this information is not currently made publicly available. 18

Chevron Richmond Refinery Regulatory Report October 2014

sharing of data, and joint accident prevention activities. California is actively working to implement this recommendation through the creation of the Interagency Refinery Task Force mentioned above.

It is also important to note that a growing dialogue has emerged throughout the US surrounding the need to improve the regulation of hazardous materials and processes, to which the CSB has been an important contributor. The CSB first examined the safety case in its 2002 investigation report entitled Improving Reactive Hazard Management50 as a potentially effective alternative framework for the regulation of reactive hazards. The CSB noted that successful implementation of this “comprehensive” regulatory approach required a competent and experienced regulator. In December 2010, the CSB held a public hearing in Washington, DC on the Regulatory Approaches to Offshore Oil and Gas Safety, where internationally recognized experts in industrial safety and accident analysis provided important testimony on managing risks offshore.51 Much of this testimony supported the implementation of the safety case as a model for regulating major hazards, both onshore and off. For example, a Shell Oil Company representative testified that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers52 and controls. In July 2012, the CSB held an additional public hearing on Safety Performance Indicators.53 A number of international regulators testified on the regulator’s ability under the safety case to drive continuous improvement in the oil and gas industry. Finally, on July 25, 2013, the CSB held a public meeting to discuss the U.S. Occupational Safety and Health Administration’s (OSHA’s) failure to implement a number of key CSB safety recommendations made to OSHA in the last decade to revise and improve its Process Safety Management (PSM) standard and to issue a new combustible dust standard.

On January 18, 2011, President Obama issued Executive Order 13563,54 which called for improvements in the nation’s regulatory system to promote predictability and reduce uncertainty and to use the best, most innovative, and least burdensome tools for achieving regulatory ends. Specifically, it directed that agencies review existing and proposed standards and regulations to ensure they effectively protect “public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”55 Finally, the order emphasized that to the extent feasible, regulations and standards should specify performance objectives rather than the behavior or manner of compliance that regulated entities must adopt, and be adopted through a process that involves public participation. As a result of this Executive Order, OSHA, the Bureau of Safety and Environmental Enforcement (BSEE), the EPA, the Department of Transportation’s Pipeline and Hazardous Materials Safety Administration 50 A full copy of the report is available at http://www.csb.gov/improving-reactive-hazard-management/ (accessed July 10, 2013). 51 For a copy of the transcript from the CSB Public Hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, see http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed August 14, 2013). 52 A barrier is a “technical, operational and/or organizational element[] which individually or collectively reduce[s] opportunities for specific error, hazard or accident to occur, or which limits its harm/drawbacks.” Petroleum Safety Authority. Safety Status & Signals, 2012-2012; 2013; p 31. 53 For the proceedings of the CSB Public Hearing on Safety Performance Indicators see http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 54 Improving Regulation and Regulatory Review. Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.archives.gov/federal-register/executive-orders/2011.html (accessed July 10, 2013). 55 Ibid. 19

Chevron Richmond Refinery Regulatory Report October 2014

(PHMSA), and the U.S. Coast Guard (USCG) solicited views from the public and stakeholders regarding opportunities to address improving efficiency and effectiveness of safety and environmental regulations and standards in the oil and gas industry.56 These five agencies then convened an expert forum57 in September 2012 in Texas City, Texas, to explore the benefits of implementing goal or performance-based regulatory models such as the safety case in the oil and gas industry, and ways to advance the use of such models in the US. The forum included a discussion of the safety case regulatory regime as a performance-based regulatory model, and industrial safety and accident analysis expert Dr. Andrew Hopkins spoke in support of that model.

In the wake of the April 2013 explosion and fire that occurred at a fertilizer storage and distribution facility in West, Texas, and resulted in fifteen fatalities and hundreds of injuries, President Obama issued Executive Order 1365058 on August 1, 2013. The Executive Order established the Chemical Facility Safety and Security Working Group, a working group of federal agencies59 tasked with, among other things, developing options for enhancing and modernizing policies, regulations, and standards to improve the safety and security of chemical facilities.60 As will be discussed in Section 4.3, the group has included the safety case regulatory model in a list of potential actions it may consider taking to improve chemical safety regulation.61

The CSB has utilized a broad range of expert testimony and research to gain a comprehensive understanding of regulatory models for onshore and offshore oil and gas facilities in countries around the world, and, in light of this investigation, the state of California. This report highlights the significant attributes of the safety case regime that together result in a more effective regulatory approach to process safety and risk reduction. It also provides a detailed contrast of the safety case regulatory model to the existing regulatory structures in the US and California, and makes recommendations to improve California’s regulatory oversight of its petroleum refineries and to promote a broader national dialogue on the safety case regulatory approach.

56 For more information see https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed July 10, 2013). 57 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed August 13, 2013). 58 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 2013). https://www.federalregister.gov/articles/2013/08/07/2013-19220/improving-chemical-facility-safety-and-security (accessed January 7, 2014). 59 The working group includes the EPA, the Department of Justice, the Department of Agriculture, the Department of Transportation, and the Department of Labor. 60 See Section 6 of the Executive Order. 61 See Working Group response to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 20

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 The Safety Case Regulatory Regime
2. 1

Introduction Throughout modern history, major industrial accidents have been catalysts for significant regulatory reform, as countries around the world strive to mitigate risk and improve the safety of their facilities and processes in order to protect human health and the environment. According to industrial safety and accident analysis expert Dr. Andrew Hopkins, “[d]isasters…offer an unparalleled opportunity to study the workings of an organisation and to identify where things are going wrong.”62 Around the world, many of these large-scale incidents have resulted in sweeping changes to legislation surrounding industrial safety and health. These changes replace prescriptive, compliance-based regulations with goal-setting regulations supplemented by prescriptive requirements that support adaptability, require duty holders63 to demonstrate to the regulator that they have driven risks to as low as reasonably practicable (ALARP) or equivalent, and provide the regulator with the tools to drive continuous improvement among major hazard facilities.64 A majority of these regulatory regimes are referred to as the safety case, which Dr. Hopkins defines as: a case which the operator of a hazardous facility makes to the regulator, setting out how safety is to be managed. It must include details of the hazard identification process, the hazards which have been identified and the procedures which have been set in place to control them. The system remains self-regulatory in principle but rather than the facility being left to its own devices by the regulator it must convince the regulator that its strategy for managing safety is satisfactory [emphasis added]. Under any safety case regime, facility operators are expected to adopt best practice risk management.65 The safety case regulatory regime is much more than a written report; it shifts risk management responsibility to the company and its employees and provides for rigorous review and oversight by a technically competent regulator to ensure effective implementation.66 62 Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999; p 1. 63 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 64 Major hazard facilities are workplaces that store, handle or process large quantities of hazardous material. Incidents at such facilities have the potential to cause serious damage to employees, people in surrounding areas, and the environment. See http://www.pc.gov.au/__data/assets/pdf_file/0018/82350/21-appendixd.pdf (accessed May 9, 2013). 65 Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online]; p 7. http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%20presentati on/Lonford%20talk.PDF (accessed May 8, 2013). 66 The CSB notes that that the burden is currently on the PSM regulator to verify compliance with existing regulations, which is primarily done following an incident or complaint. Rarely is this done proactively under the 21

Chevron Richmond Refinery Regulatory Report October 2014

The remaining portions of Section 3 will introduce major accidents that have occurred around the world and discuss the history behind the global development and implementation of the safety case regulatory approach on and offshore. Section 4.0 will then highlight major attributes of the safety case regulatory approach. The US regulatory model will also be introduced and discussed throughout these sections to allow for comparisons between the different approaches. Finally, Section 5.0 will discuss the regulation of petroleum refineries in California specifically, including Chevron. The report concludes with important recommendations focused on improving the regulatory oversight of California’s 14 refineries, and encouraging OSHA, industry, labor, and others to work together to improve the regulation of petroleum refineries throughout the US. 3.2 Initial Safety Case Implementation 3.2.1 United Kingdom 3.2.1.1 Onshore Two major onshore incidents in the 1970s helped spark legislative reform focused on major accident prevention and risk reduction for onshore major hazard facilities. A large dioxin67 release in Seveso, Italy, in 1976, which injured hundreds of individuals, led the European Commission68 to adopt legislation in 1982 known as the Seveso Directive, aimed at the prevention and control of major industrial accidents.69 Following the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, and the Sandoz chemical plant fire near Basel, Switzerland, which injured 14 individuals and released nearly 30 tons of pesticides into the Rhine River, turning it red, the Seveso Directive was amended and replaced in 1996 with the Seveso II Directive.70 The regulation requires owners or operators of facilities that contain threshold quantities of listed substances to submit safety reports to a competent authority (CA) within a Member State of the European Commission for its review and acceptance.71 These reports must demonstrate to the CA that major-accident prevention policies, safety management systems, and internal emergency plans have been created and implemented.72 The current system. The Refinery NEP is a primary example of proactive inspections to verify compliance. It was discontinued in 2011. 67 The term Dioxin refers to a family of toxic chemicals. They have been characterized by EPA as likely to be human carcinogens and are anticipated to increase the risk of cancer at background levels of exposure. See http://www.epa.gov/pbt/pubs/dioxins.htm (accessed June 17, 2013). 68 The European Commission consists of 27 Commissioners and “represents the interests of the EU [European Union] as a whole. It proposes new legislation to the European Parliament and the Council of the European Union, and it ensures that EU law is correctly applied by member countries.” http://ec.europa.eu/atwork/index_en.htm (accessed May 6, 2013). 69 See http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 70 The Seveso Directive was adopted in 1982 and was amended twice, in 1987 and 1988. On December 9, 1996, the Seveso II Directive was adopted and replaced the original Seveso Directive. The Seveso III Directive was then adopted on July 4, 2012, and became effective on August 13, 2012. Member States must implement Seveso III by June 1, 2015. http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 71See http://ec.europa.eu/environment/seveso/legislation.htm (accessed May 6, 2013). 72 Seveso II Directive, Article 9 (1996). Available at http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013). 22

Chevron Richmond Refinery Regulatory Report October 2014

regulation also requires owners or operators to “prove to the competent authority…that he has taken all measures necessary as specified in this Directive.”73 On June 1, 1974, the Flixborough Works of Nypro (UK) Limited experienced a massive cyclohexane vapor cloud explosion, killing 28 workers and injuring 36 workers and hundreds of members of the public offsite. This incident along with the Seveso incident led to the Seveso Directive in 1982, and this was converted into legislation in the United Kingdom (UK) via the Control of Industrial Major Accident Hazards (CIMAH) 1984 Regulations. The Control of Major Accidents74 Hazards Regulations (COMAH) replaced CIMAH in April 1999 to conform to the updated Seveso II Directive. The Health and Safety Executive75 (HSE), the Environment Agency76 (EA), and the Scottish Environmental Protection Agency77 (SEPA) are considered to be the UK’s CA responsible for the enforcement of these regulations. A key feature differentiating these two regulations is the increasing emphasis from the operator having to “describe” the safety systems in CIMAH to being required to “demonstrate” their adequacy in COMAH.78 73 Seveso II Directive, Article 5, Paragraph 2 (1996). Available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013). 74 The COMAH regulations define “major accident” as “an occurrence (including in particular, a major emission, fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances…” COMAH Regulations, Part 1, Regulation 2 (2005). 75 HSE is an independent regulator, and “act[s] in the public interest to reduce work-related death and serious injury across Great Britain’s workplaces.” See http://www.hse.gov.uk/aboutus/ (accessed May 7, 2013). According to the HSE’s Enforcement Policy Statement, the HSE’s purpose is “to protect the health, safety and welfare of people at work, and to safeguard others, mainly members of the public, who may be exposed to risks from the way work is carried out.” http://www.hse.gov.uk/pubns/hse41.pdf (accessed May 7, 2013). 76 EA is an Executive Non-departmental Public Body responsible for protecting the environment and promoting sustainable development. For more information see http://www.environment-agency.gov.uk/default.aspx (accessed July 17, 2013). 77 SEPA is Scotland’s environmental regulator, aimed at protecting and improving the environment. For more information see http://www.sepa.org.uk/ (accessed July 17, 2013). 78 COMAH Regulations. Schedule 4, Part 1. Purpose of safety reports is to “1. demonstrate[e] that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2; 2. Demonstrate[e] that major accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for persons and the environment; 3. Demonstrate[e] that adequate safety and reliability have been incorporated into the – (a) design and construction, and (b) operation and maintenance, of any installation and equipment and infrastructure connected with its operation which are linked to major accident hazards within the establishment.…” (2005). 23

Chevron Richmond Refinery Regulatory Report October 2014

The COMAH regulations apply to all onshore facilities that have sufficient quantities of dangerous substances as listed in Schedule 179 of the regulations.80 The general duty for all duty holders of facilities covered under the COMAH regulations is to “take all measures necessary to prevent major accidents and limit their consequences to people and the environment.”81 The HSE interprets this duty as the equivalent of reducing risks82 to “as low as reasonably practicable,” or ALARP.83,84,85 Duty holders are required to prepare a safety report that “demonstrate[s] to the CA that all measures necessary for the prevention and mitigation of major accidents have been taken.”86 These reports must contain information for the CA to review and analyze, including a policy on preventing and mitigating major accidents; a management system for implementing that policy that complies with good practice;87 an effective method for identifying any major accidents that might occur; and measures to prevent and mitigate major accidents.88 To assist operators with reducing risks to ALARP, the HSE publishes guidance documents that contain good practice guidelines and standards and that discuss what constitutes good practice.89 79 Available at http://www.legislation.gov.uk/uksi/1999/743/schedule/1/made (accessed June 17, 2013). 80 COMAH Regulations, Part 1, Regulation 3 (2005). 81 COMAH Regulations, Part 2, Section 4 (2005). 82 HSE describes “risk” as “the likelihood that a hazard will actually cause its adverse effects, together with a measure of the effect.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 83 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed May 15, 2013). 84 The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974. It requires employers to ensure that risks to employees and others are reduced “so far as is reasonably practicable,” or SFAIRP. Health and Safety at Work etc. Act, Part I, Section 2 (1) and (2) (1974). HSE has interpreted that SFAIRP duties call for the same set of tests to be applied as duties to reduce risks “as low as reasonably practicable,” or ALARP. According to HSE, “”the two terms mean essentially the same thing and at their core is the concept of ‘reasonably practicable’;…” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 85 According to HSE, the concept of “reasonably practicable” “involves weighing a risk against the trouble, time and money needed to control it. Thus, ALARP describes the level to which [they] expect to see workplace risks controlled.” This allows HSE to “set goals for duty-holders, rather than being prescriptive; HSE’s policy is that any proposed regulatory action should be based on what is reasonably practicable.” According to HSE, in most situations, deciding whether the risks are ALARP involves a “comparison between the control measures a duty- holder has in place or is proposing and the measures [they] would normally expect to see in such circumstances i.e. relevant good practice. ‘Good practice’ is defined as ‘those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.’… Once what is good practice has been determined, much of the discussion with duty-holders about whether a risk is or will be ALARP is likely to be concerned with the relevance of the good practice, and how appropriately it has been (or will be) implemented.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 86COMAH Regulations, Schedule 4, Part 1 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 87 HSE defines “good practice” as “those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.” HSE, “Assessing compliance with the law in individual cases and the use of good practice,” May 2003. Available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 88 COMAH Regulations, Schedule 4, Part 2 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 89 Such as HSE’s “Guidance for the topic assessment of the major accident hazard aspects of safety cases,” published in April 2006, and HSE’s “Assessing compliance with the law in individual cases and the use of good practice,” May 2003, available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 24

Chevron Richmond Refinery Regulatory Report October 2014

1. 2.1.2

Offshore The international offshore energy sector experienced several catastrophic incidents in the 1980s, including the Alexander Kielland 90 incident in Norway in 1980 which resulted in 123 fatalities, and the Piper Alpha91 incident in the UK in 1988, which fatally injured 167 workers. These incidents initiated offshore regulatory changes focused on risk reduction and control that were modeled after the CIMAH regulations. Following the Piper Alpha incident, the UK Secretary of State for the Department of Energy ordered that a public inquiry be held to determine the circumstances surrounding the incident.92 The Secretary directed Lord Cullen, a Senator of the College of Justice in Scotland, to hold the inquiry and report to the Secretary “the circumstances of the accident and its cause together with any observations and recommendations which he thinks fit to make with a view to the preservation of life and the avoidance of similar accidents in the future.”93 The result was The Public Inquiry into the Piper Alpha Disaster (“the Cullen Report”), an extensive report released in October 1990. The report called into question the adequacy of the detailed prescriptive regulatory regime that existed at the time of the incident94 for offshore oil and gas operations, and listed 106 recommendations to revamp offshore safety regulation in the UK, 57 of which the HSE was responsible for overseeing.95 The Cullen Report found that the operating company (Occidental Petroleum, a US company), “did not possess any system which ensured that such remote, but potentially disastrous, events were subjected to systematic scrutiny…[and] there was for major projects no comprehensive system of safety assessment and management did not appear to appreciate fully the contribution which it could make.”96 The report noted that there was a need for a formal safety assessment (FSA), “an assessment essentially equivalent to the Safety Case,”97 which “involves the identification and assessment of hazards over the whole life cycle of a project…[because]…the combinations of potential hardware and human failures are so numerous that a major accident hardly ever repeats itself…[and] [a] strategy for risk management must [] address the entire spectrum of possibilities.”98 90 The Alexander Kielland was a flotel for housing workers. A total of 212 people were on board when it capsized near the Edda platform in the Ekofisk area of the North Sea on March 27, 1980. As a result of this incident, 123 individuals lost their lives and only 89 survived. 91 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the platform. This incident became the deadliest accident in the history of the offshore industry. 92 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iii. 93 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iv. 94Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 27. 95 Oil &Gas UK. Piper Alpha: Lessons Learnt; 2008; p 2. 96 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 275. 97 Lord Cullen describes the Safety Case as “a means by which an operator demonstrates to itself the safety of its activities…[and] as the basis for the regulation of major hazard activities…” Ibid at 276-277. 98 Ibid. 25

Chevron Richmond Refinery Regulatory Report October 2014

In his analysis, Lord Cullen noted that the current offshore regulations were prescriptive in nature rather than goal-setting, and that this had the effect of hampering operators’ flexibility and stifling innovation.99 He stated that “one of the reasons for adopting the goal-setting approach was to make regulations that were more flexible, so that changing technology could be accommodated without the need for new legislation.”100 Lord Cullen pointed to the CIMAH Regulations, discussed above, as a forward-looking regulatory model, which required onshore major hazard installation operators to “provide HSE with a written report on the safety of the installation…commonly called the Safety Case.”101 Lord Cullen noted that the safety case “is a means by which an operator demonstrates to itself the safety of its activities…[and] also serves as the basis for the regulation of major hazard activities.”102 Lord Cullen concluded that an FSA “is an essential element in a modern safety regime for major hazard installations…that this FSA should take the form of a Safety Case…[and that] [t]he regime should have as its central feature demonstration of safe operation by the operator.”103 He recommended that a safety case regulatory regime be implemented offshore for both fixed and mobile installations as it already was for onshore major hazard installations, that it be complemented by other regulations dealing with specific features, that the safety case contain goal-setting regulations, and that it be part of a continuing dialogue between the operator and the regulatory body.104 Lord Cullen recommended the implementation of safety regulations requiring the owner or operator of every fixed and mobile installation operating in UK waters to submit a safety case to HSE. In response, the UK established the Offshore Installations (Safety Case) Regulations in 1992.105 The primary goal of these Regulations was “to reduce the risks from major accident hazards to the health and safety of the workforce employed on offshore installations or in connected activities.”106 Oil & Gas UK, 107 the main UK offshore oil industry trade association whose members include the major oil companies that operate in the Gulf of Mexico (such Shell and Exxon), has expressed strong support for the safety case regime. In its response to the European Commission’s published draft legislative proposals to modify offshore safety case regulations, Oil & Gas UK noted that those proposals would undermine the “proactive, flexible and responsive approach to managing risks, borne out of the lessons learnt from Piper Alpha as well as the evolving nature of the offshore oil and gas business itself.”108 In the wake of the Macondo incident in the Gulf of Mexico, the UK government directed Professor Geoffrey 99 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 339. 100 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 364. 101 Ibid at 276. 102 Ibid at 276 and 277. 103 Ibid at 282. 104 Ibid at 283 and 284. 105 The 1992 Regulations have since been replaced by the Offshore Installations (Safety Case) Regulations 2005, which were effective as of April 6, 2006. The objective of the revisions in 2005 was “to improve the effectiveness of the regulations whilst at the same time reducing the burden of three yearly resubmissions.” Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. 106 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

107 See http://www.oilandgasuk.co.uk/aboutus/aboutus.cfm (accessed December 10, 2013). 108 Oil & Gas UK. European Commission Proposed Regulation on Offshore Safety and Related Issues: Oil & Gas UK Position Paper. November 2011; p 1. http://www.oilandgasuk.co.uk/ProposedEURegulation.cfm (accessed December 10, 2013). 26

Chevron Richmond Refinery Regulatory Report October 2014

Maitland of Imperial College London to lead an independent review of the offshore safety case regime in the UK.109 In the report stemming from the review, which highlighted strengths of the safety case regime as well as recommendations for improvement, Professor Maitland commended the UK’s “‘goal-setting’ safety regime and its ability to foster innovation and continuous improvement in process integrity…”110 and noted that the UK authorities, including the HSE, are held in high regard by both the UK operators and international observers.111 3.2.2 Global Analysis of Safety Case Implementation 3.2.2.1 Australia 3.2.2.1.1 Offshore Following the Piper Alpha disaster in 1988, the then Australian Commonwealth Minister for Resources at the time, Senator Peter Cook, formed a Consultative Committee on Safety in the Offshore Petroleum Industry to advise him on safety issues surrounding offshore operations in Australia. In 1991, the Committee released its Report of the Consultative Committee on Safety in the Offshore Petroleum Industry.112 In the report, the Committee examined the circumstances, causes, and recommendations described in both the Cullen Report and Esso Australia’s113 investigation report on a fire that occurred on the Tuna platform in April 1989 in Bass Strait that injured four individuals. The Committee noted that while there were many differences between the two incidents, they “both demonstrated the need for greater attention to the management of safety in a number of areas of offshore operations.”114 They pointed to the safety case as an important regulatory concept that should be applied to oil and gas operations in Australian waters, and concluded by recommending that the safety case concept described by Lord Cullen and carried out onshore by the Seveso Directive and CIMAH regulations be adopted for Australian offshore petroleum operations.115 It would “require the operator of a facility to formally document how safety is to be managed within the facility, [and] [] demonstrate that the major hazards of the installation have been identified and appropriate controls provided…”116 The Committee also recommended the implementation of both prescriptive and “objective” regulations.117 At that time, offshore petroleum safety was the joint responsibility of the Commonwealth and the States/Northern Territory. Following this inquiry, new Commonwealth regulations were created: for example, Schedule 109 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed December 10, 2013). 110 Ibid at 3. 111 Ibid at 3. 112 See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 113 Esso was an oil and gas company in Australia that was sold to Mobil Oil Corporation in 1990. It is now part of Exxon Mobil. See http://www.exxonmobil.com/Australia-English/PA/about_who_history_esso.aspx (accessed May 8, 2013). 114 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 2. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 115 Ibid at 25. 116 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 3. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 117 Ibid. 27

Chevron Richmond Refinery Regulatory Report October 2014

8 on “Occupational Health and Safety” was added to the Petroleum Submerged Lands Act (PSLA) in 1992 to require safety cases to be developed for all offshore petroleum facilities. The Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 set out the requirements for the contents of offshore safety cases. The operator of an offshore petroleum facility must submit a safety case for review and acceptance to the Australian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA), the Australian Commonwealth Statutory Agency charged with regulating the health and safety, structural integrity, and environmental management of all offshore petroleum facilities in Australian Commonwealth waters, and in coastal waters where State powers have been reduced. NOPSEMA accepts a safety case “if it is satisfied that the arrangements set out in the document demonstrate that the risks will be reduced to…ALARP.”118 3.2.2.1.2 Onshore In 1998, Esso Australia’s gas plant at Longford in Victoria suffered a major release and fire caused by cold temperature embrittlement due to a process upset and lack of engineering support for diagnosis, which resulted in two fatalities, eight additional injuries, and cut the State of Victoria’s gas supply for two weeks causing major industrial disruption and workforce stand downs. While the safety case at this time was required for offshore operations in Australia, onshore facilities like the Longford plant were subject only to prescriptive provisions contained within the Victoria Occupational Health and Safety Act 1985. In its report on the incident, the Royal Commission concluded that all major hazard facilities in Victoria should be required to develop and submit a safety case to the appropriate regulatory authority. In 1996, Australia’s National Occupational Health and Safety Commission119 (NOHSC) recommended the safety case be adopted for all major onshore hazard facilities in Australia, and in 2002 NOHSC established a National Standard for the Control of Major Hazard Facilities and a National Code of Practice for the Control of Major Hazard Facilities.120 The Standard states that operators of major hazard facilities “shall provide the relevant public authority with a safety report…” that, among other things, identifies the type, relative likelihood and consequences of major accidents that might occur, and provides details of the safety management system (SMS) for that facility.121 In addition, operators of major hazard facilities must identify all major hazards and the risks associated with those hazards, and minimize each risk “so far as practicable.”122 118 See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July 15, 2013). 119 In 1985 The National Occupational Health and Safety Commission (NOHSC) was established as a tripartite body to develop, facilitate and implement a unified national approach to occupational health and safety in Australia. On January 1, 2006, NOHSC was replaced by the Australian Safety and Compensation Council (ASCC). On March 31, 2009, the ASCC was abolished and replaced with Safe Work Australia. Safe Work Australia was established by the Safe Work Australia Act 2008 with the authority to help develop policy to improve worker health, safety, and compensation across Australia. It does not regulate work health and safety laws; rather it develops national policy. See http://www.safeworkaustralia.gov.au/sites/swa/about/pages/about (accessed May 8, 2013). 120 National standards are documents which prescribe preventative action to avert occupational deaths, injuries and diseases; national codes of practice are documents prepared for the purpose of advising employers and workers of acceptable ways of achieving national standards. National Standard for the Control of Major Hazard Facilities [NOHSC: 1014(2002)], p 2. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/271/NationalStandard_ControlMajo rHazardFacilities_NOHSC_1014-2002_PDF.pdf (accessed May 8, 2013). 121 Ibid at 13. 122 Ibid at 12. 28

Chevron Richmond Refinery Regulatory Report October 2014

According to the Australian Safety and Compensation Council’s 2004 Annual Situation Report for the National Standard for the Control of Major Hazard Facilities, all Australian jurisdictions were expected to have the standard in place before the end of 2005, roughly three years after its inception.123 3.2.2.2 Norway Following the capsizing of the Alexander Kielland in 1980, Norway moved in a direction similar to the European Commission and developed performance-based regulations focused on major accident prevention. Although the country did not adopt the safety case regulatory regime per se, the current regulatory approach implements many similar elements. Currently in Norway, the Petroleum Safety Authority124 (PSA) regulates safety for activities at onshore and offshore major hazard facilities, and requires the responsible party125 to reduce risk “to the extent possible,” and “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”126 This concept is akin to ALARP whereby companies choose the solutions and barriers that have the greatest risk-reducing effect, provided the costs are not significantly disproportionate to the risk reduction achieved.127 However, unlike the UK and Australia, PSA regulations do not require the submission of a safety case report by the operator of a facility, although facilities are still expected to develop them and make them available to the regulator upon request for auditing purposes. Rather, PSA “supervises” industry, as explained in the following: Supervision involves much more than audits offshore or on land. It embraces the total contact between the regulator and the regulated. It covers everything which gives the PSA the necessary basis to determine whether the companies are accepting their responsibility to operate acceptably in all phases. Supervisory activities include investigations, considering consent applications and meetings with the industry.128 As will be discussed below, because the safety case regulatory approach requires the regulator to conduct detailed assessments of safety case reports and auditing of facilities against the safety case, its implementation requires substantial funding to support and maintain a sufficient number of highly experienced and competent staff. 123Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004; p1. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationReport_2004. pdf (accessed May 8, 2013). 124 The Petroleum Safety Authority (PSA) is “the regulatory authority for technical and operational safety and for the working environment.” PSA was created in 2004 as a result of a government decision to split the Norwegian Petroleum Directorate (NPD) into two parts. See http://www.ptil.no/main-page/category9.html (accessed May 8, 2013). 125 PSA defines a “responsible party” as “[t]he operator and others participating in activities covered by these regulations, without being a licensee or owner of an onshore facility.” Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 6(a). Definitions. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 126 PSA. Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 11, Risk Reduction Principles. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 127 Ibid. 128 http://www.ptil.no/supervision/what-is-supervision-article8519-88.html (accessed June 3, 2013). 29

Chevron Richmond Refinery Regulatory Report October 2014

1. 2.2.3

The United States Despite the international shift to the safety case regime and even though major oil companies that operate both onshore and offshore in the US also operate globally under safety case regimes and have shown support for the safety case,129 the US has persisted in the use of a more activity-based regulatory scheme that does not contain a specific risk reduction target and that lacks the ability to adapt to advancing technology and recently developed industry standards. Due to the major potential hazards present in onshore and offshore oil and gas operations, these sectors should have in place adaptable safety regimes that adequately engage companies and their employees in continuous improvement and risk reduction. As the CSB has devoted extensive time and resources to studying and analyzing the regulation of offshore oil and gas facilities in the US as a result of its Macondo incident investigation, this report will focus on the regulation of onshore oil and gas operations in the US and California. On October 23, 1989, a massive explosion and fire occurred at the Phillips 66 Company’s Houston Chemical Complex in Pasadena, Texas, resulting in 23 fatalities and injuring more than 130. In response, the U.S. Department of Labor issued a report to the President and declared, among other things, that the U.S. Occupational Safety and Health Administration (OSHA) would “expedite completion of its rulemaking requiring employers to implement comprehensive chemical process safety management plans for hazardous chemical processes.”130 Sparked by a number of serious accidents, including the Phillips 66 incident and the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, OSHA published in the Federal Register (55 FR 29150) on July 17, 1990, a proposed standard containing requirements for the management of hazards associated with processes using highly hazardous chemicals.131 Soon after, Congress adopted the Clean Air Act (CAA) Amendments (CAAA) of 1990, 129A Shell Oil Company representative testified at the CSB December 2010 public meeting on the safety case that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers and controls. Shell Geelong Refinery Plant Manager Huck Poh has stated, “As a Major Hazard Facility, Shell Geelong Refinery and Lara Terminal is required to submit a Safety Case for assessment by Safe Work Victoria. This document is a summary of that Safety Case and explains the potential impact of the facility on our neighbours and the community. We take a systematic approach to managing safety and preventing incidents that place our people, our neighbours, the Geelong community, the environment and our facilities at risk. This is reflected in our Safety Management System and the approach that has been undertaken for the development and review of the Safety Case. Shell is committed to achieving continuous Health, Safety, Security and Environment (HSSE) performance improvement. There are ongoing review and revision activities to ensure our analyses remain relevant and reflect the current status of operations and our risk reduction measures are consistent with latest industry practice. This commitment to continuous improvement is reflected in the Shell HSSE Policy and supported by our HSSE results.” See http://s04.static-shell.com/content/dam/shell-new/local/country/aus/downloads/geelong/safety-case- summary.pdf p3. (accessed December 10, 2013). Esso Longford Plant Manager Monte Olson has stated that “[t]he Safety Case is a systematic and comprehensive review of our operations and processes which includes the identification of potential major incidents that could occur, assesses the risks associated with these major incidents and demonstrates the controls we have in place to manage these risks to as low as reasonably practicable.” See http://www.exxonmobil.com/Australia-English/PA/Files/publication_Longford_Safety_Case_2013.pdf p5. (accessed December 10, 2013). 130 Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990; p ix. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013). 131 Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section 1 – I. Background (March 4, 1992). See http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 10, 2013). 30

Chevron Richmond Refinery Regulatory Report October 2014

which resulted in the creation of the CSB and authorized the first federal regulations specifically designed to prevent major chemical accidents that threaten workers, the public, and the environment: OSHA’s Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency’s (EPA’s) Risk Management Program. 3.2.2.3.1 OSHA PSM Standard Section 304 of the CAAA mandated that OSHA develop “a chemical process safety standard designed to protect employees from hazards associated with accidental release of highly hazardous chemicals in the workplace.”132 OSHA responded by adopting 29 CFR §1910.119 Process Safety Management of Highly Hazardous Chemicals (“the PSM standard”) in 1992. The PSM standard applies to a process133 involving a chemical at or above the listed threshold quantity (also known as a highly hazardous chemical), or flammables in a quantity of 10,000 pounds or more.134 It contains 14 elements with broad requirements to implement management systems, identify and control hazards, and prevent “catastrophic releases of highly hazardous chemicals.” While the PSM standard was intended to be performance-based and does contain some goal-setting elements, a majority of the standard is activity-based, and there is no general duty requirement under the PSM standard to reduce risks to a certain extent or prevent catastrophic accidents. As will be discussed at length in Section 4.3, the PSM standard has essentially remained stagnant since its inception in 1992. According to the Center for Chemical Process Safety (CCPS), the PSM standard has resulted “in a minimum cost, compliance-based approach to managing process safety… ‘If [it] isn’t a regulatory requirement, I’m not going to do it!’”135 A key provision of the PSM standard is the process hazard analysis (PHA) of covered processes. 136 PHA requirements include a review of the process to identify, evaluate, and control the hazards, and an evaluation of the consequences of failure of those controls.137,138 The PHA required by the OSHA PSM standard is an example of a goal-setting requirement in that it allows for a variety of hazard analysis methodologies to be performed to satisfy the requirement. However, the element is activity-based in that completing a PHA for each covered process and updating it at least every five years is satisfactory. The regulator is not responsible for evaluating the effectiveness of controls or safeguards, and there is no requirement to reduce risks to a certain extent such as ALARP. Thus, the resulting PHA that meets the 132 Clean Air Act Amendments of 1990. Section 304(a). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 133 The PSM standard defines “process” as “any activity involving a highly hazardous chemical including any use, storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 29 CFR §1910.119(b) (1992). 134 29 CFR §1910.119(a)(1) (1992). This standard also applies to the manufacture of explosives and pyrotechnics in any quantity [29 CFR §1910.109(k)(2) & (3)]. 135 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 136 A Process hazard analysis is a thorough, orderly, systematic approach for identifying, evaluating, and controlling hazards of processes involving highly hazardous chemicals. The employer must perform an initial process hazard analysis on all processes covered by the PSM standard and all process hazard analyses must be updated and revalidated, based on their completion date, every five years. See http://www.osha.gov/doc/outreachtraining/htmlfiles/psm.html (accessed May 10, 2013). 137 29 CFR §1910.119(e) (1992). 138 The other elements of the PSM standard are process safety information, operating procedures, employee participation, training, contractor safety, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning and response, and compliance audits. The 14th “element” is mainly a requirement that maintaining trade secrecy not interfere with an employer’s compliance with the other 13 elements. 31

Chevron Richmond Refinery Regulatory Report October 2014

regulatory requirements of “controlling” hazards may actually inadequately identify or mitigate the hazards. In addition, there is no requirement for employers to submit their PHAs to the regulator for review. In most cases, this means the regulator will not review these PHAs until there is a significant process accident, a complaint, or a (rare) planned inspection.

Another key element of the PSM standard, the Management of Change (MOC) provision, requires the development of written procedures “to manage changes to process chemicals, technology, equipment, and procedures…”139 The procedures must consider, among other things, the technical basis for a proposed change and its potential impact on safety and health.140 Historically, the MOC requirement has been treated and enforced as an activity-based requirement as well. For example, when the BP Texas City refinery explosion and fire occurred on March 23, 2005, all 15 fatalities and many of the 180 injuries occurred in or around nine contractor trailers that were sited near process areas and as close as 121 feet to the isomerization (ISOM) unit where the incident occurred. The refinery had been using trailers as temporary office spaces for several years. The refinery addressed facility siting for trailers during its 2004 MOC for an upcoming 2005 turnaround. The MOC form indicated that a double-wide mobile office trailer would be temporarily sited in the open area between the ISOM and naphtha desulfurization units (NDU) for use during the upcoming turnaround, to be removed at the end of April 2005. However, the MOC did not analyze siting hazards; rather the MOC team attached a drawing showing the proposed interior configuration of the trailer and measured its location from the catalyst warehouse.141 In early 2005, eight other trailers were sited between the ISOM and NDU without even conducting an MOC. The CSB pointed out in its Urgent Recommendations stemming from the Texas City incident that these trailers could have been easily relocated to less hazardous sites, and BP did so following the incident.142 Despite this fact, BP’s siting policy considered that utilizing trailers in this way posed little or no danger to occupants, which conformed with the American Petroleum Institute’s (API) Recommended Practice (RP) 752, Management of Hazards Associated with Location of Process Plant Buildings.

Although the MOC failed to identify or analyze hazards stemming from siting trailers so close to process areas, OSHA did not cite BP for conducting a poor MOC following the incident, as merely completing the MOC satisfied the requirements of the PSM standard. As it would have been very practical to move the trailers to a safer location, a regulator under the safety case regulatory regime would have the ability to require BP to do just that to reduce risks to ALARP.

The OSHA PSM standard includes requirements for two of its 14 elements – mechanical integrity and process safety information (PSI) – to comply with recognized and generally accepted good engineering practices, or RAGAGEP.143 RAGAGEPs are technologically focused, with no emphasis on 139 29 CFR §1910.119(l)(1) (1992). 140 Id at (l)(2)(i) and (ii) (1992). 141 To learn more about the PHA and MOC processes relating to the BP Texas City Refinery, see the CSB BP Texas City Final Investigation Report at http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 24. 2013). 142 See CSB Urgent Trailer Siting Recommendations at http://www.csb.gov/assets/1/19/BP_Recs_2.pdf (accessed October 24. 2013). 143 RAGAGEPs “are engineering, operation, or maintenance activities based on established codes, standards, published technical reports or recommended practices (RP) or a similar document. RAGAGEPs detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a 32

Chevron Richmond Refinery Regulatory Report October 2014

organizational, human factors, or culture-based measures. OSHA developed the mechanical integrity RAGAGEP requirement to “make sure that process equipment is inspected and tested properly, and that the inspections and tests are performed in accordance with appropriate codes and standards.”144 OSHA has recognized a number of practices, guidelines, and standards as RAGAGEPs, including the American Society of Civil Engineers, Design of Blast Resistant Buildings in Petrochemical Facilities, the Department of Defense, TMS-1300 Structures to Resist the Effects of Accidental Explosions, and the American Petroleum Institute (API) Recommended Practice (RP) 520: Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries.145 Unlike other regulators such as the HSE, OSHA has not compiled a comprehensive list of good practices, or RAGAGEPs, for companies to utilize during operations, and the CSB has only identified two OSHA Letters of Interpretation regarding implementation of RAGAGEP in PSM. According to CCPS, “[o]rganizations lack a thorough understanding of recognized and generally accepted good engineering practices and are inconsistent in interpreting and applying them.”146 In addition, key PSM elements such as PHA, incident investigation, and MOC do not reference RAGAGEP, and have not kept up to date with good practice guidelines, including CCPS’ Guidelines for Risk Based Process Safety, which addresses 20 PSM elements for process safety, including human factors, workforce involvement, and safety culture.

Historically, OSHA has primarily enforced147 RAGAGEP reactively, and may cite companies for violations of RAGAGEPs following an incident. For example, following the BP Texas City Refinery incident, OSHA issued BP hundreds of citations, some of which covered BP’s willful violations of API 520 and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, both considered by OSHA to be RAGAGEPs. Following the Chevron incident, California’s Division of Occupational Safety and Health (Cal/OSHA) issued Chevron two willful citations for allegedly not complying with API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries and Chevron’s own internal corrosion mitigation plan as RAGAGEPs (this will be discussed in greater detail in Section 5.1.2.2).

1. 2.2.3.2 U.S. Environmental Protection Agency Risk Management Program

Section 301(r) of the CAAA called for EPA to develop regulations related to the prevention and detection of accidental releases for regulated substances, including requiring owners or operators of stationary sources that have regulated substances present to prepare and implement a “risk management plan to vessel, inspecting a storage tank, or servicing a relief valve.” OSHA Instruction CPL 03-00-004. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed August 13, 2013). 144 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals, Section 3, Title III. Summary and Explanation of the Final Rule, 1992. Available at http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 6, 2013). 145 All three are cited in OSHA Letter of Interpretation. Applicability of the PSM standard’s mechanical integrity requirements to refinery structures, February 1, 2010. http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=27443 (accessed June 6, 2013). 146 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 147 An exception to this would be OSHA’s NEP that was implemented from 2007 to 2011, where OSHA inspectors cited to RAGAGEP following NEP audits. 33

Chevron Richmond Refinery Regulatory Report October 2014

detect and prevent or minimize accidental releases of such substances from the stationary source.…”148 The risk management plan would require a “hazard assessment to assess the potential effects of an accidental release of any regulated substance.”149 In 1996, EPA promulgated the Risk Management Program regulations at 40 CFR Part 68, which went into effect in 1999.

The EPA’s Risk Management Program requires facilities that contain more than the threshold quantity of any of the 77 listed toxic chemicals or 63 flammable substances150 to prepare and submit to the regulating agency emergency contact information, descriptions of processes and hazardous chemicals onsite, an accident history, and worst-case release scenarios.151 The regulation defines three different Program levels (Program 1, 2, or 3) based on a process unit’s potential for impact to the public and the requirements to prevent accidents.152 Program 3 processes are subject to additional, more stringent requirements to prevent accidents similar to those of the OSHA PSM standard. Program 3 facilities must implement elements of a prevention program, including: process safety information (PSI), PHA, standard operating procedures (SOPs), training, mechanical integrity, compliance audits, incident investigations, MOC, pre-startup reviews, employee participation, and hot work permits. These prevention program elements are based primarily on the OSHA PSM standard, and much of the language contained in each element is identical to the PSM standard. As such, the Risk Management Program regulations contain the same RAGAGEP requirements for mechanical integrity and PSI as the OSHA PSM standard for covered facilities. For example, 40 CFR §68.48 requires an owner or operator to “ensure that the process is designed in compliance with recognized and generally accepted good engineering practices [RAGAGEP].”153 Like OSHA, the EPA is able to cite facilities for failure to comply with RAGAGEP following an incident, but does not maintain a list of RAGAGEPs for reference.

Finally, each covered facility must submit a risk management plan (RMP) to EPA for all covered processes154 and update and resubmit these plans at least once every five years, or whenever a major accident occurs or the emergency contact information changes. Completing and submitting the RMP satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed by the EPA, rendering this another activity-based requirement for a covered facility. There is no approval of the RMP by the EPA, and there is no additional duty on the facility to implement what it says it is doing in the RMP, unlike the safety case regulatory regime.

Any facility with one or more covered processes must include in its RMP an executive summary; the registration for the facility; the certification statement; a worst-case scenario for each process involving flammables or toxics; the five-year accident history for each process; information concerning emergency 148 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 149 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii)(I). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 150According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements of this part no later than the latest of the following dates.…” 151 See 40 CFR §68.12. General Requirements. 152 See 40 CFR §68.10. Applicability. 153 40 CFR §68.48(b) (1999). Additionally see 40 CFR §68.56 (d) which requires the owner or operator‘s inspection and testing procedures to “follow recognized and generally accepted good engineering practices.” 154 40 CFR §68.150 (1999). 34

Chevron Richmond Refinery Regulatory Report October 2014

response at the facility; at least one alternative release scenario analysis for each regulated toxic substance or flammable; a summary of the prevention program for each Program 2 process; and a summary of the prevention program for each Program 3 process.155

The CSB found in its BP Texas City Investigation Report that as of March 2007, the RMP regulation had focused primarily on reviewing the submitted RMPs and required updates by covered facilities. The EPA Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk156 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.157 The EPA OIG also noted that of the 296 uninspected high-risk facilities regulated by the EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.158

1. 2.2.3.3 Safety Case in the United States

In contrast to its mainly activity-based regulation of hazardous chemicals, including oil and gas operations, the US has adopted a more goal-based regulatory approach for its nuclear and aeronautics and space science sectors. The U.S. Nuclear Regulatory Commission (NRC) was an early adopter of goal or performance-based regulation, which it defines as “[a] regulatory approach that focuses on desired, measureable outcomes, rather than prescriptive processes, techniques, or procedures…[and] leads to defined results without specific direction regarding how those results are to be obtained.”159 According to the NRC, performance-based regulations permit licensees to “have flexibility to determine how to meet the established performance criteria in ways that encourage and reward improved outcomes.”160 The NRC’s Reactor Oversight Process, the means by which it achieves its mission of public health and safety in commercial nuclear power plant operations, is its primary 155 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 156 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 157 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 158 Ibid. 159 See NRC Glossary, available at http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-based- regulation.html (accessed June 10, 2013). 160 US NRC NUREG/BR-0303. Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 35

Chevron Richmond Refinery Regulatory Report October 2014

performance-based regulation.161 It uses seven “cornerstones,” such as mitigating systems and barrier integrity, to monitor three performance areas (reactor safety, radiation safety, and security safeguards).162 Licensee performance data, inspection plans, quarterly assessments, and assessment and inspection responses are tied to each performance area and several cross-cutting objectives, such as worker involvement and human performance.163 Licensees are permitted to choose the precise methods they use to meet overarching performance goals, which are guided by their duty to reduce risks to as low as reasonably achievable, or ALARA.164,165 The NRC has stated that this flexibility is one of the main reasons that its regulatory philosophy encourages continuous improvement.166

The National Aeronautics and Space Administration (NASA) has the goal of implementing a safety system that is “as safe as reasonably practicable,” or ASARP,167 which it considers to be closely related to ALARP. NASA relies on a risk-informed safety case, or RISC,168 to ensure that the system’s safety objectives, goals, and thresholds have been achieved, and that safety risk is as low as possible within reasonable impacts on cost, schedule, and performance.169

161 http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html#example (accessed June 13, 2013). 162 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 163 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 164 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 165 ALARA “means making every reasonable effort to maintain exposures to radiation as far below the dose limits in this part as is practical consistent with the purpose for which the licensed activity is undertaken, taking into account the state of technology, the economics of improvements in relation to state of technology, the economics of improvements in relation to benefits to the public health and safety, and other societal and socioeconomic considerations, and in relation to utilization of nuclear energy and licensed materials in the public interest.” 10 CFR §20.1003 (2007). 166 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf 167 NASA defines ASARP as “a fundamental principle of adequate safety. A determination that a system is ASARP entails weighing its safety performance against the sacrifice needed to further improve it. The system is ASARP if an incremental improvement in safety would require a disproportionate deterioration of system performance in other areas.” NASA/SP-2010-580, NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts for Implementation; November 2011; p 5. http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20120003291_2012003429.pdf (accessed June 10, 2013). 168 NASA defines RISC as “a structured argument, supported by a body of evidence that provides a compelling, comprehensive and valid case that a system is or will be adequately safe for a given application in a given environment. This is accomplished by addressing each of the operational safety objectives that have been negotiated for the system, including articulation of a roadmap for the achievement of safety objectives that are applicable to later phases of the system life cycle. The term ‘risk-informed’ is used to emphasize that a determination of adequate safety is the result of a deliberative decision making process that necessarily entails an assessment of risks and tries to achieve a balance between the system’s safety performance and its performance in other areas.” Ibid at 13. 169 Ibid at xiii. 36

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Key Features of an Effective Safety Case Regulatory Regime

Following the Macondo disaster, the National Commission on the Macondo Oil Spill and Offshore Drilling170 made a recommendation in its Report to the President171 for the US to “develop a proactive, risk-based performance approach specific to individual facilities, operations and environments, similar to the ‘safety case’ approach in North Sea.”172 Despite the major potential hazards that are present in both onshore and offshore oil and gas operations, the safety case regime has not been implemented in the US for either sector. The US has instead implemented for major hazards at onshore facilities a more activity- based approach, resulting in static regulations such as the PSM and RMP regulations that have not seen significant improvements173 since their inception, despite advances in technology and good industry practice. According to Dr. Hopkins and other renowned experts in the field, it is essential for an effective major accident prevention safety regime to take the form of a safety case, with adaptable goal-setting regulations that facilitate innovation and sustainability, and that drive industry to continuously improve and reduce risks to ALARP. To accomplish this, the regime must utilize sufficient numbers of highly competent personnel to effectively collect or promote industry use of process safety indicators174 and to provide knowledgeable oversight of industry operations. The CSB has determined that there are several key features of an effective major accident prevention regulatory approach such as the safety case regime: • Duty Holder Safety Responsibility, including a Written Case for Safety • Continuous Risk Reduction to ALARP • Adaptability and Continuous Improvement • Active Workforce Participation • Process Safety Indicators that Drive Performance • Regulatory Assessment, Verification, and Intervention; and an • Independent, Competent, Well-Funded Regulator As will be discussed in Section 5, California’s patchwork of regulations does not effectively implement these features, which are also illustrated in the figure below. Section 4 provides a detailed discussion of these features.

170 President Barack Obama established the National Commission on the BP Macondo Oil Spill and Offshore Drilling through Executive Order 13543 on May 21, 2010, to examine the facts and circumstances concerning the root causes of the Macondo explosion and fire. For more information see http://www.oilspillcommission.gov/page/about-commission (accessed June 17, 2013). 171 Available at http://www.oilspillcommission.gov/final-report (accessed June 17, 2013). 172 National Commission on the BP Macondo Oil Spill and Offshore Drilling. Report to the President: Deep Water, The Gulf Oil Disaster and the Future of Offshore Drilling; January 2011; 252. 173 OSHA did implement changes to 29 CFR §1910.106, creating a new Hazard Communication Standard. However, no changes have been made that impact the management of process safety under PSM. See https://www.osha.gov/dsg/hazcom/ (accessed August 6, 2013). 174 Process safety indicators are also referred to as performance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc. 37

Chevron Richmond Refinery Regulatory Report October 2014

Figure 1. Safety Case Attributes. 4.1 Duty Holder Safety Responsibility, including a Written Case for Safety Under the safety case regulatory regime, each individual company is responsible for the safety of each hazardous facility. The onus is on the duty holder175 to prove to the regulator that the company’s processes, methodologies used to assess risks, and reasoning for choosing one control over another have substantially reduced risks to as low as reasonably practicable (ALARP), or equivalent. The duty holder 175 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). These entities may include operators, contractors, and subcontractors. According to NOPSEMA, the idea is that those who create the risk must manage it. See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July15, 2013). 38

Chevron Richmond Refinery Regulatory Report October 2014

is required to prepare a written case for safety176 (“safety case report”) that identifies the hazards and risks and describes how they will be reduced to ALARP. The HSE has noted that the safety case report “demonstrates that the duty holder has arrangements in place which, if implemented, are capable of achieving compliance with legal objectives set out in other [] regulations…[and] provides a comprehensive core document that can be used as a check by both the duty holder and HSE that the accepted risk control measures and the health and safety management systems are in place and operate as they should.”177 The HSE has also stated: [t]he principal matters to be demonstrated in a safety case are that: a) the management system is adequate to ensure compliance with statutory health and safety requirements; and for management of arrangements with contractors and sub-contractors, b) that adequate arrangements have been made for audit and for audit reporting, [and] c) that all hazards with the potential to cause a major accident have been identified, their risks evaluated, and measures have been, or will be, taken to control those risks to ensure that the relevant statutory provisions will be complied with.178 The safety case report must also demonstrate “how inherently safer design concepts have been applied in the design decisions taken.”179 This principle applies to all stages of the installation’s life cycle, and includes materials selection and managing corrosion in the design. It is also important to note that safety case reports are meant to be evergreen documents that reflect continuous improvement in risk reduction. For onshore operations in the UK, the duty holder is required to review the safety case report during the construction of a new facility, whenever new facts or technical knowledge about safety matters become known, or whenever the operator makes a change to the safety management system that could have significant impacts on the prevention of major accidents.180 The duty holder must revise the safety report to ensure that it “remains up to date and continues to provide an accurate representation of the major accident hazards…and the 176 The HSE defines “safety case” as “a document that gives confidence to both the duty holder and HSE that the duty holder has the ability and means to control major accident risks effectively. It provides an extra level of regulatory control on top of regulations such as the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 (PFEER) and the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR), justified by the major accident potential of the offshore activities within scope.” HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 6. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed January 13, 2014). 177 Ibid at 6. 178 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 179 Ibid at 16. 180 COMAH Regulations, Part 3, Regulation 8 (1) (a)(b) and (c) (1999). 39

Chevron Richmond Refinery Regulatory Report October 2014

measures in place to control them.”181 According to HSE guidance on the offshore Safety Case Regulations, safety case reports are “intended to be living documents, kept up to date and revised as necessary during the operational life of the installation.”182 In order for the facility to begin operation or remain in operation, the regulator must “accept” 183 the facility’s safety case report; however, the regulator’s acceptance of a safety case does not license the facility or installation as “fit,”184 nor does it shift the duty of risk control and reduction away from the facility owner or operator and onto the regulator; rather, the duty of major accident prevention and risk reduction to ALARP remains with the duty holder throughout the life of the facility. Following the regulator’s acceptance of the safety case report, the duty holder must ensure that the installation is operated in conformity with the management system and other provisions described in the safety case.185 In the US, facilities commence operation before they are inspected or evaluated for complying with PSM or RMP regulations. In fact, the CSB has investigated incidents where the employer disputed that its process was covered by the PSM standard or RMP regulations. Regulators do not evaluate and approve PHAs or other hazard reviews and do not have the authority to license specific facilities for operation, based on the adequacy of their process safety programs. If an operating facility contains processes covered by the PSM standard, the facility must complete primarily activity-based regulatory requirements at least once every five years. The employer has no general duty to continually reduce risk. RMP- covered facilities must submit fairly high-level information exhibiting compliance with RMP requirements at least once every five years. While the regulator ensures the RMP has been filed and contains the required sections, there is no analysis of the effectiveness of controls identified in the RMP to mitigate hazards. 4.2 Continuous Risk Reduction to ALARP As discussed above, a majority of the safety case regimes implemented globally impose a duty on owners or operators of covered facilities on and offshore to reduce risks to ALARP or equivalent. The Center for Chemical Process Safety (CCPS) defines ALARP as “a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.”186 This principle provides the regulator with the main foundation on 181 The Competent Authority. Revised guidance for operators of top tier COMAH establishments. Review and revision of COMAH safety reports. December 2009; p 5. http://www.hse.gov.uk/comah/report-review.pdf (accessed November 26, 2013). 182 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

183 “Acceptance requires satisfaction with the duty holder’s approach to identifying and meeting health and safety needs…HSE ‘accepts’ the validity of the described approach as being capable, if implemented as described, of achieving the necessary degree of risk control, but HSE does not confirm the outcomes of that approach.” Therefore, “HSE will accept a safety case or a revision…when duty holders demonstrate and describe specified matters to HSE’s satisfaction. Acceptance will be based on HSE’s judgment that the arrangements and measures described in the safety case taken as a whole are likely to achieve compliance if implemented as described. To give acceptance HSE does not need to be satisfied that compliance will be achieved.…” Ibid at 6. 184 TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996; p 8. 185 Ibid at 7. 186 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., 2009; p 46. 40

Chevron Richmond Refinery Regulatory Report October 2014

which to accept or reject a safety case report. In essence, the regulator ultimately determines whether ALARP has been achieved through the authority to accept or reject the safety case report. An advantage of ALARP as opposed to a prescriptive or activity-based approach is that ALARP results in the continuous reduction of risk to keep up-to-date with advancing technology and industry best practices.187 Although two of the 14 PSM elements (PHA and mechanical integrity) contain performance-based or goal-setting requirements, 188 the PSM standard does not provide a specific risk reduction target such as ALARP. In reviewing the safety case report, the regulator may accept the application of relevant good practice as a sufficient demonstration of ALARP.189 As the HSE notes, “the measures in place to prevent or limit major accidents should be described in the safety report and be at least to ‘relevant good practice.’”190 According to Dr. Hopkins, the duty of ALARP “provides leverage for the regulator…[i]f an operator wishes to adopt a procedure or a standard that falls short of good or best practice, the regulator can reject it on the grounds that it does not reduce the risk as low as reasonably practicable.”191 As noted above, regulators such as HSE provide guidance on what is considered good practice, and publish documents containing good practice standards to assist operators with applying this concept. However, the duty holder must make the case for the standard or practice being utilized, and the regulator may determine that applying good practice alone is not sufficient to demonstrate that risks have been reduced to ALARP. In addition, if there is no directly applicable rule or standard, operators still have a duty to manage risk, and they therefore must maintain a reasonable level of risk awareness that goes beyond mere compliance.192 This raises a safety case regime above the compliance mentality of a more activity-based regime, such as PSM, and requires the duty-holder and the regulator to continuously ask whether there are other measures that would be effective in further reducing risks. The UK HSE provides ample guidance on determining what is considered to be ALARP, and many British courts have interpreted the concept as well. In the 1949 case Edwards v. National Coal Board, decided by the Court of Appeal, Judge Asquith wrote: ‘Reasonably practicable’ is a narrower term than ‘physically possible’ and seems to me to imply that a computation must be made by the 187 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed December 9, 2013). 188 29 CFR §1910.119(e)(1) requires the employer to “identify, evaluate, and control the hazards involved in the process.” 29 CFR §1910.119(j)(5) states that “[t]he employer shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in paragraph (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.” 189 HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013). 190HSE. Guidance on ALARP Decisions in COMAH. http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed November 26, 2013). 191 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 192 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 41

Chevron Richmond Refinery Regulatory Report October 2014

owner, in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other; and that if it be shown that there is a gross disproportion between them – the risk being insignificant in relation to the sacrifice – the defendants discharge the onus on them.193 While some critics in the US have argued that the determination of ALARP is strictly a quantitative risk assessment (QRA) calculation that is not sufficiently protective, the CSB has found that the HSE allows reliance upon qualitative assessments, QRA, and semi-quantitative risk assessments to determine ALARP.194 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”195 and “[i]dentification of possible further measures that could be applied to lower the risk.”196 The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”197 In Norway, the PSA requires companies to “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”198 PSA regulations require companies to choose the solutions that offer the best results, provided the costs are not significantly disproportionate to the risk reduction achieved.199 In Australia, the NOPSEMA enforces the Offshore Petroleum and Greenhouse Gas Storage Act 2006 and its regulations, which imposes a duty of care on the operator of a facility to “take all reasonably practicable steps” to ensure the facility is safe and all work and other activities are “carried out in a manner that is safe and 193 Edwards, [1949] 1 K.B. at 704. 194 Center for Chemical Process Safety (CCPS) guidance on risk assessment implies that as the predicted consequence of potential hazard scenarios increases, the level of analytical detail should also increase. Risk assessment approaches range in order of increasing analytical detail from qualitative, to semi-quantitative, to quantitative. Qualitative risk assessment is the simplest approach where judgments about consequence, likelihood, and the tolerability of risk are made on a subjective basis using the knowledge and experience of team members and may not be consistently applied within an organization. Semi-quantitative risk assessment is the second level of analytical detail, where organizations develop and provide to team members predetermined risk matrices and guidance for establishing numerical consequence and frequency levels. This approach is of greater value to team members as based upon their collective experience; the team typically has a sense of how frequently an event might occur and how great the potential consequence may be within the predetermined ranges. Layer of protection analysis (LOPA) is a semi-quantitative form of risk assessment, using order of magnitude categories for evaluating frequency, consequence, and adequacy of safeguards. Quantitative risk assessment involves the highest level of analytical detail and typically involves specialized expertise to perform. Complex models are commonly developed to evaluate frequency, consequence, and the effectiveness of safeguards in a quantitative risk assessment. Such approaches are typically standardized to minimize result variability within an organization and even between organizations in countries where a quantitative risk assessment is mandated by regulatory authorities. Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009. 195 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 196 Ibid at 8. 197 Ibid at 8. 198 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations). Section 11, Risk Reduction Principles. http://www.ptil.no/framework- hse/category403.html (accessed November 26, 2013). 199 Ibid. 42

Chevron Richmond Refinery Regulatory Report October 2014

without risk to the health of any person at or near the facility.”200 NOPSEMA explains that to achieve ALARP, the company “has to show, through reasoned and supported arguments, that there are no other practical measures that could reasonably be taken to reduce risks further.”201 In the US, the NRC has “gradually revised its original scheme, giving an increasing importance to the ‘economic and social factors’, in particular the involvement of all ‘stakeholders’ (authorities, management, staff, public) in the ALARA process.”202 For the regulator, the focus for whether ALARA has been achieved is on “processes, procedures, and judgments.”203 The duty holder must ensure that choices made to achieve ALARA are “fully documented together with the criteria which have brought to those choices. When the criteria are qualitative, it is more likely that subjective judgments play a large role, but those judgments must be equally recorded.”204 There is no corresponding duty to reduce risks to ALARP in the PSM standard or RMP program. Rather, these regulations require that facilities “control” identified hazards, with no further dialogue on how far the operator must go to control those hazards. Neither the facility nor the regulator is required to determine whether more could be done to control hazards or reduce risks to comply with these regulations, and this may result in the implementation of insufficient controls relating to a hazard. While OSHA and the EPA do rely on general duty standards when implementing the PSM standard and the RMP program, these duties do not drive onshore companies toward reducing the risks of their activities to ALARP, and instead are utilized as enforcement tools typically after an incident has occurred, meant to cover those activities not specifically regulated. These standards may also be used by OSHA or EPA to cite a company for not following a specific RAGAGEP for 2 of the 14 process safety elements - mechanical integrity and PSI. OSHA enforces section 5(a) of the Occupational Safety and Health Act (OSHAct), which states the following:

(a) Each employer – (1) shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees; (2) shall comply with occupational safety and health standards promulgated under this act…205 Section 5(a)(1), also known as OSHA’s General Duty Clause, has been described as a “catch-all” provision meant to fill gaps in OSHA law for recognized unregulated hazards.206,207 In order for OSHA to 200 Offshore Petroleum and Greenhouse Storage Act 2006, Volume 3, Schedule 3, Clause 9. http://www.comlaw.gov.au/Details/C2012C00148/Html/Volume_3#_Toc315688204 (accessed October 30, 2013). 201 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 202 Fasso, Alberto, and Rokni, S. Operational Radiation Protection in High Energy Physics Accelerators. Implementation of ALARA in Design and Operation of Accelerators. May 2009; p 6.

203 Ibid at 6. 204 Ibid at 6 and 7. 205 29 U.S.C. §654(a)(1) and (2) (2004). 206 Morrison, Kyle W. The General Duty Clause: What is it, how does OSHA use it and what should employers know? Safety + Health [Online]; May 1, 2011. 43

Chevron Richmond Refinery Regulatory Report October 2014

issue a General Duty Clause violation, the hazard must be recognized, the employer must have failed to keep the workplace free of the hazard to which his or her employees were exposed, a practical method must be available to correct the hazard, and the hazard must be causing or likely to cause death or serious injury.208 This duty would thus only apply if the absence or failure of one control in a series of controls makes an accident likely to occur (emphasis added). On the other hand, in a safety case regulatory regime, the regulator proactively reviews identified hazards and risk reduction strategies proposed by the operator to ensure that risks are being reduced to ALARP. The regulator may require the installation of an absent control if such a control is considered good industry practice, or if it goes further in reducing risks to ALARP. This is a key feature of the safety case approach in preventing major accidents. Under the CAA, the General Duty Clause requires owners and operators “to identify hazards which may result from such releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.”209 Similar to OSHA, the EPA can use its General Duty Clause enforcement authority to create legally binding requirements or enforce actions for hazards that have not been specifically regulated. The EPA can use this authority proactively (before an incident) or reactively (following an incident), and can enforce the clause where it finds the possibility of imminent and substantial endangerment.210 According to EPA guidance on the RMP program, because it is the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” this may require steps to be taken “beyond those specified in the risk management program rule.”211 While this principle appears to be similar to ALARP requirements of the safety case, in practice whether this is done is not subject to regulation or review. In addition, it is permissive in that it uses the word “may.” Nothing additional, such as ALARP, is required. This will be addressed below in more detail in the discussion of implementation of the EPA RMP program in California. 4.3 Adaptability and Continuous Improvement A key strength of the safety case regulatory regime is that it provides the regulator with the tools to drive continuous improvement among facilities and ensure risks have been reduced to ALARP or equivalent, rather than focusing on compliance with activity-based regulatory requirements. Although complying with good practice may achieve ALARP, the regulator also has the ability under this regime to require facilities to go above and beyond good practices and standards to achieve ALARP without requiring http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 207 According to the National Safety Council, General Duty Clause violations make up only about 1.5 percent of total violations issued annually by OSHA. Available at http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 208 Ibid. 209 42 U.S.C. §7412(r)(1) (1990). 210 42 U.S.C. §7412(r)(9) (1990). 211 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 44

Chevron Richmond Refinery Regulatory Report October 2014

rulemaking. The Baker Panel212 noted in its 2007 report (“the Baker Report”) on BP and its process safety performance following the 2005 BP Texas City disaster that an effective process safety management system builds upon an “improvement cycle” that “should include, in practice, continuous reduction of process risk and improvements in safety performance according to some measurable criteria.”213 The Baker Panel defined “continuous improvement” as • improving controls for process hazards, including process safety knowledge and competence of workers; • improving process safety leadership of supervisors; • improving process engineering to identify and then design to remove or mitigate the effects of process hazards; • going beyond legal compliance to best practices to reduce risks; • going beyond mere compliance with internal standards, but learning from operating experiences, incident and near miss investigations, hazard studies, audits, and other assessments to improve those internal standards; and • identifying and implementing not only those external standards that must be observed, but also those that represent best practices that can lead to process safety excellence.214 An independent review conducted of the Australian offshore safety case regime in 2000 echoes the importance of continuous improvement in process safety management, stating that “critical to the successful implementation of a safety case regime is the achievement of a qualitative shift in industry and regulatory safety cultures from the minimalist compliance of the prescriptive regime to the philosophy of best practice and continuous improvement.”215 Recently, Lord Cullen addressed the importance of adaptability as well, when he spoke at the 2013 Oil & Gas UK Piper 25 offshore safety conference in Aberdeen, Scotland.216 In his keynote speech, Lord Cullen quoted the Maitland panel, which examined the UK offshore safety regime after the Macondo incident, noting that “safety cases should be living documents [emphasis added] central to the way facilities are operated, with contents widely understood.”217 212 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013). 213 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 214 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 215 Department of Industry, Science and Resources; Offshore Safety and Security, Petroleum and Electricity Division. Australian Offshore Petroleum Safety Case Review: Report of the Independent Review Team. 2000; p 33. 216 In June 2013, Oil & Gas UK held a large offshore safety conference in Aberdeen, which marked the 25th anniversary of the Piper Alpha disaster. For more information see http://www.oilandgasuk.co.uk/events/Piper25.cfm?frmAlias=/Piper25/ (accessed September 16, 2013). 217 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013). 45

Chevron Richmond Refinery Regulatory Report October 2014

As changes to regulatory requirements necessitate an extensive, lengthy rulemaking process in the US,218 process safety-related regulations can remain static for decades, while industry standards (many of which are voluntary under the current US system), technologies, and improved procedures and practices continue to change and advance, and new chemicals come into production. In light of major accidents that have occurred, such as the BP Texas City explosion and fire which resulted in 15 fatalities, and the Motiva Enterprises sulfuric acid tank explosion, which fatally injured one worker and injured eight others, the CSB has made a number of key recommendations to OSHA and the EPA to revise the PSM and RMP regulations, respectively. However, agencies have failed to implement these recommendations and these regulations have remained static despite the important lessons learned from these incidents. In addition, the OSHA PSM standard’s Appendix A, which contains a list of toxic and reactive highly hazardous chemicals and the threshold quantity for each, was originally created using a number of older sources, including the EPA’s “Extremely Hazardous Substance List,” the 1982 Seveso Directive, the 1984 CIMAH regulations, and others. A number of these sources have been revised, updated, and amended throughout the years, while Appendix A has not. In fact, no chemicals have been added to either the PSM or the RMP programs since the rules were initially adopted in the 1990s, even as numerous serious process incidents have occurred involving chemicals that were not listed. The U.S. Government Accountability Office (GAO) published a 2012 report on OSHA’s standard setting abilities, and noted that between 1981 and 2010, OSHA took anywhere from 15 months to 19 years to develop and issue 58 significant safety and health standards (averaging seven years).219 According to the report, OSHA reasoned that it must evaluate technological and economic feasibility of a potential standard using data gathered by visiting worksites in industries that will be affected, on an industry-by- industry basis.220 This was described as “an enormous undertaking because, for example, it requires visits to multiple worksites.”221 In addition, Executive Order 12866222 requires that federal agencies, including OSHA, provide an assessment of the potential overall costs and benefits for significant rules to the Office of Management and Budget (OMB). OSHA will typically be required under the Small Business Regulatory Enforcement Fairness Act of 1996223 to initiate a panel process to receive and consider input 218 5 U.S.C. Chapter 5, sections 511-599, also known as the Administrative Procedure Act, or APA, requires that federal agencies seeking to promulgate a rule or regulation submit to a lengthy notice and comment rulemaking process that includes publishing the proposed rule making in the Federal Register; providing the public with at least 30 days to participate in the rulemaking process by submitting written comments or data, and then discussing the public comments and providing a rationale for accepting or rejecting them. The OSHAct Section 6(b) specifies the procedures OSHA must use to promulgate, modify, or revoke its standards (29 U.S.C. §655(b)). These procedures include publishing the proposed rule in the Federal Register, providing interested persons an opportunity comment, and holding a public hearing upon request. 219 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

220 Ibid at 6. The Supreme Court has held that the OSHAct requires that standards be both technologically and economically feasible. Am. Textile Mfrs. Inst. V. Donovan, 452 U.S. 490, 513 n. 31 (1981). Also see United Steelworkers v. Marshall, 647 F. 2d 1189, 1301 (D.C. Cir. 1980), quoted in AFL-CIO v. OSHA, 955 F. 2d 962, 980 (11th Cir. 1992). Assessing feasibility on an industry-by-industry basis requires that the agency research all applications of the hazard being regulated, as well as the expected cost for mitigating exposure to that hazard, in every industry. 221 Ibid at 6. 222 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.whitehouse.gov/sites/default/files/omb/inforeg/eo12866/eo12866_10041993.pdf (accessed June 12, 2013). 223 5 U.S.C. §609(b), (d) (1996). 46

Chevron Richmond Refinery Regulatory Report October 2014

from representatives of affected small businesses, which could take eight months or more.224 Only OSHA, the EPA, and the Consumer Financial Protection Bureau are subject to this requirement.225 Finally, the OSHAct directs courts to review OSHA’s standards using a more stringent legal standard than the Administrative Procedure Act’s (APA’s) “arbitrary and capricious” test226 when reviewing OSHA’s standards;227 an OSHA standard may only be upheld if it is supported by “substantial evidence in the record considered as a whole.”228 According to the GAO report, OSHA officials claim this more stringent standard (known as the “substantial evidence” standard) requires a higher level of scrutiny by the courts and as a result, OSHA staff must conduct a large volume of detailed research in order to understand all industrial processes involved in the hazard being regulated, and to ensure that a given hazard control would be feasible for each process.229 The GAO also found that although OSHA has the ability to address urgent hazards by issuing emergency temporary standards, the agency has not used this authority since 1983 because of the difficult hurdles the agency faces in presenting the evidence necessary to meet the statutory requirements.230 In summary, all of these extensive rulemaking constraints have resulted in OSHA’s inability to undertake many standard revisions or improvements. In Spring 2013, OSHA announced its new regulatory agenda, which stated that one of the things OSHA plans to consider is revising the PSM standard to “address gaps in safety coverage.”231 Potential revisions include “expanding coverage and requirements for reactivity hazards,” which the CSB addressed in its 2002 report entitled “Improving Reactive Hazard Management,”232 and “expanding the scope of 224 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

225 5 U.S.C. §609(d) (1996). 226 Pursuant to the APA, agency decisions may be set aside only if “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. §706(2)(A). There is abundant case law that discusses this standard. Courts have held that a court “may reverse under the arbitrary and capricious standard only if the agency has relied on factors that Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise. See Greater Yellowstone Coalition v. Lewis, 638 F. 3d 1143, 1148 (9th Cir. 2010) (as amended) (relaying on The Lands Council v. McNair, 537 F.3d 981, 987 (9th Cir. 2008) (en banc), overruled on other grounds by Winter v. Natural Res. Def. Council, 555 U.S. 7 (2008)). 227 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

228 29 U.S.C. §655(f). 229 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

230 OSHA must demonstrate that workers are exposed to grave danger and establish that an emergency temporary standard is necessary to protect workers from that grave danger. OSHA is also required to replace an emergency temporary standard with a permanent standard within six months using the requirements laid out in OSHAct 6(b). Ibid at 11. 231 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 232 In this report, the CSB recommended to OSHA that it amend the PSM standard “to achieve more comprehensive control of reactive hazards that could have catastrophic consequences.” The report is available at http://www.csb.gov/assets/1/19/ReactiveHazardInvestigationReport.pdf (accessed September 17, 2013). The recommendations start on page 89 of the report. 47

Chevron Richmond Refinery Regulatory Report October 2014

paragraph (j) to cover the mechanical integrity of any safety-critical equipment….”233 However, OSHA has proposed changes to the PSM standard before, with no action ultimately being taken. On April 27, 1998, OSHA announced that it was considering issuing an Advance Notice of Proposed Rulemaking234 (ANPRM) “to address issues related to reactive chemicals raised by the explosion of a chemical plant in Lodi, New Jersey in 1995.”235,236 On May 14, 2001, OSHA clarified its intent to publish an ANPRM “to address the need to add reactive chemicals that are not currently covered by PSM…”237 On December 3, 2001, however, the entry on reactives was withdrawn from the rulemaking agenda.238 Following the devastating ammonium nitrate explosion on April 17, 2013, in West, Texas, which resulted in at least 14 fatalities and mass destruction in the town of West, CSB Chairperson Moure-Eraso urged both OSHA and the EPA to expand their standards to include reactive chemicals and hazards such as ammonium nitrate.239 On July 25, 2013, the CSB held a public meeting in Washington, DC to discuss the status of key open recommendations the CSB has made to OSHA over the last decade to revise its PSM standard and create a new combustible dust standard. These recommendations, which include revising the PSM standard to require MOC reviews for organizational changes such as mergers and acquisitions that may impact process safety, and ensuring PSM coverage for atmospheric storage tanks that could be involved in a potential catastrophic release, have stemmed from major CSB investigations including its BP Texas City, Motiva, ConAgra, Kleen, Imperial Sugar, and Hoeganaes investigations, as well as its Combustible Dust Study.240 OSHA’s failure to implement these recommendations, which can be attributed to its lack of rulemaking activities over the last decade, led the CSB to reclassify seven key open recommendations as “Open-Unacceptable.” The CSB also adopted the OSHA Combustible Dust Standard recommendation as a CSB “Most Wanted Chemical Safety Improvement.” OSHA formally responded and cited to the GAO report discussed above, noting that on average, it takes OSHA seven years to issue a standard, a process 233 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 234 Most federal agencies develop rules through “informal rulemaking.” Under the Administrative Procedure Act, or APA, informal rulemaking requires a publication of a “Notice of Proposed Rulemaking” (NPRM) in the Federal Register; opportunity for public participation by submission of written comments; consideration by the agency of the public comments and other relevant material; and publication of a final rule not less than 30 days before its effective date, with a statement explaining the purpose of the rule. Under the APA, an agency may publish an Advance Notice of Proposed Rulemaking (ANPRM) when the agency wants to test out a proposal or solicit ideas before it drafts its NPRM. For more information see http://www.foreffectivegov.org/node/226 (accessed September 17, 2013). 235 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13792 (accessed September 17, 2013). 236 This incident took place on Friday, April 21, 1995, at a chemical facility occupied by Napp Technologies. The explosion and fire resulted in five fatalities. 237 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16776 (accessed September 17, 2013). 238 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed September 17, 2013). 239 In a 2002 study entitled Improving Reactive Hazard Management, the CSB made recommendations to OSHA and the EPA to expand their regulations to include reactive chemicals and hazards. To date, neither agency has acted on the recommendations. See http://www.csb.gov/in-safety-message-csb-chairperson-rafael-moure-eraso- calls-for-regulatory-coverage-of-reactive-chemicals-following-the-west-fertilizer-explosion-and-fire-/ (accessed September 23, 2013). 240 For more information on this meeting, see http://www.csb.gov/events/csb-public-meeting-to-vote-on-key-safety- recommendations-and-initiate-most-wanted-program/ (accessed July 29, 2013). 48

Chevron Richmond Refinery Regulatory Report October 2014

that is only getting longer. Hence, OSHA reserves rulemaking for “widespread and serious hazards.” Needed petroleum refinery and chemical process safety improvements may never fall under this category. OSHA noted at the meeting that it would be utilizing a Request for Information241 (RFI) to aid in the revision of its PSM standard, aimed at addressing a number of issues that have developed in the 21 years since the PSM standard was promulgated in 1992. On December 9, 2013, OSHA published its RFI in the Federal Register.242 The RFI requests comment on potential revisions to OSHA’s PSM standard, among other regulations. The RFI identifies seventeen topics for potential rulemaking and enforcement changes, including clarifying the PSM exemption for atmospheric storage tanks and expanding PSM coverage and requirements for reactive hazards. The RFI also cites a number of CSB investigation reports and recommendations, including the CSB Reactive Hazard Study entitled Improving Reactive Hazard Management, the BP Texas City Investigation Report, and the Donaldson Enterprises, Inc., Investigation Report.243 Although the RFI is an important opportunity to enhance the dialogue on implementation of the safety case regulatory approach to enhance process safety management and risk reduction in the US, it does not specifically mention the safety case approach.244 On January 3, 2014, OSHA released a response to Section 6(a) of Executive Order 13650,245 which tasked the Chemical Facility Safety and Security Working Group, created by the Order and consisting of federal agencies such as OSHA, the EPA, and PHMSA,246 with considering options to improve chemical safety regulation. The document provides separate responses from each member agency of the group, and notes that the group is seeking public input on potential areas where standards could be improved. According to the document, three agencies – OSHA, the EPA, and PHMSA – have all included “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory 241 An RFI is a tool used by a federal agency to help develop a proposed rule. Federal agencies generally use RFIs when they want public input on whether a new rule or changes to an existing rule are needed, and comments on what course the agency should take should it decide to move forward. More information available at http://www.dol.gov/regulations/participate.htm (accessed July 29, 2013). 242 78 Fed. Reg. 73756 (2013). 243 A full copy of the OSHA RFI is available at https://www.federalregister.gov/articles/2013/12/09/2013- 29197/process-safety-management-and-prevention-of-major-chemical-accidents (accessed January 7, 2014). 244 OSHA has released on its website a separate document responding to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. OSHA states in this document that it is seeking public input on potential areas where it could improve its standards, and includes “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce risk in complex industrial processes” as an area to consider. https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). However, the safety case regulatory model is not mentioned in the RFI that was released for public comment. 245 This document is available at https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 246 The Chemical Facility Safety and Security Working Group is co-chaired by the Secretary of Homeland Security, the Administrator of the EPA, and the Secretary of Labor. The Working Group must consist of the head or a designated representative of the Department of Justice, Department of Agriculture, and the Department of Transportation. The Working Group must also consult with representatives from the Council on Environmental Quality; the National Security Staff; the Domestic Policy Council; the Office of Science and Technology Policy; the Office of Management and Budget; the White House Office of Cabinet Affairs; and other agencies designated by the President. http://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facility- safety-and-security (accessed January 13, 2014). 49

Chevron Richmond Refinery Regulatory Report October 2014

model to reduce risk in complex industrial processes” in a preliminary list of options to consider for improving chemical facility and safety.247 OSHA’s ability to adapt to process safety-related new or revised codes, standards, technology, and lessons learned is mainly limited to RAGAGEP requirements, which OSHA included in the mechanical integrity and PSI elements of its PSM standard in part to “provide flexibility for the employer to choose the frequency which would provide the best assurance of equipment integrity.”248 OSHA meant for RAGAGEP to include “both appropriate internal standards and applicable codes and standards.…”249 However, the concept of RAGAGEP only applies to 2 of the 14 PSM standard elements (mechanical integrity and PSI),250 only addresses equipment and mechanical integrity, and is usually utilized by OSHA as a mechanism to issue citations to companies post-incident. In addition, OSHA has had difficulty enforcing RAGAGEP citations. In a recent OSHA Review Commission proceeding, Secretary of Labor v BP Products North America, Inc., & BP-Husky Refining, LLC,251 and United Steelworkers Local 1-346, the Administrative Law Judge (ALJ) vacated OSHA RAGAGEP citations issued to BP for violations of 29 CFR §1910.119(d)(3)(ii)252 for failure to comply with a specific RAGAGEP, holding that OSHA impermissibly adopted a specific RAGAGEP, thereby diminishing the performance aspect of the RAGAGEP requirements contained within the OSHA PSM standard. The ALJ concluded that by citing to only one specific RAGAGEP, OSHA impermissibly adopted a prescriptive standard; in the ALJ’s view, OSHA should have acknowledged other possible RAGAGEPs for BP to comply with, including BP’s own internal standards. If upheld, this ruling may limit OSHA’s ability to utilize RAGAGEP as a means of requiring companies to implement industry good practices in the future.253 The cumbersome rulemaking process and lack of flexibility that has resulted in stagnant and static OSHA standards can be contrasted with the structure of the safety case regulatory regime, which facilitates adaptability and enables the regulator to improve industry safety performance and practices without requiring a major rule change. The safety case essentially provides the regulator with the tools to recognize more rigorous standards and practices that exist and drive a company to implement those practices to further reduce risks, as well as work with industry to improve existing standards and practices if necessary. It also enables companies to implement new, more efficient or safer technologies that do not necessarily meet strict prescriptive regulations, but that drive risk reduction. This adaptability is illustrated by the HSE’s recommendations following the 2004 Buncefield incident. On December 11, 2005, a number of explosions occurred at Buncefield Oil Storage Depot in Hemel Hemptstead, Hertfordshire, England following the overfilling of a gasoline tank. Over 40 people were injured and there was significant offsite damage to homes and businesses. An independently chaired Major Incident Investigation Board led by Lord Newton of Braintree was set up to investigate the incident. Between 2006 and 2008 the Board issued a number of reports and recommendations. In the 247 Ibid. 248 57 Fed. Reg. 6390-6391 (1992). 249 Ibid at 6390-6391. 250 29 CFR §§1910.119(d)(3)(ii) and (j)(4)(ii) and (iii). 251 BP Products North America, Inc. operates a refinery in Oregon, Ohio. BP-Husky is a joint venture with a business interest in the refinery. 252 29 CFR 1910.119(d)(3)(ii) requires the employer to document that equipment complies with RAGAGEP. 253The Occupational Safety and Health Review Commission is scheduled to review the decision. 50

Chevron Richmond Refinery Regulatory Report October 2014

report issued in March 2007 entitled “Recommendations on the design and operation of fuel storage sites,” the Board highlighted the adaptability of the existing regulatory regime by noting that the recommendations to improve standards and revise guidance should not require actual changes to the law, because the existing legal framework was “sufficient to ensure that necessary improvements are put in place.”254 The Board followed by making its first recommendation of the report to the COMAH CA and operators of Buncefield-type sites to develop and agree on a methodology to determine safety integrity level requirements for overfill prevention systems, which takes account of, among other things, nearby resources or populations.255 The Board also recommended that the sector “develop guidance to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs.”256 Another key recommendation was made to the CA to “ensure that safety reports submitted under the COMAH Regulations contain information to demonstrate that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for control and environmental protection engineering systems.”257 Finally, the Board recommended in this report that the “sector agree with the Competent Authority on a system of leading258 and lagging259 performance indicators for process safety performance…” based on HSE’s guidance on Developing process safety indicators.260 Spurred by recommendations made surrounding the Buncefield incident, the BP Texas City incident, and the BP Grangemouth incident,261 the COMAH CA developed an Operational Delivery Guide entitled “COMAH Competent Authority Workstream 2e: Process safety performance indicators,”262 which was “designed to continue the promotion and development of site level process safety performance indicators (PSPIs) as part of the monitoring arrangements for an effective process safety management system at major hazard sites.”263 The guide states that by the end of March 2013 all “Buncefield-type” sites would “have effective monitoring of process safety performance in place and that site specific leading and lagging performance indicators have been developed…”264 and that by the end of 2015 “all major hazard establishments and duty holders will measure their performance on the control of major hazard risks by way of key leading and lagging performance indicators.”265 It lays out in detail a six-step process for implementing a process safety measurement system; how inspectors will assess a duty holder’s 254 Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007; p 3. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013). 255 Ibid at 8. 256 Ibid at 15. 257 Ibid at 19. 258 Leading indicators are measurements that predict future performance to ensure that safety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics; October 2009; p 20. 259 Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety metric. Ibid at 20. 260 Ibid at 13. 261 Between May 29 and June 10, 2000, three incidents occurred at the BP Grangemouth Petrochemical Complex in Scotland, which is one of the largest of the 950 COMAH sites in the UK. 262 Available at http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed May 21, 2013). 263 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 3. 264 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 6. 265 Ibid at 3. 51

Chevron Richmond Refinery Regulatory Report October 2014

performance; and adds that full implementation of this program could take between 18 months and two and a half years from when the initial introduction takes place – all without requiring any fundamental changes to the COMAH regulations themselves. The COMAH CA Investigation Team noted in its publication summarizing the conclusions of the Buncefield investigation that following the incident, the CA, industry, and trade unions worked together to “drive forward high standards at fuel storage sites…[which] has resulted in agreement on improved standards of safety and environmental protection for all UK sites storing large volumes of gasoline and to systematically upgrade sites to meet these standards….”266 In another example following the Buncefield incident, the Board recommended significantly higher standards than were generally in place in the sector. For example, the Board recommended that fuel storage tanks be fitted with automatic overfill protection equipment that would cut off supply if an overfill event occurs, rather than continuing to rely on operators to interrupt flow manually in the case of an event. In response, the UK Petroleum Industry Association and the Tank Storage Association adopted the recommendation, and the British government announced that it would require all sites to move to fully automatic shutdown systems on tanks storing gasoline. The Process Safety Leadership Group (PSLG) was formed to help develop the details of the new rule, and to “meet the need for an effective framework for interaction between industry, trade unions and the COMAH Competent Authority (CA).…”267 As will be discussed in the next section, workforce involvement is a key element of an effective safety case regulatory regime. In 2009, HSE published the PSLG’s work in a document entitled Safety and Environmental Standards for Fuel Storage Sites. The document lays out precisely which tanks must utilize automatic overfill protection equipment, and also allows for duty holders to demonstrate technical reasons as to why automatic overfill protection would not be appropriate by “prepar[ing] a robust demonstration that alternative measures are capable of achieving an equivalent ALARP outcome to an overfill protection system that is automatic…”268 This document in essence was developed as an industry good practice, and compliance with its requirements would likely ensure that the duty holder is complying with the law and reducing risks to ALARP.269 This can be contrasted with an even larger release of gasoline and a subsequent explosion that occurred in the 2009 tank overfill at the Caribbean Petroleum Corporation near San Juan, Puerto Rico. This incident severely damaged surrounding buildings and impacted moving vehicles. However, the incident has not resulted in any re-evaluation of safety rules by the EPA or OSHA, despite the fact that tank terminals largely fall outside the PSM and RMP program regulations, (let alone the more rigorous requirements of a major hazard safety case regulatory regime, as practiced in the UK). These post-Buncefield examples highlight one of the most important attributes of the safety case regulatory approach: it is a regulatory framework that implements a balance of goal-setting and prescriptive elements which enable the regulator to drive facilities to continuously improve practices 266 The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011; p 3. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013). 267 Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 2009; p 7. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 268 Ibid at 29. 269 For a detailed discussion of rule-compliance and the safety case, see Hopkins, Andrew. Risk-management and rule-compliance: Decision-making in hazardous industries; Safety Science 49 (1011) 110-120. 52

Chevron Richmond Refinery Regulatory Report October 2014

aimed at reducing risks to ALARP, without having to adhere to the extensive and time-consuming rulemaking requirements that exist in the US. This flexibility and adaptability encourages facilities to focus on improving practices and technology rather than on completing activity-based requirements, which can have the effect of stifling innovation and technological advancement. Critics argue that because there have been significant industry problems with the maintenance of safety critical equipment and aging equipment in the UK, 270 the safety case regime is not operating effectively. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferral of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters. However, the HSE has worked to make improvements to these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.271 The same year, the HSE published a report intended to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,272 which provides an overview of ageing plant mechanisms and their management. This document presents analysis and findings for loss of containment incidents to demonstrate how aging plant equipment may be a factor. The HSE has been able to take this type of programmatic proactive approach in the UK thanks to the safety case regime’s adaptive nature, which is lacking in the US both on and offshore. This is positive evidence of a competent and effective regulator with the tools under the safety case regime to identify and proactively address industry gaps in safety performance. 4.4 Active Workforce Participation As the CSB noted in its Interim Report on the Chevron incident, workforce participation is a key element of process safety and effective major accident prevention. In one of its publications, the Center for Chemical Process Safety (CCPS) lists workforce involvement as one of 20 essential management components necessary to reduce process safety risks and prevent chemical accidents.273 According to CCPS, …workers are potentially the most knowledgeable people with respect to the day-to-day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their unique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise.274 This CCPS publication discusses general areas of workforce involvement in risk assessments, inspections, audits, and performance reviews, and notes that participation leads to empowerment, management 270 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf, (accessed August 28, 2013). 271 The UK launches Key Programmes to address poor performance in specific areas. Access the report entitled Key Programme 4 (KP$): Ageing and life extension at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013). 272 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 273 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv. 274 Ibid at 124. 53

Chevron Richmond Refinery Regulatory Report October 2014

responsiveness, and process safety performance improvement. 275 The OSHA PSM standard requires employers to consult with employees and their representatives on the conduct and development of PHAs and on the development of the 13 remaining PSM elements, and to develop a written plan of action regarding the implementation of the employee participation required under this section.276 During facility inspections, OSHA inspectors must request and evaluate these written plans of action regarding the implementation of employee participation as well as interview employees and their representatives to verify that the employer is satisfying the requirements.277 In previous investigation reports, the CSB has identified that workers and their representatives play a very important role in major incident prevention. For example, as will be discussed in the next section on performance indicators, the CSB recommended in its BP Texas City Final Investigation Report that BP and the United Steelworkers Union (USW) establish a joint program to report incidents and near misses, and to ensure that recommendations made during investigations were implemented. The CSB also recommended that API and the USW work together to develop a safety standard addressing leading and lagging process safety indicators.278 However, representatives from the USW have stated to the CSB that it is a constant struggle for workers and their representatives to have a voice or play a role in the management of safety in US petroleum refineries. The law in the UK also requires employers to consult with their employees or their safety representatives on health and safety matters. The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996 set out the legal framework for such consultation and worker involvement at both unionized and non-unionized onshore facilities.279 However, these regulations go further than the OSHA PSM standard in that they provide for the election of safety representatives by the workers to serve many health and safety-related functions, including investigating complaints and accidents and carrying out inspections. In his keynote speech at the Oil and Gas UK Piper 25 conference, Lord Cullen stated that the safety representative positions have “important functions, such as the power to carry out investigations and reporting safety concerns to management, without fear of recrimination,” noting that they “help[] reinforce the principle that each employee is responsible for his own safety.”280 The regulations also require employers to establish a safety committee when one is requested by at least two health and safety representatives. The 1996 regulations require employers to consult with employees not represented by safety representatives under the 1977 275 Ibid at 125. 276 29 CFR §1910.119(c) (2012). 277 See OSHA CPL 02-02-045. Process Safety Management of Highly Hazardous Chemicals – Compliance Guidelines and Enforcement Procedures. September 13, 1994. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=1558&p_table=directives (accessed September 6, 2013). 278 Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators, performance measures, indicators, etc… 279 The 1977 regulations apply to workplaces where the employer recognizes trade unions and trade unions are recognized for collective bargaining purposes. Regulations available at http://www.legislation.gov.uk/uksi/1977/500/contents/made (accessed September 4, 2013). The 1996 regulations apply to workplaces where employees are not in a trade union and/or the employer does not recognize the trade union, or the trade union does not represent those employees not in the trade union. Regulations available at http://www.legislation.gov.uk/uksi/1996/1513/contents/made (accessed September 4, 2013). 280 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013). 54

Chevron Richmond Refinery Regulatory Report October 2014

Regulations on a number of health and safety-related matters, such as the introduction of any measure which may substantially affect their health and safety at work, the planning and organization of health and safety training, and the health and safety consequences of introducing new technology.281 The law in the UK protects employees from being penalized for taking part in health and safety consultation.282 The UK’s existing regulations and policies regarding worker involvement offshore were developed and strengthened as a result of the Piper Alpha incident. In the Piper Alpha Report, Lord Cullen emphasized the importance of workforce involvement in safe operations, and noted that a safety committee system is “the most visible instrument for the involvement of the workforce in safety.”283 He concluded by recommending that “the regulatory body, operators and contractors should support and encourage the involvement of the offshore workforce in safety.”284 The HSE developed guidance in response to Lord Cullen’s recommendations entitled Play your part! How offshore workers can help improve health and safety, intended to encourage workforce participation offshore.285 The most current version of this guidance document, which was prepared by the Workforce Involvement Group,286 located within the HSE’s Offshore Industry Advisory Committee,287 utilizes good practice and examples of successful workforce involvement in improving health and safety with the goal of assisting operators, contractors, safety representatives, and others in effectively utilizing workforce involvement in their workplaces. It encourages companies to facilitate workforce involvement by providing information, improving communication at all levels, good training, and ensuring that all workers are represented in the decisions that affect them.288 The Piper Alpha incident also resulted in the swift development of the SI971 Offshore Regulations (Safety Representatives and Safety Committees) Regulations 1989 (“the SI971 Regulations”), which provide for the nomination and election of safety representatives and require offshore installations to establish safety committees.289290 The HSE has published a guidance document entitled A guide to the 281 See HSE. Consulting employees on health and safety: A brief guide to the law; 2013. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 4, 2013). 282 See Employment Rights Act 1996. Section 44. Health and safety cases. http://www.legislation.gov.uk/ukpga/1996/18/section/44 (accessed September 4, 2013). 283 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 301. 284 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 392. 285 See HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 286 The Workforce Involvement Group’s mission is to improve safety “by stimulating lateral learning and best practice across the offshore industry through involvement of the whole workforce.” It looks at ways to increase worker involvement in health and safety matters offshore and is chaired by HSE. For more information see http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig.htm (accessed June 17, 2013). 287 The Offshore Industry Advisory Committee is a tripartite committee that includes members representing employers, employees, unions, trade associations and other government departments. It is focused solely on the offshore sector. More information is available at http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/information.htm (accessed June 17, 2013). 288 HSE. Play your part! How offshore workers can help improve health and safety; 2013; p 4. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 289 Under Regulation 16, safety representatives are responsible for investigating potential hazards and incidents, examining causes of accidents, investigating complaints by any member of his or her constituency relating to occupational health and safety, representing members of the workforce in consultations on the offshore installation with inspectors, and consulting constituency members on any matters arising out of the Regulation. Under Regulation 17, a safety representative may inspect any part of the offshore installation or its equipment either on a 55

Chevron Richmond Refinery Regulatory Report October 2014

Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989291 designed to assist duty holders, employers, installation managers, safety representatives, safety committee members and all members of the workforce in the offshore industry with what the regulations require and what must be done to comply with them. The document explains that although the primary responsibility for health and safety resides with the duty holder, “all members of the workforce must play their part if risks are to be eliminated or minimized.”292 It also emphasizes the importance of training of safety representatives, which enables them to effectively represent workers and fulfill their responsibilities and functions under these Regulations. In April 2010, the HSE launched an inspection project to examine the effectiveness of the SI971 Regulations and the effectiveness of those regulations, as well as to collect examples of best practice to present to the offshore industry.293 Forty-one inspections were completed in a six-month period on offshore installations operated by 25 different duty holders. The project helped focus on the power of safety representatives and how to strengthen their ability to effectively perform their duties. It also was well-received by the safety representatives, as it gave them encouragement and recognition, and sent a message to management on the importance of SI971 and the key role of safety representatives and committees in workplace health and safety. The HSE has placed great emphasis and importance on the role of worker involvement and consultation in improving workplace health and safety and reducing major accidents on and offshore. In June 2009, HSE launched a new strategy entitled Be part of the solution, which lists workforce involvement as one of its main priorities, and the agency has published a significant amount of guidance on worker involvement and consultation on its website.294 The Norwegian Working Environment Act addresses the rights and duties of safety representatives and committees in Norway. It applies to nearly all workers in Norway, including onshore and offshore oil workers. The Act provides for the election of government recognized safety representatives whose duty is to “safeguard the interests or employees in matters of the working environment.”295 These regular basis or following an incident. According to HSE, “this can be of great benefit to the duty holder because it brings an independent look at health and safety factors from the workforce viewpoint. Workers are in the front line and are often well placed to see problems and put forward practical suggestions.” HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989; 2012; p 20. http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 290 Under Regulation 22, safety committees are responsible for reviewing the system of constituencies so as to ensure adequate representation of the workforce on health and safety matters, reviewing training of safety representatives, reviewing the frequency of safety committee meetings and the circumstances under which they may be called, and considering causes of accidents and making recommendations to the installation manager. 291Third edition published in 2012. Available at http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 292 Ibid at 7. 293 See HSE. Offshore workforce involvement and consultation: Compliance Inspection Project. Available at http://www.hse.gov.uk/offshore/si971.pdf (accessed September 4, 2013). 294 See http://www.hse.gov.uk/involvement/hsrepresentatives.htm (accessed September 4, 2013). 295 Act Relating to Working Environment, Working Hours and Employment Protection, Etc. (Working Environment Act). December 2012. Section 6-1. Obligation to elect safety representatives. 56

Chevron Richmond Refinery Regulatory Report October 2014

representatives have the right to information, consultation, and participation in inspections.296 Unlike in the UK currently, they also have the legal authority to halt unsafe work until the regulator decides when the work may continue.297 A fundamental element in effective safety management for major accident prevention is active and equal participation from the regulator, industry, and labor. Each entity provides unique and essential insights, and removing the participation of these entities removes a critical voice in health and safety matters. In the UK and Norway, tripartite systems consisting of industry, the regulator, and the workforce have been established to deal with safety and health issues at the highest levels beyond just site workforce representation. The CSB investigation staff has had extensive discussions with worker representatives who have voiced their opinions on their systems to the CSB. Roy Furre, a Representative from the Norwegian Union of Energy Workers, spoke at the CSB’s 2010 public hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, and stated that the Norwegian working environment and the accompanying petroleum regulations empower unions and safety delegates in all phases of the petroleum activities.298 He also noted that the Norwegian petroleum regulations require that all necessary information about risks and decisions be given to the workers’ representatives.299 During the CSB’s public hearing on Safety Performance Indicators in July 2012, Jake Molloy, the Regional Organizer for the National Union of Rail, Maritime and Transport Workers in the UK, stated that the input of workers is “crucial” in major accident prevention and that “if the people operating these systems and delivering these results are unable for any reason to tell you what the true picture is, everything else is worthless.”300 When speaking at a “Step Change for Safety” Conference in Aberdeen, Scotland, on September 5, 2012, Mr. Molloy noted that attending the public hearing in Houston was “eye opening” and that hearing about the US system was like a “walk back in time.”301

296 Ibid at Section 6-2. Duties of safety representatives. 297 Ibid at Section 6-3. The safety representative’s right to halt dangerous work. See also the Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) Section 35. It states that “[t]he responsible safety delegate can, pursuant to Section 6-3 of the Working Environment Act, demand that a work operation or work process be halted by the person responsible for the operation or process. The operation or work shall stop immediately if the safety delegate does not accept the implementation of alternative measures.” http://www.ptil.no/framework-hse/category403.html#_Toc357595266 (accessed April 14, 2014).

298 CSB. Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety. December 15, 2010; p 300. http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed December 10, 2013). 299 Ibid at 300. 300 CSB. Public Hearing: Safety Performance Indicators. July 23, 2013; p 143. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed December 10, 2013). 301 http://www.youtube.com/watch?v=-xDzb4x8t_c (accessed December 10, 2013). 57

Chevron Richmond Refinery Regulatory Report October 2014

1. 5

Process Safety Indicators that Drive Performance As the CSB noted in both its July 2012 public hearing on Safety Performance Indicators and its Chevron Interim Report, leading and lagging process safety indicators help drive continuous process safety improvement, as long as regulators utilize these indicators to focus inspections, audits, and investigations, and organizations focus attention on them in a way that makes a difference. Process safety indicators are a significant element of process safety management systems. They measure the strengths and weaknesses of these systems to achieve and maintain safe and reliable operations302 and, if properly defined, collected and used, can identify the successes and flaws of the system.303 Lagging indicators are a “form of reactive monitoring”304 that includes events such as major spills, fires, or gas releases. Leading indicators, on the other hand, are a “form of active monitoring,”305 and are described as events that do not result in severe consequences and usually address safety system performance, such as deviations from safe operating limits or timely maintenance on safety critical equipment.306 Leading indicators “can be considered as measures of process or inputs essential to deliver the desired safety outcome.”307 The general thinking globally is that if companies rely primarily on lagging indicator data, which is retrospective, they are not effectively managing process safety to ensure major accidents are prevented. According to the HSE, “[t]oo many organizations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly.”308 Rather, facilities must identify critical controls to monitor and set leading indicators against each one to show that the system is operating as intended. The HSE was one of the earliest regulators to adopt process safety indicators regulations. In 1995, the agency began requiring companies to report health and safety data, and then published annual reports based on those statistics. In 2006, the HSE developed a step-by-step guidance document entitled Developing process safety indicators309 to assist industry. The guide establishes and discusses in detail six main steps necessary to implement a process safety measurement system, including developing leading and lagging indicators. It also defines leading and lagging indicators for each of the controls in the risk control system. According to Jake Molloy, “[i]t is our firm belief that the most influential and 302 CCPS. Guidelines for Process Safety Metrics; October 2009; p 109. 303 Ibid. 304 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 305 Ibid. 306 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 83. 307 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/priced/hsg254.pdf (accessed October 30, 2013). 308 Ibid at 1. 309 Full title is Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; first published in 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 58

Chevron Richmond Refinery Regulatory Report October 2014

effective schemes using indicators to measure improvements and major accident prevention are those initiatives generated by our regulator, the Health and Safety Executive [HSE].”310 As discussed in the previous section, a number of large incidents, including BP Texas City and BP Grangemouth, have highlighted the need for the chemical and other major hazard sectors to demonstrate that risks are being adequately controlled. In response to recommendations stemming from such incidents, the COMAH CA developed an Operational Delivery Guide in 2010 on process safety performance indicators setting out four stages to aid facilities in the development of process safety indicators. The document sets out a goal that by the end of 2015 major hazard establishments and duty holders will measure their safety performance and control of risk by way of key leading and lagging performance indicators. Following the 2005 BP Texas City incident, BP developed company-wide process safety indicators, and now includes process safety metrics in performance contracts for its US refinery managers.311 However, existing guidance in the US pertaining to safety performance indicators does not adequately aid companies in managing major hazards onshore. The CSB has noted that in virtually every incident it investigates in the US, process safety indicators are either not used at all or not used effectively.312 Millions of workplaces around the US primarily measure their safety performance using OSHA recordable injury and illness rates, which include slips, trips, and falls. While collecting this type of data is also necessary in hazardous operations, it is not sufficient. Injury rates do not depict the effectiveness of a high hazard facility’s process safety management program.313 For example, the CSB noted in its BP Texas City investigation that BP’s personal injury metrics were described as being at the best level on record; yet, around this same time, in March 2005, BP Texas City experienced the devastating 15-fatality incident, which resulted from a progressive erosion of process safety performance that was not reflected in injury statistics. Following the BP Texas City incident, a number of key recommendations were made to strengthen guidance on indicators in the US. For example, the Baker Panel314 issued the Baker report, which recommended the incorporation of safety indicators to measure safety performance, and stated: The Panel believes that relying exclusively or predominantly on lagging indicators to assess process safety performance is ill-advised. … BP’s reliance on lagging, after-the-fact indicators of process safety performance rather than leading, predictive measures…impaired BP’s ability to measure, monitor and detect deteriorating or degraded process safety conditions and performance… This failure to use a set of effective performance metrics that includes leading indicators increased the 310 Molloy Testimony. CSB Indicators Public Hearing Transcript; July 24, 2012; p 139. 311 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 84. 312 Donald Holmstrom. CSB Indicators Public Hearing Transcript; July 24, 2012; p 13. 313 Ibid. 314 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013). 59

Chevron Richmond Refinery Regulatory Report October 2014

likelihood that the organisation would identify the need for improvements or additional controls only after something had gone wrong.315 The Baker Panel also noted that it was not enough just to develop process indicators: these indicators needed to be meaningful to the company. As such, the Baker Panel also recommended that “a significant proportion of total compensation of refining line managers and supervisors [be] contingent on satisfactorily meeting process safety performance goals….”316 In its final investigation report on the incident, the CSB made a recommendation to API and the USW to jointly lead development of a consensus standard for leading and lagging process safety indicators to drive performance improvements in the prevention of major incidents. API responded by issuing RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries. However, this voluntary standard, which defines a framework of four tiered indicators that incorporate the concepts of lagging to leading measures, has significant shortcomings, as the CSB described in a two-day public hearing on Safety Performance Indicators that was held in July 2012. The CSB analysis found that the ability of RP 754 to drive performance improvement and inform key stakeholders will be hampered by • lagging indicators with insufficient statistical rigor needed to allow for trending or incremental performance improvements; • the lack of well-defined standardized and normalized leading indicators that are needed for comparison among sites, corporations, or to national averages; • weak employee protection requirements; public reporting requirements that will be ineffective to adequately inform stakeholders; and • the lack of broadly based consensus in the standard’s development process.317 As a result, in 2012 the CSB Board designated the response to the CSB’s recommendation as “open- acceptable,”318 meaning that the recommendations recipient is moving in the right direction, but more remains to be done. The CSB also noted in the Chevron Interim Report the important role the public plays in monitoring safety management systems, and referenced CCPS as promoting the sharing of process safety indicators with the public: Sharing performance metrics and results broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics and performance public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating process safety successes also demonstrates to 315 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 194. 316 Ibid at 251. 317 CSB Public Hearing: Safety Performance Indicators. July 23-24, 2012; p 26. http://www.csb.gov/events/csb- public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 318 For more information on recommendations status designations, see http://www.csb.gov/recommendations/faq/#5 (accessed June 21, 2013). 60

Chevron Richmond Refinery Regulatory Report October 2014

employees and the public that positive change can be, and are being, made within an organization.319 The Petroleum Safety Authority (PSA) in Norway provides annual reports to the public on its website assessing indicators it has collected directly from offshore and onshore major hazard facilities since 2000 and 2006, respectively. The PSA utilizes the indicators data found in these reports to identify critical safety areas that must be targeted for improvement in order to prevent near misses and accidents.320 The onshore report, Risk level in the petroleum industry, Onshore facilities,321, 322 includes a description and explanation of the indicators collected and analysis of these data. In this report the PSA notes a decreasing trend in the number of reported hydrocarbon leaks on offshore production facilities between 2007 and 2010.323 However, it is too soon for PSA to assess trends in the onshore indicators data, because the time period for onshore data collection has been relatively short and there are fewer data points with only eight facilities onshore. The PSA also indicated that it will take time for the onshore data to improve as indicators are refined, but recognized that the same approach has already yielded good results in the offshore sector.324 Additional information on data and trends based on safety case regime implementation are provided in Appendix C.

319 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics. 2010; p 109. 320 PSA. Trends in Risk Level: Summary Report 2012 – Norwegian Continental Shelf. 2012; p 1. 321 The CSB had the 2010 version of the onshore report translated into English. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17,

1. (accessed September 17, 2013).

322 The corresponding report discussing offshore indicator data is entitled Trends in Risk Level. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 2013. 323 PSA. Risk level in the petroleum industry, Onshore facilities. 2010; p 80. 324 Ibid. 61

Chevron Richmond Refinery Regulatory Report October 2014

1. 6

Regulatory Assessment, Verification, and Intervention To effectively oversee covered facilities and enforce safety case regulations, technically competent regulators review and assess325 safety case reports and utilize preventative inspections and audits to effectively intervene before high-risk activities commence. According to the HSE, “[t]he assessment process is only a part of the COMAH regime and examines at face value the factual information and examines arguments and demonstrations contained in the report against the requirements of the regulations.”326 The HSE places great emphasis during the assessment phase on the adoption of inherently safer designs327 and notes that “[m]ajor accident hazards should be avoided or reduced at source through the application of principles of inherent safety.”328 Conclusions on the adequacy of the safety case report are developed at the end of the assessment process, and, if deficiencies are found, an intervention strategy for the facility is developed to addresses those deficient measures. According to the HSE, assessment of a safety case report or document “is not a discrete activity but leads to further action under the intervention plan for the operator at that establishment.”329 Intervention by the regulator ensures that the facility and its operations are consistent with information provided in the safety case report, and that there are robust systems in place to “reduce the likelihood of hazards and to mitigate their consequences until the associated risks are ALARP.”330,331 Under the safety case regulatory regime, the regulator has the authority to accept the safety case report or reject it and require additional measures to further reduce risks. Preventative inspections and audits by a technically competent regulator can also result in deep challenges to industry, which does not typically happen under the PSM or RMP regulations. In the UK, the COMAH regulations authorize the CA to

325 According to the HSE, the “assessment reviews the documentary evidence in the report and further documentation, as appropriate, which is referred to in the report or requested by the assessor.” HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013). 326 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 9. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 327 Ibid at 30. 328 HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013). 329 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 4. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 330 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 331 According to HSE, essential considerations to ensure ALARP are “the scope of hazard elimination, the adoption of inherently safer designs, whether good practice has been, or is to be adopted, [and] the application of risk- reducing measures where relevant good practice is not yet established.” Ibid at 30 and 31. 62

Chevron Richmond Refinery Regulatory Report October 2014

organize an adequate system of inspections of establishments or other measures of control appropriate to the type of establishment concerned…[that are] sufficient for a planned and systematic examination of the systems being employed at the establishment, whether of a technical, organisational or managerial nature, so as to ensure…(a) that the operator can demonstrate that he has taken appropriate measures to prevent major accidents; (b) that the operator can demonstrate that he has provided appropriate means for limiting the consequences of major accidents both inside and outside the establishment; (c) that the information contained in any report sent to the competent authority by the operator of the establishment adequately reflects the conditions in the establishment…332 The CSB noted in its BP Texas City Final Investigation Report that in the UK, HSE inspectors thoroughly inspect high hazard facilities annually, and all COMAH-covered facilities are inspected every five years. For the approximately ten petroleum refineries in the UK, detailed planned inspections (ranging from 80 to 150 days) are conducted annually for each refinery by a multidisciplinary team (regulatory inspectors, process safety, mechanical engineering, electrical and instrumentation, and human factors specialists).333 The HSE lists its offshore priorities as safety case assessment;334 verification;335 inspection; investigation; and enforcement.336 In its business plan for 2012-2015, the HSE set out a goal of assessing 72 safety cases onshore and 100 safety cases offshore for 2013 and 2014.337 The work required to assess a safety case report both on and offshore is very resource-intensive (a typical new offshore safety case assessment requires anywhere from 100 to 300 hours of work), and demands that the regulator hire and retain individuals with significant oil and gas experience, specifically in areas such as process safety, human factors, engineering, and organizational performance. In Australia, the Offshore Petroleum and Greenhouse Gas Storage Act 2006 authorizes NOPSEMA to conduct planned inspections of offshore installations to ensure compliance with the Act.338 NOPSEMA notes that planned inspections “are a critical examination of aspects of a facility, its systems and 332 COMAH Regulations 1999 Part 6, Regulation 19(1) and (2). 333 The CSB. Investigation Report: BP Texas City Refinery Explosion and Fire. March 2007; p 205. http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 29, 2013). 334 An owner or operator (i.e. the duty holder) is required to submit a safety case to HSE for each offshore installation. HSE then assesses the safety case using both regulations and HSE’s “Assessment Principles for Offshore Safety Cases (APOSC) and must accept it before an installation can operate. See http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed July 31, 2013). 335 Duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to put in place and keep under continual review a verification scheme by which assurance is obtained from an independent competent person (ICP) that safety critical elements and the PFEER (Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) specified plant are suitable and remain suitable for the life of the installation. For more information see http://www.hse.gov.uk/offshore/verification.htm (accessed July 31, 2013). 336 See http://www.hse.gov.uk/offshore/priorities.htm (accessed July 15, 2013). 337 HSE. HSE Business Plan 2012-15; June 2012; p 14. http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). 338 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Sections 600 and 601. See http://www.comlaw.gov.au/Series/C2006A00014 (accessed July 15, 2013). 63

Chevron Richmond Refinery Regulatory Report October 2014

operations with information obtained from the facility safety case.”339 Subjects of planned inspections include risk control measures related to either a Major Accident Event340 or Occupational Health and Safety controls, or both. NOPSEMA states that it conducts at least two per year for each normally manned offshore installation.341 NOPSEMA distinguishes between two types of planned inspections: field-based inspections, which focus on implementation of control measures described in a facility’s safety case, and themed audits, which deal with inspection of organizational issues by following a common theme to direct lines of questioning.342 In a 1992 compliance directive,343 OSHA stated that the primary enforcement model for the PSM standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) inspections.344 These inspections consist of three parts: determining if the elements of a PSM program are in place; evaluating if the programs comply with the requirements of the standard; and verifying compliance with the standard through interviews, data sampling, and field observations. However, OSHA does not make planned inspections, which have the most opportunity for prevention, a high priority. Rather, OSHA lists its inspection priorities as 1) imminent danger situations; 2) fatalities and catastrophes; 3) complaints; 4) referrals; 5) follow-ups; and 6) planned inspections.345 The CSB noted in its BP Texas City Final Investigation Report that for the 10-year period prior to the Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by developing more highly trained and experienced inspectors to conduct more comprehensive inspections, such as the PQV audits envisioned in the 1992 directive, at facilities presenting the greatest risk of a catastrophic accident. The intent of the recommendation was to establish a permanent, ongoing planned comprehensive inspections program. Spurred in part by the CSB’s recommendations, OSHA issued the Petroleum Refinery Process Safety Management National Emphasis Program (NEP) on June 7, 2007.346 The NEP was a federal program that established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard. Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and uses a more global approach to identify compliance deficiencies…,” the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standard…[which] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, 339 NOPSEMA. Inspection Policy; p 2. http://www.nopsema.gov.au/assets/document/N-02000-PL0025- Inspection.pdf (accessed July 15, 2013). 340 Australia’s Offshore Petroleum and Greenhouse Gas Storage Regulations 2009 define a Major Accident Event as “an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of person at or near the facility.” Chapter 1.5. See http://www.comlaw.gov.au/Details/F2009L04578/Html/Text#param5 (accessed July 15, 2013). 341 For more information, see http://www.nopsema.gov.au/safety/inspections/ (accessed July 15, 2013). 342 For more information, see http://www.nopsema.gov.au/assets/document/N-02000-PL0025-Inspection.pdf (accessed July 15, 2013). 343 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new regulation. 344 OSHA Instruction CPL 02-02-045 (1994). 345 “OSHA Fact Sheet: OSHA Inspections,” available at http://www.osha.gov/OshDoc/data_General_Facts/factsheet-inspections.pdf (accessed on May 20, 2013). 346 Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to complete NEP inspections under the original CPL 03-00-004. 64

Chevron Richmond Refinery Regulatory Report October 2014

interview employees, and verify implementation for specific processes, equipment, and procedures.”347 The NEP inspections were meant to be more targeted and efficient than PQV inspections. However, the inspections being conducted pursuant to the NEP were ended in 2011 partly because they were very time- consuming and resource-intensive.348 OSHA has publicly stated349 that NEP inspection hours were roughly 40 times greater than average OSHA inspection hours. OSHA described the NEP as its most effective emphasis program in its history, citing a disturbing number of issues and subsequent citations. In 1999, EPA established an audit350 program to help ensure compliance with the RMP program. The audits were intended to provide an independent verification of the information in the RMP and include on-site inspections. Under these requirements, the implementing agency (EPA or a correlating state agency) must “periodically audit” RMPs to review their adequacy and require revisions when necessary to ensure compliance. 351 Between fiscal years (FYs) 2010 and 2012, each EPA Region responsible for implementing the RMP program was mandated by EPA to perform inspections352 at five percent of the total number of regulated facilities in the regions, and a certain percentage of these facilities were required to be high-risk.353 In FY 347 CPL 03-00-004, Section X(D)(1). 2007. 348 Jordan Barab, Deputy Assistant Secretary of Labor for Occupational Safety and Health, stated the following during a symposium at the Mary K O’Connor Process Safety Center: “As our refinery NEP comes to an end, we are engaged in a process of trying to figure out how we will address refinery PSM issues in the future. Clearly OSHA's past practice of targeting inspection according to injury and illness numbers is not adequate. However, because of resource limitations, we are also unable to commit to a full-time NEP.” “Saving Lives and Transforming Workplaces: OSHA and Process Safety.” Remarks for Jordan Barab, Deputy Assistant Secretary of Labor for Occupational Safety and Health. Mary Kay O’Connor Process Safety Center International Symposium. Texas A&M University, College Station, Texas. Wednesday, October 27, 2010. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=SPEECHES&p_id=2311 (accessed January 13, 2014). 349 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation made at CSB Public Hearing on Process Safety Indicators; July 20, 2012. http://www.csb.gov/UserFiles/file/Barab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). Also see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013). 350 Within Part 68, the term “audit” refers to the process that implementing agencies may use to verify the quality of the RMP submitted to EPA and require revisions when necessary to ensure compliance. RMP audits will generally involve on-site verification of a facility’s underlying risk management program. Section 68.220 of the RMP rule requires implementing agencies to select facilities for audits based on specific criteria, and to follow a specific process for resolving audit findings prior to any enforcement action. See EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 351 40 CFR §68.220 (1999). 352 RMP inspections “are different from audits in that facilities are not necessarily selected for inspection based on Part 68 regulatory criteria, and inspections can lead directly to implementing agency enforcement actions for regulatory violations. Also, RMP inspections always involve on-site verification activities.” See EPA, “Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r).” January 2011; page 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 353 Criteria used to determine high-risk includes the number of people in the footprint (if it is more than 100,000); accidental releases reported in the RMP; the hazard index (percentage of chemical quantity above threshold and number of chemicals onsite); and the number of Program Levels 2 or 3. US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March 2013. See http://www.condorearth.com/files/08- Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 2013). 65

Chevron Richmond Refinery Regulatory Report October 2014

2010, regions were to conduct 10 percent of the inspections at high-risk facilities, and in FYs 2011 and 2012, 25 percent at high-risk facilities.354 Although EPA has acknowledged that “full compliance with the Risk Management Program regulations cannot be determined without on-site or independent verification of all or part of the information submitted in an RMP[,]”355 the EPA has not effectively implemented the audit and inspection elements of the Risk Management Program. As mentioned above in Section 3.2.2.3.2, the EPA Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk356 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.357 The EPA OIG also noted that of the 296 uninspected high-risk facilities managed by EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.358 4.7 Independent, Competent, Well-Funded Regulator As noted by NOPSEMA, a safety regulator “provides ‘independent’ assurance to society, governments and industry that companies have identified the risks to health and safety and have put appropriate measures in place to control these risks.”359 To ensure that companies are managing risks and employing the best available standards and technologies, the regulator must be independent,360 well-resourced, and retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess companies’ safety case reports and performance. Without independent and competent examinations, the safety case report becomes a meaningless document in terms of controlling risk and preventing major accidents. Offshore regulators in the UK and Australia also utilize independent third party specialist safety companies recognized by the regulator. Third party inspectors review important aspects of the safety case, such as safety critical elements361 and performance standards.362 Third party inspections, however, do not take the place of rigorous inspections by the regulator. 354 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 7. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 355 EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 356 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 357 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 358 Ibid. 359 See http://www.nopsema.gov.au/safety/safety-case/safety-case-approach/ (accessed May 31, 2013). 360 You will find a more detailed discussion of regulator independence in the CSB’s upcoming investigation report on the Macondo incident. 361 The UK HSE requires offshore installations to define “safety critical elements,” which are the technical barriers in place for the prevention, detection, control, and mitigation of major accident risks. Lauder, Bob. Major Hazard (Asset Integrity) Key Performance Indicators in use in the UK Offshore Oil and Gas Industry. Paper at the CSB Indicators Public Hearing. July 24, 2012. 66

Chevron Richmond Refinery Regulatory Report October 2014

As of June 2012, the HSE employed roughly 3,300 staff, of which 1,381were front-line inspectors,363 whose responsibilities include conducting preventative inspections of roughly 950 COMAH facilities throughout the UK. The HSE employs roughly 105 inspectors to inspect approximately 300 offshore installations, in effect a one to three ratio. As such, the HSE, with a budget of roughly $472 million,364 has the authority to offer higher specialist salaries to attract and retain more experienced, competent personnel. According to information obtained from the HSE, in 2011 and 2012 their onshore specialist inspector pay ranged from $85,806 to $102,344, and their offshore inspector pay ranged from $134,387 to $148,423 at the highest grade and $116,288 to $131,499 at the next highest grade.365 A safety case regime requires regulators to conduct preventative facility inspections and audits against the safety case to ensure that specified controls are functioning as intended. Regulators must be capable of interacting as equals with company risk managers when conducting these inspections. Former HSE staff have communicated to the CSB that the HSE seeks new employees with good communication skills in addition to education and experience, as the job of a safety case regulator requires encouraging companies to aspire to make safety improvements that they may not want to make. One message that current and former HSE staff have repeated is that the industry believes having competent regulatory staff adds significant value to their business.366 In any country, competent offshore regulatory staff can persuade companies to manage risks in a rigorous manner, knowing that if not done properly, their risk management practices will be challenged.367 This competence is also essential for companies’ confidence in the accuracy of the regulatory staff’s advice, inspections, and citations. According to a literature review on the safety case in the UK, “[s]ome companies see as positive the requirement to have ‘someone external to the company keeping you on your toes by regularly asking if you have done all you can,’ and that it ‘forces you to convince yourself’ that you have covered all the risks.”368 362 In the UK, duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to “put in place and keep under continual review a verification scheme by means of which assurance is obtained from an independent competent person (ICP) that safety critical elements and PFEER [Offshore Installations ) Prevention of Fire and Explosion, and Emergency Response] specified plant are suitable and remain suitable for the lifetime of the installation.” See http://www.hse.gov.uk/offshore/verification.htm (accessed November 14, 2013). 363 HSE. The Health and Safety Executive Annual Report and Accounts 2011/12; July 2012; p 30. http://www.hse.gov.uk/aboutus/reports/1112/ar1112.pdf (accessed June 3, 2013). 364 For 2013/2014, HSE’s budget is listed as 308.1 £million. HSE recovers approximately 40 percent of its costs through income mainly in the nuclear, offshore, and chemical sectors, and the remainder is funded from Grant-in- Aid pursuant to the Health and Safety at Work etc. Act 1974, and fee for intervention (FFI).364 See HSE, “HSE Business Plan 2012-15,” July 2012; page 17. Available at http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021-forex.html (accessed June 4, 2013). 365 Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021- forex.html (accessed June 4, 2013). 366 Based on conversations between the CSB staff and Magne Ognedal (Norway PSA), Ian Whewell (the UK HSE), Peter Wilkinson (Australia NOPSA [forerunner of NOPSEMA]), and John Clegg (inaugural CEO of NOPSA). 367 Peter Wilkinson, Manager Review Implementation Team, Offshore Safety Section, Australia Department of Industry, Tourism and Resources and “architect” of NOPSA. Presentation to the National Research Centre for Occupational Health and Safety, ANU (May 15, 2002). 368 Vectra Group Limited. Literature Review on the Perceived Benefits and Disadvantages of UK Safety Case Regimes; 2003; p 40. 67

Chevron Richmond Refinery Regulatory Report October 2014

In the US, the federal government has used extensive resources to retain the best available talent to focus on health and safety oversight of US commercial and defense nuclear facilities.369 For instance, many nonsupervisory technical staff at the US Nuclear Regulatory Commission370 (NRC) and the Defense Nuclear Facilities Safety Board are paid at the top of the General Schedule pay schedule.371 Virtually all technical staff at the Defense Nuclear Facilities Safety Board hold technical master’s degrees and approximately 25 percent hold doctoral degrees.372 The federal government has a unique category of non-executive positions that involve high-level research and development in the physical, biological, medical, or engineering sciences, or a closely-related field.373 These are known as “Scientific or Professional” positions, and they are classified above the highest general schedule pay level.374 These special salary authorizations contribute to the technical agencies’ ability to compete with private industry to recruit and retain highly competent staff. The NRC also has a type of funding mechanism that ensures that the agency’s budget adequately covers its regulator activities, as the NRC is required by law to recover at least 90 percent of its budget through licensing and inspection fees.375 Another method by which the NRC is able to attract and retain competent technical staff is its extensive training programs. For new inspection staff, the NRC requires a series of courses, assessments, and simulation, all of which takes approximately two years to complete.376 Inspectors must have a bachelor’s degree in engineering or a degree in a relevant scientific field and Professional Engineer certification.377 The agency operates a technical training center in Chattanooga, Tennessee, with various control room simulators that mirror licensees’ facilities. The NRC staff is expected to sufficiently understand this equipment so that they are able to conduct sufficient audits and investigations.378 Before he or she is fully qualified to conduct inspections, inspector candidates must be recommended by the NRC inspector qualification board and certified by the regional administrator or division director.379 As will be discussed in greater detail under Section 5.0, at the time of the Chevron incident, a majority of the regulators responsible for oversight of Chevron and other petroleum refineries in California did not have sufficient, sustainable funding or staffing to oversee major accident prevention activities. An effective safety case regulatory system would necessitate that the California industry regulator be well- 369 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 370 Presentation by NRC Executive Director Bill Borchardt, January 2011. 371 $123,758 to $155,500 per year in 2012 in Washington, DC. See https://www.opm.gov/oca/12tables/html/dcb.asp (accessed May 15, 2013). 372 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 373 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 374 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 375 Section 6101 “NRC User Fees and Annual Charges,” Omnibus Budget Reconciliation Act, Pub. L. 103-66. 107 Stat. 312 (Aug. 10, 1993). 376 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) at 4, available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed May 28, 2013). 377 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001 378 See, e.g., http://www.iaea.org/ns/tutorials/regcontrol/regbody/reg2124.htm (accessed May 28, 2013). 379 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf 68

Chevron Richmond Refinery Regulatory Report October 2014

resourced and retain a sufficient number of competent, well-trained and experienced staff to critically assess a company’s safety case. The overall knowledge and expertise of the regulator must at a minimum match that of industry in order for the regulator to successfully assess a company’s safety case with the ultimate goal of preventing major accidents.

69

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Oversight of Petroleum Refineries in California

In California, there currently exists a patchwork of primarily activity-based federal, state, and local laws and regulations aimed at preventing harmful releases of hazardous materials at facilities such as petroleum refineries. This regulatory framework does not foster continuous improvement by driving companies to reduce risks of their hazardous activities to ALARP, nor does it have the requisite number of regulatory staff with the skills, knowledge, and experience to provide sufficient oversight. 5.1 Cal/OSHA 5.1.1 Background Information Section 18 of the OSHAct380 encourages states to develop and implement their own job safety and health programs. Twenty-five states (including California), Puerto Rico and the Virgin Islands currently implement OSHA-approved State Plans.381 States must set job safety and health standards that are “at least as effective as” comparable federal standards; most adopt standards that are identical to the federal standards.382 California was certified as an OSHA State Plan state on August 12, 1977.383 California’s Division of Occupational Safety and Health (Cal/OSHA) administers the California Occupational Safety and Health Program. A PSM District Office384 within Cal/OSHA enforces California’s PSM standard, which is established under Title 8, Section 5189 of the California Code of Regulations (CCR) and entitled Process Safety Management of Acutely Hazardous Materials.385,386 The PSM District Office is comprised of seven inspectors, known as Associate Safety Engineers, and one District Manager to regulate nearly 1,700 PSM-covered facilities in California, including 14 petroleum refineries. Only one of these individuals has a technical background, with a degree in Chemical Engineering. Appendix B of this report summarizes the key differences between the federal and California PSM standards and the safety case regulatory regime. A more detailed analysis of those differences will be provided in the remainder of Section 5.1.

The CSB in its Interim Report identified a number of weaknesses of Chevron’s process safety performance. In many of these causal issues, Chevron was not required to perform at a more effective level by the existing California PSM regulations. In Table 1 below, the CSB identifies the causal issues or findings, which highlight the gaps in the California and federal PSM regulations, and how each issue is more effectively managed in the safety case regulatory regime. In this section of the report, some of these examples will be examined in relation to key features of an effective regulatory approach such as the 380 29 U.S.C. §667 (2004). 381 These are referred to informally as OSHA State Plans. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs 382 29 U.S.C. §667 (c)(2) (2004). Also see http://www.osha.gov/dcsp/osp/faq.html (accessed May 13, 2013). 383 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed June 17, 2013). 384 The California PSM District Offices were established in 2001 after the February 1999 Tosco refinery incident in which four workers were fatally injured following the ignition of a highly flammable material during a turnaround operation. In January 2012 the two district offices were combined into one PSM District Office. 385 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed May 13, 2013). 386 8 CCR §5189 (2012). 70

Chevron Richmond Refinery Regulatory Report October 2014

safety case. More information on these causal findings can also be found in the CSB Chevron Interim Report.

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** MOC Inspection recommendation to upgrade pipe to 9- Chrome not implemented. The MOC to implement the recommendation narrowed the scope allowing the 52- inch component that failed to remain in service. Implementation of 9- Chrome could have prevented the incident.387 MOC element requires implementation of written procedures to manage changes that shall address the impact of the change on health and safety; however the element is activity based and there is no requirement to implement effective recommendations or control hazards. There is no requirement in the MOC element to consider inherent safety. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Description of MOC procedures and demonstration of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Implementation of the concept of inherent safety is required.388 ∗ Unless otherwise noted, California and federal PSM requirements are nearly identical. ** Regulatory regimes such as offshore in Norway have many attributes of the safety case regulatory regime but are not called the safety case regulatory regime. 387 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 41 and 42. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 388 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8. 71

Chevron Richmond Refinery Regulatory Report October 2014

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** MOC Chevron conducted MOCs to evaluate proposed changes to crude feed that introduced higher sulfur concentration. However, Chevron failed to thoroughly evaluate the change of increasing sulfur weight percentage in crude oil feed and to assess how it might affect corrosion rates within the 4-sidecut piping circuit. Cal/OSHA did not issue any citations for failing to consider the impact of corrosion in the MOC process when sulfur composition in the crude oil feed was increased.389 MOC element is activity- based rather than performance based and requirements in RAGAGEP such as API 570390 do not apply to the MOC element of PSM. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Duty holder must identify in the safety case report the standards that they are using to reduce risk such as API 570. The implementation of those standards can be enforced by the regulator to achieve ALARP. PHA In its 2009 crude unit PHA, Chevron simply cited non- specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances. The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. While the PHA element requires addressing the control of hazards, it does not require addressing the effectiveness of the controls or using the hierarchy of controls. For example, the standard would not require the use of improved metallurgy or inherent safety to mitigate corrosion hazards. Cal/OSHA did not cite Chevron for this issue. Requires the use of the most effective practical safeguards to achieve ALARP. The safety case requires the use of inherently safer design and the hierarchy of controls.391 389 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 34, 35 and 36. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 390 API 570. Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems. November 2009. 391 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8. 72

Chevron Richmond Refinery Regulatory Report October 2014

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** PHA The 4-sidecut line was analyzed in the most recent crude unit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping. Damage mechanism hazard reviews are not required by the PSM regulation. The process hazard analysis element does not require consideration of RAGAGEP such as API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. Cal/OSHA did not cite Chevron for this issue. For example in the UK the HSE has worked with the industry to develop guidance on damage mechanism hazard reviews in the UK's offshore petrochemical industry. The implementation of best practice standards referenced by a duty holder’s safety case report may be enforced by the regulator to achieve ALARP. Incident Investigations Chevron made recommendations following its investigation of sulfidation incidents at Richmond, Salt Lake City and Pascagoula refineries requiring 100 percent component inspection in high risk piping systems. These recommendations were not implemented in the Richmond refinery crude unit prior to the incident. In 2007 Chevron identified the inherently safer solution of improved metallurgy to prevent sulfidation corrosion but only applied it to the crude unit small spool piece that failed. Neither California nor federal PSM regulations require root cause investigations or recommendations to be developed as the result of incident investigations. While California does require taking action to prevent reoccurrence, (goes beyond federal OSHA) it does not drive risk to ALARP. Cal/OSHA did not cite Chevron for this issue. Federal PSM does not require the development of recommendations or the prevention of future incidents. Investigation of incidents is required to demonstrate legal compliance with framework legislation. ALARP requirement would require remedial action including cross- company learning from incident investigations. HSE can require safety case duty holder compliance with investigation report recommendations (e.g. Buncefield Report- “determine SIL level requirements for overfill protection”). 73

Chevron Richmond Refinery Regulatory Report October 2014

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** Mechanical Integrity Chevron was instrumental in the development of API RP 939-C, which suggests ("should") but does not require ("shall") that 100 percent component inspection be performed. API states that the use of "shall" denotes minimum requirements in the use of the standard - API RP 939- C has no minimum requirements (no substantive "shalls" are used in the recommended practice). The mechanical integrity element of PSM requires that for inspection and testing procedures, employers follow RAGAGEP. However, API RP 939-C has no minimum requirements. Nonetheless, Cal/OSHA cited Chevron for failure to follow API RP 939-C under this mechanical integrity provision. In the federal regulatory context, this approach has been called into question by the recent administrative law judge decision in BP Products. This case is scheduled for review by the full commission. In a safety case regime, the regulator can reject the use of weak and inadequate standards referenced in a safety case report (by rejecting the report) and can require more rigorous performance to achieve ALARP. 74

Chevron Richmond Refinery Regulatory Report October 2014

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** Inherent Safety Chevron employees have recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past employee recommendations. However, the CSB has not identified any documented, thorough analysis of the proposed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. Had Chevron implemented these recommendations, the incident could have been prevented. Neither California nor federal PSM regulations require the use or implementation of inherent safety. Cal/OSHA did not cite Chevron for this issue. In its Interim Report, the CSB made a recommendation to the California legislature and the Governor of California to use inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. Safety case requires the implementation of inherently safer systems analysis.392 Regulator Enforcement Despite numerous safety system deficiencies the Cal/OSHA regulator failed to identify these issues prior to the incident. Cal/OSHA conducted three planned inspections prior to the incident that resulted in no citations or fines. The CSB determined Cal/OSHA lacked sufficient resources and numbers of highly qualified inspectors. California is adding 15 additional inspectors to its PSM unit. The Governor's Interagency Task Force on Refinery Safety will be proposing to implement additional recommendations from their draft report. A key feature of the safety case is a rigorous review of the safety case report that may be accepted or rejected by the regulator. Preventative audits of covered facilities are regularly performed by technically competent, well resourced regulators. 392 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8. 75

Chevron Richmond Refinery Regulatory Report October 2014

Process Safety Element Causal Finding California PSM Regulation∗ The Safety Case Regulatory Regime** Workforce Involvement The workers in previous loss of containment incidents raised concerns about the level of corrosion in the Crude and RLOP incidents, but their concerns were not effectively addressed prior to the August 6, 2012, incident. The workforce participation element requires an employer to develop a written plan to "ensure employee participation in process safety management…” including "consultation with employees and their representatives on the conduct and development of the elements of process safety management...” However, development of a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company's safety management system such as PHAs, MOCs, and investigation activities. Safety case sets out a legal framework for the participation of employees on health and safety-related matters, the election of safety representatives, and the establishment of safety committees to serve health and safety related functions. Workforce participation practices are documented by the duty holder and submitted to the regulator.

Table 1. CSB Causal Findings.

1. 1.2

Analysis 5.1.2.1 ALARP Unlike the OSHAct, the California Occupational Safety and Health Act does not have a General Duty Clause. Rather, Section 5189 was established to “eliminate to a substantial degree, the risks to which employees are exposed in petroleum refineries, chemical plants and other facilities.”393 By focusing on the significant reduction of risk, this language supports the principle of ALARP, which requires a showing by the company that “there are no other practical measures that could reasonably be taken to reduce risks further.”394 However, this section, which lays out the “scope and purpose” of the regulation, is not an enforceable element of the regulation that is subject to citations, and the remaining PSM regulation elements do not lead in practice to that result. Rather, California’s PSM standard has remained activity-based, with many activity-based elements almost identical to the federal PSM standard. For example, an employer must “perform a hazard analysis [PHA] appropriate to the complexity of the 393 8 CCR §5189 (a) (2012). 394 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 76

Chevron Richmond Refinery Regulatory Report October 2014

process for identifying, evaluating, and controlling hazards involved in the process....”395 The PHA must address hazards of the process; engineering and administrative controls applicable to the hazards and their relationships; consequences of failure of these controls; facility siting; human factors; a qualitative evaluation of a range of the possible safety and health effects of the failure of controls on facility employees; and the identification of any previous incident which had a likely potential for catastrophic consequences in the workplace.”396 This language does not support the principle of ALARP, and makes no mention of risk or continuous improvement in any way. As a result, PHAs satisfy the California PSM regulatory requirement by merely listing safeguards; there is no requirement to evaluate or document the effectiveness of these safeguards, or to show that the safeguards in place are effectively reducing risks. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron cited in its 2009 crude unit PHA non-specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.397 The effectiveness of these safeguards was neither evaluated nor documented. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation- induced failure of carbon steel piping could have been recommended. In addition, while the 4-sidecut line was analyzed in this PHA, corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added). A corrosion review, also referred to as a damage mechanism hazard review, analyzes hazards presented by all process failure mechanisms such as corrosion and cracking. This type of review, while considered to be good practice,398 is not required by the PSM regulations either federally or in California, and as such the CSB made a recommendation in its Interim Report to require these in future California PHAs. Under a safety case regulatory regime, the regulator has the ability to drive industry to adapt new technologies and safer practices as soon as they are developed; new rulemaking is not required for immediate improvements, because companies are obligated to continually work toward specified performance goals such as reducing risks to ALARP. Therefore, under a safety case regulatory regime the regulator could require these types of reviews to be conducted to reduce risk without requiring additional legislation. Cal/OSHA does not typically review a company’s PHA as part of its routine oversight of process safety management unless there is a specific complaint, accident, or targeted inspection. Nor does it “accept” a company’s PHA and proposed hazard mitigations. Therefore, prior to the August 2012 incident, Cal/OSHA inspectors did not require any additional information or analysis to be provided in the Chevron crude unit PHA. Highlighting the reactive nature of the PSM standard, Cal/OSHA inspected the Chevron facility post-incident and issued 17 citations related to the incident and eight additional citations, with a total proposed fine of nearly $1 million. Only one citation related to PHAs, and it was not associated with evaluating the effectiveness of safeguards or failure to control the 4-sidecut corrosion hazard. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units 395 8 CCR §5189 (e)(1) (2012). 396 8 CCR §5189 (e)(2) (A) through (G) (2012). 397 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. 398 API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, describes common process failure mechanism and is considered to be good practice for analyzing risks presented by process failure mechanisms such as corrosion and cracking. 77

Chevron Richmond Refinery Regulatory Report October 2014

associated with the crude unit. This again highlights the lack of a requirement for Chevron to demonstrate that risks have been reduced to ALARP, or for Chevron to provide this type of analysis to Cal/OSHA to review.

1. 1.2.2

Adaptability and Continuous Improvement

Of the 25 Cal/OSHA citations mentioned above, two were issued to Chevron for its failure to follow API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries as RAGAGEP. This voluntary API standard will be discussed in greater detail in the CSB’s Final Investigation Report on the Chevron incident. However, it is important to note for purposes of this report that API RP 939-C is a permissive and voluntary standard merely intended to provide guidance to industry personnel on how to address sulfidation corrosion in petroleum refining operations. Existing safety guidelines use words “shall” and “should” to denote either requirements or recommendations. API RP 939-C does not use the word “shall”; as such, it contains no requirements for industry. While the regulator in a safety case regulatory regime has the authority to analyze and challenge the requirements of API RP 939-C with the goal of driving continuous improvement and risk reduction (note the Buncefield examples discussed in Section 4.3), in the present case Cal/OSHA utilized the voluntary practice as an opportunity to issue a citation to Chevron post-incident. Cal/OSHA did not analyze API RP 939-C to determine whether its provisions are sufficient to reduce risks and manage hazards. It also remains to be seen whether this citation will be upheld considering the permissive language contained within the standard. Chevron has investigated a number of sulfidation incidents at its refineries over the years, including Richmond, Salt Lake City, and Pascagoula. Figure 2 shows a timeline of Chevron’s key sulfidation events. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron Richmond Refinery crude unit resulting in a CWS Level 3 alert, injuring one worker and initiating a shelter-in-place for the surrounding community. As a result of these investigations, Chevron made internal recommendations to require 100 percent component inspections in high-risk piping systems. However, these recommendations were not implemented in the Richmond Refinery crude unit prior to the incident, highlighting a lack of learning from previous incidents by Chevron. 78

Chevron Richmond Refinery Regulatory Report October 2014

Figure 2. Chevron's key sulfidation events between 1974 and 2013.

In addition, as a result of the January 2007 incident, Chevron informed Contra Costa Health Services’ Hazardous Materials Program399 (CCHMP) in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, the CSB learned that this upgrade was limited to only the immediate piping spool400 that failed. Cal/OSHA also did not require Chevron to update the crude unit PHA to address the findings from this incident. Under a safety case regulatory regime, the regulator would work with the company to improve its practices following such an incident. The company would also be required to update its safety case report to address these corrosion hazards and demonstrate how the company has reduced risks to ALARP.

The CSB also noted in its Chevron Interim Report that despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction, Chevron’s 2006 Management of Change (MOC) analysis limited the application of those recommendations. Instead of replacing the entire piping segment identified by the original recommendation, the 2006 MOC considered only the replacement of a small section. Although the recommendation was intended to more broadly apply inherently safer materials of construction, the final implementation under the 2006 MOC limited the application of this more corrosion resistant 399 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). CCHSHMP also implements the CalARP and ISO programs, which will be discussed in greater detail later on. 400 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. 79

Chevron Richmond Refinery Regulatory Report October 2014

metallurgy.401 As the mere completion of an MOC and the implementation of any action item satisfy the California PSM standard requirements, regardless of its adequacy or effectiveness, Cal/OSHA did not evaluate the MOC or cite Chevron for narrowing the scope of the MOC, despite its disregard of internal recommendations. Neither the California nor the federal PSM standards allow citations for inadequate MOCs. In addition, RAGAGEP does not apply to the MOC PSM element.

This can be contrasted with the safety case regulatory regime in the UK, where the HSE includes the adoption of inherently safer designs as an essential consideration for determining whether a duty holder has reduced risks to ALARP.402 The HSE also notes that the guidance to COMAH Regulation 4, (the COMAH General Duty provision) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”403 5.1.2.3 Process Safety Indicators As the CSB has noted in its BP Texas City Investigation Report, Chevron Interim Report, and Section 4.5 of this report, process safety indicators are a significant element of process safety management systems and are critical for reducing process safety incidents. A major goal of process safety indicators is to drive continuous process safety improvement. Regulators can utilize these indicators to focus inspections, audits, and investigations.

Federally and in the state of California, neither the PSM standard nor the RMP rule require companies to utilize or report process safety indicators. Chevron voluntarily utilizes both leading and lagging indicators internally in its US petroleum refineries, in a system called Operational Excellence and Reliability Intelligence (OERI), which tracks 26 different process safety indicators. OERI was implemented in May 2009. However, Chevron is not required to report the status of its indicators to California regulators. Nor is Chevron held accountable to use the indicators to drive performance or continuous improvement. As a result, the CSB made a recommendation in its Chevron Interim Report to the California State Legislature to identify and require the reporting of leading and lagging process safety indicators to state and local regulatory agencies, with the goal of improving mechanical integrity and process hazard analysis performance at all California petroleum refineries, and preventing major chemical incidents. 5.1.2.4 Inspections As noted in Section 4.6, safety case regulators utilize preventative inspections and audits to monitor compliance with legislation and to ensure that the facility and its operations are consistent with information provided in the safety case. However, like federal OSHA, California regulations require Cal/OSHA to prioritize accident, complaint, and referral-based inspections over planned inspections. As such, Cal/OSHA’s inspection program of the nearly 1,700 PSM-regulated facilities in California, 401 As discussed in the Interim Report, only the section of piping downstream of the pumps was replaced with 9- Chrome. 402 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 403 Ibid at 8. 80

Chevron Richmond Refinery Regulatory Report October 2014

including 14 petroleum refineries, 404 has been reactive in nature rather than proactive to maximize prevention. OSHA State Plan states405 were strongly encouraged but not required to implement the federal Petroleum Refinery NEP. Cal/OSHA did not adopt the NEP “because of its dedicated PSM Unit.”406 Between 2006 and August 6, 2012, the Cal/OSHA PSM District Office conducted only three planned inspections of the Chevron Richmond facility, totaling only 150 inspector hours of effort. Cal/OSHA has acknowledged that these were not PQV inspections, as envisioned in its mission statement and in the federal PSM compliance directive. None of these inspections resulted in citations or fines. According to statistics provided by OSHA, federal NEP refinery inspections conducted between 2007 and the end of 2011 required roughly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehensiveness between the planned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA and other OSHA State Plan States. The federal NEP, which represented a more robust and intensive inspection program, ended in 2011 due to the stated great demand on OSHA resources. 5.1.2.5 Workforce Participation Like the federal PSM standard, California’s PSM standard provides for workforce participation in a company’s process safety management program. 8 CCR §5189 (p) requires an employer to develop a written plan to “ensure employee participation in process safety management” including “consultation with employees and their representatives on the conduct and development of the elements of process safety management…”407 However, developing a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company’s process safety management systems. In its investigation of the Chevron incident, the CSB noted that the Chevron Richmond Refinery workforce and its representatives, the United Steelworkers (USW), had expressed concerns regarding sulfidation corrosion and broader workplace safety issues, but were not consistently listened to by Chevron managers, and their concerns regarding corrosion were not adequately acted upon. In November 2011, Cal/OSHA investigated a complaint of unsafe working conditions during the fourth quarter Richmond Lube Oil Plant (RLOP) turnaround at the Richmond Refinery. The RLOP receives feedstock from the crude unit where the August 6th incident occurred and has similar sulfidation corrosion concerns. During the shutdown of the RLOP, a fire occurred at one of the RLOP furnaces. According to Cal/OSHA’s inspection report, Chevron employees told Cal/OSHA that “OPERATORS GET IGNORED.” Many of the employees were concerned about increased corrosion they were finding during the turnaround, and believed that increased temperatures and throughput rates had an adverse effect on 404 Also see the California Labor Code Sections 6309 to 6315 (The California Occupational Safety and Health Act of 1973). 405 Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs. 406 Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety Management District Office. Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012. 407 8 CCR §5189(p)(1) (2012). 81

Chevron Richmond Refinery Regulatory Report October 2014

equipment integrity. According to the interview notes, many operators had raised issues of corrosion in the RLOP to higher level supervisors to no avail; according to one, if you raise an issue a couple of times, “you get labeled a ‘pest.’” The CSB has not identified evidence indicating that Cal/OSHA took further action to respond to these concerns, and Cal/OSHA did not issue any citations as a result of its investigation.408 Post-incident, significant sulfidation corrosion was found in the RLOP and piping and equipment were replaced. The CSB found other significant evidence that increased workforce participation could have reduced the likelihood that unchecked corrosion would lead to the August 2012 incident. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron technical staff has considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. In 2009, Chevron Energy Technology Company (Chevron ETC)409 created an internal document on the subject of sulfidation corrosion. Chevron ETC metallurgists released a formal report dated September 30, 2009 (nearly 3 years prior to the incident) to Chevron refinery-based reliability managers and chief inspectors entitled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries. Sulfidation experts explained in the Chevron ETC report that, “[u]ntil now, Chevron has not directly addressed the risk of low Si[licon] carbon steel…”410 and that the report introduced a program that “seeks to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic failure from sulfidation corrosion and calls out Chevron’s need for action. The Chevron ETC report specifically recommended that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 100 percent component inspection program was not implemented at the Richmond refinery prior to the August 6, 2012, incident. The Chevron ETC report defined a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4-sidecut pipe placed it in the highest priority for inspection. Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the potential consequence of sulfidation failures. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut piping. The newsletter stated: Sulfidation corrosion failures … are of great concern because of the comparatively high likelihood of ‘blowout’ or catastrophic failure. This typically happens because corrosion occurs at a relatively uniform rate over a broad area, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition, the 408 Post-incident, there were significant mechanical integrity improvements and piping replaced in the RLOP unit. 409 The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that provides technology solutions and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013). 410 A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident. 82

Chevron Richmond Refinery Regulatory Report October 2014

process fluid is often above its auto ignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents have reinforced the need for revised inspection strategies and a robust PMI (Positive Materials Identification) program. The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, established in 2009, was not implemented at Richmond, and the thin-walled low silicon 4-sidecut piping component remained in service until it catastrophically failed on August 6, 2012. Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. They educated personnel and advocated for identification and control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. These individuals did not participate in the crude unit PHA and did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.411 Despite the history of sulfidation corrosion incidents and the recommendations by Chevron’s workforce to implement better inspection methodologies, Cal/OSHA did not evaluate these recommendations or determine whether Chevron management ensured that the hazards of this damage mechanism were addressed and mitigated in Chevron’s PHAs. In addition, Cal/OSHA issued no citations to Chevron post- incident regarding the failure to address sulfidation corrosion in its crude unit PHA. Finally, when Chevron employees raised concerns, Cal/OSHA did not effectively address them. The examples highlighted in this section speak to the need for California to develop more effective regulation similar to the UK legislation discussed in Section 4.4, to ensure strong workforce involvement in health and safety matters at petroleum refineries. This will not only help prevent incidents such as the one that occurred at Chevron, but it will also help improve communication and ensure that workers are represented in the decisions that affect them. 5.1.2.6 Funding and Regulator Competency Cal/OSHA has not received sufficient funding to employ a well-staffed, multi-disciplinary team capable of conducting thorough inspections of PSM-covered facilities in California. This is apparent when examining the lack of preventative, planned inspections of petroleum refineries being conducted by the PSM team in the state. In order for a safety regulatory regime to successfully regulate with the goal of major accident prevention, there must be a technically competent, well-resourced regulator in place to sufficiently review, scrutinize, and challenge the hazard identification and evaluation that has been conducted and controls that have been put in place to reduce risk, to help drive continuous improvement and ensure that risks are being controlled. It is not an acceptable outcome for society that petroleum refineries with the potential for catastrophic accidents be inspected only after an accident occurs or a complaint is filed.

411 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown. 83

Chevron Richmond Refinery Regulatory Report October 2014

Compensation is one important factor for recruiting and retaining technically competent personnel. The CSB found that California regulators are significantly less compensated when compared to their industry counterparts. Based on information Chevron provided to the CSB, the average annual salary of refinery personnel who would interact with a California regulator performing an audit or safety inspection is $187,630. Table 2 below provides the 2012 salaries of California regulatory personnel that the CSB determined would likely perform a safety inspection or a hypothetical safety case assessment. These figures indicate a substantial compensation gap between the regulator and the regulated. A Cal/OSHA PSM team of associate safety engineers receive an average annual salary that is 46 percent lower than the refinery employees they would likely interface with during an inspection. EPA RMP inspectors receive an annual salary that is 33 percent lower than their facility counterparts and Contra Costa County accidental release prevention engineers and their supervisor are paid 48 percent less than these industry personnel.412

Entity Average Annual Salary Refinery Personnel $187,630 Cal/OSHA $100,536 Contra Costa County $96,875 EPA $125,000 Table 2. Average 2012 salary for individuals selected by the CSB as representative of the professional staff within each California regulator and of the refinery professional staff who interface with the regulators regarding audits or safety inspections at the Chevron Richmond Refinery. As noted in the introduction of this report, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a fee by March 31, 2014, to support an increase in funding and to pay for at least 15 new positions in Cal/OSHA’s PSM Unit.413 The CSB considers this to be a positive step towards improving process safety management in the state of California, as it will provide the team the opportunity to conduct more thorough inspections. However, it is imperative that these additional inspectors have the skills, knowledge, and experience to provide sufficient direct oversight over PSM- covered facilities. Despite the additional funding, there remains a longstanding salary cap on associate safety engineers within Cal/OSHA. This will continue to make it difficult for Cal/OSHA to consistently attract or retain the necessary talent and expertise to effectively oversee these facilities. 412 Compensation information is based on salary only. It does not take into account non-salary information such as bonuses, retirement programs, or benefit programs. 413 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 84

Chevron Richmond Refinery Regulatory Report October 2014

1. 2

U.S. Environmental Protection Agency According to the EPA OIG, as of May 2012, only eight states and five local agencies had accepted full or partial RMP program delegation from EPA.414 As such, EPA regions directly implement the RMP program in most states. As no state agency has requested or received delegation to implement the RMP program within EPA Region 9, the federal EPA regional office is responsible for RMP program implementation for California as well as Arizona, Nevada, Hawaii, the Pacific Islands, and 148 Tribal Nations. 5.2.1 Risk Management Plan (RMP) Program As of March 2013, there were 1,137 RMP-covered facilities in Region 9: 957 in California; 118 in Arizona; 42 in Nevada; 16 in Hawaii; and four in Guam.415 The Chevron Richmond Refinery has many processes covered by the RMP rule, including Program 3 processes, 416 such as the crude unit. As such, Chevron is required to submit an RMP every five years to EPA Region 9, and EPA is expected to audit the facility against this RMP to ensure compliance. According to Chevron’s most recent RMP submitted to EPA Region 9 in October 2011, its crude unit contained 400,000 pounds of a flammable mixture of propane, pentane, butane, ethane, and methane, well above the 10,000-pound threshold quantity for flammables.417 EPA Region 9 employs four full-time and two part-time RMP inspectors to implement the RMP program for the roughly 1,100 RMP-covered facilities in the entire region. Region 9 staff informed the EPA OIG that to most effectively utilize their resources, they “place an additional focus on facilities in States, such as Arizona, that do not have their own risk management or accident prevention programs.418 The EPA’s mandates to conduct a certain number of inspections at high-risk facilities plus a lack of resources and staffing prevent the inspectors from fully auditing many of the petroleum refineries in each state; thus, the inspectors aim to visit each refinery every three years, where they pick one process to evaluate for two to three days. These inspectors target their inspections towards a specific industry issue during these visits. For example, when they last inspected Chevron in 2010, the inspectors focused on the issue of high temperature hydrogen attack (HTHA) due to the Tesoro incident that occurred in April 2010.419 414 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 2. 415 US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March

1. See http://www.condorearth.com/files/08-Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14,

2013). 416 Processes not eligible for Program 1 and either subject to OSHA’s PSM standard or classified in one of ten specified North American Industrial Classification System (NAICS) codes are placed in Program 3, which imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and emergency response requirements. 417 EPA List of Regulated Chemicals and Threshold Quantities for RMP program available at http://www.epa.gov/R5Super/cepps/pdfs/rmp-listed-chemicals-200708.pdf (accessed May 17, 2013). 418 California has its own RMP program, called CalARP. See EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 23. 419 On April 2, 2010, a heat exchanger ruptured due to high temperature hydrogen attack, resulting in seven worker fatalities at the Tesoro Anacortes Refinery in Anacortes, Washington. The CSB is set to release its investigation report on this incident near the end of January 2014. 85

Chevron Richmond Refinery Regulatory Report October 2014

1. 2.2

Implementation of the RMP Program In order for a safety regime to function well, there must be a competent, well-resourced regulator in place to implement the regime. However, the EPA Region 9 RMP group is extremely understaffed and under- resourced, as there are only six full-time inspectors to cover over 1,100 facilities across many states. Instead of fully inspecting or auditing petroleum refineries, the group is able to inspect one process at each refinery for two to three days every three years, which makes fully inspecting these facilities or auditing against the RMPs submitted by these facilities impossible. In addition, this group has other responsibilities beyond the RMP program, including the management of contracts, emergency prevention and preparedness training and outreach, and reporting violations under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). The CSB has learned that because this group has such limited resources, it hopes to delegate RMP inspection authority to other agencies throughout the region, as long as it maintains power to enforce violations. Like the federal and California PSM standards, the RMP regulations provide for workforce participation420 and require facilities to prepare a written plan of action regarding employee participation. It is the RMP program’s policy to invite employee representatives to participate in all parts of onsite inspections. EPA Region 9 RMP staff told the CSB, however, that the limited amount of time they were able to spend onsite at refineries made speaking with facility inspectors and operators a difficult task. They expressed that a lesson learned from the Chevron incident was that EPA RMP inspectors should commit more time onsite during facility inspections and audits, which will allow them more time to speak with workers to gain a better insight into how any issues within the facility are being addressed and resolved.421 As mentioned above, EPA guidance on the RMP program states that the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” may require steps to be taken “beyond those specified in the risk management program rule.”422 While this principle appears to be similar to ALARP requirements of the safety case, in practice this is not required, and whether this is done is not subject to regulation or review. Similar to the PSM standard, RMP regulations require each facility with Program 3 processes to conduct a PHA as part of its prevention program that is “appropriate to the complexity of the process…and[] identify, evaluate, and control the hazards involved in the process.”423 However, these regulations do not require facilities to include these analyses in the RMPs they submit to EPA. Rather, facilities with Program 2 or 3 processes are only required to include in the RMP very high-level, simplified information on their prevention programs and their PHAs. The Chevron Richmond Refinery’s most recent RMP submission from October 2011 included the following information on the PHAs for each relevant process: the date of the last PHA for that process; what technique was used; what major hazards were identified; what process controls were in use (i.e. automatic shutoffs, interlocks, alarms, emergency power); what mitigation systems were in use (i.e. dikes, fire walls, water curtain); what monitoring/detection systems were in use (i.e. process area detectors); date of the most recent review or 420 See 40 CFR §68.83 (2000). 421 This need for greater interface with worker is a professional opinion by EPA staff, but has not resulted in EPA policy modifications to ensure effective worker input in future inspections. 422 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 423 40 CFR §68.67(a) (1998). 86

Chevron Richmond Refinery Regulatory Report October 2014

revision of training programs; and maintenance. Chevron included one paragraph entitled “E.5. General Accidental Release Prevention Program,” which stated that PSM is applied to the entire refinery, and the PSM program is documented in Refinery Instruction (RI)-360, “Richmond Refinery PSM Policy.” No additional information or analysis could be located concerning the identification or control of hazards, or risk reduction, as, unlike the safety case model, there is no requirement for the company to demonstrate to the regulator that it is effectively ensuring that the safety systems are functioning as intended. Under the EPA RMP program, there is no regulatory requirement to reduce risks to ALARP. In addition, there is no requirement to submit to the regulator detailed information relating to risk reduction or hazard assessments. Finally, the Region 9 EPA RMP inspection team does not have the resources to fully audit petroleum refineries and other high hazard facilities subject to the RMP program. As a result, the EPA RMP program is not comprehensive or rigorous enough to control major accident hazards and reduce risks. Instead, facilities submit high-level summary information providing evidence that the activity- based requirements contained within the RMP regulations have been completed by the facility. 5.3 Unified Program Chevron’s Richmond refinery was also subject to process safety regulatory requirements at the county and city level. The facility had to adhere to additional requirements above the PSM and RMP regulations, but these requirements were not sufficient to prevent the Chevron incident. The following sections will discuss those county and city requirements. In 1993, Chapter 418, Statutes of 1993 (Senate Bill 1082) established Chapter 6.11 of the California Health and Safety Code (HSC), which required the Secretary of the California Environmental Protection Agency (Cal/EPA) to adopt regulations creating a “unified hazardous waste and hazardous materials management” regulatory program, or Unified Program, by January 1, 1996, to consolidate and make consistent six existing hazardous materials and hazardous waste programs within the state.424 The Secretary of Cal/EPA was charged with ensuring that the Unified Program was established and implemented by a Certified Unified Program Agency, or CUPA, in all counties in California. Cal/EPA adopted the Unified Program regulations under Title 27, Division 1 of the California Code of Regulations, which integrated six existing programs: the Hazardous Waste Generator and Onsite Hazardous Waste Treatment programs; the Aboveground Storage Tank program; the Underground Storage Tank program; the Hazardous Materials Release Response Plans and Inventory program; the California Accidental Release Prevention (CalARP) program; and the California Uniform Fire Code.425 The CalARP program, which was created through Assembly Bill AB1889 with the goal of major accident prevention, will be discussed at greater length below. There are currently 83 CUPAs in the state of California that implement the Unified Program at a local level.426 5.3.1.1 Contra Costa County Hazardous Materials Programs The Chevron Richmond Refinery is located in the City of Richmond, within Contra Costa County. The local CUPA responsible for implementing the Unified Program in all areas of the country is the Contra 424 California Health and Safety Code §25404(b) (1993). Also see http://www.calepa.ca.gov/cupa/Reports/2002/ReimbAcct.pdf (accessed May 16, 2013). 425 27 CCR §15100 (a)(1) through (6) (1994). 426 See http://www.calepa.ca.gov/cupa/Documents/2012/FactSheet.pdf (accessed May 16, 2013). 87

Chevron Richmond Refinery Regulatory Report October 2014

Costa Health Services’ Hazardous Materials Programs (CCHMP).427 CCHMP is responsible for implementing the Unified Program in all areas of Contra Costa County. CCHMP implements two programs that are relevant to this investigation: the CalARP program and the City of Richmond Industrial Safety Ordinance (RISO). CCHMP also implements the county’s own Industrial Safety Ordinance (ISO), which covers seven facilities. CCHMP has five full-time engineers, known as accidental release prevention engineers, who are responsible for implementing these programs for the county. While all have technical degrees in engineering, only two of these engineers have past refinery experience. 5.3.1.1.1 CalARP The California Health and Safety Code Article 2 (Chapter 6.95, Sections 25531 – 25543.3) was amended effective January 1, 1997, to implement EPA’s RMP program at the state level through the creation of the CalARP program regulations. Modeled after EPA’s RMP program and California’s Risk Management and Prevention Plan, which was enacted in 1986, the CalARP regulations (Title 19, Chapter 4.5 of the CCR) were implemented with the goal of preventing accidental releases of substances that can cause serious harm to the public and the environment, minimizing damage caused by a release, and to satisfy community right-to-know laws.428 California is one of at least three states that implement a state RMP program without delegation of the federal program from EPA.429 The CalARP regulations, including PHA requirements, are essentially duplicative in nature to EPA’s RMP program, with a few exceptions: the list of toxic chemicals covered is 276 instead of 77; the threshold quantities of some chemicals are smaller; CalARP requires a seismic analysis; and there is more interaction with the public and other agencies.430 The CalARP regulations require that businesses that produce, handle, process, distribute, or store certain chemicals over a certain threshold quantity develop a Risk Management Plan (RMP) and submit the RMP to a local CUPA for review. Like the EPA RMP program, facilities with a Program 3 process must develop a management system that includes a PHA and emergency response program.431 State oversight authority and responsibility for the CalARP program is with the California Emergency Management Agency.432 The CalARP regulations apply to roughly 45 facilities in Contra Costa County, including the Chevron refinery in Richmond. Each covered facility is required to submit an updated RMP to CCHMP at least once every five years.433 The group of CCHMP engineers reviews these plans and is required to 427 Contra Costa County’s Hazardous Materials program is responsible for responding to emergencies and monitoring hazardous materials in Contra Costa County. It is the duty of CCC to safeguard the Contra Costa County ecosystem from the release of hazardous materials and other pollutants. For more information see http://cchealth.org/hazmat/ (accessed May 21, 2013). 428 Information available at http://www.calema.ca.gov/HazardousMaterials/Pages/Accidental-Release-Prevention- (CalARP).aspx (accessed May 16, 2013). 429EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 20. 430 Information on differences between EPA’s RMP program and CalARP available at http://cchealth.org/hazmat/differences-rmp-calarp-iso.php (accessed May 16, 2013). 431 22 CCR §2735.5(f) (2004). 432The California Emergency Management Agency is responsible for the coordination of overall state agency response to major disasters in support of local government. For more information see http://www.calema.ca.gov/Pages/default.aspx (accessed May 21, 2013). 433 22 CCR §2745.10(a)(1) (2004). 88

Chevron Richmond Refinery Regulatory Report October 2014

“periodically audit RMPs”434 against the regulations to ensure compliance. This group has told the CSB that it audits each facility at least once every three years. It last audited Chevron in February 2011, and has been conducting another audit in October and November 2013. Although CCHMP is authorized to issue enforcement actions for violations uncovered during facility audits, in practice CCHMP engineers issue “ensure” action items that list the deficiencies and recommend improvements. They then work with the facility to make sure that these action items are implemented. CCHMP has rarely issued fines or citations to facilities for violations. If the engineers identify other gaps or areas for improvement that are not actual regulatory violations, they can issue “consider” action items, which are essentially suggestions to the facility for improvements that are not technically required to be implemented by the regulation. Whether these types of action items are issued is dependent upon the knowledge and experience of the engineer conducting the audit. Once CCHMP engineers have completed the audit, CCHMP issues a final audit report on the facility, which they also supply to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.1.2 Industrial Safety Ordinance The Contra Costa County Industrial Safety Ordinance (ISO) became effective January 15, 1999. Adopted as County Ordinance Chapter 450-8, the ISO expands on the CalARP program in Contra Costa County for facilities meeting the following criteria: 1) the facility is within an unincorporated area of the County; 2) the facility is either a petroleum refinery or chemical plant; 3) the facility is required to submit a Risk Management Plan (RMP) to the EPA and the Contra Costa County Health Service; and 4) the facility has at least one Program 3 process.435 Seven of the 45 CalARP facilities in the county are currently required to comply with the ISO requirements. The ISO was adopted to improve industrial safety by, among other things, requiring more comprehensive coverage of the whole facility rather than only certain processes; providing review, inspection, auditing and safety requirements more stringent than are currently in effect; requiring the development and implementation of a human factors program; and preventing and reducing the number, frequency and severity of accidental releases in Contra Costa County.436 Facilities subject to the ISO are essentially required to treat every process as subject to the CalARP Program 3 prevention program requirements. Covered facilities have additional requirements as well, including developing and implementing a human factors program, considering inherently safer technologies and systems for new and existing facilities or processes, submitting a safety plan to CCHMP, and conducting a Management of Organizational Change (MOOC) prior to changes in permanent staffing levels or reorganization in operations, maintenance, health and safety, or emergency response.437

434 22 CCR §2775.2(a) (2004). 435 See http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 436 County Ordinance Chapter 450-8.004(a)(1) through (10) (2006). http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 437 Information available at http://cchealth.org/groups/hazmat/industrial_safety_ordinance_risk_management.php (accessed May 22, 2013). 89

Chevron Richmond Refinery Regulatory Report October 2014

1. 3.1.1.3 City of Richmond Industrial Safety Ordinance

On December 18, 2001, the City of Richmond adopted an Industrial Safety Ordinance (RISO) under Municipal Code Chapter 6.43 that was almost identical to the ISO. In February 2013, the City of Richmond Council amended the RISO to make it equivalent to the ISO. Chevron is one of two facilities subject to RISO requirements. Pursuant to an agreement with the City of Richmond, CCHMP implements and enforces the RISO within the city. Like the ISO, the RISO requires that a covered facility submit a safety plan to CCHMP that includes safety elements such as process safety information (PSI), operating procedures, mechanical integrity, employee participation, and management of change (MOC).438 CCHMP has posted a Safety Plan Guidance Document on its website to assist facilities in developing these plans. Each facility is also required to comply with safety requirements including performing PHAs, and must include a description of the manner of compliance with these in the safety plan.439 In performing a PHA, facilities are required to address the hazards of the process, identify any previous incident, identify controls applicable to the hazards, and identify consequences of failure of those controls, human factors, and a qualitative evaluation of a range of possible safety and health effects of failure of controls.440 The CCHMP engineers are required to review each facility’s safety plan as well as audit each facility to determine compliance with ISO or RISO. CCHMP engineers conduct the CalARP and ISO/RISO audits concurrently at each covered facility. CCHMP generally audits each facility once every three years. To aid in the auditing process, CCHMP engineers have entered all the CalARP program requirements into a database. They have taken each of these requirements and turned them into questions. When the engineers go onsite, they perform three main functions: 1) they identify and review any policy statement that directs how people should handle a particular piece of equipment; 2) they identify and review records of procedures, such as MOCs and permits; and 3) they randomly select and interview individuals about their familiarity with various aspects of different programs. If the engineers find a regulatory deficiency, they issue an ensure action item to the facility. Once the engineers have completed their facility audit, they issue a preliminary determination to the facility. The facility has 90 days to review the draft and provide a proposed remedy with specifics on how they will fix each deficiency, and the timeline. Once the report is finalized it goes out for public comment. Following public comment, it is issued to the facility and provided to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.2 Analysis Chevron submitted its most updated safety plan to CCHMP on February 25, 2013. Section 3.12 of the plan discusses PHAs and Action Items. Under this section, Chevron lists eight objectives of its PHAs, including identifying possible failures or releases, evaluating potential consequences, and proposing recommendations that would reduce the risks. Chevron also discusses its possible justifications for declining recommendations from PHAs, including the fact that an alternative measure would be sufficient, and that the recommendation may be infeasible. There was no additional information or 438 Richmond Municipal Code Section 6.43.090 (a) (2013). 439 Ibid at Sections (a) through (e) (2013). 440 Ibid at (d) (2013). 90

Chevron Richmond Refinery Regulatory Report October 2014

analysis contained in this section concerning the identification or control of hazards, or risk reduction, as there is no requirement to do so. The RISO and CalARP regulations require that PHAs list controls and possible consequences of failure of those controls, but there is no specific requirement to include evaluations of the safeguards and controls in the PHA. As CCHMP engineers are only required to audit against the regulatory requirements, they would only examine the evaluation of safeguards if such an evaluation were performed and documented in the facility’s PHAs. As noted previously, Chevron’s most recent crude unit PHA ineffectively listed qualitative safeguards for corrosion and mechanical integrity. While CCHMP engineers are able to issue “consider” action items to the facility recommending actions above and beyond regulatory requirements, CCHMP engineers did not do this regarding Chevron’s Crude Unit PHA or its evaluation of safeguards. After reviewing CCHMP’s most recent audit of Chevron, the CSB could find nothing referring to sulfidation corrosion, reduction of risk, or safeguard evaluation. While CCHMP is able to utilize these “consider” action items to encourage facilities to go above and beyond regulatory requirements to reduce risk, CCHMP engineers have stated to the CSB that they do not make sufficient use of this mechanism. Rather, they tend to audit against the existing regulatory requirements to ensure compliance. Unlike the safety case regulatory approach, which requires a reduction of risk to ALARP or equivalent, facilities covered by RISO or ISO are only required to “consider [emphasis added] the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis [PHA] and in the design and review of new processes and facilities.”441 Despite multiple internal recommendations to replace its piping due to the risk of sulfidation corrosion, Chevron failed to replace the piping prior to the incident with an inherently safer material. Again, the CSB has not found evidence that CCHMP effectively encouraged Chevron to go above and beyond regulatory requirements by utilizing inherently safer systems to reduce risk. As emphasized repeatedly in this report, a regulatory regime is only as strong as its regulators, and must employ individuals with the requisite skills, knowledge, and experience to provide sufficient oversight over facilities. In the case of CCHMP, there are only five engineers for nearly 45 facilities in the county, and only two have previous refinery experience.442 In addition, while the CCHMP is funded mostly through CUPA fees, ISO fees, and other means of cost recovery, the engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which has experienced annual budget reductions in the millions.443 This has unnecessarily resulted in a decrease in the CCHMP engineers’ salaries and has made it extremely difficult for CCHMP to fill a current position that has been open over three years because of its inability to offer competitive salaries to attract its engineers. Overall, CCHMP suffers from a lack of resources and funding, limiting its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County.

441 City of Richmond Municipal Code §6.43.050(g) (February 5, 2013). 442 Two of the other engineers have chemical plant experience and have led or participated in refinery compliance audits in the past ten years. 443 More information available at http://www.co.contra-costa.ca.us/DocumentCenter/Home/View/8917 (accessed May 23, 2013). 91

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Conclusion

This report has focused on several attributes of more robust process safety management regulatory regimes from around the world that the CSB believes would greatly enhance existing federal and California process safety regulations. Some attributes discussed include: an enhanced process hazard analysis; continuous risk reduction to ALARP; active workforce participation; the effective use of process safety indicators that drive performance; regulatory assessment, verification, and intervention; and an independent, competent, well-funded regulator. These attributes together enable industry and the regulator to ensure that facilities are developing and implementing comprehensive, robust safety management systems to prevent major accidents. Implementation of a more comprehensive process safety management regulatory approach in California for petroleum refineries will require a commitment of extensive resources to fund a regulator that has the requisite skills, knowledge, and experience to ensure petroleum refineries in the state continually assess their practices and reduce risks to ALARP. However, the CSB believes that effective implementation of this regulatory approach will achieve greater major accident prevention in California and, in the process, provide greater protection for its workers and the public. An enhanced process safety management regulatory model provides the adaptability necessary to keep current with improving standards and advancing technology, without requiring lengthy and often unproductive rulemaking on the part of the regulator. A competent regulator will independently ensure that California refineries have taken all practical measures that can be reasonably taken to reduce risks. For example, the regulator would have the ability to work with these facilities to implement recommendations and lessons learned from significant petroleum refinery incidents throughout the world without requiring extensive rulemaking or legislation, as regulators have done post-incident in the UK, Norway, and Australia. (Additional information and discussion of the safety case type regime is included in Appendix C).

92

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Process Safety Management Reform at the Federal Level: A

Path Forward

As this report discusses, process safety management in the US has undergone little reform since its inception in the 1990s despite advancing best practices and technology. On July 25, 2013, the CSB held a public meeting to discuss the status of three key CSB safety recommendations made to OSHA in the last decade to revise and improve the Process Safety Management (PSM) standard.444 While acknowledging some positive steps taken by OSHA, such as including process safety management in its regulatory agenda, the CSB expressed at the meeting its disappointment with OSHA’s lack of progress with implementation of open CSB recommendations to improve the PSM standard.445 As a result of the meeting, the Board voted to change the status of the three recommendations made to OSHA concerning the PSM standard to “Open-Unacceptable”.446

Recent significant incidents such as the April 2013 explosion and fire that occurred at a fertilizer storage and distribution facility in West, Texas, and resulted in fifteen fatalities and hundreds of injuries, have resulted in an increased national dialogue on the issue of process safety management reform.447 As mentioned in Section 2.0 above, President Obama has issued a number of Executive Orders focused on improving chemical safety in the US. On January 18, 2011, President Obama issued Executive Order 13563,448 which called for improvements in the nation’s regulatory system to promote predictability and reduce uncertainty and to use the best, most innovative, and least burdensome tools for achieving regulatory ends. 444 The CSB made a fourth recommendation (2001-01-H-R1) to OSHA in its 2002 reactive hazards study to modify the PSM standard to more comprehensively manage reactive hazards. On January 28, 2004, the Board voted unanimously to designate the status of this recommendation as “Open-Unacceptable”. 445 For a copy of the public meeting transcript see http://www.csb.gov/assets/1/7/0725CSB-OSHA_(2).pdf (accessed October 27, 2014). 446 “Open-Unacceptable” means that the recommendation recipient responds by expressing disagreement with the need outlined in the recommendation. The Board believes, however, that there is enough supporting evidence to ask the recipient to reconsider. The three open recommendations concerning the PSM standard are: 1) Recommendation to ensure coverage under the Process Safety Management (PSM) standard for atmospheric storage tanks that could be involved in a potential catastrophic release as a result of being interconnected to a covered process with 10,000 pounds of a flammable substance. The recommendation was issued in 2002 following the CSB’s investigation of a 2001 explosion of a poorly maintained, corroded storage tank containing spent sulfuric acid and flammable hydrocarbons at the Motiva refinery in Delaware City, Delaware. A worker was conducting hot work which ignited vapor through holes in the deteriorated tank. 2) Recommendation to revise the PSM standard to require management of change (MOC) reviews for organizational changes such as mergers and acquisitions that may impact process safety. This recommendation, issued in 2007, followed the 2005 explosions and fire at the BP Texas City refinery which killed 15 workers and injured 180 others. 3) Recommendation that OSHA issue a fuel gas safety standard for construction and general industry. This recommendation, issued in June 2010 followed two catastrophic accidents that occurred that year: In one, an explosion caused a roof collapse at the ConAgra Slim Jim facility in Garner, North Carolina, killing four workers and injuring 67 others. A worker had been attempting to purge new natural gas piping during the installation of an industrial water heater, resulting in a large release of natural gas indoors. In the other, at the Kleen Energy power plant in Middletown, Connecticut, high pressure natural gas was being used to clean new piping and was released in a congested outdoor area. It ignited, killing six workers and injuring at least 50. 447 See CSB investigation of West, Texas, fertilizer incident at http://www.csb.gov/west-fertilizer-explosion-and- fire-/ (accessed October 27, 2014). 448 Improving Regulation and Regulatory Review. Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.archives.gov/federal-register/executive-orders/2011.html (accessed July 10, 2013). 93

Chevron Richmond Refinery Regulatory Report October 2014

Following the incident in West, Texas, President Obama issued Executive Order 13650, Improving Chemical Facility Safety and Security , on August 1, 2013.449 The Executive Order established the Chemical Facility Safety and Security Working Group, a working group of federal agencies450 tasked with, among other things, developing options for enhancing and modernizing policies, regulations, and standards to improve the safety and security of chemical facilities.451, 452

Consistent with Executive Order 13650, both OSHA and the EPA issued Requests for Information, or RFIs, in the last year, requesting comment on potential revisions to several standards, including the Process Safety Management (Standard) and the Risk Management Plan (RMP) Program regulations, respectively.453 These are all positive steps toward significant improvements in process safety management at the federal level. CSB Chairperson Rafael Moure-Eraso has publicly advocated for Executive Order 13650 implementation, including requirements for safer technologies, regulation of reactive chemicals like the ammonium nitrate stored at West's fertilizer site, public reporting of process safety indicators, and regulatory coverage for hazardous oil drilling and production operations.454

The CSB believes that it is important to continue to build upon this significant national dialogue. In the coming months, the CSB will consider adding the issue of federal process safety management reform and modernization to its Most Wanted Chemical Safety Improvements Program (“Most Wanted Program”).455 The purpose of the Most Wanted Program is to: • identify the most important chemical safety improvement goals of the CSB in the form of a “Most Wanted List” of Chemical Safety Improvements, which will be based on recommendations resulting from CSB investigations, studies, hearings, and similar fact-finding activities;

449 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 2013). https://www.federalregister.gov/articles/2013/08/07/2013-19220/improving-chemical-facility-safety-and-security (accessed January 7, 2014). 450 The working group includes the EPA, the Department of Justice, the Department of Agriculture, the Department of Transportation, and the Department of Labor. 451 See Section 6 of the Executive Order. 452 The group has included the safety case regulatory model in a list of potential actions it may consider taking to improve chemical safety regulation. See Working Group response to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 453 OSHA issued its RFI on potential revisions to its standards, including the PSM standard, on December 9, 2013 (at 78 FR 73756). The CSB issued its formal response to the RFI on March 31, 2014. View the CSB’s response at http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed October 27, 2014). The EPA issued its RFI on potential revisions to the RMP program regulations and related programs on July 31, 2014 (at 79 FR 44603). View the EPA RFI at https://www.federalregister.gov/articles/2014/07/31/2014-18037/accidental-release-prevention- requirements-risk-management-programs-under-the-clean-air-act-section (accessed October 27, 2014). Responses to the RFI are due on or before October 29, 2014. 454 Moure-Eraso, Rafael. Effective regulation of chemical industry still elusive since 1989 accident: The 25 years after disaster at Pasadena’s Phillips 66 plant have brought reform, but more vigilance needed. The Houston Chronicle; October 23, 2014. http://www.houstonchronicle.com/opinion/outlook/article/Moure-Eraso-Effective- regulation-of-chemical-5843582.php (accessed October 27, 2014). 455 The CSB adopted the Most Wanted Program on June 12, 2012. Board Order 046, Most Wanted Chemical Safety Improvements Program, discusses the policies of the program in detail. See http://www.csb.gov/assets/Record/Order_046_(06122012).pdf (accessed October 27, 2014). 94

Chevron Richmond Refinery Regulatory Report October 2014

• make efficient use of limited resources to pursue implementation of changes that are most likely to achieve important national-level safety improvements;

• focus special advocacy efforts by Board Members and staff on the Most Wanted List;

• inform the CSB’s deployment decisions and strategic allocation of staff resources; and

• issue periodic reports of the activities of the Program.

Consistent with Executive Order 13650, the CSB will also hold a public hearing to discuss the need for process safety management regulatory reform at the federal level. The public hearing will include discussion of various models for high hazard facility safety regulation from around the US and the world – including consideration of safety case type models. Presentations, or written comments, regarding various regimes should discuss, at a minimum, the following:

• The role of transparency and community involvement;

• The effectiveness of worker (union and non-union) involvement programs and the effectiveness of protecting workers from retaliatory actions;

• The methods for measuring process safety performance and for reporting of process safety indicator data (to regulators, the public, third parties, or industry groups);

• The approach used to strive for risk reduction and continuous improvement;

• The approach for establishing a “tolerable” risk level; and

• The effectiveness of enforcement methods.

The CSB will hold this public hearing in the Spring of 2015, following the publication of this report. Upon completion of the public hearing the CSB will publish a document summarizing the proceedings.

95

Chevron Richmond Refinery Regulatory Report October 2014

1. 0 Recommendations

Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer operations at California petroleum refineries and protecting workers and communities from future accidents, the CSB makes the following safety recommendations:

California State Legislature, Governor of California

2012-03-I-CA-R21

Based on the findings in this report, enhance and restructure California’s process safety management (PSM) regulations for petroleum refineries by including the following goal-setting attributes:

a. Require a comprehensive process hazard analysis (PHA) written by the company that includes:

i. Systematic analysis and documentation of all major hazards and safeguards, using the hierarchy of controls to identify hazards and significantly reduce risks to a goal of as low as reasonably practicable (ALARP) or similar;

ii. Documentation of the recognized methodologies, rationale and conclusions used to claim that inherently safer systems have been implemented to as low as reasonably practicable (ALARP) or similar, and that additional safeguards intended to control remaining hazards will be effective;

iii. Documented damage mechanism hazard review conducted by a diverse team of qualified personnel. This review shall be an integral part of the process hazard analysis (PHA) cycle and shall be conducted on all covered processes, piping circuits and equipment. The damage mechanism hazard review shall identify potential process damage mechanisms and consequences of failure, and shall ensure effective safeguards are in place to prevent or control hazards presented by those damage mechanisms. Require the analysis and incorporation of applicable industry best practices and inherently safer design to the greatest extent feasible into this review; and iv. Documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP) or similar. Include requirements for inherently safer systems analysis to be automatically triggered for all management of change (MOC) and process hazard analysis (PHA) reviews, as well as prior to the construction of new processes, process unit rebuilds, significant process repairs, and in the development of corrective actions from incident investigation recommendations.

96

Chevron Richmond Refinery Regulatory Report October 2014

b. Require a thorough review of the comprehensive process hazard analysis by technically competent regulatory personnel;

c. Require preventative audits and preventative inspections by the regulator to ensure the effective implementation of the comprehensive process hazard analysis (PHA);

d. Require that all safety codes, standards, employer internal procedures and recognized and generally accepted good engineering practices (RAGAGEP) used in the implementation of the regulations contain adequate minimum requirements;

e. Require mechanisms for the regulator, the refinery, and workers and their representatives to play an equal and essential role in the direction of preventing major incidents. Require an expanded role for workers in management of process safety by establishing the rights and responsibilities of workers and their representatives on health and safety-related matters, and the election of safety representatives and establishment of safety committees (with equal representation between management and labor) to serve health and safety-related functions. The elected representatives should have a legally recognized role that goes beyond consultation in activities such as the development of the comprehensive process hazard analysis, implementation of corrective actions generated from hierarchy of control analyses, management of change, incident investigation, audits, and the identification, prevention, and control of all process hazards. The regulation should provide workers and their representatives with the authority to stop work that is perceived to be unsafe until the employer resolves the matter or the regulator intervenes. Workforce participation practices should be documented by the refinery to the regulator;

f. Require reporting of information to the public to the greatest extent feasible, such as a summary of the comprehensive process hazard analysis (PHA) which should include a list of inherently safer systems implemented; safeguards implemented for remaining hazards; standards utilized to reduce risks to As Low As Reasonably Practicable (ALARP) or similar; and process safety indicators that demonstrate the effectiveness of the safeguards and management systems;

g. Implement an approach or system that determines when new or improved industry standards and practices are needed and initiate programs and other activities, such as an advisory committee or forum, to prompt the timely development and implementation of such standards and practices; and

h. Ensure that a means of sustained funding is established to support an independent, well-funded, well- staffed, technically competent regulator.

2012-03-I-CA-R22

Implement a compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency at all levels of process safety regulatory oversight and policy development in California. A market analysis and benchmarking review should be periodically conducted to ensure the compensation system remains competitive with California petroleum refineries. 97

Chevron Richmond Refinery Regulatory Report October 2014

2012-03-I-CA-R23 Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the state of California to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from refineries and contractors to promote continuous safety improvements. At a minimum, this program shall: a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness of process safety management systems and safeguards for major accident prevention. Include leading and lagging indicators that are measureable, actionable, and standardized. Require that the reported data be used for continuous process safety improvement and accident prevention; b. Analyze data to identify trends and poor performers and publish annual reports with the data at facility and corporate levels; c. Require companies to publicly report required indicators annually at facility and corporate levels; d. Use process safety indicators (1) to drive continuous improvement for major accident prevention by using the data to identify industry and facility safety trends and deficiencies and (2) to determine appropriate allocation of regulator resources and inspections; and e. Be periodically updated to incorporate new learning from world-wide industry improvements in order to drive continuous major accident safety improvements in California.

Mayor and City Council, City of Richmond, California

2012-03-I-CA-R24

Implement or cause to be implemented a compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency at all levels of process safety regulatory oversight and policy development in Richmond, California. A market analysis and benchmarking review should be periodically conducted to ensure the compensation system remains competitive with California petroleum refineries.

98

Chevron Richmond Refinery Regulatory Report October 2014

Board of Supervisors Contra Costa County, California

2012-03-I-CA-R25

Implement a compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency at all levels of process safety regulatory oversight and policy development in Contra Costa County, California. A market analysis and benchmarking review should be periodically conducted to ensure the compensation system remains competitive with California petroleum refineries.

99

Chevron Richmond Refinery Regulatory Report October 2014

References

Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationRe port_2004.pdf (accessed May 8, 2013).

Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007.

Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013).

Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; October 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; March 2007.

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., December 2008.

Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990.

Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013).

EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009.

EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19,

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012.

Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online]. 100

Chevron Richmond Refinery Regulatory Report October 2014

http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%2 0presentation/Lonford%20talk.PDF (accessed May 8, 2013).

Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999;.

Hopkins, Andrew. The Meaning of “Safety Case”; February 2013.

HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations;

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013).

HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013).

HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013).

HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996.

The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013).

101

Chevron Richmond Refinery Regulatory Report October 2014

Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013. Citing Zimgast, Erst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-EXTRACT. Risk Engineering Services, Swiss Re. http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013).

102

Chevron Richmond Refinery Regulatory Report October 2014

Appendix A: Significant Petroleum Refinery Incidents in 2012 1. Tank failure at the ExxonMobil refinery in Beaumont, Texas on 11 January 2. Vessel pressure excursion at the Flint Hills refinery in St. Paul, Minnesota on 22 January 3. Hydrogen Sulfide release from mechanical integrity failure at the Northern Tier Energy refinery in St. Paul, Minnesota on 26 January 4. Sulfuric acid release from a mechanical integrity failure at the ConocoPhillips refinery in Wood River, Illinois on 27 January 5. Hydrogen Sulfide release from mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 31 January 6. Hydrocarbon and hydrogen fluoride release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 31 January 7. Sulfur dioxide and hydrogen sulfide release following a vessel pressure excursion at the Alon refinery in Big Spring, Texas on 1 February 8. Hydrocarbon release from a vessel pressure excursion at the ConocoPhillips refinery in Belle Chasse, Louisiana on 1 February 9. Benzene release from a mechanical integrity failure at the Husky refinery in Lima, Ohio on 16 February 10. Fire at the Tesoro refinery in Salt Lake City, Utah on 17 February 11. Fire at the BP refinery in Cherry Point, Washington on 17 February 12. Tank failure at the Shell refinery in Deer Park, Texas on 22 February 13. Tank failure at the Paulsboro refinery in Paulsboro, New Jersey on 23 February 14. Fire at the Citgo refinery in Corpus Christi, Texas on 24 February 15. Hydrogen Sulfide release from a mechanical integrity failure at the Flint Hills refinery in Rosemount, Minnesota on 28 February 16. Vessel pressure excursion at the Motiva refinery in St. Charles, Louisiana on 28 February 17. Benzene release from a mechanical integrity failure at the Chalmette refinery in Chalmette, Louisiana on 28 February 18. Crude oil release from a mechanical integrity failure at the Flint Hills refinery in North Pole, Alaska on 4 March 19. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 6 March 20. 1 worker was fatally injured and 2 other workers were burned at the Valero refinery in Memphis, Tennessee on 6 March 21. Fire during a hot work activity at the Tesoro refinery in Martinez, California on 7 March 22. Benzene release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 8 March 23. Heavy oil release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 13 March 24. Benzene release from a mechanical integrity failure at the Marathon refinery in Texas City, Texas on 14 March 25. Fire at the PBF Energy refinery in Delaware City, Delaware on 16 March 26. Hydrocarbon release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 19 March 103

Chevron Richmond Refinery Regulatory Report October 2014

Hydrocarbon release from a mechanical integrity failure at the Tesoro refinery in Anacortes, Washington on 23 March

Hydrocarbon release from a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 24 March

Fire at the ExxonMobil refinery in Billings, Montana on 25 March

Hydrogen fluoride release from a mechanical integrity failure at the BP refinery in Texas City, Texas on 27 March

Hydrocarbon release from a mechanical integrity failure at the Total refinery in Port Arthur, Texas on 11 April

Fire at the ConocoPhillips refinery in Rodeo, California on 13 April

Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 16 April

Crane fell over and damaged utility piping at the Citgo refinery in Lemont, Illinois on 17 April

Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 19 April

Fire at BP refinery in Texas City, Texas on 20 April

Hydrocarbon release from a mechanical integrity failure at the ConocoPhillips refinery in Sweeny, Texas on 24 April

Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 8 May

4 workers injured in fire at the Sinclair refinery in Sinclair, Wyoming on 8 May

Hydrocarbon release from a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 8 May

Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 9 May

Fire at the Motiva refinery in Port Arthur, Texas on 12 May

Hydrogen sulfide release from a mechanical integrity failure at the CVR Energy refinery in Wynnewood, Oklahoma on 11 May

Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 15 May

Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 17 May

Benzene and hydrogen sulfide release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 21 May

Fire at the Montana Refining Company refinery in Great Falls, Montana on 24 May

Hydrocarbon release from a mechanical integrity failure at the Valero refinery in Memphis, Tennessee on 25 May

2 workers injured from a fire at the Sinclair refinery in Sinclair, Wyoming on 28 May

Propylene release from overpressure event at the PBF Energy refinery in Delaware City, Delaware on 29 May

Hydrocarbon release from a mechanical integrity failure at the Valery refinery in Houston, Texas on 31 May

Hydrogen and hydrocarbon release due to loss of containment event at the Shell refinery in Deer Park, Texas on 7 June 104 Chevron Richmond Refinery Regulatory Report October 2014

Hydrogen sulfide and hydrocarbon release due to flare failure at the Motiva refinery in Norco, Louisiana on 7 June

Fire at the Motiva refinery in Port Arthur, Texas on 9 June

Hydrocarbon release due to a mechanical integrity failure at the BP refinery in Texas City, Texas on 9 June

Fire at the ExxonMobil refinery in Torrance, California on 11 June

Fire at the Total refinery in Port Arthur, Texas on 13 June

Hydrogen sulfide release from a tank failure at the ConocoPhillips refinery in Rodeo, California on 15 June

Hydrocarbon release at the Shell refinery in Deer Park, Texas on 20 June

Fire at the BP refinery in Whiting, Indiana on 21 June

Hydrocarbon release due to a mechanical integrity failure at the Valero refinery in Corpus Christi, Texas on 23 June

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 25 June

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 28 June

Propane release due to a mechanical integrity failure at the Valero refinery in McKee, Texas on 28 June

Sulfuric acid release due to a mechanical integrity failure at the Chevron refinery in El Segundo, California on 2 July

Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Westlake, Louisiana on 14 July

Fire at the Citgo refinery in Corpus Christi, Texas on 16 July

Fire at the Valero refinery in Meraux, Louisiana on 22 July

Sulfuric acid release due to a mechanical integrity failure at the Sunoco Point Breeze refinery in Philadelphia, Pennsylvania on 22 July

Fire at the BP refinery in Whiting, Indiana on 23 July

Hydrocarbon and hydrogen fluoride release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 24 July

Fire at the HollyFrontier refinery in Tulsa, Oklahoma on 2 August

8,614 lbs of hydrogen sulfide were released to the atmosphere due to a mechanical integrity failure on a compressor suction line at the Chevron refinery in Richmond, California on 2 August.

Hydrogen sulfide release from an overpressure event at the Valero refinery in Texas City, Texas on 5 August

Fire at the Sinclair refinery in Sinclair, Wyoming on 5 August

Fire at the Chevron refinery in Richmond, California on 6 August

Fire at the Shell refinery in Martinez, California on 13 August

Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Martinez, California on 14 August

2 workers injured from a fire at the BP refinery in Whiting, Indiana on 14 August

Hydrogen sulfide release due to a mechanical integrity failure at the Phillips 66 refinery in Wood River, Illinois on 22 August 105 Chevron Richmond Refinery Regulatory Report October 2014

Fire at the Sinclair refinery in Sinclair, Wyoming on 24 August

Hydrocarbon release due to a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 25 August

Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 26 August

Hydrogen sulfide and propylene release due to a mechanical integrity failure at the ExxonMobil refinery in Beaumont, Texas on 29 August

Fire at the Phillips 66 refinery in Rodeo, California on 29 August

A high pressure excursion in a vessel resulted in a hydrocarbon release with offsite consequences at the Holly refinery in Woods Cross, Utah on 30 August

Worker injured following a fire at the Marathon refinery in Detroit, Michigan on 5 September

Chemical release with offsite consequences at the Marathon refinery in Detroit, Michigan on 8 September

Sulfuric acid release due to a mechanical integrity failure at the Tesoro refinery in Martinez, California on 10 September

Carbon monoxide and hydrogen sulfide release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 11 September

Hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 11 September

Hydrocarbon release due to a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 14 September

Unspecified leak at the Tesoro refinery in Martinez, California on 15 September

Hydrocarbon release due to a mechanical integrity failure at the PBF Energy refinery in Delaware City, Delaware on 21 September

Hydrogen sulfide release due to a mechanical integrity failure at the Motiva refinery in Norco, Louisiana on 24 September

2 workers killed from an explosion at the CVR Energy refinery in Wynnewood, Oklahoma on 28 September

Fire at the Motiva refinery in Convent, Louisiana on 1 October

Hydrogen fluoride release at the Placid refinery in Port Allen, Louisiana on 1 October

Hydrogen sulfide release from a high pressure excursion at the Valero refinery in Port Arthur, Texas on 1 October

Fire at the ExxonMobil refinery in Baytown, Texas on 3 October

Vapor cloud release at the Hess refinery in Port Reading, New Jersey on 3 October

Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Rodeo, California on 8 October

Fire at the Citgo refinery in Corpus Christi, Texas on 9 October

Vapor cloud release with offsite impact from the Kern Oil refinery in Bakersfield, California on 17 October

Hydrocarbon and hydrogen sulfide release from a pressure excursion at the ExxonMobil refinery in Joliet, Illinois on 19 October

Hydrocarbon release due to a mechanical integrity failure at the Citgo refinery in Sulfur, Louisiana on 22 October 106 Chevron Richmond Refinery Regulatory Report October 2014

Hydrogen sulfide release at the Chalmette refinery in Chalmette, Louisiana on 23 October

Fire at the Tesoro refinery in Martinez, California on 21 October

Fire at the BP refinery in Texas City, Texas on 30 October

Fire at the Valero refinery in Port Arthur, Texas on 3 November

Benzene release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 8 November

Vapor release at the Tesoro refinery in Martinez, California on 8 November

Hydrogen sulfide release due to a mechanical integrity failure or a high pressure excursion at the Shell refinery in Martinez, California on 24 November

Hydrogen sulfide and hydrocarbon release at the Northern Tier Energy refinery in St. Paul Park, Minnesota on 27 November

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 1 December

Hydrogen fluoride release that killed one worker, injured 2 other workers and 7 emergency responders at the Valero refinery in Memphis, Tennessee on 3 December

Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 5 December

Hydrogen sulfide release at the Phillips 66 refinery in Wood River, Illinois on 8 December

Fire at the Motiva refinery in Port Arthur, Texas on 11 December

Benzene release due to a mechanical integrity failure at the Alon refinery in Big Spring, Texas on 11 December

Hydrocarbon release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 11 December

Hydrocarbon release at the Shell refinery in Anacortes, Washington on 12 December

Hydrogen sulfide release due to a pressure excursion at the PBF Energy refinery in Paulsboro, New Jersey on 14 December

Hydrocarbon and hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 15 December

Fire at the Motiva refinery in Port Arthur, Texas on 17 December Note -Incidents of hydrocarbon leaks into a cooling tower or releases to a flare system are not included in the above list. 107

Chevron Richmond Refinery Regulatory Report October 2014

Appendix B: Regulatory Comparison Table OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime Scope Covered processes excluding oil and gas well drilling and servicing Covered processes excluding oil and gas well drilling and servicing Applies to offshore and onshore oil and gas operations Specific PSM/ Major Accident Focus Yes Yes Yes ALARP or Equivalent No No Yes Adaptability to New or Revised Codes, Standards, Technology, Hazard Information, Lessons Learned, etc. Limited to RAGAGEP –only addresses equipment and mechanical integrity (2 of 14 elements); RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Limited to RAGAGEP – only addresses equipment and mechanical integrity; RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Yes via safety case and supporting framework legislation PSM Indicators Req. No No Yes for Companies Competent Regulator 50% or more Engineers/PSM OSHA-some progress but no Cal/OSHA – some progress but no Yes Sufficient Funding for Competent Regulatory staff OSHA-No California is increasing funding to support additional staff on Cal/OSHA PSM team Yes Hazard Analysis Required – “shall identify, evaluate, and control the hazards involved in the process.” Required – “appropriate to the complexity of the process for identifying, evaluating, and controlling hazards involved in the process.” Is a specific aspect of SC and supporting framework regulation and is required for all onshore and offshore facilities. To meet legislative goal-setting requirements, a structured risk assessment including HA as appropriate is required from all “employers.” 108

Chevron Richmond Refinery Regulatory Report October 2014

OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime Incident Investigation Requires a report but activity- based; requires including “any recommendations resulting from the investigations” (what if there are none?); system required to “resolve the incident report findings and recommendation; no explicit requirement to prevent a similar occurrence or controlling hazards. Requires a report including “any recommendations resulting from the investigation.” System required to “establish a system to promptly address and resolve the report findings and recommendations and…implement the report recommendations in a timely manner, or take action to prevent a reoccurrence.” Investigation of incidents required to demonstrate legal compliance with framework legislation. ‘Reasonably practicable’ requirement would require remedial action and cross company learning from incident investigations. HSE can require SC duty holder compliance with investigation report recommendations (e.g. Buncefield Report-“determine SIL level requirements for overfill protection”) Management of Change Activity-based; the employer “shall establish and implement written procedures to manage changes;” “the procedures shall assure the following considerations are addressed…impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Activity-based: the employer “shall establish and implement written procedures to manage changes…;” “the procedures shall assure that the following are addressed prior to any change…technical basis for proposed change; impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Description of MOC procedures and demonstrations of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. 109

Chevron Richmond Refinery Regulatory Report October 2014

OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime Workforce Participation “Employers shall develop a written plan of action regarding the implementation of the employee participation;” Employers shall consult with employees and their representatives on the conduct and development of PHAs and the other elements of PSM in this standard.” “Employer shall develop a written plan of action to ensure employee participation in process safety management;” includes employer consultation with employees and their representatives on the conduct and development of the elements of process safety management required by this section; and providing employees and their representatives with access to all information required to be developed by this section…” Provides for the election of protected safety representative positions and safety committees. Inherent Safety No No Yes

110

Chevron Richmond Refinery Regulatory Report October 2014

Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach

1. Is it true that the safety case regulatory approach leads to self-regulation by industry?

Critics of the safety case regulatory approach have noted that this type of regulatory regime is likely to result in mere industry self-regulation.456 Critics have also noted that this is at least partly due to the fact that there is no will in the US to ensure that regulators have the tools, resources, and competence to effectively regulate workplaces. The CSB and those with experience in developing and implementing the safety case regulatory regime have repeatedly stated that the purpose of the safety case regulatory approach is to ensure that all hazards have been identified, evaluated, and controlled so that risks are reduced to as low as reasonably practicable, or ALARP. In simple terms, the safety case report is a series of claims as to how an installation is being safety operated. The real strength of the safety case regulatory regime is testing the validity of those claims through strategic intervention by competent, well-funded regulators. Advanced performance-based regulatory regimes in the United Kingdom (UK) and Norway, for example,457 incorporate a list of regulator-accepted standards and good practices that provide companies with the minimum performance that is expected. Companies must demonstrate that they meet or exceed those standards. Therefore, companies are aware of minimum performance expectations they must meet as they work to reduce risks to ALARP. If a competent regulator is not in place, then the safety case report equates to nothing more than a lifeless document sitting on a shelf, and the criticism of self-regulation becomes valid.

It is also important to point out that in a letter from the USW Local 5 to the CSB dated November 22, 2013, it was stated that “[t]he current system is truly a self regulated system, with the industry setting the rules, changing the rules, and monitoring themselves.” Individuals are noting that the current system in place has actually led to self-regulation despite the intent of the PSM standard and RMP program to be performance-based.

Critics have also argued that there is a lack of transparency with the safety case regime. However, under the existing PSM standard, none of the PSM elements are made public by the company or the regulator, including the process hazard analyses and management of change documents. To improve transparency, many safety case regimes collect and report indicator data, and companies are required make safety case report summaries publicly available. These are high level documents that are published online and summarize safety assessments, hazardous materials, hazards and control measures, potential major incidents, emergency response, and safety management systems.

Rather than accepting the inevitability of catastrophic events, we should act to prevent them from happening. As discussed in this report, there is a movement in California to improve oversight of 456 See e.g. Rena Steinzor. Lessons from the North Sea: Should “Safety Cases” Come to America? Vol. 38: 417; 2011; p 439. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1735537 (accessed September 4, 2013). 457 Norway requires many similar aspects of a safety case regime offshore but there are differences in implementation and style and content of the regulations. The UK implements a safety case regime both onshore and offshore. 111

Chevron Richmond Refinery Regulatory Report October 2014

petroleum refineries. There has also been increased dialogue in the US in recent years surrounding the regulation of the oil and gas industry and how to make improvements. As such, the support exists to not only shift the current activity-based regulatory structure to a more goal-based safety case regulatory regime, but to also ensure that competent, well-funded regulators are in place to implement and enforce such a regime.

• How does the safety case regulatory regime in the US allow for changes to be made without requiring

rulemaking under the Administrative Procedure Act? The Administrative Procedure Act, or APA, was passed in 1947, and lays out the basic framework under which federal rulemaking is conducted. It defines “rule” as “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency…”458 “Rulemaking” is defined as the “agency process for formulating, amending, or repealing a rule.”459 Federal agencies often impact their specific area of jurisdiction by publishing rules promulgated through notice and comment rulemaking, or informal rulemaking, under the APA. Unfortunately, as this report discusses at length, the rulemaking process in the US is cumbersome and some federal agencies, such as OSHA and the EPA, are subject to additional requirements and more stringent review standards that go above and beyond those contained in the APA. To avoid these additional burdens, many agencies provide further guidance to regulated parties through more informal means, such as answering questions and issuing policy statements, guidance, or opinion letters. Another way to lessen the burden on regulating agencies and their regulated entities is to adopt performance or goal-based regulations rather than prescriptive regulations. Performance-based standards state the objective or outcome to be achieved, such as risk reduction, without describing the specific means of obtaining that objective. This provides the regulated entities with the freedom and flexibility to work to achieve a stated goal, such as reducing risks to as low as reasonably practicable, or ALARP, through their chosen and preferred means.460 Performance-based standards also provide flexibility to the regulator; for example, in a safety case regulatory regime, should the regulator determine through assessment of the safety case report and/or inspection that the facility has not reduced risks to ALARP with regard to a specific hazard, he or she may require that the facility take additional steps to further reduce risk without needing to propose and adopt a new rule or regulation to address it. The regulator must accept the safety case report in order for the facility to operate.

The Regulatory Flexibility Act was passed in 1980 during the Carter Administration. It requires agencies to prepare and make available for public comment regulatory flexibility analyses of proposed rulemaking, and also encourages agencies to consider alternatives to rulemaking, including “the use of performance rather than design standards…”461 Executive Order 13272 then directed federal agencies to establish procedures and policies to comply with the Act.462 Federal agencies have been encouraged to adopt 458 5 U.S.C. §551(4) (2011). 459 5 U.S.C. §551(5) (2011). 460 Such as reliance upon qualitative assessments, quantitative assessments, semi-quantitative risk assessments, and good practice guidance. 461 5 U.S.C. §603(3) (2010). 462 Exec. Order No. 13272, 67 Fed. Reg. 159 (August 13, 2002). http://www.gpo.gov/fdsys/pkg/FR-2002-08- 16/pdf/02-21056.pdf (accessed September 24, 2013). 112

Chevron Richmond Refinery Regulatory Report October 2014

performance-based standards in the US for decades. Recognizing the inefficient process of federal rulemaking in the US, President Clinton signed Executive Order 12866 in September of 1993, which, among other things, directed federal agencies to “identify and assess alternative forms of regulation…[and] specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt.”463 Executive Order 13563, entitled Improving Regulation and Regulatory Review, supplemented and reaffirmed Executive Order 12866 by ordering agencies to “identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of choice for the public.”464 Its stated goal was to “protect public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”465 Its seven guiding principles are as follows: • Increase predictability and reduce uncertainty; • Use and rely on best available science; • Ensure public participation and open exchange of ideas; • Use the most innovative and least burdensome tools; • Consider cost benefit analysis (quantitative and qualitative); • Ensure regulations are publicly available, consistent, written in plain language and easy to understand; and • Measure results and seek to improve actual results.466

The safety case regime aims to satisfy all of these principles.

California has adopted its own version of the APA, known as the California Administrative Procedure Act (CAPA) (California Government Code §11340 et seq.).467 Among its many requirements for California state agencies that adopt regulations, CAPA directs them to consider the substitution of performance standards for prescriptive standards.468 CAPA defines “performance standard” as “a regulation that describes an objective with the criteria stated for achieving the objective.”469

Federal agencies that are engaged in and responsible for regulating high hazards, such as NASA and the Nuclear Regulatory Commission (NRC), have adopted goal or performance-based standards that require risks to be reduced to “as safe as reasonably practicable” (ASARP) and “as low as reasonably achievable,” (ALARA), respectively. The OSHA Process Safety Management (PSM) standard also contains performance-based elements to some extent; for example, it provides regulated entities with flexibility in how to perform a process hazard analysis (PHA). However, it contains no risk reduction goals such as ALARP. This has resulted in an activity-based regulatory scheme that emphasizes completing activities, such as a PHA or a Management of Change (MOC) analysis, rather than actual risk reduction. Without a risk reduction goal such as ALARP in place, the PSM standard will not have the 463 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.archives.gov/federal- register/executive-orders/pdf/12866.pdf (accessed September 24, 2013). 464 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.gpo.gov/fdsys/pkg/FR-2011-01- 21/pdf/2011-1385.pdf (accessed September 24, 2013). 465 Ibid. 466 Ibid. 467 Available at http://www.oal.ca.gov/administrative_procedure_act.htm (accessed September 18, 2013). 468 California Government Code, §11340.1(a) (1995). 469 California Government Code, §11342.570 (1995). 113

Chevron Richmond Refinery Regulatory Report October 2014

ability to successfully drive continuous improvement and adaptation of industry safety management advances.

• Can the safety case regulatory approach work in the US when workforce involvement is emphasized

less than other regions and unionization rates are lower than other countries? A majority of the workforce in California petroleum refineries is unionized, as the unionization rate for the 14 petroleum refineries in California is actually 73 percent,470 which is significantly higher than the 2012 rates for the US as a whole (11.1 percent), Australia (17.9 percent), the UK (25.8 percent), and Norway (54.7 percent).471 Despite a declining unionization rate in the UK, the region has developed strong onshore and offshore regulations that provide for the creation of protected safety representative positions and safety committees for unionized and non-unionized facilities. These positions are meant to create a healthier and safer workplace, and result in better decision-making regarding health and safety, increased productivity, higher workforce motivation, a stronger commitment to implementing decisions or actions (as employees have been actively involved in reaching these decisions), and greater cooperation and trust.472 The HSE has devoted extensive time and resources to ensuring employers are complying with these regulations and understand the importance and benefits of involving workers in health and safety-related matters.

The UK also has a standard establishing the minimum level of training that elected safety representatives offshore should receive to enable them to fully perform their functions as defined in the Safety Representatives and Safety Committees Regulations – SI 1989/971. This training standard, entitled the OPITO Approved Standard, was developed by an industry workgroup facilitated by OPITO.473 In June 2013, Det Norske Veritas (DNV)474 became accredited by OPITO to offer newly developed training courses to more than 2,000 elected safety representatives in the offshore industry. The training, which has been driven and supported by HSE, Oil and Gas UK, and the Offshore Industry Advisory Committee’s Workforce Involvement Group, consists of four separate Modules run over the course of eight days.475 The training covers topics such as Understanding and Identifying Major Accident Hazards and Investigating Incidents and Applying Root Cause Analysis.

The CSB recognizes the HSE’s effort to improve workforce involvement through regulations, protected positions, and training, and has recommended in this report that California develop regulations and guidelines to establish similar protected safety positions to ensure effective workforce participation. The 470 In September 2013, the USW provided the CSB with a list of California petroleum refinery locations as of October 2012 and the existing unionization representation at those refineries. Of the 15 petroleum refineries operating in California as of October 2012, 11 of those were unionized, with USW providing the union representation at all 11 facilities. 471 For complete statistics on trade union density for countries around the world see http://stats.oecd.org/Index.aspx?QueryId=20167 (accessed September 5, 2013). 472 HSE. Consulting employees on health and safety: A brief guide to the law. 2013; p 2. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 5, 2013). 473 OPITO is an industry-owned non-profit that serves the needs of the oil and gas industry in the UK and around the world. See http://www.opito.com/ (accessed September 10, 2013). 474 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 475 http://www.marinelink.com/news/launches-offshore355749.aspx (accessed September 10, 2013). 114

Chevron Richmond Refinery Regulatory Report October 2014

CSB believes the HSE model can also be effective in the US as these regulations require effective safety representation regardless of unionization rates.

• Has the safety case regulatory approach resulted in fewer major accidents?

The CSB has identified a small number of independent studies conducted on the impact of the safety case regulatory approach on safety performance onshore and offshore. In 1999, a report commissioned by the HSE (“the Aberdeen Report”) which evaluated the impact of the offshore Safety Case Regulations on offshore safety was published.476 One of the purposes of the study was to review published safety data for trends in offshore accidents and incidents from 1990 until 1997.477 Upon this review, it was determined there had been a decrease in accidents since the implementation of the offshore safety case regulations in the UK, but cautioned it was difficult to distinguish the effect of the safety case regulations from other industry activities such as the level and type of exploration and production activity, oil prices, and industry-led initiatives.478 The Aberdeen Report also cautioned about the difficulties in analyzing offshore data that also hold true for the more current data presented in Figure 3. The total number of accidents and incidents recorded can be affected by industry attitudes toward reporting, changes in how and what data is reported, and the decrease or increase in offshore activity. As stated in the Aberdeen Report, “[d]espite these cautions, accident statistics play an important role in the analysis of the state of safety in any industry, since accidents represent the ‘bottom line’ in safety. It is therefore important to analyze the trends, but to also take the drawbacks into consideration.”479 As discussed in this report, the reporting and analyzing leading process safety indicators is important to gain a better understanding of how safety management systems are functioning, and thus a better idea of how well the various regimes are managing hazards and mitigating risk. Statistics from the seven years covered by the Aberdeen Report indicated an overall decrease in reported accident rates in the UK and Norwegian databases up until 1994. From 1994 to 1997, both the UK and Norway reported a slight increase in the number of reported accidents.480 Norway did report a drop in 1997 from 1996. The decrease reported up until 1994 for the UK appeared to be independent of the offshore production activities as those levels had been on the increase during the same time period. Drilling in the UK decreased during the same time frame, making the cause for the decrease in reported drilling accidents unclear. More recent reviews of accident data indicate decreasing trends in accident statistics. The Presidential Oil Spill Commission noted the following in its report to the President on the Macondo disaster: [f]rom 2004 to 2009, fatalities in the offshore oil and gas industry were more than four times higher per person-hours worked in U.S. waters than in European waters, even though many of the same companies work in both venues. This striking statistical discrepancy reinforces the view that the problem is not an inherent trait of the business itself, but rather 476 Evaluation of the Offshore Safety Legislative Regime—A study undertaken by AUPEC Ltd. For the Safety Policy Division, Health & Safety Executive, Ref: 8938/3714, June 1999. 477 Ibid at Ch 7. 478 Ibid at Ch 7, p 7-1. 479 Ibid at Ch. 7, p 7-11. 480 This was based on the number of accidents per million man hours for the two Continental Shelves (Ibid, Figure 7.8) 115

Chevron Richmond Refinery Regulatory Report October 2014

depends on the differing cultures and regulatory systems under which members of the industry operate.481

In September 2013, Det Norske Veritas (DNV)482 released a position paper discussing necessary improvements to reduce risk of major offshore accidents, and noted in the report that “there are no good globally accepted metrics for major accident hazards…”483 However, DNV was able to point to UK HSE’s Hydrocarbon Releases Database System (HCR)484 in the North Sea to provide an example of improving safety performance trends.485 The HRC contains detailed voluntary information of over 4,000 hydrocarbon releases offshore from close to 300 installations since 1992. The HRC data, plotted in Figure 3, show the total number of releases to be on the decline. Classifying the severity of a release is based on agreed-upon criteria with the offshore industry.486 The UK has defined significant events to be those that, if ignited, have the potential to cause a major accident where multiple casualties could occur. The occurrence of any hydrocarbon release is undesirable because of the potential to escalate, and so reporting data from minor incidents has also been included in Figure 3 below.

Figure 3. Hydrocarbon releases in the North Sea reported to UK HSE as dangerous occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations.487 481 National Commission on the BP Deepwater Horizon Oil Spill. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President; January 2011; Ch 8, p 225. 482 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 483 DNV. Enhancing offshore safety and environmental performance: Key levers to further reduce the risk of major offshore accidents. 2013; p 5. http://www.dnv.com/industry/oil_gas/services_solutions/offshore_safety.asp (accessed September 10, 2013). 484 https://www.hse.gov.uk/hcr3/ (accessed January 13, 2014). 485 In its position paper, DNV cited data from 1996, but UK HSE has noted that the criteria for severity classification was refined in 1999 so data since that date is presented here. 486 Hydrocarbon Releases System Internet Help File, https://www.hse.gov.uk/hcr3/help/help_public.asp (accessed September 10, 2013). 487 RIDDOR – Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 became effective offshore on April 1, 1996, http://www.hse.gov.uk/riddor/ (accessed September 10, 2013). 0 50 100 150 200 250 Reported Releases Financial Year (April-March) 2000/01 to 2012/13 Minor Significant Major Total 116

Chevron Richmond Refinery Regulatory Report October 2014

It is important to note that major accidents are low-probability, high-consequence events, and as such they are difficult to measure. According to Dr. Andrew Hopkins, major accidents are more difficult to define than, say, a car accident, and they are rare, making it difficult to estimate the number of major accidents prevented.488 In addition, based on the data in existence, there is a continued need for improved data collection; key leading performance indicators development and implementation on a global scale would provide an improved glimpse into how safety is being managed for major accident prevention.

A team of three independent safety experts was asked to conduct an independent evaluation of the operational effectiveness of the National Offshore Petroleum Safety Authority (NOPSA), which was established in January 2005 to regulate offshore health and safety in Australia (it was superseded by NOPSEMA in January 2012). The 2008 report released as a result of the evaluation noted that the team of experts received submissions identifying issues surrounding the safety case regime from twelve stakeholders, including the Australian Workers Union, the Maritime Union of Australia, and the International Association of Drilling Contractors. The report states that a majority of the submissions expressed that the safety case regime had “generally been a success…” and “had led to improvements and already brought forth better consistency in many areas….”489 The report noted that there was general stakeholder agreement “that the regulatory processes have been improved.”490

As mentioned in Section 3.2.1.2 of the report, following the Macondo incident in April 2010, an independent review of the offshore safety case regime in the UK was conducted by a panel consisting of three independent appointees, including Professor Geoffrey Maitland at Imperial College London. A report was published discussing the review in December 2011, and it noted that, while not perfect, the offshore safety case regime was “robust and effective at identifying risks and appropriate measures for mitigation and response….”491 The report stated the following:

From its analysis of the existing UK framework and the information it gleaned from its discussion with those directly involved in the sector from both an operational and regulatory perspective, the Review Panel was reassured that the UK regime already incorporates a number of positive, key features which were not present in the US at the time of the Macondo incident. At a high level, the Panel notes and commends in particular:

• the UK’s “goal-setting” safety regime and its ability to foster innovation and continuous improvement in process integrity,

488 Hopkins, Andrew. The Cost-Benefit Hurdle for Safety Case Regulation: A discussion paper prepared for the US Chemical Safety Board. Add Date, Page, and Link. 489 Ognedal, Magne; Griffiths, Derek; and Lake, Bruce. Review of the National Offshore Petroleum Safety Authority Operational Activities. February-March 2008; p 14. 490 Ibid at 28. 491 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011; p 4. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed January 13, 2014). 117

Chevron Richmond Refinery Regulatory Report October 2014

• the strength of the mechanisms in place for independent, third party verification in the crucial areas of well design and integrity of safety critical equipment,

• the rigour with which the potential environmental impacts of the industry are examined and of the controls and procedures in place to mitigate them,

• the detailed and comprehensive emergency response framework which exists for managing the consequences of incidents should they occur,

• the high regard in which the UK authorities, in the form of DECC, HSE and MCA, are held both by UK operators and international observers,

• the fact that the events in the Gulf of Mexico have clearly acted as a catalyst for UK operators, working in concert with the regulators and other stakeholders, to redouble their efforts to improve safety and to strengthen response capabilities.492

• The UK HSE has published reports493 showing significant industry problems with maintenance of

safety critical equipment, poor understanding of the potential impact of degrading plant and utility systems on safety critical elements, and lack of understanding of the role of asset integrity and the concept of barriers in major hazard risk control. Don’t these reports developed by the UK regulator demonstrate that the safety case is not effective and is not working? The CSB recognizes that there have been critiques of the safety case regime and its implementation. The CSB acknowledges that the safety case is not perfect and that no regulatory system will be perfect in its implementation. Some have noted the issue of aging equipment due to many issues, including the harsh conditions that exist in the North Sea. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferrals of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters, rather than anticipating worst-case scenarios. However, the safety case regime’s adaptive nature has been able to address these concerns. The HSE has recognized asset integrity management and the issue of ageing equipment as key issues to address in its inspection programs, and has developed internal processes and priorities for these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.494 The same year, the HSE published a report intended 492 Ibid at 3. 493 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf (accessed August 28, 2013). 494 The report is available at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013). 118 Chevron Richmond Refinery Regulatory Report October 2014

to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,495 which provides an overview of ageing plant mechanisms and their management and presents the findings of an analysis of loss of containment incidents to indicate the extent to which ageing plant equipment may be a factor. This type of programmatic proactive approach and information dissemination is lacking in the US both on and offshore.

• How have other countries implemented the safety case regime? What challenges do the countries face

when transitioning to a safety case approach? From the international safety case community, the CSB has found that when transitioning to a safety case regime there are many obstacles that may hinder the transition, such as:

• Major stakeholders not being committed to the process, unconvinced of the need; • Lack of understanding that the safety case regime is a “process” to be undertaken by the duty holder and the workforce to improve understanding of the hazards, risks, and their controls, and to put in place measures for continuous improvement, rather than just creation of a “document”; • Lack of sufficient funding by government and industry; and • Lack of the necessary legislative timetable.

The transition to a safety case regime has significant challenges for both the duty holder and the regulator, including:

• The safety case report could be treated as a check-the-box exercise; • Documented safety management system does not reflect reality; • Poor identification of hazards and risks; • Poor understanding of the performance of control systems; • Attempting to justify existing controls rather than to seek opportunity to improve; • Insufficient workforce involvement in the process; • The safety case process is under-resourced; • The safety case report is “inaccessible” so the report simply lives on the shelf; • The regulator does not use the safety case report to inform the inspection or audit; • Limited requirement for the reporting of accidents, dangerous occurrences and precursors resulting in lack of comprehensive performance data; and • The regulator is under-resourced, technically challenged, poorly trained, has poor systems and procedures, and is inconsistent.

In implementing the safety case regime, there should be regard for the regulatory principles and frameworks which represent best practice. The underlying principles are:

• The legislation and regulation should be fit for purpose, not simply superimposed on existing prescriptive regulation; 495 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 119

Chevron Richmond Refinery Regulatory Report October 2014

• Regulation should be effective and efficient; and • Industry should move away from a culture of compliance with detailed prescriptive regulation to one of involving the workforce in understanding the hazards.

Some significant points worth noting from international experience in setting up the regulation are:

• Staff should be recruited against detailed job descriptions and should cover the full range of technical, management and regulatory requirements; • Pay rates and terms and conditions should be sufficient to attract highly qualified staff; • A competency framework needs to be developed reflecting the required knowledge, skills, and experience required to undertake; • Appropriate training programs must be in place; • An electronic dedicated safety case assessment procedure which captures the detail of the process to be followed and records the background to the decision-making process will be needed. This helps ensure good quality, consistent, and transparent assessment and provides a database of information which is used for future validation/topic facility inspections. It also provides a comprehensive record of the process which can be used in the event of an appeal against an assessment decision; • An accident and dangerous occurrence data base will be needed to store knowledge and data to provide reference information and the capacity to analyze trends; and • An emergency reporting and response process is necessary to ensure all significant events are properly logged and dealt with.

120

Chevron Richmond Refinery Regulatory Report October 2014

Appendix D: CSB Staff May 2014 Response to the Board’s Motion to Postpone issued on January 15, 2014 Background

On January 15, 2014, the CSB held a public meeting in Richmond, California, to present the draft Chevron Regulatory Report for a vote by the Board. In the first CSB Chevron Report (the Chevron Interim Report), which was approved by the Board on April 19, 2013, the CSB staff committed to investigating additional issues which would be presented in a final report on the incident. These issues included the regulatory oversight of petroleum refineries in California. Due to deployments to West, Texas, and Geismar, Louisiana, the CSB Chevron investigation team produced a second interim draft report focused solely on the regulation of petroleum refineries. At the Richmond public meeting, the Board moved to postpone a vote on the draft regulatory report in order for the CSB investigation staff to address additional issues raised concerning regulatory oversight of petroleum refineries and the proposed safety case regime. The CSB staff was given 120 days from the date of the public meeting to respond to the motion.

I.

Does Cal/OSHA have sufficient authority to require timely abatement of hazards associated with serious and willful violations? CSB Investigations Staff Response:

Following the August 6th incident at the Chevron Richmond Refinery, Cal/OSHA cited Chevron for, among other things, failing to replace pipe clamps at the refinery, and ordered Chevron to replace those pipe clamps by a certain date. The CSB Chevron Interim Report states that Chevron has a history of frequently using leak repair clamps to externally stop process fluid leaks, and that following discovery of the leak on the 4-sidecut piping prior to the incident, “Chevron hoped to forestall a shutdown by installing a leak repair clamp.”496 The CSB determined that Chevron had more than 100 clamps on hydrocarbon and other piping components containing hazardous flammable process fluids at the Richmond refinery and that reliance on such clamps to mitigate leaks “identifies serious questions about its mechanical integrity program.”497 The interim report, which was approved by the Board on April 19, 2013, committed to evaluating the Chevron Richmond Refinery’s use of clamps and its mechanical integrity program as they relate to the refinery’s process safety culture in the final CSB report on the Chevron incident.

A letter written by California Representative George Miller dated January 15, 2014 discussed Chevron’s use of clamps and expressed concern that some of the clamps have not been replaced, and will not be replaced until late 2014. The letter stated that under the California Labor Code, an employer is not obligated to correct a Cal/OSHA safety violation if they appeal. According to Representative Miller, 496 CSB. Chevron Interim Report. April 19, 2013; p 62. 497 Ibid. 121

Chevron Richmond Refinery Regulatory Report October 2014

Chevron appealed its Cal/OSHA citations on February 19, 2013. In the letter Rep. Miller requested that given these facts, the CSB investigators should assess the issue of timely abatement, and consider making recommendations to the Legislature and Governor on this matter.

The CSB staff notes that while it has already committed to evaluating the use of clamps at the Chevron Richmond Refinery as it relates to mechanical integrity and process safety culture, we are not aware of a causal connection between the refinery’s use of the clamps to mitigate leaks and the August 6th incident. Regulatory bodies often cite companies for deficiencies following an incident that are not related to that incident. However, the CSB is directed under the Clean Air Act to “investigate (or cause to be investigated), determine and report to the public in writing the facts, conditions, and circumstances and the cause or probable cause” of an accidental release.498 (emphasis added). The CSB’s Board Order 040, Procedure G: Causal Analysis, discusses requirements of formal analysis tools that identify the multiple causes of an incident, including technical, organizational, and societal causes. Thus, while the CSB staff committed to analyzing the issue of clamps at the refinery as it pertains to safety culture, the staff did not analyze the usage of clamps and abatement in its regulatory report, as it was not determined to be causal and was therefore not within the scope of the regulatory investigation.

Should Contra Costa County Health Services have direct enforcement authority under the Industrial Safety Ordinance? The CSB staff looked into this matter, including interviewing key personnel, and determined that while having enforcement power is generally beneficial, a CSB recommendation on the issue is not warranted in this case, as Contra Costa County’s lack of enforcement authority under the ISO is not causal to the August 6th incident. According to Contra Costa County officials, the inspectors have never gone to the District Attorney to enforce the ISO. In addition, these officials have stated to the CSB that the Chevron Richmond Refinery has cooperated fully with past recommendations and has addressed any violations issued as a result of any audit conducted by Contra Costa County inspectors. While the CSB agrees that having enforcement power provides the regulator with another tool to ensure compliance with regulations, there is no causal connection to the August 6th incident and therefore no additional recommendation regarding this issue is warranted.

Does Contra Costa County Health Services have sufficient resources to conduct comprehensive inspections and retain technically qualified personnel? The report discusses the lack of resources and funding within the Contra Costa Hazardous Materials Program, which has limited its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County. The engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which has experienced annual budget reductions in the millions. The CSB agrees that for a performance based regulatory approach to be effective it is essential to have a well funded, qualified regulator and has therefore added a recommendation to the City of Richmond and Contra Costa County. 498 42 U.S.C. §7412 (r)(6)(C)(i) (1990). 122

Chevron Richmond Refinery Regulatory Report October 2014

Does Contra Costa County Health Services have sufficient authority to require facilities to undertake feasible risk reduction measures, such as best practices, which go beyond minimum regulatory requirements? The draft report discusses on page 89 that Contra Costa engineers conduct CalArp and ISO/RISO audits concurrently at each covered facility generally once every three years. The engineers are only able to audit against the regulatory requirements, and while they can issue “consider” action items to the facility recommending actions above and beyond regulatory requirements, they do this very infrequently.

The Chevron Interim Report addressed ISO regulatory deficiencies, including the fact that there is no required implementation of inherent safety (unlike in the safety case). The Interim Report issues recommendations R3, R4 and R6 and R7, which request the City of Richmond and Contra Costa County to revise the ISO to require damage mechanism hazard reviews and the documented use of inherently safer systems analysis and the hierarchy of controls “to the greatest extent feasible” in establishing safeguards for identified process hazards. The recommendations note that the goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable, or ALARP.

The ISO is currently being revised to implement these recommendations, and should be finalized as early as June 2014. The revised regulatory language would require facilities to reduce risk to “the greatest extent feasible,” which is a concept that is very similar to ALARP. Contra Costa County will have the ability to issue guidance that elaborates on what will be required to achieve that standard.

The CSB staff believes that these recommendations cover the issue raised in this question, and no additional recommendations are warranted.

II.

In the motion to postpone the Board made the following proposal to have additional questions addressed by an expert panel:

The CSB staff shall convene a multidisciplinary expert panel (selected by the full Board), similar to the Baker Panel established after the BP Texas City incident, to provide the agency with an assessment of the following topics regarding regulating process safety in refineries in California:

To address questions raised in the comments received by the CSB, the panel shall assess the available process safety performance data to evaluate the effectiveness of the safety case regulatory model for refineries.

Assess the challenges of making safety case operational and effective with regard to the following topics:

a. What is the role of transparency and community involvement under this regime? Are safety case reports made public? 123

Chevron Richmond Refinery Regulatory Report October 2014

b. How are workers empowered as part of the tripartite model? Have there been retaliatory actions taken against workers for their involvement, and what protective measures are in place? c. Are safety committees mandatory or optional in non-union workplaces? How are safety committee members selected, and under what authority? d. Is there a public data base of incident and near miss reporting? How are process safety performance indicators developed and used? Are these made public? e. How are standards for minimum levels of risk set (ALARP presumably goes beyond minimum levels)? f. What are the enforcement methods used by regulators under the safety case? g. What are the key transition issues that were addressed with facilities in operation at the time the safety case was adopted?

In response to this Board motion the staff has developed a white paper with staff responses to the questions posed by the Board. Additionally, the CSB is planning a public hearing in the Spring of 2015 to discuss various models, including safety case, for regulating high hazard facility safety.

124

Chevron Richmond Refinery Regulatory Report October 2014

[This page left intentionally blank.]

125

Chevron Richmond Refinery Regulatory Report October 2014

126

FD06453 ｜ 2012_美国_Chevron Richmond 炼油厂 火灾 - Chevron Richmond Refinery Fire__最终报告_6.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所：化工/石化 ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

REGULATORY REPORT

REPORT NO. 2012-03-I-CA MAY 2014 CHEVRON RICHMOND REFINERY PIPE RUPTURE AND FIRE

CHEVRON RICHMOND REFINERY #4 CRUDE UNIT RICHMOND, CALIFORNIA AUGUST 6, 2012

Chevron Richmond Refinery Regulatory Report May 2014

2

Chevron Richmond Refinery Regulatory Report May 2014

3

Table of Contents Table of Contents .......................................................................................................................................... 3  Acronyms and Abbreviations ....................................................................................................................... 5  1.0  Executive Summary ......................................................................................................................... 7  1.1  Incident Summary ............................................................................................................................ 7  1.2  Interim Report .................................................................................................................................. 7  1.3  Background ...................................................................................................................................... 9  1.4  Key Findings .................................................................................................................................. 10  1.5  Regulatory Conclusions ................................................................................................................. 12  1.6  Recommendations .......................................................................................................................... 13  2.0  Introduction .................................................................................................................................... 14  3.0  The Safety Case Regulatory Regime ............................................................................................. 21  3.1  Introduction .................................................................................................................................... 21  3.2  Initial Safety Case Implementation ................................................................................................ 22  3.2.1  United Kingdom .................................................................................................................... 22  3.2.1.1  Onshore .......................................................................................................................... 22  3.2.1.2  Offshore ......................................................................................................................... 25  3.2.2  Global Analysis of Safety Case Implementation .................................................................. 27  3.2.2.1  Australia ........................................................................................................................ 27  3.2.2.1.1  Offshore ................................................................................................................. 27  3.2.2.1.2  Onshore .................................................................................................................. 28  3.2.2.2  Norway .......................................................................................................................... 29  3.2.2.3  The United States........................................................................................................... 30  3.2.2.3.1  OSHA PSM Standard ............................................................................................ 31  3.2.2.3.2  U.S. Environmental Protection Agency Risk Management Program .................... 33  3.2.2.3.3  Safety Case in the United States ............................................................................ 35  4.0  Key Features of an Effective Safety Case Regulatory Regime ...................................................... 37  4.1  Duty Holder Safety Responsibility, including a Written Case for Safety ...................................... 38  4.2  Continuous Risk Reduction to ALARP ......................................................................................... 40  4.3  Adaptability and Continuous Improvement ................................................................................... 44  4.4  Active Workforce Participation ..................................................................................................... 53  4.5  Process Safety Indicators that Drive Performance ......................................................................... 58 

Chevron Richmond Refinery Regulatory Report May 2014

4

1. 6 

Regulatory Assessment, Verification, and Intervention ................................................................ 61  4.7  Independent, Competent, Well-Funded Regulator ........................................................................ 66  5.0  Oversight of Petroleum Refineries in California ........................................................................... 69  5.1  Cal/OSHA ...................................................................................................................................... 69  5.1.1  Background Information ....................................................................................................... 69  5.1.2  Analysis ................................................................................................................................. 75  5.1.2.1  ALARP .......................................................................................................................... 75  5.1.2.2  Adaptability and Continuous Improvement ................................................................... 77  5.1.2.3  Process Safety Indicators ............................................................................................... 79  5.1.2.4  Inspections ..................................................................................................................... 79  5.1.2.5  Workforce Participation ................................................................................................ 80  5.1.2.6  Funding and Regulator Competency ............................................................................. 82  5.2  U.S. Environmental Protection Agency ......................................................................................... 84  5.2.1  Risk Management Plan (RMP) Program ............................................................................... 84  5.2.2  Implementation of the RMP Program ................................................................................... 85  5.3  Unified Program ............................................................................................................................ 86  5.3.1.1  Contra Costa County Hazardous Materials Programs ................................................... 86  5.3.1.1.1  CalARP .................................................................................................................. 87  5.3.1.1.2  Industrial Safety Ordinance ................................................................................... 88  5.3.1.1.3  City of Richmond Industrial Safety Ordinance ..................................................... 89  5.3.1.2  Analysis ......................................................................................................................... 89  6.0  Conclusion ..................................................................................................................................... 91  7.0  Recommendations .......................................................................................................................... 92  References ................................................................................................................................................... 95  Appendix A: Significant Petroleum Refinery Incidents in 2012 ............................................................... 98  Appendix B: Regulatory Comparison Table ............................................................................................ 103  Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach ... 106  Appendix D: CSB Staff Response to the Board’s Motion to Postpone issued on January 15, 2014 ....... 116 

Chevron Richmond Refinery Regulatory Report May 2014

5

Acronyms and Abbreviations ALARA

As Low As Reasonably Achievable ALARP

As Low As Reasonably Practicable ALJ

Administrative Law Judge ANPRM

Advance Notice of Proposed Rulemaking APA

Administrative Procedure Act API

American Petroleum Institute ASARP

As Safe As Reasonably Practicable BSEE

Bureau of Safety and Environmental Enforcement CA

Competent Authority CAA

Clean Air Act CAAA

Clean Air Act Amendments CalARP

California Accidental Release Prevention Cal/EPA

California Environmental Protection Agency Cal/OSHA

California Division of Occupational Safety and Health CAPA

California Administrative Procedure Act CCHMP

Contra Costa Health Services’ Hazardous Materials Program CCPS

Center for Chemical Process Safety CCR

California Code of Regulations CERCLA Comprehensive Environmental Response, Compensation, and Liability Act CFR

Code of Federal Regulations Chevron ETC Chevron Energy Technology Company CIMAH

Control of Industrial Major Accident Hazards COMAH

Control of Major Accidents Hazards Regulations CSB

U.S. Chemical Safety and Hazard Investigation Board CSHO

Compliance Safety and Health Officer CUPA

Certified Unified Program Agency DIR

California Department of Industrial Relations DNV

Det Norske Veritas EA

Environment Agency EPA

U.S. Environmental Protection Agency FSA

Formal Safety Assessment FY

Fiscal Year GAO

U.S. Government Accountability Office HSC

California Health and Safety Code HSE

Health and Safety Executive HTHA

High Temperature Hydrogen Attack ISO

Industrial Safety Ordinance

Chevron Richmond Refinery Regulatory Report May 2014

6

ISOM

Isomerization LOHP

Labor Occupational Health Program MOC

Management of Change MOOC

Management of Organizational Change NASA

National Aeronautics and Space Administration NDU

Naphtha Desulfurization Unit NEP

National Emphasis Program NOHSC

Australia National Occupational Health and Safety Commission NOPSEMA Australian National Offshore Petroleum Safety and Environmental Management Authority NPRM Notice of Proposed Rulemaking NRC U.S. Nuclear Regulatory Commission OERI Operational Excellence and Reliability Intelligence OIG Office of Inspector General OMB Office of Management and Budget OSHA

U.S. Occupational Safety and Health Administration OSHAct

Occupational Safety and Health Act PHA

Process Hazard Analysis PHMSA Department of Transportation, Pipeline and Hazardous Materials Safety Administration PQV Program Quality Verification PSA Petroleum Safety Authority PSI Process Safety Information PSLA Petroleum Submerged Lands Act PSLG Process Safety Leadership Group PSM Process Safety Management QRA Quantitative Risk Assessment RAGAGEP Recognized and Generally Accepted Good Engineering Practices RFI Request for Information RISC Risk-Informed Safety Case RISO City of Richmond Industrial Safety Ordinance RLOP Richmond Lube Oil Plant RMP Risk Management Plan RP Recommended Practice SEPA Scottish Environmental Protection Agency SFAIRP So Far As Is Reasonably Practicable SOP Standard Operating Procedure UK

United Kingdom USCG

U.S. Coast Guard USW

United Steelworkers Union

Chevron Richmond Refinery Regulatory Report May 2014

7

1. 0 Executive Summary
2. 1

Incident Summary On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, (“the Chevron Richmond Refinery”) experienced a catastrophic pipe failure in the #4 Crude Unit (“the crude unit”). The pipe, a 52- inch long carbon steel piping component of the #4 sidecut line, ruptured and released flammable, hydrocarbon process fluid, which partially vaporized into a large vapor cloud that engulfed 19 Chevron employees and ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition of the flammable portion of the vapor cloud and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of particulates and vapor traveling across the Richmond, California area. Approximately 15,000 people from the surrounding area sought medical treatment due to the release. 1.2 Interim Report The CSB released an Interim Report on the Chevron incident in April 2013 (“the Interim Report”), which highlighted technical findings and safety system deficiencies. Testing conducted on the ruptured pipe determined that it had experienced extreme thinning near the rupture location due to sulfidation corrosion.1 Sulfidation corrosion is a damage mechanism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F.2 This damage mechanism3 causes pipe walls to gradually thin over time, and is common in crude oil distillation4 where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide,5 are available to react with steel piping and equipment. The Interim Report stated that virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled.

The Interim Report noted a number of causal safety system deficiencies that highlight regulatory gaps relating to major accident prevention at California petroleum refineries. For example, in conducting its process hazard analysis6 (PHA) of the crude unit, which was required under California’s Process Safety

1 With respect to the sulfidation corrosion damage mechanism that caused the Chevron incident, carbon steel piping corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels, including stainless steel. 2 For an electronic copy of the CSB Chevron Interim Report see http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 24. 2013). 3 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 3.1.1.5, November 2009. 4 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 5 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. 6 A process hazard analysis (PHA) is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section 5189, Process

Chevron Richmond Refinery Regulatory Report May 2014

8

Management (PSM) standard,7 Chevron did not conduct a rigorous review of corrosion and damage mechanisms present in the crude unit, and did not identify sulfidation corrosion as a hazard. As such, Chevron did not effectively address inherent safety8 or implement effective controls to prevent sulfidation corrosion, including those controls proposed by Chevron’s technical group. Although both the California and federal PSM standards require that hazards be identified, evaluated, and controlled, there is no further discussion of how far to reduce risks, and there is no requirement to address the effectiveness of controls or to use the hierarchy of controls.9 Therefore, this type of analysis was not required to be conducted, and Chevron was never cited post-incident for failing to evaluate the effectiveness of safeguards.

In another example, despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction through the Management of Change (MOC) process, incident investigations, technical reports, and employee recommendations, Chevron repeatedly failed to implement those proposed recommendations. Chevron’s 2006 MOC analysis limited application of those recommendations to only a small section of the pipe. As a result, the portion of the pipe that failed on the August 6th incident remained in service until the incident. As there is no requirement to implement effective recommendations or control hazards under the MOC element, it is essentially an activity-based requirement. Chevron was not cited for narrowing the scope of the MOC, despite its disregard of internal recommendations. The CSB concluded in its Interim Report that Chevron did not regularly or rigorously apply inherently safer technology, which provides an opportunity for preventing major accidents, in its PHAs, MOCs, incident investigation recommendations, or during turnarounds.

The CSB made safety recommendations in the Interim Report to a number of entities, including the California State Legislature, the U.S. Environmental Protection Agency, and Contra Costa County. The Board recommended that the California State Legislature require California petroleum refineries to perform damage mechanism hazard reviews, to identify and report leading and lagging process safety indicators, to document recognized methodologies, rationale, and conclusions used to claim that safeguards intended to control hazards will be effective, and to document their inherently safer systems analysis and the hierarchy of controls in establishing safeguards for process hazards, with the goal of driving risk of major accidents to as low as reasonably practicable, or ALARP. These concepts, introduced in the Interim Report and highlighted in the recommendations, are the basic building blocks for the implementation of the safety case regime, a regulatory scheme that will be discussed in great detail in the following report.

The CSB concluded its Interim Report by highlighting additional issues that were still under investigation, including emergency planning and reporting, emergency response, safety culture, and regulatory oversight of petroleum refineries in California. The following report fulfills the CSB’s

Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental Release Prevention Program and the federal EPA Risk Management Program. 7 Under 8 CCR §5189 (e). https://www.dir.ca.gov/title8/5189.html (accessed September 25, 2013). 8 According to the Center for Chemical Process Safety (CCPS), “inherently safer design solutions eliminate or mitigate the hazard by using materials nad process conditions that are less hazardous.” Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processs – A Life Cycle Approach. 2nd ed., Section 5.1.1, 2009. 9 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a hierarchy of controls. The further up the hierarchy, the more effective the risk reduction achieved.

Chevron Richmond Refinery Regulatory Report May 2014

9

commitment to examine whether the implementation of the safety case regulatory regime could be a more effective regulatory tool to achieve major accident prevention for California petroleum refineries. The reader will find additional issues, arguments, and counterarguments regarding the safety case regulatory regime addressed in Appendix C of this report. 1.3 Background Although both the federal and California PSM standards, respectively, were intended to be goal-setting or performance-based,10,11 in practice they appear to function primarily as reactive and activity-based12 regulatory schemes that require extensive rulemaking to modify. As a result, the federal and California PSM standards have become static in the face of advancing best practices and technology, with the emphasis placed on the completion of a task or activity rather than achievement of continuous risk reduction.13 Many regions around the world such as the United Kingdom (UK), Australia, and Norway have acknowledged similar deficiencies and have implemented regulatory regimes consisting of both prescriptive14 and goal-setting elements that require duty holders15 to demonstrate to the regulator through rigorous reviews and audits that they have reduced risks to as low as reasonably practicable, or ALARP. This is referred to as the safety case regulatory regime.16 The safety case regulatory regime is a rigorous prescriptive and goal-setting regulatory approach applied globally both onshore and offshore. It is highlighted by its adaptability and requirements for continuous improvement in risk reduction for high hazard industrial facilities. A written case for safety, known as the safety case report, is generated by the duty holder and is generally rigorously reviewed, audited, and enforced by highly technically competent inspectors with skill sets familiar to those employed by the industries they oversee. Despite this global shift, the US has persisted in the use of a more activity-based regulatory scheme that lacks the ability to adapt to advancing technology and recently developed industry standards, and which has failed to adequately engage companies and their employees in continuous improvement and risk reduction with similarly-skilled inspectors.

10 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 11 See Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and Explanation of the Final Rule (March 4, 1992). https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed August 13, 2013). 12 Activity-based standards and regulations require the mere completion of an activity and do not focus on the effectiveness of major accident prevention or risk reduction. 13 As will be discussed below, certain sections of the PSM standard have elements of a performance-based regulatory approach. 14 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 15 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 16 Norway’s offshore regulatory regime is not referred to as the safety case regime, but it does contain many of the same elements as the safety case regime, with some differences in style, substances, and implementation.

Chevron Richmond Refinery Regulatory Report May 2014

10

1. 4

Key Findings Technical

In the ten years prior to the incident, highly knowledgeable and experienced Chevron technical staff repeatedly recommended that inspectors perform 100 percent component inspections on high temperature carbon steel piping susceptible to sulfidation corrosion. These recommendations were not implemented by Chevron management.17

Chevron technical staff recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past recommendations from employees. However, Chevron failed to implement proposed inherently safer recommendations prior to the incident. For example, an inspection recommendation to upgrade piping to 9-Chrome was made, but the MOC to implement the recommendation narrowed the scope, allowing the 52-inch component that failed to remain in service.

In January 2007, a failure due to sulfidation corrosion caused a fire in the Chevron Richmond Refinery crude unit, initiating a shelter-in-place for the surrounding community. A carbon steel piping spool18 failed catastrophically during operation. Chevron informed Contra Costa Health Services’ Hazardous Materials Program19 in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, this upgrade was limited to only the immediate piping spool that had failed. The inherently safer, more corrosion resistant metallurgy was not implemented more broadly in the crude unit as a result of this incident.

Chevron and Chevron Energy Technology Company metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. However, they had limited practical influence to implement their recommendations. They did not participate in the most recent crude unit PHA, and they did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.20

The 2009 crude unit PHA did not identify corrosion as a potential cause of a leak or rupture in piping. The PHA cited non-specific, judgment-based qualitative safeguards to reduce risk, such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.21 The effectiveness of these safeguards was neither evaluated nor

17 These recommendations are discussed in detail in paragraphs 44 through 51 of the Chevron Interim Report. 18 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. 19 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). 20 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown. 21 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment.

Chevron Richmond Refinery Regulatory Report May 2014

11

documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel piping could have been recommended.

Regulatory

Following the August 6th incident, California’s Division of Occupational Safety and Health (Cal/OSHA) inspected the Chevron facility and issued citations. Only one citation was related to PHAs; and it was not associated with evaluating the effectiveness of safeguards. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude unit. Had the California PSM standard required documentation of the effectiveness of safeguards, Chevron would have been obligated to conduct this analysis.

There is a significant discrepancy in the compensation between the California regulators and the Chevron Richmond Refinery personnel they interact with. The California regulators also lack the technical staff with the necessary skills, knowledge, and experience to provide sufficient direct oversight of petroleum refineries in California.

The CSB has examined records that demonstrate a considerable problem with significant and deadly incidents at petroleum refineries over the last decade. The EPA has noted 234 recordable accidents at petroleum refineries between 2000 and 2010. This is more than any other industry despite the fact that the nation’s petroleum refineries make up only roughly one percent of the some 13,000 facilities covered by the EPA’s Risk Management Program. In 2007, OSHA stated that according to its IMIS (Integrated Management Information System) database, since May 1992, 36 fatality/catastrophe (FAT/CAT) incidents related to HHC releases in the refining industry occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. This number surpassed the combined total of the next three highest industries over the same period. In 2010, an OSHA official testified to a Congressional Subcommittee that over 20 major incidents resulting in injuries or fatalities across the country occurred between 2005 and 2010, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry. Finally, in 2012 alone, the CSB tracked 125 significant process safety incidents at US petroleum refineries. Seventeen of these took place in California.

Under the existing regulatory regimes for onshore petroleum refineries in the US and California, such as the PSM and RMP programs, there is no requirement to reduce risks to ALARP. For example, under both PSM and RMP an employer must “control” hazards when conducting a process hazard analysis (PHA) of a covered process. However, there is no requirement to address the effectiveness of the controls or the hierarchy of controls. Thus, a PHA that meets the regulatory requirements may inadequately identify or mitigate major hazard risk. In addition, there is no requirement to submit PHAs to the regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed safeguards.

Chevron Richmond Refinery Regulatory Report May 2014

12

The PSM standard does not effectively establish goals to prevent accidents or reduce risk. Only two of the 14 elements (PHA and mechanical integrity) of the PSM standard contain some goal-setting component.

In the last decade, the CSB has made a number of process-safety related recommendations to OSHA and EPA in its investigation reports and studies (e.g. Motiva, BP Texas City, and Reactive Hazards). However, none of the regulatory recommendations have been implemented, and there have been no substantive changes made to the PSM and RMP regulations to improve the prevention of major accidents.

Available data from Norway and the United Kingdom (UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime.22

Regulatory approaches similar to the safety case regulatory regime, which require risk reduction to ALARP or equivalent, have been implemented in the nuclear sector by the Nuclear Regulatory Commission (NRC) and the aerospace sector by NASA.

Independent studies of the safety case regulatory regime in the UK have identified improvements to safety performance from the safety case and a variety of stakeholders, including major oil companies, have shown support of the safety case.23

1. 5

Regulatory Conclusions The existing regulatory regimes for onshore petroleum refineries in the US and California:

Rely on a safety and environmental management system framework that is primarily activity-based rather than requiring goal-based risk reduction to as low as reasonably practicable (ALARP) or equivalent.

Are static, unable to adapt to innovation and advances in the management of major hazard risks.

Do not require that companies effectively manage the risks they create; nor do they require regulator evaluation of the effectiveness of safeguards or regulator acceptance of companies’ plans for controlling those risks.

Do not ensure continuous improvement by effectively incorporating lessons learned from major accidents; nor do they require companies to address newly-identified safety issues as a result of such incidents.

Do not effectively collect or promote industry use of major accident performance indicators to drive industry to reduce risks to ALARP.

22 Norway’s indicator data is discussed in Section 4.5. The UK data is discussed in Appendix C. 23 See Sections 2.0, 3.2.1.2, and 3.2.2.3. Also see FAQ 4.

Chevron Richmond Refinery Regulatory Report May 2014

13

Do not require the use or implementation of inherently safer systems analysis or hierarchy of controls.

Do not effectively involve the workforce in risk reduction and prevention of major accidents.

Do not provide the regulator with the authority to accept or reject a company’s hazard analysis, risk assessment, or proposed safeguards; and

Do not employ the requisite number of staff with the technical skills, knowledge, and experience to provide sufficient direct safety oversight of petroleum refineries.

1. 6

Recommendations As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized below, to the following recipients:

California State Legislature, Governor of California

Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory framework for petroleum refineries in the state of California based on the principles of the “safety case” framework.

The Chemical Facility Safety and Security Working Group and the Occupational Safety and Health Administration

As part of your response to Executive Order 13650, develop questions and evaluate issues raised from the findings and conclusions in this report concerning the safety case regime.

Section 7.0 details the recommendations.

Chevron Richmond Refinery Regulatory Report May 2014

14

1. 0 Introduction

Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction of the thousands of industrial and chemical facilities that exist in the US, the CSB has seen a great number of serious and deadly incidents at refineries over the last decade.

In March 2005, the BP Texas City Refinery suffered one of the worst industrial accidents in recent US history, when overfill of a distillation column resulted in an explosion and fire that led to 15 fatalities, another 180 injuries, and the issuance of a shelter-in-place order that required 43,000 people to remain indoors. Houses were damaged as far as three-quarters of a mile away from the refinery. In a 2006 statement, former CSB Chairwoman Carolyn Merritt said that while BP did make some safety improvements before the March 2005 explosion, “the focus of many of these initiatives was on improving procedural compliance and reducing occupational injury rates, while catastrophic safety risks remained….”24

In November 2009, an explosion at the Silver Eagle Refinery damaged over 100 homes in a nearby subdivision in Woods Cross, Utah. At a public meeting to discuss the incident, former CSB Chairman John Bresland called on refineries to improve their safety performance, stating:

The frequency of accidents in US refineries is very troubling. These accidents cost lives, inflict serious injuries and can harm communities. They also earn scrutiny from government regulators; in the past few weeks a refinery in Texas drew the largest OSHA fine in history, more than US $80 million, for alleged process safety violations. I call on all refineries to redouble their commitment to safer operations and safer communities. The current rate of accidents in refineries is not sustainable and it is not acceptable.25 On the five-year anniversary of the BP Texas City explosion in March 2010, Chairman Bresland continued to relay his concern regarding refinery safety, noting that “refinery accidents…continue to occur with dismaying frequency…[and] will only stop when every refinery has made the financial and human commitment to sound process safety management.”26 Yet just ten days later, seven workers were fatally injured at the Tesoro refinery in Anacortes, Washington, following the catastrophic failure of a heat exchanger. Again, Chairman Bresland pointed out the alarming frequency of refinery incidents, stating that “if the aviation industry had the same number and types of incidents as the refining industry, I don’t think people would be flying too much.”27

24 Scrutiny Finds BP Safety Troubles. http://usatoday30.usatoday.com/money/industries/energy/2006-10-30-bp- blast-findings_x.htm (accessed September 5, 2013). 25US Refineries Commitment to Safety Called Into Question. http://www.engineerlive.com/content/22354 (accessed September 5, 2013). 26 http://www.csb.gov/statement-from-csb-chairman-john-bresland-on-5th-anniversary-of-fatal-bp-texas-city-2005- explosion/?pg=18 (accessed September 5, 2013). 27Refinery Tragedies All Too Common. See http://seattletimes.com/html/localnews/2011518449_safetysunday04m.html (accessed September 5, 2013)

Chevron Richmond Refinery Regulatory Report May 2014

15

On June 10, 2010, OSHA Deputy Assistant Secretary Jordan Barab testified before the Senate Committee on Health, Education, Labor and Pensions’ Subcommittee on Employment and Workplace Safety regarding worker safety in US energy production industries. Mr. Barab noted that OSHA had counted over 20 major incidents resulting in injuries or fatalities across the country that had occurred within the last five years, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry.28 According to Mr. Barab, “[t]his cycle of workers being hurt or killed because their employers failed to implement well-known safety measures points out major deficiencies in chemical process safety management in the nation’s refineries and, quite possibly, to systemic safety and health problems in the entire petrochemical industry.”29 According to OSHA’s compliance instruction document CPL-03-00-00430 on the OSHA Petroleum Process Safety Management National Emphasis Program (NEP) issued in 2007, Since the PSM standard was promulgated by OSHA in 1992, no other industry sector has had as many fatal or catastrophic incidents related to the release of HHC [highly hazardous chemicals] as the petroleum refining industry []. According to OSHA's IMIS [Integrated Management Information System] database, since May 1992, 36 fatality/catastrophe (FAT/CAT) incidents related to HHC releases in the refining industry have occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. The number of refinery FAT/CAT incidents surpasses the combined total of the next three highest industries over the same period (SIC 2899 Chemical Manufacturing, Not Elsewhere Classified (NEC) – 12 FAT/CATs; SIC 2869 Industrial Organic Chemical Manufacturing, NEC – 12 FAT/CATs; and SIC 2892 Explosive Manufacturing – 11 FAT/CATs).31 In 2012 alone, the CSB tracked 125 significant32 process safety incidents at US petroleum refineries, which are listed in Appendix A. Seventeen of these took place in California, including a major release of 8,614 pounds of highly toxic hydrogen sulfide at the Chevron Richmond Refinery on August 2, 2012, just four days prior to the incident. Of the 15 major accidents that the CSB is currently investigating, six occurred in petroleum refineries. These include two separate explosions at the Silver Eagle refinery in Woods Cross, Utah, which resulted in injuries and offsite consequences, the heat exchanger rupture at the Tesoro refinery in Anacortes, Washington, which resulted in seven fatalities, and a series of equipment failures at CITGO’s refinery in

28 Jordan Barab’s Congressional testimony is available at http://www.dol.gov/ocia/congressionaltestimony/20100610_JBarab.htm (accessed January 7, 2014). 29 Ibid. 30 OSHA Instruction CPL 03-00-004. Petroleum Refinery Process Safety Management National Emphasis Program. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=3589#VIII (accessed January 7, 2014). 31 Ibid at Section VIII. 32 These incidents were reported to the Department of Energy and/or the National Response Center and examined by the CSB’s Incident Screening Department. The CSB believes that incidents that result in disruptions to the national energy supply, serious injuries, or receive high media attention are all significant.

Chevron Richmond Refinery Regulatory Report May 2014

16

Corpus Christi, Texas, involving highly toxic hydrogen fluoride. The U.S. Environmental Protection Agency (EPA) has also documented 234 recordable accidents at petroleum refineries between 2000 and

1. Despite the fact that the nation’s petroleum refineries make up only roughly one percent of the

some 13,000 facilities covered by the EPA’s Risk Management Program, they accounted for more incidents in that time period than any other industry, including the much larger sector of chemical manufacturing, which EPA documented as having 218 recordable accidents.33

The CSB concludes that the continuing occurrence of refinery accidents demonstrates the pressing need to examine the current regulatory structure in place in the US and, in light of the Chevron incident, in the state of California for petroleum refineries. There have been a number of positive developments in the wake of the Chevron incident that demonstrate California’s prime opportunity to lead the nation in implementing changes to improve safety and health in the refining industry. In the Fall of 2012 following the Chevron incident, California Governor Jerry Brown created the California Interagency Working Group on Refinery Safety (“the working group”), charged with improving cooperation among agencies, including the EPA, Cal EPA, California’s Division of Occupational Safety and Health (Cal/OSHA), and Contra Costa County, with the goal of improving safety at California’s petroleum refineries and preventing major accidents.

The working group began its initiative by commissioning the Labor Occupational Health Program34 (LOHP) to conduct “listening panels” throughout California, enabling community members to meet with working group members to discuss their concerns surrounding refineries. LOHP convened a series of meetings and conference calls with labor unions, community-based organizations, fire agencies, and environmental health groups between November 6, 2012, and March 18, 2013. Dr. Michael P. Wilson, the former Director of LOHP,35 documented his findings and recommendations regarding refinery safety in a summary report entitled Refinery Safety in California: Labor, Community and Fire Agency Views, which was released on June 4, 2013.36 In the report, Dr. Wilson quoted Swiss Re’s finding that the US has experienced financial losses from refinery incidents that are three times that of industry counterparts in countries within the “EU cluster,”37 a gap which continues to grow due in part to the US refining industry’s “pushing…mode of operation”, its “compliance-driven focus on safety”, and “a ‘detached’ workforce….”38

33 Matthiessen, Craig. EPA Risk Management Program: An Overview of the EPA Risk Management Program and Inherently Safer Processes. NAS-MIC Bayer Public Meeting Power Point Presentation; May 24, 2011; p 20. 34 LOHP is a public service program for the Center for Occupational and Environmental Health at UC Berkeley’s School of Public Health. LOHP seeks “to reduce occupational injury, illness and death by protecting the health and safety of workers worldwide.” For more information, see http://www.lohp.org/ (accessed July 8, 2013). 35 Dr. Wilson now serves as Chief Scientist in the Office of the Director, California Department of Industrial Relations (DIR). DIR oversees state programs dedicated to protecting the health, safety, and economic security of California’s workers. 36 Dr. Wilson released an initial draft of the summary report on March 27, 2013. He then released a revised copy of the summary report on June 4, 2013. See http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 37 The countries in the EU cluster are all of Europe, Singapore, South Korea, Japan, Saudi Arabia, Gulf States and Egypt. 38 Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013; pp 5 and 6. Citing Zirngast, Ernst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-

Chevron Richmond Refinery Regulatory Report May 2014

17

Dr. Wilson reiterated a number of the findings contained in the CSB’s Interim Report on the Chevron incident, including the “striking lack of attention on the part of the Richmond Chevron refinery to maintenance and metallurgy upgrades…,” and the Chevron Richmond Refinery’s failure to implement a recommended 100% component inspection program for high-risk piping. He also stated that California’s refineries are able to operate without demonstrating competence in health, safety, and environmental performance to a regulatory agency or to the public, and as such recommended that California establish a regulatory approach similar to that of the safety case regulatory regime, a rigorous prescriptive39 and goal- setting40 regulatory regime used widely by other regions throughout the world such as the United Kingdom (UK) and Australia to regulate high hazard industrial facilities. It is highlighted by its adaptability and requirements for continuous improvements in risk reduction, places the duty on industry to demonstrate its competence in health and safety to the regulator. The regime is overseen by highly competent, well-funded regulators that rigorously audit facilities for compliance with the written safety case report and good industry practice.

On July 11, 2013, the working group released a draft report entitled Improving Public and Worker Safety at Oil Refineries,41 which the CSB has recognized as an important step forward in improving petroleum refinery safety and environmental performance both in California and nationally. The report outlined the process of adopting several of the CSB‘s recommendations from its Interim Report on the Chevron incident, including requiring refineries to implement inherently safer systems and conduct damage mechanism hazard reviews. Furthermore, the report announced the creation of an Interagency Refinery Task Force within the California Environmental Protection Agency (Cal/EPA) by September 1, 2013, aimed at facilitating information sharing and improving coordination of oversight and enforcement activities among regulatory agencies. The CSB welcomed the report’s recommendation for California to study the safety case regulatory approach.

In addition to the work being done by the working group, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at least 15 new positions in Cal/OSHA’s Process Safety Unit, which enforces the California Process Safety Management (PSM) standard throughout the state.42

The Chevron incident also spurred the formation of the City of Richmond’s Refinery Action Collaborative (“the collaborative”), which was launched on January 30, 2013. The collaborative, whose

EXTRACT. Risk Engineering Services, Swiss Re. http://coeh.berkeley.edu/people/apers_educ/docs/LOHPRefinery%20Safety.pdf (accessed December 30, 2013). 39 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective. 40 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels. 41 See http://www.calepa.ca.gov/Publications/Reports/2013/Refineries.PDF (accessed September 25, 2013). 42 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

18

members include the United Steelworkers43 (USW) Local 5, the USW International, Communities for a Better Environment,44 and LOHP,45 was launched after a preliminary exploratory meeting held in October

1. The collaborative advocates for community and worker safety, better transparency, and

environmental health, and has already made recommendations to the working group to improve emissions reporting and require more thorough assessments of pipe corrosion damage at oil refineries.46

On October 10, 2013, the collaborative formally responded in a memo to the July 2013 draft report issued by the Interagency Working Group on Refinery Safety (Improving Public and Worker Safety at Oil Refineries). In the memo, the collaborative stated its support for the working group’s findings and recommendations. The collaborative also issued its own recommendations and highlighted 12 principles as being important to the development of effective regulatory policy in California. These principles include linking regulatory non-compliance to an operator’s license to operate and integrating meaningful participation in decision-making by workers and communities.47 The collaborative also noted in the memo that it supported “shifting the ‘burden of proof’ of safety from public agencies to the industry, as is required in the ‘Safety Case’ approach….”48

The CSB noted in its Chevron Interim Report the important role of transparency between industry and the public in improving health and safety for the facility and the surrounding communities. Following the Chevron incident the collaborative, worker representatives, regulators, and governmental bodies played a key role in driving transparency, accountability, and improved risk reduction during the decision-making process related to crude unit piping repairs. The CSB recommended to the California State Legislature in the Interim Report to establish a multi-agency process safety regulatory program for all California petroleum refineries to further improve public accountability and transparency by establishing a system to report to the regulator methodologies, findings, conclusions, and corrective actions related to refinery mechanical integrity inspection and repair work arising from California petroleum refinery PHAs, turnarounds, and maintenance-related shutdowns.49 This system would require reporting of information such as damage mechanism hazard reviews, establish procedures for greater workforce and public participation, and provide mechanisms for federal, state, and local agency operational coordination,

43 The USW is the largest industrial union in North America and has approximately 1.2 million active and retired members in the US, Canada, and the Caribbean. For more information see http://www.usw.org/ (accessed July 17, 2013). 44 Communities for a Better Environment is an “environmental justice organization[s]” in California which has the mission of “build[ing] people’s power in California’s communities of color and low income communities to achieve environmental health and justice by preventing and reducing pollution and building green, health and sustainable communities and environments.” See http://www.cbecal.org/about/mission-vision/ (accessed August 14, 2013). 45 Other members of the collaborative include the BlueGreen Alliance (a coalition of labor unions and environmental groups that advocate for a green economy and safer workplaces), the National Resources Defense Council, and the Asian Pacific Environmental Network. 46 See http://richmondconfidential.org/2013/02/20/labor-and-environmental-groups-join-forces-on-refinery-issues/ (accessed July 9, 2013). 47 Refinery Action Collaborative. Initial Response of the Collaborative to the Findings & Recommendations of The July 2013 Draft Report of the Interagency Working Group on Refinery Safety, Governor Jerry Brown. October 10, 2013; p 10. 48 Ibid at 7. 49 Under the existing federal and California state PSM standards, this information is not currently made publicly available.

Chevron Richmond Refinery Regulatory Report May 2014

19

sharing of data, and joint accident prevention activities. California is actively working to implement this recommendation through the creation of the Interagency Refinery Task Force mentioned above.

The positive and productive developments that have taken place in the wake of the Chevron incident strongly suggest that California has a unique opportunity to implement changes to improve safety and health in the refining industry that can serve as a model to the rest of the country.

It is also important to note that a growing dialogue has emerged throughout the US surrounding the need to improve the regulation of hazardous materials and processes, to which the CSB has been an important contributor. The CSB first examined the safety case in its 2002 investigation report entitled Improving Reactive Hazard Management50 as a potentially effective alternative framework for the regulation of reactive hazards. The CSB noted that successful implementation of this “comprehensive” regulatory approach required a competent and experienced regulator. In December 2010, the CSB held a public hearing in Washington, DC on the Regulatory Approaches to Offshore Oil and Gas Safety, where internationally recognized experts in industrial safety and accident analysis provided important testimony on managing risks offshore.51 Much of this testimony supported the implementation of the safety case as a model for regulating major hazards, both onshore and off. For example, a Shell Oil Company representative testified that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers52 and controls. In July 2012, the CSB held an additional public hearing on Safety Performance Indicators.53 A number of international regulators testified on the regulator’s ability under the safety case to drive continuous improvement in the oil and gas industry. Finally, on July 25, 2013, the CSB held a public meeting to discuss the U.S. Occupational Safety and Health Administration’s (OSHA’s) failure to implement a number of key CSB safety recommendations made to OSHA in the last decade to revise and improve its Process Safety Management (PSM) standard and to issue a new combustible dust standard.

On January 18, 2011, President Obama issued Executive Order 13563,54 which called for improvements in the nation’s regulatory system to promote predictability and reduce uncertainty and to use the best, most innovative, and least burdensome tools for achieving regulatory ends. Specifically, it directed that agencies review existing and proposed standards and regulations to ensure they effectively protect “public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”55 Finally, the order emphasized that to the extent feasible, regulations

50 A full copy of the report is available at http://www.csb.gov/improving-reactive-hazard-management/ (accessed July 10, 2013). 51 For a copy of the transcript from the CSB Public Hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, see http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed August 14, 2013). 52 A barrier is a “technical, operational and/or organizational element[] which individually or collectively reduce[s] opportunities for specific error, hazard or accident to occur, or which limits its harm/drawbacks.” Petroleum Safety Authority. Safety Status & Signals, 2012-2012; 2013; p 31. 53 For the proceedings of the CSB Public Hearing on Safety Performance Indicators see http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 54 Improving Regulation and Regulatory Review. Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.archives.gov/federal-register/executive-orders/2011.html (accessed July 10, 2013). 55 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

20

and standards should specify performance objectives rather than the behavior or manner of compliance that regulated entities must adopt, and be adopted through a process that involves public participation. As a result of this Executive Order, OSHA, the Bureau of Safety and Environmental Enforcement (BSEE), the EPA, the Department of Transportation’s Pipeline and Hazardous Materials Safety Administration (PHMSA), and the U.S. Coast Guard (USCG) solicited views from the public and stakeholders regarding opportunities to address improving efficiency and effectiveness of safety and environmental regulations and standards in the oil and gas industry.56 These five agencies then convened an expert forum57 in September 2012 in Texas City, Texas, to explore the benefits of implementing goal or performance-based regulatory models such as the safety case in the oil and gas industry, and ways to advance the use of such models in the US. The forum included a discussion of the safety case regulatory regime as a performance-based regulatory model, and industrial safety and accident analysis expert Dr. Andrew Hopkins spoke in support of that model.

In the wake of the April 2013 explosion and fire that occurred at a fertilizer storage and distribution facility in West, Texas, and resulted in fifteen fatalities and hundreds of injuries, President Obama issued Executive Order 1365058 on August 1, 2013. The Executive Order established the Chemical Facility Safety and Security Working Group, a working group of federal agencies59 tasked with, among other things, developing options for enhancing and modernizing policies, regulations, and standards to improve the safety and security of chemical facilities.60 As will be discussed in Section 4.3, the group has included the safety case regulatory model in a list of potential actions it may consider taking to improve chemical safety regulation.61

The CSB has utilized a broad range of expert testimony and research to gain a comprehensive understanding of regulatory models for onshore and offshore oil and gas facilities in countries around the world, and, in light of this investigation, the state of California. This report highlights the significant attributes of the safety case regime that together result in a more effective regulatory approach to process safety and risk reduction. It also provides a detailed contrast of the safety case regulatory model to the existing regulatory structures in the US and California, and makes recommendations to improve California’s regulatory oversight of its petroleum refineries and to promote a broader national dialogue on the safety case regulatory approach.

56 For more information see https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed July 10, 2013). 57 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed August 13, 2013). 58 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 2013). https://www.federalregister.gov/articles/2013/08/07/2013-19220/improving-chemical-facility-safety-and-security (accessed January 7, 2014). 59 The working group includes the EPA, the Department of Justice, the Department of Agriculture, the Department of Transportation, and the Department of Labor. 60 See Section 6 of the Executive Order. 61 See Working Group response to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014).

Chevron Richmond Refinery Regulatory Report May 2014

21

1. 0 The Safety Case Regulatory Regime
2. 1

Introduction Throughout modern history, major industrial accidents have been catalysts for significant regulatory reform, as countries around the world strive to mitigate risk and improve the safety of their facilities and processes in order to protect human health and the environment. According to industrial safety and accident analysis expert Dr. Andrew Hopkins, “[d]isasters…offer an unparalleled opportunity to study the workings of an organisation and to identify where things are going wrong.”62 Around the world, many of these large-scale incidents have resulted in sweeping changes to legislation surrounding industrial safety and health. These changes replace prescriptive, compliance-based regulations with goal-setting regulations supplemented by prescriptive requirements that support adaptability, require duty holders63 to demonstrate to the regulator that they have driven risks to as low as reasonably practicable (ALARP) or equivalent, and provide the regulator with the tools to drive continuous improvement among major hazard facilities.64 A majority of these regulatory regimes are referred to as the safety case, which Dr. Hopkins defines as: a case which the operator of a hazardous facility makes to the regulator, setting out how safety is to be managed. It must include details of the hazard identification process, the hazards which have been identified and the procedures which have been set in place to control them. The system remains self-regulatory in principle but rather than the facility being left to its own devices by the regulator it must convince the regulator that its strategy for managing safety is satisfactory [emphasis added]. Under any safety case regime, facility operators are expected to adopt best practice risk management.65 The safety case regulatory regime is much more than a written report; it shifts risk management responsibility to the company and its employees and provides for rigorous review and oversight by a technically competent regulator to ensure effective implementation.66

62 Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999; p 1. 63 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include operators, contractors, and subcontractors. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 64 Major hazard facilities are workplaces that store, handle or process large quantities of hazardous material. Incidents at such facilities have the potential to cause serious damage to employees, people in surrounding areas, and the environment. See http://www.pc.gov.au/__data/assets/pdf_file/0018/82350/21-appendixd.pdf (accessed May 9, 2013). 65 Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online]; p 7. http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%20presentati on/Lonford%20talk.PDF (accessed May 8, 2013). 66 The CSB notes that that the burden is currently on the PSM regulator to verify compliance with existing regulations, which is primarily done following an incident or complaint. Rarely is this done proactively under the

Chevron Richmond Refinery Regulatory Report May 2014

22

The remaining portions of Section 3 will introduce major accidents that have occurred around the world and discuss the history behind the global development and implementation of the safety case regulatory approach on and offshore. Section 4.0 will then highlight major attributes of the safety case regulatory approach. The US regulatory model will also be introduced and discussed throughout these sections to allow for comparisons between the different approaches. Finally, Section 5.0 will discuss the regulation of petroleum refineries in California specifically, including Chevron. The report concludes with important recommendations focused on improving the regulatory oversight of California’s 14 refineries, and encouraging OSHA, industry, labor, and others to work together to improve the regulation of petroleum refineries throughout the US. 3.2 Initial Safety Case Implementation 3.2.1 United Kingdom 3.2.1.1 Onshore Two major onshore incidents in the 1970s helped spark legislative reform focused on major accident prevention and risk reduction for onshore major hazard facilities. A large dioxin67 release in Seveso, Italy, in 1976, which injured hundreds of individuals, led the European Commission68 to adopt legislation in 1982 known as the Seveso Directive, aimed at the prevention and control of major industrial accidents.69 Following the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, and the Sandoz chemical plant fire near Basel, Switzerland, which injured 14 individuals and released nearly 30 tons of pesticides into the Rhine River, turning it red, the Seveso Directive was amended and replaced in 1996 with the Seveso II Directive.70 The regulation requires owners or operators of facilities that contain threshold quantities of listed substances to submit safety reports to a competent authority (CA) within a Member State of the European Commission for its review and acceptance.71 These reports must demonstrate to the CA that major-accident prevention policies, safety management systems, and internal emergency plans have been created and implemented.72 The

current system. The Refinery NEP is a primary example of proactive inspections to verify compliance. It was discontinued in 2011. 67 The term Dioxin refers to a family of toxic chemicals. They have been characterized by EPA as likely to be human carcinogens and are anticipated to increase the risk of cancer at background levels of exposure. See http://www.epa.gov/pbt/pubs/dioxins.htm (accessed June 17, 2013). 68 The European Commission consists of 27 Commissioners and “represents the interests of the EU [European Union] as a whole. It proposes new legislation to the European Parliament and the Council of the European Union, and it ensures that EU law is correctly applied by member countries.” http://ec.europa.eu/atwork/index_en.htm (accessed May 6, 2013). 69 See http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 70 The Seveso Directive was adopted in 1982 and was amended twice, in 1987 and 1988. On December 9, 1996, the Seveso II Directive was adopted and replaced the original Seveso Directive. The Seveso III Directive was then adopted on July 4, 2012, and became effective on August 13, 2012. Member States must implement Seveso III by June 1, 2015. http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 71See http://ec.europa.eu/environment/seveso/legislation.htm (accessed May 6, 2013). 72 Seveso II Directive, Article 9 (1996). Available at http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

23

regulation also requires owners or operators to “prove to the competent authority…that he has taken all measures necessary as specified in this Directive.”73 On June 1, 1974, the Flixborough Works of Nypro (UK) Limited experienced a massive cyclohexane vapor cloud explosion, killing 28 workers and injuring 36 workers and hundreds of members of the public offsite. This incident along with the Seveso incident led to the Seveso Directive in 1982, and this was converted into legislation in the United Kingdom (UK) via the Control of Industrial Major Accident Hazards (CIMAH) 1984 Regulations. The Control of Major Accidents74 Hazards Regulations (COMAH) replaced CIMAH in April 1999 to conform to the updated Seveso II Directive. The Health and Safety Executive75 (HSE), the Environment Agency76 (EA), and the Scottish Environmental Protection Agency77 (SEPA) are considered to be the UK’s CA responsible for the enforcement of these regulations. A key feature differentiating these two regulations is the increasing emphasis from the operator having to “describe” the safety systems in CIMAH to being required to “demonstrate” their adequacy in COMAH.78

73 Seveso II Directive, Article 5, Paragraph 2 (1996). Available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013). 74 The COMAH regulations define “major accident” as “an occurrence (including in particular, a major emission, fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances…” COMAH Regulations, Part 1, Regulation 2 (2005). 75 HSE is an independent regulator, and “act[s] in the public interest to reduce work-related death and serious injury across Great Britain’s workplaces.” See http://www.hse.gov.uk/aboutus/ (accessed May 7, 2013). According to the HSE’s Enforcement Policy Statement, the HSE’s purpose is “to protect the health, safety and welfare of people at work, and to safeguard others, mainly members of the public, who may be exposed to risks from the way work is carried out.” http://www.hse.gov.uk/pubns/hse41.pdf (accessed May 7, 2013). 76 EA is an Executive Non-departmental Public Body responsible for protecting the environment and promoting sustainable development. For more information see http://www.environment-agency.gov.uk/default.aspx (accessed July 17, 2013). 77 SEPA is Scotland’s environmental regulator, aimed at protecting and improving the environment. For more information see http://www.sepa.org.uk/ (accessed July 17, 2013). 78 COMAH Regulations. Schedule 4, Part 1. Purpose of safety reports is to “1. demonstrate[e] that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2; 2. Demonstrate[e] that major accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for persons and the environment; 3. Demonstrate[e] that adequate safety and reliability have been incorporated into the – (a) design and construction, and (b) operation and maintenance, of any installation and equipment and infrastructure connected with its operation which are linked to major accident hazards within the establishment.…” (2005).

Chevron Richmond Refinery Regulatory Report May 2014

24

The COMAH regulations apply to all onshore facilities that have sufficient quantities of dangerous substances as listed in Schedule 179 of the regulations.80 The general duty for all duty holders of facilities covered under the COMAH regulations is to “take all measures necessary to prevent major accidents and limit their consequences to people and the environment.”81 The HSE interprets this duty as the equivalent of reducing risks82 to “as low as reasonably practicable,” or ALARP.83,84,85 Duty holders are required to prepare a safety report that “demonstrate[s] to the CA that all measures necessary for the prevention and mitigation of major accidents have been taken.”86 These reports must contain information for the CA to review and analyze, including a policy on preventing and mitigating major accidents; a management system for implementing that policy that complies with good practice;87 an effective method for identifying any major accidents that might occur; and measures to prevent and mitigate major accidents.88 To assist operators with reducing risks to ALARP, the HSE publishes guidance documents that contain good practice guidelines and standards and that discuss what constitutes good practice.89

79 Available at http://www.legislation.gov.uk/uksi/1999/743/schedule/1/made (accessed June 17, 2013). 80 COMAH Regulations, Part 1, Regulation 3 (2005). 81 COMAH Regulations, Part 2, Section 4 (2005). 82 HSE describes “risk” as “the likelihood that a hazard will actually cause its adverse effects, together with a measure of the effect.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 83 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed May 15, 2013). 84 The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974. It requires employers to ensure that risks to employees and others are reduced “so far as is reasonably practicable,” or SFAIRP. Health and Safety at Work etc. Act, Part I, Section 2 (1) and (2) (1974). HSE has interpreted that SFAIRP duties call for the same set of tests to be applied as duties to reduce risks “as low as reasonably practicable,” or ALARP. According to HSE, “”the two terms mean essentially the same thing and at their core is the concept of ‘reasonably practicable’;…” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 85 According to HSE, the concept of “reasonably practicable” “involves weighing a risk against the trouble, time and money needed to control it. Thus, ALARP describes the level to which [they] expect to see workplace risks controlled.” This allows HSE to “set goals for duty-holders, rather than being prescriptive; HSE’s policy is that any proposed regulatory action should be based on what is reasonably practicable.” According to HSE, in most situations, deciding whether the risks are ALARP involves a “comparison between the control measures a duty- holder has in place or is proposing and the measures [they] would normally expect to see in such circumstances i.e. relevant good practice. ‘Good practice’ is defined as ‘those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.’… Once what is good practice has been determined, much of the discussion with duty-holders about whether a risk is or will be ALARP is likely to be concerned with the relevance of the good practice, and how appropriately it has been (or will be) implemented.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 86COMAH Regulations, Schedule 4, Part 1 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 87 HSE defines “good practice” as “those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.” HSE, “Assessing compliance with the law in individual cases and the use of good practice,” May 2003. Available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 88 COMAH Regulations, Schedule 4, Part 2 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013). 89 Such as HSE’s “Guidance for the topic assessment of the major accident hazard aspects of safety cases,” published in April 2006, and HSE’s “Assessing compliance with the law in individual cases and the use of good practice,” May 2003, available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

25

1. 2.1.2

Offshore The international offshore energy sector experienced several catastrophic incidents in the 1980s, including the Alexander Kielland 90 incident in Norway in 1980 which resulted in 123 fatalities, and the Piper Alpha91 incident in the UK in 1988, which fatally injured 167 workers. These incidents initiated offshore regulatory changes focused on risk reduction and control that were modeled after the CIMAH regulations. Following the Piper Alpha incident, the UK Secretary of State for the Department of Energy ordered that a public inquiry be held to determine the circumstances surrounding the incident.92 The Secretary directed Lord Cullen, a Senator of the College of Justice in Scotland, to hold the inquiry and report to the Secretary “the circumstances of the accident and its cause together with any observations and recommendations which he thinks fit to make with a view to the preservation of life and the avoidance of similar accidents in the future.”93 The result was The Public Inquiry into the Piper Alpha Disaster (“the Cullen Report”), an extensive report released in October 1990. The report called into question the adequacy of the detailed prescriptive regulatory regime that existed at the time of the incident94 for offshore oil and gas operations, and listed 106 recommendations to revamp offshore safety regulation in the UK, 57 of which the HSE was responsible for overseeing.95 The Cullen Report found that the operating company (Occidental Petroleum, a US company), “did not possess any system which ensured that such remote, but potentially disastrous, events were subjected to systematic scrutiny…[and] there was for major projects no comprehensive system of safety assessment and management did not appear to appreciate fully the contribution which it could make.”96 The report noted that there was a need for a formal safety assessment (FSA), “an assessment essentially equivalent to the Safety Case,”97 which “involves the identification and assessment of hazards over the whole life cycle of a project…[because]…the combinations of potential hardware and human failures are so numerous that a major accident hardly ever repeats itself…[and] [a] strategy for risk management must [] address the entire spectrum of possibilities.”98

90 The Alexander Kielland was a flotel for housing workers. A total of 212 people were on board when it capsized near the Edda platform in the Ekofisk area of the North Sea on March 27, 1980. As a result of this incident, 123 individuals lost their lives and only 89 survived. 91 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the platform. This incident became the deadliest accident in the history of the offshore industry. 92 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iii. 93 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iv. 94Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 27. 95 Oil &Gas UK. Piper Alpha: Lessons Learnt; 2008; p 2. 96 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 275. 97 Lord Cullen describes the Safety Case as “a means by which an operator demonstrates to itself the safety of its activities…[and] as the basis for the regulation of major hazard activities…” Ibid at 276-277. 98 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

26

In his analysis, Lord Cullen noted that the current offshore regulations were prescriptive in nature rather than goal-setting, and that this had the effect of hampering operators’ flexibility and stifling innovation.99 He stated that “one of the reasons for adopting the goal-setting approach was to make regulations that were more flexible, so that changing technology could be accommodated without the need for new legislation.”100 Lord Cullen pointed to the CIMAH Regulations, discussed above, as a forward-looking regulatory model, which required onshore major hazard installation operators to “provide HSE with a written report on the safety of the installation…commonly called the Safety Case.”101 Lord Cullen noted that the safety case “is a means by which an operator demonstrates to itself the safety of its activities…[and] also serves as the basis for the regulation of major hazard activities.”102 Lord Cullen concluded that an FSA “is an essential element in a modern safety regime for major hazard installations…that this FSA should take the form of a Safety Case…[and that] [t]he regime should have as its central feature demonstration of safe operation by the operator.”103 He recommended that a safety case regulatory regime be implemented offshore for both fixed and mobile installations as it already was for onshore major hazard installations, that it be complemented by other regulations dealing with specific features, that the safety case contain goal-setting regulations, and that it be part of a continuing dialogue between the operator and the regulatory body.104 Lord Cullen recommended the implementation of safety regulations requiring the owner or operator of every fixed and mobile installation operating in UK waters to submit a safety case to HSE. In response, the UK established the Offshore Installations (Safety Case) Regulations in 1992.105 The primary goal of these Regulations was “to reduce the risks from major accident hazards to the health and safety of the workforce employed on offshore installations or in connected activities.”106 Oil & Gas UK, 107 the main UK offshore oil industry trade association whose members include the major oil companies that operate in the Gulf of Mexico (such Shell and Exxon), has expressed strong support for the safety case regime. In its response to the European Commission’s published draft legislative proposals to modify offshore safety case regulations, Oil & Gas UK noted that those proposals would undermine the “proactive, flexible and responsive approach to managing risks, borne out of the lessons learnt from Piper Alpha as well as the evolving nature of the offshore oil and gas business itself.”108 In the wake of the Macondo incident in the Gulf of Mexico, the UK government directed Professor Geoffrey

99 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 339. 100 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 364. 101 Ibid at 276. 102 Ibid at 276 and 277. 103 Ibid at 282. 104 Ibid at 283 and 284. 105 The 1992 Regulations have since been replaced by the Offshore Installations (Safety Case) Regulations 2005, which were effective as of April 6, 2006. The objective of the revisions in 2005 was “to improve the effectiveness of the regulations whilst at the same time reducing the burden of three yearly resubmissions.” Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. 106 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

107 See http://www.oilandgasuk.co.uk/aboutus/aboutus.cfm (accessed December 10, 2013). 108 Oil & Gas UK. European Commission Proposed Regulation on Offshore Safety and Related Issues: Oil & Gas UK Position Paper. November 2011; p 1. http://www.oilandgasuk.co.uk/ProposedEURegulation.cfm (accessed December 10, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

27

Maitland of Imperial College London to lead an independent review of the offshore safety case regime in the UK.109 In the report stemming from the review, which highlighted strengths of the safety case regime as well as recommendations for improvement, Professor Maitland commended the UK’s “‘goal-setting’ safety regime and its ability to foster innovation and continuous improvement in process integrity…”110 and noted that the UK authorities, including the HSE, are held in high regard by both the UK operators and international observers.111 3.2.2 Global Analysis of Safety Case Implementation 3.2.2.1 Australia 3.2.2.1.1 Offshore Following the Piper Alpha disaster in 1988, the then Australian Commonwealth Minister for Resources at the time, Senator Peter Cook, formed a Consultative Committee on Safety in the Offshore Petroleum Industry to advise him on safety issues surrounding offshore operations in Australia. In 1991, the Committee released its Report of the Consultative Committee on Safety in the Offshore Petroleum Industry.112 In the report, the Committee examined the circumstances, causes, and recommendations described in both the Cullen Report and Esso Australia’s113 investigation report on a fire that occurred on the Tuna platform in April 1989 in Bass Strait that injured four individuals. The Committee noted that while there were many differences between the two incidents, they “both demonstrated the need for greater attention to the management of safety in a number of areas of offshore operations.”114 They pointed to the safety case as an important regulatory concept that should be applied to oil and gas operations in Australian waters, and concluded by recommending that the safety case concept described by Lord Cullen and carried out onshore by the Seveso Directive and CIMAH regulations be adopted for Australian offshore petroleum operations.115 It would “require the operator of a facility to formally document how safety is to be managed within the facility, [and] [] demonstrate that the major hazards of the installation have been identified and appropriate controls provided…”116 The Committee also recommended the implementation of both prescriptive and “objective” regulations.117 At that time, offshore petroleum safety was the joint responsibility of the Commonwealth and the States/Northern Territory. Following this inquiry, new Commonwealth regulations were created: for example, Schedule

109 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed December 10, 2013). 110 Ibid at 3. 111 Ibid at 3. 112 See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 113 Esso was an oil and gas company in Australia that was sold to Mobil Oil Corporation in 1990. It is now part of Exxon Mobil. See http://www.exxonmobil.com/Australia-English/PA/about_who_history_esso.aspx (accessed May 8, 2013). 114 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 2. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 115 Ibid at 25. 116 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 3. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 117 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

28

8 on “Occupational Health and Safety” was added to the Petroleum Submerged Lands Act (PSLA) in 1992 to require safety cases to be developed for all offshore petroleum facilities. The Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 set out the requirements for the contents of offshore safety cases. The operator of an offshore petroleum facility must submit a safety case for review and acceptance to the Australian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA), the Australian Commonwealth Statutory Agency charged with regulating the health and safety, structural integrity, and environmental management of all offshore petroleum facilities in Australian Commonwealth waters, and in coastal waters where State powers have been reduced. NOPSEMA accepts a safety case “if it is satisfied that the arrangements set out in the document demonstrate that the risks will be reduced to…ALARP.”118 3.2.2.1.2 Onshore In 1998, Esso Australia’s gas plant at Longford in Victoria suffered a major release and fire caused by cold temperature embrittlement due to a process upset and lack of engineering support for diagnosis, which resulted in two fatalities, eight additional injuries, and cut the State of Victoria’s gas supply for two weeks causing major industrial disruption and workforce stand downs. While the safety case at this time was required for offshore operations in Australia, onshore facilities like the Longford plant were subject only to prescriptive provisions contained within the Victoria Occupational Health and Safety Act 1985. In its report on the incident, the Royal Commission concluded that all major hazard facilities in Victoria should be required to develop and submit a safety case to the appropriate regulatory authority. In 1996, Australia’s National Occupational Health and Safety Commission119 (NOHSC) recommended the safety case be adopted for all major onshore hazard facilities in Australia, and in 2002 NOHSC established a National Standard for the Control of Major Hazard Facilities and a National Code of Practice for the Control of Major Hazard Facilities.120 The Standard states that operators of major hazard facilities “shall provide the relevant public authority with a safety report…” that, among other things, identifies the type, relative likelihood and consequences of major accidents that might occur, and provides details of the safety management system (SMS) for that facility.121 In addition, operators of major hazard facilities must identify all major hazards and the risks associated with those hazards, and minimize each risk “so far as practicable.”122

118 See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July 15, 2013). 119 In 1985 The National Occupational Health and Safety Commission (NOHSC) was established as a tripartite body to develop, facilitate and implement a unified national approach to occupational health and safety in Australia. On January 1, 2006, NOHSC was replaced by the Australian Safety and Compensation Council (ASCC). On March 31, 2009, the ASCC was abolished and replaced with Safe Work Australia. Safe Work Australia was established by the Safe Work Australia Act 2008 with the authority to help develop policy to improve worker health, safety, and compensation across Australia. It does not regulate work health and safety laws; rather it develops national policy. See http://www.safeworkaustralia.gov.au/sites/swa/about/pages/about (accessed May 8, 2013). 120 National standards are documents which prescribe preventative action to avert occupational deaths, injuries and diseases; national codes of practice are documents prepared for the purpose of advising employers and workers of acceptable ways of achieving national standards. National Standard for the Control of Major Hazard Facilities [NOHSC: 1014(2002)], p 2. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/271/NationalStandard_ControlMajo rHazardFacilities_NOHSC_1014-2002_PDF.pdf (accessed May 8, 2013). 121 Ibid at 13. 122 Ibid at 12.

Chevron Richmond Refinery Regulatory Report May 2014

29

According to the Australian Safety and Compensation Council’s 2004 Annual Situation Report for the National Standard for the Control of Major Hazard Facilities, all Australian jurisdictions were expected to have the standard in place before the end of 2005, roughly three years after its inception.123 3.2.2.2 Norway Following the capsizing of the Alexander Kielland in 1980, Norway moved in a direction similar to the European Commission and developed performance-based regulations focused on major accident prevention. Although the country did not adopt the safety case regulatory regime per se, the current regulatory approach implements many similar elements. Currently in Norway, the Petroleum Safety Authority124 (PSA) regulates safety for activities at onshore and offshore major hazard facilities, and requires the responsible party125 to reduce risk “to the extent possible,” and “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”126 This concept is akin to ALARP whereby companies choose the solutions and barriers that have the greatest risk-reducing effect, provided the costs are not significantly disproportionate to the risk reduction achieved.127 However, unlike the UK and Australia, PSA regulations do not require the submission of a safety case report by the operator of a facility, although facilities are still expected to develop them and make them available to the regulator upon request for auditing purposes. Rather, PSA “supervises” industry, as explained in the following: Supervision involves much more than audits offshore or on land. It embraces the total contact between the regulator and the regulated. It covers everything which gives the PSA the necessary basis to determine whether the companies are accepting their responsibility to operate acceptably in all phases. Supervisory activities include investigations, considering consent applications and meetings with the industry.128 As will be discussed below, because the safety case regulatory approach requires the regulator to conduct detailed assessments of safety case reports and auditing of facilities against the safety case, its implementation requires substantial funding to support and maintain a sufficient number of highly experienced and competent staff.

123Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004; p1. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationReport_2004. pdf (accessed May 8, 2013). 124 The Petroleum Safety Authority (PSA) is “the regulatory authority for technical and operational safety and for the working environment.” PSA was created in 2004 as a result of a government decision to split the Norwegian Petroleum Directorate (NPD) into two parts. See http://www.ptil.no/main-page/category9.html (accessed May 8, 2013). 125 PSA defines a “responsible party” as “[t]he operator and others participating in activities covered by these regulations, without being a licensee or owner of an onshore facility.” Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 6(a). Definitions. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 126 PSA. Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 11, Risk Reduction Principles. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 127 Ibid. 128 http://www.ptil.no/supervision/what-is-supervision-article8519-88.html (accessed June 3, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

30

1. 2.2.3

The United States Despite the international shift to the safety case regime and even though major oil companies that operate both onshore and offshore in the US also operate globally under safety case regimes and have shown support for the safety case,129 the US has persisted in the use of a more activity-based regulatory scheme that does not contain a specific risk reduction target and that lacks the ability to adapt to advancing technology and recently developed industry standards. Due to the major potential hazards present in onshore and offshore oil and gas operations, these sectors should have in place adaptable safety regimes that adequately engage companies and their employees in continuous improvement and risk reduction. As the CSB has devoted extensive time and resources to studying and analyzing the regulation of offshore oil and gas facilities in the US as a result of its Macondo incident investigation, this report will focus on the regulation of onshore oil and gas operations in the US and California. On October 23, 1989, a massive explosion and fire occurred at the Phillips 66 Company’s Houston Chemical Complex in Pasadena, Texas, resulting in 23 fatalities and injuring more than 130. In response, the U.S. Department of Labor issued a report to the President and declared, among other things, that the U.S. Occupational Safety and Health Administration (OSHA) would “expedite completion of its rulemaking requiring employers to implement comprehensive chemical process safety management plans for hazardous chemical processes.”130 Sparked by a number of serious accidents, including the Phillips 66 incident and the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, OSHA published in the Federal Register (55 FR 29150) on July 17, 1990, a proposed standard containing requirements for the management of hazards associated with processes using highly hazardous chemicals.131 Soon after, Congress adopted the Clean Air Act (CAA) Amendments (CAAA) of 1990,

129A Shell Oil Company representative testified at the CSB December 2010 public meeting on the safety case that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers and controls. Shell Geelong Refinery Plant Manager Huck Poh has stated, “As a Major Hazard Facility, Shell Geelong Refinery and Lara Terminal is required to submit a Safety Case for assessment by Safe Work Victoria. This document is a summary of that Safety Case and explains the potential impact of the facility on our neighbours and the community. We take a systematic approach to managing safety and preventing incidents that place our people, our neighbours, the Geelong community, the environment and our facilities at risk. This is reflected in our Safety Management System and the approach that has been undertaken for the development and review of the Safety Case. Shell is committed to achieving continuous Health, Safety, Security and Environment (HSSE) performance improvement. There are ongoing review and revision activities to ensure our analyses remain relevant and reflect the current status of operations and our risk reduction measures are consistent with latest industry practice. This commitment to continuous improvement is reflected in the Shell HSSE Policy and supported by our HSSE results.” See http://s04.static-shell.com/content/dam/shell-new/local/country/aus/downloads/geelong/safety-case- summary.pdf p3. (accessed December 10, 2013). Esso Longford Plant Manager Monte Olson has stated that “[t]he Safety Case is a systematic and comprehensive review of our operations and processes which includes the identification of potential major incidents that could occur, assesses the risks associated with these major incidents and demonstrates the controls we have in place to manage these risks to as low as reasonably practicable.” See http://www.exxonmobil.com/Australia-English/PA/Files/publication_Longford_Safety_Case_2013.pdf p5. (accessed December 10, 2013) 130 Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990; p ix. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013). 131 Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section 1 – I. Background (March 4, 1992). See http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 10, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

31

which resulted in the creation of the CSB and authorized the first federal regulations specifically designed to prevent major chemical accidents that threaten workers, the public, and the environment: OSHA’s Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency’s (EPA’s) Risk Management Program. 3.2.2.3.1 OSHA PSM Standard Section 304 of the CAAA mandated that OSHA develop “a chemical process safety standard designed to protect employees from hazards associated with accidental release of highly hazardous chemicals in the workplace.”132 OSHA responded by adopting 29 CFR §1910.119 Process Safety Management of Highly Hazardous Chemicals (“the PSM standard”) in 1992. The PSM standard applies to a process133 involving a chemical at or above the listed threshold quantity (also known as a highly hazardous chemical), or flammables in a quantity of 10,000 pounds or more.134 It contains 14 elements with broad requirements to implement management systems, identify and control hazards, and prevent “catastrophic releases of highly hazardous chemicals.” While the PSM standard was intended to be performance-based and does contain some goal-setting elements, a majority of the standard is activity-based, and there is no general duty requirement under the PSM standard to reduce risks to a certain extent or prevent catastrophic accidents. As will be discussed at length in Section 4.3, the PSM standard has essentially remained stagnant since its inception in 1992. According to the Center for Chemical Process Safety (CCPS), the PSM standard has resulted “in a minimum cost, compliance-based approach to managing process safety… ‘If [it] isn’t a regulatory requirement, I’m not going to do it!’”135 A key provision of the PSM standard is the process hazard analysis (PHA) of covered processes. 136 PHA requirements include a review of the process to identify, evaluate, and control the hazards, and an evaluation of the consequences of failure of those controls.137,138 The PHA required by the OSHA PSM standard is an example of a goal-setting requirement in that it allows for a variety of hazard analysis methodologies to be performed to satisfy the requirement. However, the element is activity-based in that completing a PHA for each covered process and updating it at least every five years is satisfactory. The regulator is not responsible for evaluating the effectiveness of controls or safeguards, and there is no requirement to reduce risks to a certain extent such as ALARP. Thus, the resulting PHA that meets the

132 Clean Air Act Amendments of 1990. Section 304(a). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 133 The PSM standard defines “process” as “any activity involving a highly hazardous chemical including any use, storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 29 CFR §1910.119(b) (1992). 134 29 CFR §1910.119(a)(1) (1992). This standard also applies to the manufacture of explosives and pyrotechnics in any quantity [29 CFR §1910.109(k)(2) & (3)]. 135 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 136 A Process hazard analysis is a thorough, orderly, systematic approach for identifying, evaluating, and controlling hazards of processes involving highly hazardous chemicals. The employer must perform an initial process hazard analysis on all processes covered by the PSM standard and all process hazard analyses must be updated and revalidated, based on their completion date, every five years. See http://www.osha.gov/doc/outreachtraining/htmlfiles/psm.html (accessed May 10, 2013). 137 29 CFR §1910.119(e) (1992). 138 The other elements of the PSM standard are process safety information, operating procedures, employee participation, training, contractor safety, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning and response, and compliance audits. The 14th “element” is mainly a requirement that maintaining trade secrecy not interfere with an employer’s compliance with the other 13 elements.

Chevron Richmond Refinery Regulatory Report May 2014

32

regulatory requirements of “controlling” hazards may actually inadequately identify or mitigate the hazards. In addition, there is no requirement for employers to submit their PHAs to the regulator for review. In most cases, this means the regulator will not review these PHAs until there is a significant process accident, a complaint, or a (rare) planned inspection.

Another key element of the PSM standard, the Management of Change (MOC) provision, requires the development of written procedures “to manage changes to process chemicals, technology, equipment, and procedures…”139 The procedures must consider, among other things, the technical basis for a proposed change and its potential impact on safety and health.140 Historically, the MOC requirement has been treated and enforced as an activity-based requirement as well. For example, when the BP Texas City refinery explosion and fire occurred on March 23, 2005, all 15 fatalities and many of the 180 injuries occurred in or around nine contractor trailers that were sited near process areas and as close as 121 feet to the isomerization (ISOM) unit where the incident occurred. The refinery had been using trailers as temporary office spaces for several years. The refinery addressed facility siting for trailers during its 2004 MOC for an upcoming 2005 turnaround. The MOC form indicated that a double-wide mobile office trailer would be temporarily sited in the open area between the ISOM and naphtha desulfurization units (NDU) for use during the upcoming turnaround, to be removed at the end of April 2005. However, the MOC did not analyze siting hazards; rather the MOC team attached a drawing showing the proposed interior configuration of the trailer and measured its location from the catalyst warehouse.141 In early 2005, eight other trailers were sited between the ISOM and NDU without even conducting an MOC. The CSB pointed out in its Urgent Recommendations stemming from the Texas City incident that these trailers could have been easily relocated to less hazardous sites, and BP did so following the incident.142 Despite this fact, BP’s siting policy considered that utilizing trailers in this way posed little or no danger to occupants, which conformed with the American Petroleum Institute’s (API) Recommended Practice (RP) 752, Management of Hazards Associated with Location of Process Plant Buildings.

Although the MOC failed to identify or analyze hazards stemming from siting trailers so close to process areas, OSHA did not cite BP for conducting a poor MOC following the incident, as merely completing the MOC satisfied the requirements of the PSM standard. As it would have been very practical to move the trailers to a safer location, a regulator under the safety case regulatory regime would have the ability to require BP to do just that to reduce risks to ALARP.

The OSHA PSM standard includes requirements for two of its 14 elements – mechanical integrity and process safety information (PSI) – to comply with recognized and generally accepted good engineering practices, or RAGAGEP.143 RAGAGEPs are technologically focused, with no emphasis on

139 29 CFR §1910.119(l)(1) (1992). 140 Id at (l)(2)(i) and (ii) (1992). 141 To learn more about the PHA and MOC processes relating to the BP Texas City Refinery, see the CSB BP Texas City Final Investigation Report at http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 24. 2013). 142 See CSB Urgent Trailer Siting Recommendations at http://www.csb.gov/assets/1/19/BP_Recs_2.pdf (accessed October 24. 2013). 143 RAGAGEPs “are engineering, operation, or maintenance activities based on established codes, standards, published technical reports or recommended practices (RP) or a similar document. RAGAGEPs detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a

Chevron Richmond Refinery Regulatory Report May 2014

33

organizational, human factors, or culture-based measures. OSHA developed the mechanical integrity RAGAGEP requirement to “make sure that process equipment is inspected and tested properly, and that the inspections and tests are performed in accordance with appropriate codes and standards.”144 OSHA has recognized a number of practices, guidelines, and standards as RAGAGEPs, including the American Society of Civil Engineers, Design of Blast Resistant Buildings in Petrochemical Facilities, the Department of Defense, TMS-1300 Structures to Resist the Effects of Accidental Explosions, and the American Petroleum Institute (API) Recommended Practice (RP) 520: Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries.145 Unlike other regulators such as the HSE, OSHA has not compiled a comprehensive list of good practices, or RAGAGEPs, for companies to utilize during operations, and the CSB has only identified two OSHA Letters of Interpretation regarding implementation of RAGAGEP in PSM. According to CCPS, “[o]rganizations lack a thorough understanding of recognized and generally accepted good engineering practices and are inconsistent in interpreting and applying them.”146 In addition, key PSM elements such as PHA, incident investigation, and MOC do not reference RAGAGEP, and have not kept up to date with good practice guidelines, including CCPS’ Guidelines for Risk Based Process Safety, which addresses 20 PSM elements for process safety, including human factors, workforce involvement, and safety culture.

Historically, OSHA has primarily enforced147 RAGAGEP reactively, and may cite companies for violations of RAGAGEPs following an incident. For example, following the BP Texas City Refinery incident, OSHA issued BP hundreds of citations, some of which covered BP’s willful violations of API 520 and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, both considered by OSHA to be RAGAGEPs. Following the Chevron incident, California’s Division of Occupational Safety and Health (Cal/OSHA) issued Chevron two willful citations for allegedly not complying with API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries and Chevron’s own internal corrosion mitigation plan as RAGAGEPs (this will be discussed in greater detail in Section 5.1.2.2).

1. 2.2.3.2 U.S. Environmental Protection Agency Risk Management Program

Section 301(r) of the CAAA called for EPA to develop regulations related to the prevention and detection of accidental releases for regulated substances, including requiring owners or operators of stationary sources that have regulated substances present to prepare and implement a “risk management plan to

vessel, inspecting a storage tank, or servicing a relief valve.” OSHA Instruction CPL 03-00-004. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed August 13, 2013). 144 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals, Section 3, Title III. Summary and Explanation of the Final Rule, 1992. Available at http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 6, 2013). 145 All three are cited in OSHA Letter of Interpretation. Applicability of the PSM standard’s mechanical integrity requirements to refinery structures, February 1, 2010. http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=27443 (accessed June 6, 2013). 146 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 147 An exception to this would be OSHA’s NEP that was implemented from 2007 to 2011, where OSHA inspectors cited to RAGAGEP following NEP audits.

Chevron Richmond Refinery Regulatory Report May 2014

34

detect and prevent or minimize accidental releases of such substances from the stationary source.…”148 The risk management plan would require a “hazard assessment to assess the potential effects of an accidental release of any regulated substance.”149 In 1996, EPA promulgated the Risk Management Program regulations at 40 CFR Part 68, which went into effect in 1999.

The EPA’s Risk Management Program requires facilities that contain more than the threshold quantity of any of the 77 listed toxic chemicals or 63 flammable substances150 to prepare and submit to the regulating agency emergency contact information, descriptions of processes and hazardous chemicals onsite, an accident history, and worst-case release scenarios.151 The regulation defines three different Program levels (Program 1, 2, or 3) based on a process unit’s potential for impact to the public and the requirements to prevent accidents.152 Program 3 processes are subject to additional, more stringent requirements to prevent accidents similar to those of the OSHA PSM standard. Program 3 facilities must implement elements of a prevention program, including: process safety information (PSI), PHA, standard operating procedures (SOPs), training, mechanical integrity, compliance audits, incident investigations, MOC, pre-startup reviews, employee participation, and hot work permits. These prevention program elements are based primarily on the OSHA PSM standard, and much of the language contained in each element is identical to the PSM standard. As such, the Risk Management Program regulations contain the same RAGAGEP requirements for mechanical integrity and PSI as the OSHA PSM standard for covered facilities. For example, 40 CFR §68.48 requires an owner or operator to “ensure that the process is designed in compliance with recognized and generally accepted good engineering practices [RAGAGEP].”153 Like OSHA, the EPA is able to cite facilities for failure to comply with RAGAGEP following an incident, but does not maintain a list of RAGAGEPs for reference.

Finally, each covered facility must submit a risk management plan (RMP) to EPA for all covered processes154 and update and resubmit these plans at least once every five years, or whenever a major accident occurs or the emergency contact information changes. Completing and submitting the RMP satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed by the EPA, rendering this another activity-based requirement for a covered facility. There is no approval of the RMP by the EPA, and there is no additional duty on the facility to implement what it says it is doing in the RMP, unlike the safety case regulatory regime.

Any facility with one or more covered processes must include in its RMP an executive summary; the registration for the facility; the certification statement; a worst-case scenario for each process involving flammables or toxics; the five-year accident history for each process; information concerning emergency

148 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 149 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii)(I). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 150According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements of this part no later than the latest of the following dates…” 151 See 40 CFR §68.12. General Requirements. 152 See 40 CFR §68.10. Applicability. 153 40 CFR §68.48(b) (1999). Additionally see 40 CFR §68.56 (d) which requires the owner or operator‘s inspection and testing procedures to “follow recognized and generally accepted good engineering practices.” 154 40 CFR §68.150 (1999).

Chevron Richmond Refinery Regulatory Report May 2014

35

response at the facility; at least one alternative release scenario analysis for each regulated toxic substance or flammable; a summary of the prevention program for each Program 2 process; and a summary of the prevention program for each Program 3 process.155

The CSB found in its BP Texas City Investigation Report that as of March 2007, the RMP regulation had focused primarily on reviewing the submitted RMPs and required updates by covered facilities. The EPA Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk156 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.157 The EPA OIG also noted that of the 296 uninspected high-risk facilities regulated by the EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.158

1. 2.2.3.3 Safety Case in the United States

In contrast to its mainly activity-based regulation of hazardous chemicals, including oil and gas operations, the US has adopted a more goal-based regulatory approach for its nuclear and aeronautics and space science sectors. The U.S. Nuclear Regulatory Commission (NRC) was an early adopter of goal or performance-based regulation, which it defines as “[a] regulatory approach that focuses on desired, measureable outcomes, rather than prescriptive processes, techniques, or procedures…[and] leads to defined results without specific direction regarding how those results are to be obtained.”159 According to the NRC, performance-based regulations permit licensees to “have flexibility to determine how to meet the established performance criteria in ways that encourage and reward improved outcomes.”160 The NRC’s Reactor Oversight Process, the means by which it achieves its mission of public health and safety in commercial nuclear power plant operations, is its primary

155 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 156 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 157 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 158 Ibid. 159 See NRC Glossary, available at http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-based- regulation.html (accessed June 10, 2013). 160 US NRC NUREG/BR-0303. Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

36

performance-based regulation.161 It uses seven “cornerstones,” such as mitigating systems and barrier integrity, to monitor three performance areas (reactor safety, radiation safety, and security safeguards).162 Licensee performance data, inspection plans, quarterly assessments, and assessment and inspection responses are tied to each performance area and several cross-cutting objectives, such as worker involvement and human performance.163 Licensees are permitted to choose the precise methods they use to meet overarching performance goals, which are guided by their duty to reduce risks to as low as reasonably achievable, or ALARA.164,165 The NRC has stated that this flexibility is one of the main reasons that its regulatory philosophy encourages continuous improvement.166

The National Aeronautics and Space Administration (NASA) has the goal of implementing a safety system that is “as safe as reasonably practicable,” or ASARP,167 which it considers to be closely related to ALARP. NASA relies on a risk-informed safety case, or RISC,168 to ensure that the system’s safety objectives, goals, and thresholds have been achieved, and that safety risk is as low as possible within reasonable impacts on cost, schedule, and performance.169

161 http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html#example (accessed June 13, 2013). 162 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 163 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 164 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 165 ALARA “means making every reasonable effort to maintain exposures to radiation as far below the dose limits in this part as is practical consistent with the purpose for which the licensed activity is undertaken, taking into account the state of technology, the economics of improvements in relation to state of technology, the economics of improvements in relation to benefits to the public health and safety, and other societal and socioeconomic considerations, and in relation to utilization of nuclear energy and licensed materials in the public interest.” 10 CFR §20.1003 (2007). 166 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/reading- rm/doc-collections/nuregs/brochures/br0303/br0303.pdf 167 NASA defines ASARP as “a fundamental principle of adequate safety. A determination that a system is ASARP entails weighing its safety performance against the sacrifice needed to further improve it. The system is ASARP if an incremental improvement in safety would require a disproportionate deterioration of system performance in other areas.” NASA/SP-2010-580, NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts for Implementation; November 2011; p 5. http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20120003291_2012003429.pdf (accessed June 10, 2013). 168 NASA defines RISC as “a structured argument, supported by a body of evidence that provides a compelling, comprehensive and valid case that a system is or will be adequately safe for a given application in a given environment. This is accomplished by addressing each of the operational safety objectives that have been negotiated for the system, including articulation of a roadmap for the achievement of safety objectives that are applicable to later phases of the system life cycle. The term ‘risk-informed’ is used to emphasize that a determination of adequate safety is the result of a deliberative decision making process that necessarily entails an assessment of risks and tries to achieve a balance between the system’s safety performance and its performance in other areas.” Ibid at 13. 169 Ibid at xiii.

Chevron Richmond Refinery Regulatory Report May 2014

37

1. 0 Key Features of an Effective Safety Case Regulatory Regime

Following the Macondo disaster, the National Commission on the Macondo Oil Spill and Offshore Drilling170 made a recommendation in its Report to the President171 for the US to “develop a proactive, risk-based performance approach specific to individual facilities, operations and environments, similar to the ‘safety case’ approach in North Sea.”172 Despite the major potential hazards that are present in both onshore and offshore oil and gas operations, the safety case regime has not been implemented in the US for either sector. The US has instead implemented for major hazards at onshore facilities a more activity- based approach, resulting in static regulations such as the PSM and RMP regulations that have not seen significant improvements173 since their inception, despite advances in technology and good industry practice. According to Dr. Hopkins and other renowned experts in the field, it is essential for an effective major accident prevention safety regime to take the form of a safety case, with adaptable goal-setting regulations that facilitate innovation and sustainability, and that drive industry to continuously improve and reduce risks to ALARP. To accomplish this, the regime must utilize sufficient numbers of highly competent personnel to effectively collect or promote industry use of process safety indicators174 and to provide knowledgeable oversight of industry operations. The CSB has determined that there are several key features of an effective major accident prevention regulatory approach such as the safety case regime:  Duty Holder Safety Responsibility, including a Written Case for Safety  Continuous Risk Reduction to ALARP  Adaptability and Continuous Improvement  Active Workforce Participation  Process Safety Indicators that Drive Performance  Regulatory Assessment, Verification, and Intervention; and an  Independent, Competent, Well-Funded Regulator As will be discussed in Section 5, California’s patchwork of regulations does not effectively implement these features, which are also illustrated in the figure below. Section 4 provides a detailed discussion of these features.

170 President Barack Obama established the National Commission on the BP Macondo Oil Spill and Offshore Drilling through Executive Order 13543 on May 21, 2010, to examine the facts and circumstances concerning the root causes of the Macondo explosion and fire. For more information see http://www.oilspillcommission.gov/page/about-commission (accessed June 17, 2013). 171 Available at http://www.oilspillcommission.gov/final-report (accessed June 17, 2013). 172 National Commission on the BP Macondo Oil Spill and Offshore Drilling. Report to the President: Deep Water, The Gulf Oil Disaster and the Future of Offshore Drilling; January 2011; 252. 173 OSHA did implement changes to 29 CFR §1910.106, creating a new Hazard Communication Standard. However, no changes have been made that impact the management of process safety under PSM. See https://www.osha.gov/dsg/hazcom/ (accessed August 6, 2013). 174 Process safety indicators are also referred to as performance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc.

Chevron Richmond Refinery Regulatory Report May 2014

38

Figure 1. Safety Case Attributes. 4.1 Duty Holder Safety Responsibility, including a Written Case for Safety Under the safety case regulatory regime, each individual company is responsible for the safety of each hazardous facility. The onus is on the duty holder175 to prove to the regulator that the company’s processes, methodologies used to assess risks, and reasoning for choosing one control over another have substantially reduced risks to as low as reasonably practicable (ALARP), or equivalent. The duty holder

175 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). These entities may include operators, contractors, and subcontractors. According to NOPSEMA, the idea is that those who create the risk must manage it. See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July15, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

39

is required to prepare a written case for safety176 (“safety case report”) that identifies the hazards and risks and describes how they will be reduced to ALARP. The HSE has noted that the safety case report “demonstrates that the duty holder has arrangements in place which, if implemented, are capable of achieving compliance with legal objectives set out in other [] regulations…[and] provides a comprehensive core document that can be used as a check by both the duty holder and HSE that the accepted risk control measures and the health and safety management systems are in place and operate as they should.”177 The HSE has also stated: [t]he principal matters to be demonstrated in a safety case are that: a) the management system is adequate to ensure compliance with statutory health and safety requirements; and for management of arrangements with contractors and sub-contractors, b) that adequate arrangements have been made for audit and for audit reporting, [and] c) that all hazards with the potential to cause a major accident have been identified, their risks evaluated, and measures have been, or will be, taken to control those risks to ensure that the relevant statutory provisions will be complied with.178 The safety case report must also demonstrate “how inherently safer design concepts have been applied in the design decisions taken.”179 This principle applies to all stages of the installation’s life cycle, and includes materials selection and managing corrosion in the design. It is also important to note that safety case reports are meant to be evergreen documents that reflect continuous improvement in risk reduction. For onshore operations in the UK, the duty holder is required to review the safety case report during the construction of a new facility, whenever new facts or technical knowledge about safety matters become known, or whenever the operator makes a change to the safety management system that could have significant impacts on the prevention of major accidents.180 The duty holder must revise the safety report to ensure that it “remains up to date and continues to provide an accurate representation of the major accident hazards…and the

176 The HSE defines “safety case” as “a document that gives confidence to both the duty holder and HSE that the duty holder has the ability and means to control major accident risks effectively. It provides an extra level of regulatory control on top of regulations such as the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 (PFEER) and the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR), justified by the major accident potential of the offshore activities within scope.” HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 6. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed January 13, 2014). 177 Ibid at 6. 178 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 179 Ibid at 16. 180 COMAH Regulations, Part 3, Regulation 8 (1) (a)(b) and (c) (1999).

Chevron Richmond Refinery Regulatory Report May 2014

40

measures in place to control them.”181 According to HSE guidance on the offshore Safety Case Regulations, safety case reports are “intended to be living documents, kept up to date and revised as necessary during the operational life of the installation.”182 In order for the facility to begin operation or remain in operation, the regulator must “accept” 183 the facility’s safety case report; however, the regulator’s acceptance of a safety case does not license the facility or installation as “fit,”184 nor does it shift the duty of risk control and reduction away from the facility owner or operator and onto the regulator; rather, the duty of major accident prevention and risk reduction to ALARP remains with the duty holder throughout the life of the facility. Following the regulator’s acceptance of the safety case report, the duty holder must ensure that the installation is operated in conformity with the management system and other provisions described in the safety case.185 In the US, facilities commence operation before they are inspected or evaluated for complying with PSM or RMP regulations. In fact, the CSB has investigated incidents where the employer disputed that its process was covered by the PSM standard or RMP regulations. Regulators do not evaluate and approve PHAs or other hazard reviews and do not have the authority to license specific facilities for operation, based on the adequacy of their process safety programs. If an operating facility contains processes covered by the PSM standard, the facility must complete primarily activity-based regulatory requirements at least once every five years. The employer has no general duty to continually reduce risk. RMP- covered facilities must submit fairly high-level information exhibiting compliance with RMP requirements at least once every five years. While the regulator ensures the RMP has been filed and contains the required sections, there is no analysis of the effectiveness of controls identified in the RMP to mitigate hazards. 4.2 Continuous Risk Reduction to ALARP As discussed above, a majority of the safety case regimes implemented globally impose a duty on owners or operators of covered facilities on and offshore to reduce risks to ALARP or equivalent. The Center for Chemical Process Safety (CCPS) defines ALARP as “a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.”186 This principle provides the regulator with the main foundation on

181 The Competent Authority. Revised guidance for operators of top tier COMAH establishments. Review and revision of COMAH safety reports. December 2009; p 5. http://www.hse.gov.uk/comah/report-review.pdf (accessed November 26, 2013). 182 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

183 “Acceptance requires satisfaction with the duty holder’s approach to identifying and meeting health and safety needs…HSE ‘accepts’ the validity of the described approach as being capable, if implemented as described, of achieving the necessary degree of risk control, but HSE does not confirm the outcomes of that approach.” Therefore, “HSE will accept a safety case or a revision…when duty holders demonstrate and describe specified matters to HSE’s satisfaction. Acceptance will be based on HSE’s judgment that the arrangements and measures described in the safety case taken as a whole are likely to achieve compliance if implemented as described. To give acceptance HSE does not need to be satisfied that compliance will be achieved.…” Ibid at 6. 184 TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996; p 8. 185 Ibid at 7. 186 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., 2009; p 46.

Chevron Richmond Refinery Regulatory Report May 2014

41

which to accept or reject a safety case report. In essence, the regulator ultimately determines whether ALARP has been achieved through the authority to accept or reject the safety case report. An advantage of ALARP as opposed to a prescriptive or activity-based approach is that ALARP results in the continuous reduction of risk to keep up-to-date with advancing technology and industry best practices.187 Although two of the 14 PSM elements (PHA and mechanical integrity) contain performance-based or goal-setting requirements, 188 the PSM standard does not provide a specific risk reduction target such as ALARP. In reviewing the safety case report, the regulator may accept the application of relevant good practice as a sufficient demonstration of ALARP.189 As the HSE notes, “the measures in place to prevent or limit major accidents should be described in the safety report and be at least to ‘relevant good practice.’”190 According to Dr. Hopkins, the duty of ALARP “provides leverage for the regulator…[i]f an operator wishes to adopt a procedure or a standard that falls short of good or best practice, the regulator can reject it on the grounds that it does not reduce the risk as low as reasonably practicable.”191 As noted above, regulators such as HSE provide guidance on what is considered good practice, and publish documents containing good practice standards to assist operators with applying this concept. However, the duty holder must make the case for the standard or practice being utilized, and the regulator may determine that applying good practice alone is not sufficient to demonstrate that risks have been reduced to ALARP. In addition, if there is no directly applicable rule or standard, operators still have a duty to manage risk, and they therefore must maintain a reasonable level of risk awareness that goes beyond mere compliance.192 This raises a safety case regime above the compliance mentality of a more activity-based regime, such as PSM, and requires the duty-holder and the regulator to continuously ask whether there are other measures that would be effective in further reducing risks. The UK HSE provides ample guidance on determining what is considered to be ALARP, and many British courts have interpreted the concept as well. In the 1949 case Edwards v. National Coal Board, decided by the Court of Appeal, Judge Asquith wrote: ‘Reasonably practicable’ is a narrower term than ‘physically possible’ and seems to me to imply that a computation must be made by the

187 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed December 9, 2013). 188 29 CFR §1910.119(e)(1) requires the employer to “identify, evaluate, and control the hazards involved in the process.” 29 CFR §1910.119(j)(5) states that “[t]he employer shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in paragraph (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.” 189 HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013). 190HSE. Guidance on ALARP Decisions in COMAH. http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed November 26, 2013). 191 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 192 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6.

Chevron Richmond Refinery Regulatory Report May 2014

42

owner, in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other; and that if it be shown that there is a gross disproportion between them – the risk being insignificant in relation to the sacrifice – the defendants discharge the onus on them.193 While some critics in the US have argued that the determination of ALARP is strictly a quantitative risk assessment (QRA) calculation that is not sufficiently protective, the CSB has found that the HSE allows reliance upon qualitative assessments, QRA, and semi-quantitative risk assessments to determine ALARP.194 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”195 and “[i]dentification of possible further measures that could be applied to lower the risk.”196 The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”197 In Norway, the PSA requires companies to “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations occur.”198 PSA regulations require companies to choose the solutions that offer the best results, provided the costs are not significantly disproportionate to the risk reduction achieved.199 In Australia, the NOPSEMA enforces the Offshore Petroleum and Greenhouse Gas Storage Act 2006 and its regulations, which imposes a duty of care on the operator of a facility to “take all reasonably practicable steps” to ensure the facility is safe and all work and other activities are “carried out in a manner that is safe and

193 Edwards, [1949] 1 K.B. at 704. 194 Center for Chemical Process Safety (CCPS) guidance on risk assessment implies that as the predicted consequence of potential hazard scenarios increases, the level of analytical detail should also increase. Risk assessment approaches range in order of increasing analytical detail from qualitative, to semi-quantitative, to quantitative. Qualitative risk assessment is the simplest approach where judgments about consequence, likelihood, and the tolerability of risk are made on a subjective basis using the knowledge and experience of team members and may not be consistently applied within an organization. Semi-quantitative risk assessment is the second level of analytical detail, where organizations develop and provide to team members predetermined risk matrices and guidance for establishing numerical consequence and frequency levels. This approach is of greater value to team members as based upon their collective experience; the team typically has a sense of how frequently an event might occur and how great the potential consequence may be within the predetermined ranges. Layer of protection analysis (LOPA) is a semi-quantitative form of risk assessment, using order of magnitude categories for evaluating frequency, consequence, and adequacy of safeguards. Quantitative risk assessment involves the highest level of analytical detail and typically involves specialized expertise to perform. Complex models are commonly developed to evaluate frequency, consequence, and the effectiveness of safeguards in a quantitative risk assessment. Such approaches are typically standardized to minimize result variability within an organization and even between organizations in countries where a quantitative risk assessment is mandated by regulatory authorities. Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009. 195 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 196 Ibid at 8. 197 Ibid at 8. 198 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations). Section 11, Risk Reduction Principles. http://www.ptil.no/framework- hse/category403.html (accessed November 26, 2013). 199 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

43

without risk to the health of any person at or near the facility.”200 NOPSEMA explains that to achieve ALARP, the company “has to show, through reasoned and supported arguments, that there are no other practical measures that could reasonably be taken to reduce risks further.”201 In the US, the NRC has “gradually revised its original scheme, giving an increasing importance to the ‘economic and social factors’, in particular the involvement of all ‘stakeholders’ (authorities, management, staff, public) in the ALARA process.”202 For the regulator, the focus for whether ALARA has been achieved is on “processes, procedures, and judgments.”203 The duty holder must ensure that choices made to achieve ALARA are “fully documented together with the criteria which have brought to those choices. When the criteria are qualitative, it is more likely that subjective judgments play a large role, but those judgments must be equally recorded.”204 There is no corresponding duty to reduce risks to ALARP in the PSM standard or RMP program. Rather, these regulations require that facilities “control” identified hazards, with no further dialogue on how far the operator must go to control those hazards. Neither the facility nor the regulator is required to determine whether more could be done to control hazards or reduce risks to comply with these regulations, and this may result in the implementation of insufficient controls relating to a hazard. While OSHA and the EPA do rely on general duty standards when implementing the PSM standard and the RMP program, these duties do not drive onshore companies toward reducing the risks of their activities to ALARP, and instead are utilized as enforcement tools typically after an incident has occurred, meant to cover those activities not specifically regulated. These standards may also be used by OSHA or EPA to cite a company for not following a specific RAGAGEP for 2 of the 14 process safety elements - mechanical integrity and PSI. OSHA enforces section 5(a) of the Occupational Safety and Health Act (OSHAct), which states the following:

(a) Each employer – (1) shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees; (2) shall comply with occupational safety and health standards promulgated under this act…205 Section 5(a)(1), also known as OSHA’s General Duty Clause, has been described as a “catch-all” provision meant to fill gaps in OSHA law for recognized unregulated hazards.206,207 In order for OSHA to

200 Offshore Petroleum and Greenhouse Storage Act 2006, Volume 3, Schedule 3, Clause 9. http://www.comlaw.gov.au/Details/C2012C00148/Html/Volume_3#_Toc315688204 (accessed October 30, 2013). 201 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 202 Fasso, Alberto, and Rokni, S. Operational Radiation Protection in High Energy Physics Accelerators. Implementation of ALARA in Design and Operation of Accelerators. May 2009; p 6.

203 Ibid at 6. 204 Ibid at 6 and 7. 205 29 U.S.C. §654(a)(1) and (2) (2004). 206 Morrison, Kyle W. The General Duty Clause: What is it, how does OSHA use it and what should employers know? Safety + Health [Online]; May 1, 2011.

Chevron Richmond Refinery Regulatory Report May 2014

44

issue a General Duty Clause violation, the hazard must be recognized, the employer must have failed to keep the workplace free of the hazard to which his or her employees were exposed, a practical method must be available to correct the hazard, and the hazard must be causing or likely to cause death or serious injury.208 This duty would thus only apply if the absence or failure of one control in a series of controls makes an accident likely to occur (emphasis added). On the other hand, in a safety case regulatory regime, the regulator proactively reviews identified hazards and risk reduction strategies proposed by the operator to ensure that risks are being reduced to ALARP. The regulator may require the installation of an absent control if such a control is considered good industry practice, or if it goes further in reducing risks to ALARP. This is a key feature of the safety case approach in preventing major accidents. Under the CAA, the General Duty Clause requires owners and operators “to identify hazards which may result from such releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.”209 Similar to OSHA, the EPA can use its General Duty Clause enforcement authority to create legally binding requirements or enforce actions for hazards that have not been specifically regulated. The EPA can use this authority proactively (before an incident) or reactively (following an incident), and can enforce the clause where it finds the possibility of imminent and substantial endangerment.210 According to EPA guidance on the RMP program, because it is the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” this may require steps to be taken “beyond those specified in the risk management program rule.”211 While this principle appears to be similar to ALARP requirements of the safety case, in practice whether this is done is not subject to regulation or review. In addition, it is permissive in that it uses the word “may.” Nothing additional, such as ALARP, is required. This will be addressed below in more detail in the discussion of implementation of the EPA RMP program in California. 4.3 Adaptability and Continuous Improvement A key strength of the safety case regulatory regime is that it provides the regulator with the tools to drive continuous improvement among facilities and ensure risks have been reduced to ALARP or equivalent, rather than focusing on compliance with activity-based regulatory requirements. Although complying with good practice may achieve ALARP, the regulator also has the ability under this regime to require facilities to go above and beyond good practices and standards to achieve ALARP without requiring

http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 207 According to the National Safety Council, General Duty Clause violations make up only about 1.5 percent of total violations issued annually by OSHA. Available at http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013). 208 Ibid. 209 42 U.S.C. §7412(r)(1) (1990). 210 42 U.S.C. §7412(r)(9) (1990). 211 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

45

rulemaking. The Baker Panel212 noted in its 2007 report (“the Baker Report”) on BP and its process safety performance following the 2005 BP Texas City disaster that an effective process safety management system builds upon an “improvement cycle” that “should include, in practice, continuous reduction of process risk and improvements in safety performance according to some measurable criteria.”213 The Baker Panel defined “continuous improvement” as  improving controls for process hazards, including process safety knowledge and competence of workers;   improving process safety leadership of supervisors;   improving process engineering to identify and then design to remove or mitigate the effects of process hazards;   going beyond legal compliance to best practices to reduce risks;   going beyond mere compliance with internal standards, but learning from operating experiences, incident and near miss investigations, hazard studies, audits, and other assessments to improve those internal standards; and   identifying and implementing not only those external standards that must be observed, but also those that represent best practices that can lead to process safety excellence.214  An independent review conducted of the Australian offshore safety case regime in 2000 echoes the importance of continuous improvement in process safety management, stating that “critical to the successful implementation of a safety case regime is the achievement of a qualitative shift in industry and regulatory safety cultures from the minimalist compliance of the prescriptive regime to the philosophy of best practice and continuous improvement.”215 Recently, Lord Cullen addressed the importance of adaptability as well, when he spoke at the 2013 Oil & Gas UK Piper 25 offshore safety conference in Aberdeen, Scotland.216 In his keynote speech, Lord Cullen quoted the Maitland panel, which examined the UK offshore safety regime after the Macondo incident, noting that “safety cases should be living documents [emphasis added] central to the way facilities are operated, with contents widely understood.”217

212 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013). 213 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 214 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 215 Department of Industry, Science and Resources; Offshore Safety and Security, Petroleum and Electricity Division. Australian Offshore Petroleum Safety Case Review: Report of the Independent Review Team. 2000; p 33. 216 In June 2013, Oil & Gas UK held a large offshore safety conference in Aberdeen, which marked the 25th anniversary of the Piper Alpha disaster. For more information see http://www.oilandgasuk.co.uk/events/Piper25.cfm?frmAlias=/Piper25/ (accessed September 16, 2013). 217 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

46

As changes to regulatory requirements necessitate an extensive, lengthy rulemaking process in the US,218 process safety-related regulations can remain static for decades, while industry standards (many of which are voluntary under the current US system), technologies, and improved procedures and practices continue to change and advance, and new chemicals come into production. In light of major accidents that have occurred, such as the BP Texas City explosion and fire which resulted in 15 fatalities, and the Motiva Enterprises sulfuric acid tank explosion, which fatally injured one worker and injured eight others, the CSB has made a number of key recommendations to OSHA and the EPA to revise the PSM and RMP regulations, respectively. However, agencies have failed to implement these recommendations and these regulations have remained static despite the important lessons learned from these incidents. In addition, the OSHA PSM standard’s Appendix A, which contains a list of toxic and reactive highly hazardous chemicals and the threshold quantity for each, was originally created using a number of older sources, including the EPA’s “Extremely Hazardous Substance List,” the 1982 Seveso Directive, the 1984 CIMAH regulations, and others. A number of these sources have been revised, updated, and amended throughout the years, while Appendix A has not. In fact, no chemicals have been added to either the PSM or the RMP programs since the rules were initially adopted in the 1990s, even as numerous serious process incidents have occurred involving chemicals that were not listed. The U.S. Government Accountability Office (GAO) published a 2012 report on OSHA’s standard setting abilities, and noted that between 1981 and 2010, OSHA took anywhere from 15 months to 19 years to develop and issue 58 significant safety and health standards (averaging seven years).219 According to the report, OSHA reasoned that it must evaluate technological and economic feasibility of a potential standard using data gathered by visiting worksites in industries that will be affected, on an industry-by- industry basis.220 This was described as “an enormous undertaking because, for example, it requires visits to multiple worksites.”221 In addition, Executive Order 12866222 requires that federal agencies, including OSHA, provide an assessment of the potential overall costs and benefits for significant rules to the Office of Management and Budget (OMB). OSHA will typically be required under the Small Business Regulatory Enforcement Fairness Act of 1996223 to initiate a panel process to receive and consider input

218 5 U.S.C. Chapter 5, sections 511-599, also known as the Administrative Procedure Act, or APA, requires that federal agencies seeking to promulgate a rule or regulation submit to a lengthy notice and comment rulemaking process that includes publishing the proposed rule making in the Federal Register; providing the public with at least 30 days to participate in the rulemaking process by submitting written comments or data, and then discussing the public comments and providing a rationale for accepting or rejecting them. The OSHAct Section 6(b) specifies the procedures OSHA must use to promulgate, modify, or revoke its standards (29 U.S.C. §655(b)). These procedures include publishing the proposed rule in the Federal Register, providing interested persons an opportunity comment, and holding a public hearing upon request. 219 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

220 Ibid at 6. The Supreme Court has held that the OSHAct requires that standards be both technologically and economically feasible. Am. Textile Mfrs. Inst. V. Donovan, 452 U.S. 490, 513 n. 31 (1981). Also see United Steelworkers v. Marshall, 647 F. 2d 1189, 1301 (D.C. Cir. 1980), quoted in AFL-CIO v. OSHA, 955 F. 2d 962, 980 (11th Cir. 1992). Assessing feasibility on an industry-by-industry basis requires that the agency research all applications of the hazard being regulated, as well as the expected cost for mitigating exposure to that hazard, in every industry. 221 Ibid at 6. 222 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.whitehouse.gov/sites/default/files/omb/inforeg/eo12866/eo12866_10041993.pdf (accessed June 12, 2013). 223 5 U.S.C. §609(b), (d) (1996).

Chevron Richmond Refinery Regulatory Report May 2014

47

from representatives of affected small businesses, which could take eight months or more.224 Only OSHA, the EPA, and the Consumer Financial Protection Bureau are subject to this requirement.225 Finally, the OSHAct directs courts to review OSHA’s standards using a more stringent legal standard than the Administrative Procedure Act’s (APA’s) “arbitrary and capricious” test226 when reviewing OSHA’s standards;227 an OSHA standard may only be upheld if it is supported by “substantial evidence in the record considered as a whole.”228 According to the GAO report, OSHA officials claim this more stringent standard (known as the “substantial evidence” standard) requires a higher level of scrutiny by the courts and as a result, OSHA staff must conduct a large volume of detailed research in order to understand all industrial processes involved in the hazard being regulated, and to ensure that a given hazard control would be feasible for each process.229 The GAO also found that although OSHA has the ability to address urgent hazards by issuing emergency temporary standards, the agency has not used this authority since 1983 because of the difficult hurdles the agency faces in presenting the evidence necessary to meet the statutory requirements.230 In summary, all of these extensive rulemaking constraints have resulted in OSHA’s inability to undertake many standard revisions or improvements. In Spring 2013, OSHA announced its new regulatory agenda, which stated that one of the things OSHA plans to consider is revising the PSM standard to “address gaps in safety coverage.”231 Potential revisions include “expanding coverage and requirements for reactivity hazards,” which the CSB addressed in its 2002 report entitled “Improving Reactive Hazard Management,”232 and “expanding the scope of

224 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

225 5 U.S.C. §609(d) (1996). 226 Pursuant to the APA, agency decisions may be set aside only if “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. §706(2)(A). There is abundant case law that discusses this standard. Courts have held that a court “may reverse under the arbitrary and capricious standard only if the agency has relied on factors that Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise. See Greater Yellowstone Coalition v. Lewis, 638 F. 3d 1143, 1148 (9th Cir. 2010) (as amended) (relaying on The Lands Council v. McNair, 537 F.3d 981, 987 (9th Cir. 2008) (en banc), overruled on other grounds by Winter v. Natural Res. Def. Council, 555 U.S. 7 (2008)). 227 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

228 29 U.S.C. §655(f). 229 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

230 OSHA must demonstrate that workers are exposed to grave danger and establish that an emergency temporary standard is necessary to protect workers from that grave danger. OSHA is also required to replace an emergency temporary standard with a permanent standard within six months using the requirements laid out in OSHAct 6(b). Ibid at 11. 231 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 232 In this report, the CSB recommended to OSHA that it amend the PSM standard “to achieve more comprehensive control of reactive hazards that could have catastrophic consequences.” The report is available at http://www.csb.gov/assets/1/19/ReactiveHazardInvestigationReport.pdf (accessed September 17, 2013). The recommendations start on page 89 of the report.

Chevron Richmond Refinery Regulatory Report May 2014

48

paragraph (j) to cover the mechanical integrity of any safety-critical equipment.…”233 However, OSHA has proposed changes to the PSM standard before, with no action ultimately being taken. On April 27, 1998, OSHA announced that it was considering issuing an Advance Notice of Proposed Rulemaking234 (ANPRM) “to address issues related to reactive chemicals raised by the explosion of a chemical plant in Lodi, New Jersey in 1995.”235,236 On May 14, 2001, OSHA clarified its intent to publish an ANPRM “to address the need to add reactive chemicals that are not currently covered by PSM…”237 On December 3, 2001, however, the entry on reactives was withdrawn from the rulemaking agenda.238 Following the devastating ammonium nitrate explosion on April 17, 2013, in West, Texas, which resulted in at least 14 fatalities and mass destruction in the town of West, CSB Chairperson Moure-Eraso urged both OSHA and the EPA to expand their standards to include reactive chemicals and hazards such as ammonium nitrate.239 On July 25, 2013, the CSB held a public meeting in Washington, DC to discuss the status of key open recommendations the CSB has made to OSHA over the last decade to revise its PSM standard and create a new combustible dust standard. These recommendations, which include revising the PSM standard to require MOC reviews for organizational changes such as mergers and acquisitions that may impact process safety, and ensuring PSM coverage for atmospheric storage tanks that could be involved in a potential catastrophic release, have stemmed from major CSB investigations including its BP Texas City, Motiva, ConAgra, Kleen, Imperial Sugar, and Hoeganaes investigations, as well as its Combustible Dust Study.240 OSHA’s failure to implement these recommendations, which can be attributed to its lack of rulemaking activities over the last decade, led the CSB to reclassify seven key open recommendations as “Open-Unacceptable.” The CSB also adopted the OSHA Combustible Dust Standard recommendation as a CSB “Most Wanted Chemical Safety Improvement.” OSHA formally responded and cited to the GAO report discussed above, noting that on average, it takes OSHA seven years to issue a standard, a process

233 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013). 234 Most federal agencies develop rules through “informal rulemaking.” Under the Administrative Procedure Act, or APA, informal rulemaking requires a publication of a “Notice of Proposed Rulemaking” (NPRM) in the Federal Register; opportunity for public participation by submission of written comments; consideration by the agency of the public comments and other relevant material; and publication of a final rule not less than 30 days before its effective date, with a statement explaining the purpose of the rule. Under the APA, an agency may publish an Advance Notice of Proposed Rulemaking (ANPRM) when the agency wants to test out a proposal or solicit ideas before it drafts its NPRM. For more information see http://www.foreffectivegov.org/node/226 (accessed September 17, 2013). 235 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13792 (accessed September 17, 2013). 236 This incident took place on Friday, April 21, 1995, at a chemical facility occupied by Napp Technologies. The explosion and fire resulted in five fatalities. 237 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16776 (accessed September 17, 2013). 238 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed September 17, 2013). 239 In a 2002 study entitled Improving Reactive Hazard Management, the CSB made recommendations to OSHA and the EPA to expand their regulations to include reactive chemicals and hazards. To date, neither agency has acted on the recommendations. See http://www.csb.gov/in-safety-message-csb-chairperson-rafael-moure-eraso- calls-for-regulatory-coverage-of-reactive-chemicals-following-the-west-fertilizer-explosion-and-fire-/ (accessed September 23, 2013). 240 For more information on this meeting, see http://www.csb.gov/events/csb-public-meeting-to-vote-on-key-safety- recommendations-and-initiate-most-wanted-program/ (accessed July 29, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

49

that is only getting longer. Hence, OSHA reserves rulemaking for “widespread and serious hazards.” Needed petroleum refinery and chemical process safety improvements may never fall under this category. OSHA noted at the meeting that it would be utilizing a Request for Information241 (RFI) to aid in the revision of its PSM standard, aimed at addressing a number of issues that have developed in the 21 years since the PSM standard was promulgated in 1992. On December 9, 2013, OSHA published its RFI in the Federal Register.242 The RFI requests comment on potential revisions to OSHA’s PSM standard, among other regulations. The RFI identifies seventeen topics for potential rulemaking and enforcement changes, including clarifying the PSM exemption for atmospheric storage tanks and expanding PSM coverage and requirements for reactive hazards. The RFI also cites a number of CSB investigation reports and recommendations, including the CSB Reactive Hazard Study entitled Improving Reactive Hazard Management, the BP Texas City Investigation Report, and the Donaldson Enterprises, Inc., Investigation Report.243 Although the RFI is an important opportunity to enhance the dialogue on implementation of the safety case regulatory approach to enhance process safety management and risk reduction in the US, it does not specifically mention the safety case approach.244 On January 3, 2014, OSHA released a response to Section 6(a) of Executive Order 13650,245 which tasked the Chemical Facility Safety and Security Working Group, created by the Order and consisting of federal agencies such as OSHA, the EPA, and PHMSA,246 with considering options to improve chemical safety regulation. The document provides separate responses from each member agency of the group, and notes that the group is seeking public input on potential areas where standards could be improved. According to the document, three agencies – OSHA, the EPA, and PHMSA – have all included “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce

241 An RFI is a tool used by a federal agency to help develop a proposed rule. Federal agencies generally use RFIs when they want public input on whether a new rule or changes to an existing rule are needed, and comments on what course the agency should take should it decide to move forward. More information available at http://www.dol.gov/regulations/participate.htm (accessed July 29, 2013). 242 78 Fed. Reg. 73756 (2013). 243 A full copy of the OSHA RFI is available at https://www.federalregister.gov/articles/2013/12/09/2013- 29197/process-safety-management-and-prevention-of-major-chemical-accidents (accessed January 7, 2014). 244 OSHA has released on its website a separate document responding to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. OSHA states in this document that it is seeking public input on potential areas where it could improve its standards, and includes “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce risk in complex industrial processes” as an area to consider. https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). However, the safety case regulatory model is not mentioned in the RFI that was released for public comment. 245 This document is available at https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 246 The Chemical Facility Safety and Security Working Group is co-chaired by the Secretary of Homeland Security, the Administrator of the EPA, and the Secretary of Labor. The Working Group must consist of the head or a designated representative of the Department of Justice, Department of Agriculture, and the Department of Transportation. The Working Group must also consult with representatives from the Council on Environmental Quality; the National Security Staff; the Domestic Policy Council; the Office of Science and Technology Policy; the Office of Management and Budget; the White House Office of Cabinet Affairs; and other agencies designated by the President. http://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facility- safety-and-security (accessed January 13, 2014).

Chevron Richmond Refinery Regulatory Report May 2014

50

risk in complex industrial processes” in a preliminary list of options to consider for improving chemical facility and safety.247 OSHA’s ability to adapt to process safety-related new or revised codes, standards, technology, and lessons learned is mainly limited to RAGAGEP requirements, which OSHA included in the mechanical integrity and PSI elements of its PSM standard in part to “provide flexibility for the employer to choose the frequency which would provide the best assurance of equipment integrity.”248 OSHA meant for RAGAGEP to include “both appropriate internal standards and applicable codes and standards.…”249 However, the concept of RAGAGEP only applies to 2 of the 14 PSM standard elements (mechanical integrity and PSI),250 only addresses equipment and mechanical integrity, and is usually utilized by OSHA as a mechanism to issue citations to companies post-incident. In addition, OSHA has had difficulty enforcing RAGAGEP citations. In a recent OSHA Review Commission proceeding, Secretary of Labor v BP Products North America, Inc., & BP-Husky Refining, LLC,251 and United Steelworkers Local 1-346, the Administrative Law Judge (ALJ) vacated OSHA RAGAGEP citations issued to BP for violations of 29 CFR §1910.119(d)(3)(ii)252 for failure to comply with a specific RAGAGEP, holding that OSHA impermissibly adopted a specific RAGAGEP, thereby diminishing the performance aspect of the RAGAGEP requirements contained within the OSHA PSM standard. The ALJ concluded that by citing to only one specific RAGAGEP, OSHA impermissibly adopted a prescriptive standard; in the ALJ’s view, OSHA should have acknowledged other possible RAGAGEPs for BP to comply with, including BP’s own internal standards. If upheld, this ruling may limit OSHA’s ability to utilize RAGAGEP as a means of requiring companies to implement industry good practices in the future.253 The cumbersome rulemaking process and lack of flexibility that has resulted in stagnant and static OSHA standards can be contrasted with the structure of the safety case regulatory regime, which facilitates adaptability and enables the regulator to improve industry safety performance and practices without requiring a major rule change. The safety case essentially provides the regulator with the tools to recognize more rigorous standards and practices that exist and drive a company to implement those practices to further reduce risks, as well as work with industry to improve existing standards and practices if necessary. It also enables companies to implement new, more efficient or safer technologies that do not necessarily meet strict prescriptive regulations, but that drive risk reduction. This adaptability is illustrated by the HSE’s recommendations following the 2004 Buncefield incident. On December 11, 2005, a number of explosions occurred at Buncefield Oil Storage Depot in Hemel Hemptstead, Hertfordshire, England following the overfilling of a gasoline tank. Over 40 people were injured and there was significant offsite damage to homes and businesses. An independently chaired Major Incident Investigation Board led by Lord Newton of Braintree was set up to investigate the incident. Between 2006 and 2008 the Board issued a number of reports and recommendations. In the

247 Ibid. 248 57 Fed. Reg. 6390-6391 (1992). 249 Ibid at 6390-6391. 250 29 CFR §§1910.119(d)(3)(ii) and (j)(4)(ii) and (iii). 251 BP Products North America, Inc. operates a refinery in Oregon, Ohio. BP-Husky is a joint venture with a business interest in the refinery. 252 29 CFR 1910.119(d)(3)(ii) requires the employer to document that equipment complies with RAGAGEP. 253The Occupational Safety and Health Review Commission is scheduled to review the decision.

Chevron Richmond Refinery Regulatory Report May 2014

51

report issued in March 2007 entitled “Recommendations on the design and operation of fuel storage sites,” the Board highlighted the adaptability of the existing regulatory regime by noting that the recommendations to improve standards and revise guidance should not require actual changes to the law, because the existing legal framework was “sufficient to ensure that necessary improvements are put in place.”254 The Board followed by making its first recommendation of the report to the COMAH CA and operators of Buncefield-type sites to develop and agree on a methodology to determine safety integrity level requirements for overfill prevention systems, which takes account of, among other things, nearby resources or populations.255 The Board also recommended that the sector “develop guidance to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs.”256 Another key recommendation was made to the CA to “ensure that safety reports submitted under the COMAH Regulations contain information to demonstrate that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for control and environmental protection engineering systems.”257 Finally, the Board recommended in this report that the “sector agree with the Competent Authority on a system of leading258 and lagging259 performance indicators for process safety performance…” based on HSE’s guidance on Developing process safety indicators.260 Spurred by recommendations made surrounding the Buncefield incident, the BP Texas City incident, and the BP Grangemouth incident,261 the COMAH CA developed an Operational Delivery Guide entitled “COMAH Competent Authority Workstream 2e: Process safety performance indicators,”262 which was “designed to continue the promotion and development of site level process safety performance indicators (PSPIs) as part of the monitoring arrangements for an effective process safety management system at major hazard sites.”263 The guide states that by the end of March 2013 all “Buncefield-type” sites would “have effective monitoring of process safety performance in place and that site specific leading and lagging performance indicators have been developed…”264 and that by the end of 2015 “all major hazard establishments and duty holders will measure their performance on the control of major hazard risks by way of key leading and lagging performance indicators.”265 It lays out in detail a six-step process for implementing a process safety measurement system; how inspectors will assess a duty holder’s

254 Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007; p 3. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013). 255 Ibid at 8. 256 Ibid at 15. 257 Ibid at 19. 258 Leading indicators are measurements that predict future performance to ensure that safety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics; October 2009; p 20. 259 Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety metric. Ibid at 20. 260 Ibid at 13. 261 Between May 29 and June 10, 2000, three incidents occurred at the BP Grangemouth Petrochemical Complex in Scotland, which is one of the largest of the 950 COMAH sites in the UK. 262 Available at http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed May 21, 2013). 263 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 3. 264 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 6. 265 Ibid at 3.

Chevron Richmond Refinery Regulatory Report May 2014

52

performance; and adds that full implementation of this program could take between 18 months and two and a half years from when the initial introduction takes place – all without requiring any fundamental changes to the COMAH regulations themselves. The COMAH CA Investigation Team noted in its publication summarizing the conclusions of the Buncefield investigation that following the incident, the CA, industry, and trade unions worked together to “drive forward high standards at fuel storage sites…[which] has resulted in agreement on improved standards of safety and environmental protection for all UK sites storing large volumes of gasoline and to systematically upgrade sites to meet these standards….”266 In another example following the Buncefield incident, the Board recommended significantly higher standards than were generally in place in the sector. For example, the Board recommended that fuel storage tanks be fitted with automatic overfill protection equipment that would cut off supply if an overfill event occurs, rather than continuing to rely on operators to interrupt flow manually in the case of an event. In response, the UK Petroleum Industry Association and the Tank Storage Association adopted the recommendation, and the British government announced that it would require all sites to move to fully automatic shutdown systems on tanks storing gasoline. The Process Safety Leadership Group (PSLG) was formed to help develop the details of the new rule, and to “meet the need for an effective framework for interaction between industry, trade unions and the COMAH Competent Authority (CA).…”267 As will be discussed in the next section, workforce involvement is a key element of an effective safety case regulatory regime. In 2009, HSE published the PSLG’s work in a document entitled Safety and Environmental Standards for Fuel Storage Sites. The document lays out precisely which tanks must utilize automatic overfill protection equipment, and also allows for duty holders to demonstrate technical reasons as to why automatic overfill protection would not be appropriate by “prepar[ing] a robust demonstration that alternative measures are capable of achieving an equivalent ALARP outcome to an overfill protection system that is automatic…”268 This document in essence was developed as an industry good practice, and compliance with its requirements would likely ensure that the duty holder is complying with the law and reducing risks to ALARP.269 This can be contrasted with an even larger release of gasoline and a subsequent explosion that occurred in the 2009 tank overfill at the Caribbean Petroleum Corporation near San Juan, Puerto Rico. This incident severely damaged surrounding buildings and impacted moving vehicles. However, the incident has not resulted in any re-evaluation of safety rules by the EPA or OSHA, despite the fact that tank terminals largely fall outside the PSM and RMP program regulations, (let alone the more rigorous requirements of a major hazard safety case regulatory regime, as practiced in the UK). These post-Buncefield examples highlight one of the most important attributes of the safety case regulatory approach: it is a regulatory framework that implements a balance of goal-setting and prescriptive elements which enable the regulator to drive facilities to continuously improve practices

266 The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011; p 3. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013). 267 Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 2009; p 7. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 268 Ibid at 29. 269 For a detailed discussion of rule-compliance and the safety case, see Hopkins, Andrew. Risk-management and rule-compliance: Decision-making in hazardous industries; Safety Science 49 (1011) 110-120.

Chevron Richmond Refinery Regulatory Report May 2014

53

aimed at reducing risks to ALARP, without having to adhere to the extensive and time-consuming rulemaking requirements that exist in the US. This flexibility and adaptability encourages facilities to focus on improving practices and technology rather than on completing activity-based requirements, which can have the effect of stifling innovation and technological advancement. Critics argue that because there have been significant industry problems with the maintenance of safety critical equipment and aging equipment in the UK, 270 the safety case regime is not operating effectively. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferral of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters. However, the HSE has worked to make improvements to these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.271 The same year, the HSE published a report intended to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,272 which provides an overview of ageing plant mechanisms and their management. This document presents analysis and findings for loss of containment incidents to demonstrate how aging plant equipment may be a factor. The HSE has been able to take this type of programmatic proactive approach in the UK thanks to the safety case regime’s adaptive nature, which is lacking in the US both on and offshore. This is positive evidence of a competent and effective regulator with the tools under the safety case regime to identify and proactively address industry gaps in safety performance. 4.4 Active Workforce Participation As the CSB noted in its Interim Report on the Chevron incident, workforce participation is a key element of process safety and effective major accident prevention. In one of its publications, the Center for Chemical Process Safety (CCPS) lists workforce involvement as one of 20 essential management components necessary to reduce process safety risks and prevent chemical accidents.273 According to CCPS, …workers are potentially the most knowledgeable people with respect to the day-to-day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their unique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise.274 This CCPS publication discusses general areas of workforce involvement in risk assessments, inspections, audits, and performance reviews, and notes that participation leads to empowerment, management

270 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf, (accessed August 28, 2013). 271 The UK launches Key Programmes to address poor performance in specific areas. Access the report entitled Key Programme 4 (KP$): Ageing and life extension at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013). 272 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 273 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv. 274 Ibid at 124.

Chevron Richmond Refinery Regulatory Report May 2014

54

responsiveness, and process safety performance improvement. 275 The OSHA PSM standard requires employers to consult with employees and their representatives on the conduct and development of PHAs and on the development of the 13 remaining PSM elements, and to develop a written plan of action regarding the implementation of the employee participation required under this section.276 During facility inspections, OSHA inspectors must request and evaluate these written plans of action regarding the implementation of employee participation as well as interview employees and their representatives to verify that the employer is satisfying the requirements.277 In previous investigation reports, the CSB has identified that workers and their representatives play a very important role in major incident prevention. For example, as will be discussed in the next section on performance indicators, the CSB recommended in its BP Texas City Final Investigation Report that BP and the United Steelworkers Union (USW) establish a joint program to report incidents and near misses, and to ensure that recommendations made during investigations were implemented. The CSB also recommended that API and the USW work together to develop a safety standard addressing leading and lagging process safety indicators.278 However, representatives from the USW have stated to the CSB that it is a constant struggle for workers and their representatives to have a voice or play a role in the management of safety in US petroleum refineries. The law in the UK also requires employers to consult with their employees or their safety representatives on health and safety matters. The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996 set out the legal framework for such consultation and worker involvement at both unionized and non-unionized onshore facilities.279 However, these regulations go further than the OSHA PSM standard in that they provide for the election of safety representatives by the workers to serve many health and safety-related functions, including investigating complaints and accidents and carrying out inspections. In his keynote speech at the Oil and Gas UK Piper 25 conference, Lord Cullen stated that the safety representative positions have “important functions, such as the power to carry out investigations and reporting safety concerns to management, without fear of recrimination,” noting that they “help[] reinforce the principle that each employee is responsible for his own safety.”280 The regulations also require employers to establish a safety committee when one is requested by at least two health and safety representatives. The 1996 regulations require employers to consult with employees not represented by safety representatives under the 1977

275 Ibid at 125. 276 29 CFR §1910.119(c) (2012). 277 See OSHA CPL 02-02-045. Process Safety Management of Highly Hazardous Chemicals – Compliance Guidelines and Enforcement Procedures. September 13, 1994. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=1558&p_table=directives (accessed September 6, 2013). 278 Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators, performance measures, indicators, etc… 279 The 1977 regulations apply to workplaces where the employer recognizes trade unions and trade unions are recognized for collective bargaining purposes. Regulations available at http://www.legislation.gov.uk/uksi/1977/500/contents/made (accessed September 4, 2013). The 1996 regulations apply to workplaces where employees are not in a trade union and/or the employer does not recognize the trade union, or the trade union does not represent those employees not in the trade union. Regulations available at http://www.legislation.gov.uk/uksi/1996/1513/contents/made (accessed September 4, 2013). 280 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as px (accessed September 16, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

55

Regulations on a number of health and safety-related matters, such as the introduction of any measure which may substantially affect their health and safety at work, the planning and organization of health and safety training, and the health and safety consequences of introducing new technology.281 The law in the UK protects employees from being penalized for taking part in health and safety consultation.282 The UK’s existing regulations and policies regarding worker involvement offshore were developed and strengthened as a result of the Piper Alpha incident. In the Piper Alpha Report, Lord Cullen emphasized the importance of workforce involvement in safe operations, and noted that a safety committee system is “the most visible instrument for the involvement of the workforce in safety.”283 He concluded by recommending that “the regulatory body, operators and contractors should support and encourage the involvement of the offshore workforce in safety.”284 The HSE developed guidance in response to Lord Cullen’s recommendations entitled Play your part! How offshore workers can help improve health and safety, intended to encourage workforce participation offshore.285 The most current version of this guidance document, which was prepared by the Workforce Involvement Group,286 located within the HSE’s Offshore Industry Advisory Committee,287 utilizes good practice and examples of successful workforce involvement in improving health and safety with the goal of assisting operators, contractors, safety representatives, and others in effectively utilizing workforce involvement in their workplaces. It encourages companies to facilitate workforce involvement by providing information, improving communication at all levels, good training, and ensuring that all workers are represented in the decisions that affect them.288 The Piper Alpha incident also resulted in the swift development of the SI971 Offshore Regulations (Safety Representatives and Safety Committees) Regulations 1989 (“the SI971 Regulations”), which provide for the nomination and election of safety representatives and require offshore installations to establish safety committees.289290 The HSE has published a guidance document entitled A guide to the

281 See HSE. Consulting employees on health and safety: A brief guide to the law. 2013. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 4, 2013). 282 See Employment Rights Act 1996. Section 44. Health and safety cases. http://www.legislation.gov.uk/ukpga/1996/18/section/44 (accessed September 4, 2013). 283 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 301. 284 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 392. 285 See HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 286 The Workforce Involvement Group’s mission is to improve safety “by stimulating lateral learning and best practice across the offshore industry through involvement of the whole workforce.” It looks at ways to increase worker involvement in health and safety matters offshore and is chaired by HSE. For more information see http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig.htm (accessed June 17, 2013). 287 The Offshore Industry Advisory Committee is a tripartite committee that includes members representing employers, employees, unions, trade associations and other government departments. It is focused solely on the offshore sector. More information is available at http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/information.htm (accessed June 17, 2013). 288 HSE. Play your part! How offshore workers can help improve health and safety; 2013; p 4. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 289 Under Regulation 16, safety representatives are responsible for investigating potential hazards and incidents, examining causes of accidents, investigating complaints by any member of his or her constituency relating to occupational health and safety, representing members of the workforce in consultations on the offshore installation with inspectors, and consulting constituency members on any matters arising out of the Regulation. Under Regulation 17, a safety representative may inspect any part of the offshore installation or its equipment either on a

Chevron Richmond Refinery Regulatory Report May 2014

56

Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989291 designed to assist duty holders, employers, installation managers, safety representatives, safety committee members and all members of the workforce in the offshore industry with what the regulations require and what must be done to comply with them. The document explains that although the primary responsibility for health and safety resides with the duty holder, “all members of the workforce must play their part if risks are to be eliminated or minimized.”292 It also emphasizes the importance of training of safety representatives, which enables them to effectively represent workers and fulfill their responsibilities and functions under these Regulations. In April 2010, the HSE launched an inspection project to examine the effectiveness of the SI971 Regulations and the effectiveness of those regulations, as well as to collect examples of best practice to present to the offshore industry.293 Forty-one inspections were completed in a six-month period on offshore installations operated by 25 different duty holders. The project helped focus on the power of safety representatives and how to strengthen their ability to effectively perform their duties. It also was well-received by the safety representatives, as it gave them encouragement and recognition, and sent a message to management on the importance of SI971 and the key role of safety representatives and committees in workplace health and safety. The HSE has placed great emphasis and importance on the role of worker involvement and consultation in improving workplace health and safety and reducing major accidents on and offshore. In June 2009, HSE launched a new strategy entitled Be part of the solution, which lists workforce involvement as one of its main priorities, and the agency has published a significant amount of guidance on worker involvement and consultation on its website.294 The Norwegian Working Environment Act addresses the rights and duties of safety representatives and committees in Norway. It applies to nearly all workers in Norway, including onshore and offshore oil workers. The Act provides for the election of government recognized safety representatives whose duty is to “safeguard the interests or employees in matters of the working environment.”295 These

regular basis or following an incident. According to HSE, “this can be of great benefit to the duty holder because it brings an independent look at health and safety factors from the workforce viewpoint. Workers are in the front line and are often well placed to see problems and put forward practical suggestions.” HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989; 2012; p 20. http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 290 Under Regulation 22, safety committees are responsible for reviewing the system of constituencies so as to ensure adequate representation of the workforce on health and safety matters, reviewing training of safety representatives, reviewing the frequency of safety committee meetings and the circumstances under which they may be called, and considering causes of accidents and making recommendations to the installation manager. 291Third edition published in 2012. Available at http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 292 Ibid at 7. 293 See HSE. Offshore workforce involvement and consultation: Compliance Inspection Project. Available at http://www.hse.gov.uk/offshore/si971.pdf (accessed September 4, 2013). 294 See http://www.hse.gov.uk/involvement/hsrepresentatives.htm (accessed September 4, 2013). 295 Act Relating to Working Environment, Working Hours and Employment Protection, Etc. (Working Environment Act). December 2012. Section 6-1. Obligation to elect safety representatives.

Chevron Richmond Refinery Regulatory Report May 2014

57

representatives have the right to information, consultation, and participation in inspections.296 Unlike in the UK currently, they also have the legal authority to halt unsafe work until the regulator decides when the work may continue.297 A fundamental element in effective safety management for major accident prevention is active and equal participation from the regulator, industry, and labor. Each entity provides unique and essential insights, and removing the participation of these entities removes a critical voice in health and safety matters. In the UK and Norway, tripartite systems consisting of industry, the regulator, and the workforce have been established to deal with safety and health issues at the highest levels beyond just site workforce representation. The CSB investigation staff has had extensive discussions with worker representatives who have voiced their opinions on their systems to the CSB. Roy Furre, a Representative from the Norwegian Union of Energy Workers, spoke at the CSB’s 2010 public hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, and stated that the Norwegian working environment and the accompanying petroleum regulations empower unions and safety delegates in all phases of the petroleum activities.298 He also noted that the Norwegian petroleum regulations require that all necessary information about risks and decisions be given to the workers’ representatives.299 During the CSB’s public hearing on Safety Performance Indicators in July 2012, Jake Molloy, the Regional Organizer for the National Union of Rail, Maritime and Transport Workers in the UK, stated that the input of workers is “crucial” in major accident prevention and that “if the people operating these systems and delivering these results are unable for any reason to tell you what the true picture is, everything else is worthless.”300 When speaking at a “Step Change for Safety” Conference in Aberdeen, Scotland, on September 5, 2012, Mr. Molloy noted that attending the public hearing in Houston was “eye opening” and that hearing about the US system was like a “walk back in time.”301

296 Ibid at Section 6-2. Duties of safety representatives. 297 Ibid at Section 6-3. The safety representative’s right to halt dangerous work. See also the Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) Section 35. It states that “[t]he responsible safety delegate can, pursuant to Section 6-3 of the Working Environment Act, demand that a work operation or work process be halted by the person responsible for the operation or process. The operation or work shall stop immediately if the safety delegate does not accept the implementation of alternative measures.” http://www.ptil.no/framework-hse/category403.html#_Toc357595266 (accessed April 14, 2014).

298 CSB. Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety. December 15, 2010; p 300. http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed December 10, 2013). 299 Ibid at 300. 300 CSB. Public Hearing: Safety Performance Indicators. July 23, 2013; p 143. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed December 10, 2013). 301 http://www.youtube.com/watch?v=-xDzb4x8t_c (accessed December 10, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

58

1. 5

Process Safety Indicators that Drive Performance As the CSB noted in both its July 2012 public hearing on Safety Performance Indicators and its Chevron Interim Report, leading and lagging process safety indicators help drive continuous process safety improvement, as long as regulators utilize these indicators to focus inspections, audits, and investigations, and organizations focus attention on them in a way that makes a difference. Process safety indicators are a significant element of process safety management systems. They measure the strengths and weaknesses of these systems to achieve and maintain safe and reliable operations302 and, if properly defined, collected and used, can identify the successes and flaws of the system.303 Lagging indicators are a “form of reactive monitoring”304 that includes events such as major spills, fires, or gas releases. Leading indicators, on the other hand, are a “form of active monitoring,”305 and are described as events that do not result in severe consequences and usually address safety system performance, such as deviations from safe operating limits or timely maintenance on safety critical equipment.306 Leading indicators “can be considered as measures of process or inputs essential to deliver the desired safety outcome.”307 The general thinking globally is that if companies rely primarily on lagging indicator data, which is retrospective, they are not effectively managing process safety to ensure major accidents are prevented. According to the HSE, “[t]oo many organizations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly.”308 Rather, facilities must identify critical controls to monitor and set leading indicators against each one to show that the system is operating as intended. The HSE was one of the earliest regulators to adopt process safety indicators regulations. In 1995, the agency began requiring companies to report health and safety data, and then published annual reports based on those statistics. In 2006, the HSE developed a step-by-step guidance document entitled Developing process safety indicators309 to assist industry. The guide establishes and discusses in detail six main steps necessary to implement a process safety measurement system, including developing leading and lagging indicators. It also defines leading and lagging indicators for each of the controls in

302 CCPS. Guidelines for Process Safety Metrics; October 2009; p 109. 303 Ibid. 304 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 305 Ibid. 306 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 83. 307 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/priced/hsg254.pdf (accessed October 30, 2013). 308 Ibid at 1. 309 Full title is Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; first published in 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

59

the risk control system. According to Jake Molloy, “[i]t is our firm belief that the most influential and effective schemes using indicators to measure improvements and major accident prevention are those initiatives generated by our regulator, the Health and Safety Executive [HSE].”310 As discussed in the previous section, a number of large incidents, including BP Texas City and BP Grangemouth, have highlighted the need for the chemical and other major hazard sectors to demonstrate that risks are being adequately controlled. In response to recommendations stemming from such incidents, the COMAH CA developed an Operational Delivery Guide in 2010 on process safety performance indicators setting out four stages to aid facilities in the development of process safety indicators. The document sets out a goal that by the end of 2015 major hazard establishments and duty holders will measure their safety performance and control of risk by way of key leading and lagging performance indicators. Following the 2005 BP Texas City incident, BP developed company-wide process safety indicators, and now includes process safety metrics in performance contracts for its US refinery managers.311 However, existing guidance in the US pertaining to safety performance indicators does not adequately aid companies in managing major hazards onshore. The CSB has noted that in virtually every incident it investigates in the US, process safety indicators are either not used at all or not used effectively.312 Millions of workplaces around the US primarily measure their safety performance using OSHA recordable injury and illness rates, which include slips, trips, and falls. While collecting this type of data is also necessary in hazardous operations, it is not sufficient. Injury rates do not depict the effectiveness of a high hazard facility’s process safety management program.313 For example, the CSB noted in its BP Texas City investigation that BP’s personal injury metrics were described as being at the best level on record; yet, around this same time, in March 2005, BP Texas City experienced the devastating 15-fatality incident, which resulted from a progressive erosion of process safety performance that was not reflected in injury statistics. Following the BP Texas City incident, a number of key recommendations were made to strengthen guidance on indicators in the US. For example, the Baker Panel314 issued the Baker report, which recommended the incorporation of safety indicators to measure safety performance, and stated: The Panel believes that relying exclusively or predominantly on lagging indicators to assess process safety performance is ill-advised. … BP’s reliance on lagging, after-the-fact indicators of process safety performance rather than leading, predictive measures…impaired BP’s ability to measure, monitor and detect deteriorating or degraded process safety conditions and performance… This failure to use a set of effective

310 Molloy Testimony. CSB Indicators Public Hearing Transcript; July 24, 2012; p 139. 311 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 84. 312 Donald Holmstrom. CSB Indicators Public Hearing Transcript; July 24, 2012; p 13. 313 Ibid. 314 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

60

performance metrics that includes leading indicators increased the likelihood that the organisation would identify the need for improvements or additional controls only after something had gone wrong.315 The Baker Panel also noted that it was not enough just to develop process indicators: these indicators needed to be meaningful to the company. As such, the Baker Panel also recommended that “a significant proportion of total compensation of refining line managers and supervisors [be] contingent on satisfactorily meeting process safety performance goals…”316 In its final investigation report on the incident, the CSB made a recommendation to API and the USW to jointly lead development of a consensus standard for leading and lagging process safety indicators to drive performance improvements in the prevention of major incidents. API responded by issuing RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries. However, this voluntary standard, which defines a framework of four tiered indicators that incorporate the concepts of lagging to leading measures, has significant shortcomings, as the CSB described in a two-day public hearing on Safety Performance Indicators that was held in July 2012. The CSB analysis found that the ability of RP 754 to drive performance improvement and inform key stakeholders will be hampered by  lagging indicators with insufficient statistical rigor needed to allow for trending or incremental performance improvements;  the lack of well-defined standardized and normalized leading indicators that are needed for comparison among sites, corporations, or to national averages;  weak employee protection requirements; public reporting requirements that will be ineffective to adequately inform stakeholders; and  the lack of broadly based consensus in the standard’s development process.317 As a result, in 2012 the CSB Board designated the response to the CSB’s recommendation as “open- acceptable,”318 meaning that the recommendations recipient is moving in the right direction, but more remains to be done. The CSB also noted in the Chevron Interim Report the important role the public plays in monitoring safety management systems, and referenced CCPS as promoting the sharing of process safety indicators with the public: Sharing performance metrics and results broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics and performance public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating process safety successes also demonstrates to

315 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 194. 316 Ibid at 251. 317 CSB Public Hearing: Safety Performance Indicators. July 23-24, 2012; p 26. http://www.csb.gov/events/csb- public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 318 For more information on recommendations status designations, see http://www.csb.gov/recommendations/faq/#5 (accessed June 21, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

61

employees and the public that positive change can be, and are being, made within an organization.319 The Petroleum Safety Authority (PSA) in Norway provides annual reports to the public on its website assessing indicators it has collected directly from offshore and onshore major hazard facilities since 2000 and 2006, respectively. The PSA utilizes the indicators data found in these reports to identify critical safety areas that must be targeted for improvement in order to prevent near misses and accidents.320 The onshore report, Risk level in the petroleum industry, Onshore facilities,321, 322 includes a description and explanation of the indicators collected and analysis of these data. In this report the PSA notes a decreasing trend in the number of reported hydrocarbon leaks on offshore production facilities between 2007 and 2010.323 However, it is too soon for PSA to assess trends in the onshore indicators data, because the time period for onshore data collection has been relatively short and there are fewer data points with only eight facilities onshore. The PSA also indicated that it will take time for the onshore data to improve as indicators are refined, but recognized that the same approach has already yielded good results in the offshore sector.324 Additional information on data and trends based on safety case regime implementation are provided in Appendix C. 4.6 Regulatory Assessment, Verification, and Intervention To effectively oversee covered facilities and enforce safety case regulations, technically competent regulators review and assess325 safety case reports and utilize preventative inspections and audits to effectively intervene before high-risk activities commence. According to the HSE, “[t]he assessment process is only a part of the COMAH regime and examines at face value the factual information and examines arguments and demonstrations contained in the report against the requirements of the regulations.”326 The HSE places great emphasis during the assessment phase on the adoption of inherently safer designs327 and notes that “[m]ajor accident hazards should be avoided or reduced at source through the application of principles of inherent safety.”328 Conclusions on the adequacy of the safety case report are developed at the end of the assessment process, and, if deficiencies are found, an

319 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics. 2010; p 109. 320 PSA. Trends in Risk Level: Summary Report 2012 – Norwegian Continental Shelf. 2012; p 1. 321 See http://www.ptil.no/publications/category175.html?ptil_md_art_list-select_group=Category-233. The CSB had the 2010 version of the onshore report translated into English. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17,

1. (accessed September 17, 2013).

322 The corresponding report discussing offshore indicator data is entitled Trends in Risk Level. http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 2013. 323 PSA. Risk level in the petroleum industry, Onshore facilities. 2010; p 80. 324 Ibid. 325 According to the HSE, the “assessment reviews the documentary evidence in the report and further documentation, as appropriate, which is referred to in the report or requested by the assessor.” HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013). 326 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 9. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 327 Ibid at 30. 328 HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

62

intervention strategy for the facility is developed to addresses those deficient measures. According to the HSE, assessment of a safety case report or document “is not a discrete activity but leads to further action under the intervention plan for the operator at that establishment.”329 Intervention by the regulator ensures that the facility and its operations are consistent with information provided in the safety case report, and that there are robust systems in place to “reduce the likelihood of hazards and to mitigate their consequences until the associated risks are ALARP.”330,331 Under the safety case regulatory regime, the regulator has the authority to accept the safety case report or reject it and require additional measures to further reduce risks. Preventative inspections and audits by a technically competent regulator can also result in deep challenges to industry, which does not typically happen under the PSM or RMP regulations. In the UK, the COMAH regulations authorize the CA to organize an adequate system of inspections of establishments or other measures of control appropriate to the type of establishment concerned…[that are] sufficient for a planned and systematic examination of the systems being employed at the establishment, whether of a technical, organisational or managerial nature, so as to ensure…(a) that the operator can demonstrate that he has taken appropriate measures to prevent major accidents; (b) that the operator can demonstrate that he has provided appropriate means for limiting the consequences of major accidents both inside and outside the establishment; (c) that the information contained in any report sent to the competent authority by the operator of the establishment adequately reflects the conditions in the establishment…332 The CSB noted in its BP Texas City Final Investigation Report that in the UK, HSE inspectors thoroughly inspect high hazard facilities annually, and all COMAH- covered facilities are inspected every five years. For the approximately ten petroleum refineries in the UK, detailed planned inspections (ranging from 80 to 150 days) are conducted annually for each refinery by a multidisciplinary team (regulatory inspectors, process safety, mechanical engineering, electrical and instrumentation, and human factors specialists).333 The HSE lists its offshore priorities as safety case assessment;334 verification;335 inspection; investigation; and

329 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 4. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 330 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 331 According to HSE, essential considerations to ensure ALARP are “the scope of hazard elimination, the adoption of inherently safer designs, whether good practice has been, or is to be adopted, [and] the application of risk- reducing measures where relevant good practice is not yet established.” Ibid at 30 and 31. 332 COMAH Regulations 1999 Part 6, Regulation 19(1) and (2). 333 The CSB. Investigation Report: BP Texas City Refinery Explosion and Fire. March 2007; p 205. http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 29, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

63

enforcement.336 In its business plan for 2012-2015, the HSE set out a goal of assessing 72 safety cases onshore and 100 safety cases offshore for 2013 and 2014.337 The work required to assess a safety case report both on and offshore is very resource-intensive (a typical new offshore safety case assessment requires anywhere from 100 to 300 hours of work), and demands that the regulator hire and retain individuals with significant oil and gas experience, specifically in areas such as process safety, human factors, engineering, and organizational performance. In Australia, the Offshore Petroleum and Greenhouse Gas Storage Act 2006 authorizes NOPSEMA to conduct planned inspections of offshore installations to ensure compliance with the Act.338 NOPSEMA notes that planned inspections “are a critical examination of aspects of a facility, its systems and operations with information obtained from the facility safety case.”339 Subjects of planned inspections include risk control measures related to either a Major Accident Event340 or Occupational Health and Safety controls, or both. NOPSEMA states that it conducts at least two per year for each normally manned offshore installation.341 NOPSEMA distinguishes between two types of planned inspections: field-based inspections, which focus on implementation of control measures described in a facility’s safety case, and themed audits, which deal with inspection of organizational issues by following a common theme to direct lines of questioning.342 In a 1992 compliance directive,343 OSHA stated that the primary enforcement model for the PSM standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) inspections.344 These inspections consist of three parts: determining if the elements of a PSM program are in place; evaluating if the programs comply with the requirements of the standard; and verifying compliance with the standard through interviews, data sampling, and field observations. However, OSHA does not make planned inspections, which have the most opportunity for prevention, a high

334 An owner or operator (i.e. the duty holder) is required to submit a safety case to HSE for each offshore installation. HSE then assesses the safety case using both regulations and HSE’s “Assessment Principles for Offshore Safety Cases (APOSC) and must accept it before an installation can operate. See http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed July 31, 2013). 335 Duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to put in place and keep under continual review a verification scheme by which assurance is obtained from an independent competent person (ICP) that safety critical elements and the PFEER (Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) specified plant are suitable and remain suitable for the life of the installation. For more information see http://www.hse.gov.uk/offshore/verification.htm (accessed July 31, 2013). 336 See http://www.hse.gov.uk/offshore/priorities.htm (accessed July 15, 2013). 337 HSE. HSE Business Plan 2012-15; June 2012; p 14. http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). 338 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Sections 600 and 601. See http://www.comlaw.gov.au/Series/C2006A00014 (accessed July 15, 2013). 339 NOPSEMA. Inspection Policy; p 2. http://www.nopsema.gov.au/assets/document/N-02000-PL0025- Inspection.pdf (accessed July 15, 2013). 340 Australia’s Offshore Petroleum and Greenhouse Gas Storage Regulations 2009 define a Major Accident Event as “an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of person at or near the facility.” Chapter 1.5. See http://www.comlaw.gov.au/Details/F2009L04578/Html/Text#param5 (accessed July 15, 2013). 341 For more information, see http://www.nopsema.gov.au/safety/inspections/ (accessed July 15, 2013). 342 For more information, see http://www.nopsema.gov.au/assets/document/N-02000-PL0025-Inspection.pdf (accessed July 15, 2013). 343 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new regulation. 344 OSHA Instruction CPL 02-02-045 (1994).

Chevron Richmond Refinery Regulatory Report May 2014

64

priority. Rather, OSHA lists its inspection priorities as 1) imminent danger situations; 2) fatalities and catastrophes; 3) complaints; 4) referrals; 5) follow-ups; and 6) planned inspections.345 The CSB noted in its BP Texas City Final Investigation Report that for the 10-year period prior to the Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by developing more highly trained and experienced inspectors to conduct more comprehensive inspections, such as the PQV audits envisioned in the 1992 directive, at facilities presenting the greatest risk of a catastrophic accident. The intent of the recommendation was to establish a permanent, ongoing planned comprehensive inspections program. Spurred in part by the CSB’s recommendations, OSHA issued the Petroleum Refinery Process Safety Management National Emphasis Program (NEP) on June 7, 2007.346 The NEP was a federal program that established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard. Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and uses a more global approach to identify compliance deficiencies…,” the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standard…[which] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, interview employees, and verify implementation for specific processes, equipment, and procedures.”347 The NEP inspections were meant to be more targeted and efficient than PQV inspections. However, the inspections being conducted pursuant to the NEP were ended in 2011 partly because they were very time- consuming and resource-intensive.348 OSHA has publicly stated349 that NEP inspection hours were roughly 40 times greater than average OSHA inspection hours. OSHA described the NEP as its most effective emphasis program in its history, citing a disturbing number of issues and subsequent citations. In 1999, EPA established an audit350 program to help ensure compliance with the RMP program. The audits were intended to provide an independent verification of the information in the RMP and include

345 “OSHA Fact Sheet: OSHA Inspections,” available at http://www.osha.gov/OshDoc/data_General_Facts/factsheet-inspections.pdf (accessed on May 20, 2013). 346 Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to complete NEP inspections under the original CPL 03-00-004. 347 CPL 03-00-004, Section X(D)(1). 2007. 348 Jordan Barab, Deputy Assistant Secretary of Labor for Occupational Safety and Health, stated the following during a symposium at the Mary K O’Connor Process Safety Center: “As our refinery NEP comes to an end, we are engaged in a process of trying to figure out how we will address refinery PSM issues in the future. Clearly OSHA's past practice of targeting inspection according to injury and illness numbers is not adequate. However, because of resource limitations, we are also unable to commit to a full-time NEP.” “Saving Lives and Transforming Workplaces: OSHA and Process Safety.” Remarks for Jordan Barab, Deputy Assistant Secretary of Labor for Occupational Safety and Health. Mary Kay O’Connor Process Safety Center International Symposium. Texas A&M University, College Station, Texas. Wednesday, October 27, 2010. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=SPEECHES&p_id=2311 (accessed January 13, 2014). 349 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation made at CSB Public Hearing on Process Safety Indicators; July 20, 2012. http://www.csb.gov/UserFiles/file/Barab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). Also see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013). 350 Within Part 68, the term “audit” refers to the process that implementing agencies may use to verify the quality of the RMP submitted to EPA and require revisions when necessary to ensure compliance. RMP audits will generally involve on-site verification of a facility’s underlying risk management program. Section 68.220 of the RMP rule

Chevron Richmond Refinery Regulatory Report May 2014

65

on-site inspections. Under these requirements, the implementing agency (EPA or a correlating state agency) must “periodically audit” RMPs to review their adequacy and require revisions when necessary to ensure compliance. 351 Between fiscal years (FYs) 2010 and 2012, each EPA Region responsible for implementing the RMP program was mandated by EPA to perform inspections352 at five percent of the total number of regulated facilities in the regions, and a certain percentage of these facilities were required to be high-risk.353 In FY 2010, regions were to conduct 10 percent of the inspections at high-risk facilities, and in FYs 2011 and 2012, 25 percent at high-risk facilities.354 Although EPA has acknowledged that “full compliance with the Risk Management Program regulations cannot be determined without on-site or independent verification of all or part of the information submitted in an RMP[,]”355 the EPA has not effectively implemented the audit and inspection elements of the Risk Management Program. As mentioned above in Section 3.2.2.3.2, the EPA Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as high-risk356 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.357 The EPA OIG also noted that of the 296 uninspected high-risk facilities managed by EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.358

requires implementing agencies to select facilities for audits based on specific criteria, and to follow a specific process for resolving audit findings prior to any enforcement action. See EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 351 40 CFR §68.220 (1999). 352 RMP inspections “are different from audits in that facilities are not necessarily selected for inspection based on Part 68 regulatory criteria, and inspections can lead directly to implementing agency enforcement actions for regulatory violations. Also, RMP inspections always involve on-site verification activities.” See EPA, “Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r).” January 2011; page 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 353 Criteria used to determine high-risk includes the number of people in the footprint (if it is more than 100,000); accidental releases reported in the RMP; the hazard index (percentage of chemical quantity above threshold and number of chemicals onsite); and the number of Program Levels 2 or 3. US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March 2013. See http://www.condorearth.com/files/08- Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 2013). 354 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 7. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 355 EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 356 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 357 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15. 358 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

66

1. 7

Independent, Competent, Well-Funded Regulator As noted by NOPSEMA, a safety regulator “provides ‘independent’ assurance to society, governments and industry that companies have identified the risks to health and safety and have put appropriate measures in place to control these risks.”359 To ensure that companies are managing risks and employing the best available standards and technologies, the regulator must be independent,360 well-resourced, and retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess companies’ safety case reports and performance. Without independent and competent examinations, the safety case report becomes a meaningless document in terms of controlling risk and preventing major accidents. Offshore regulators in the UK and Australia also utilize independent third party specialist safety companies recognized by the regulator. Third party inspectors review important aspects of the safety case, such as safety critical elements361 and performance standards.362 Third party inspections, however, do not take the place of rigorous inspections by the regulator. As of June 2012, the HSE employed roughly 3,300 staff, of which 1,381were front-line inspectors,363 whose responsibilities include conducting preventative inspections of roughly 950 COMAH facilities throughout the UK. The HSE employs roughly 105 inspectors to inspect approximately 300 offshore installations, in effect a one to three ratio. As such, the HSE, with a budget of roughly $472 million,364 has the authority to offer higher specialist salaries to attract and retain more experienced, competent personnel. According to information obtained from the HSE, in 2011 and 2012 their onshore specialist inspector pay ranged from $85,806 to $102,344, and their offshore inspector pay ranged from $134,387 to $148,423 at the highest grade and $116,288 to $131,499 at the next highest grade.365 A safety case regime requires regulators to conduct preventative facility inspections and audits against the safety case to ensure that specified controls are functioning as intended. Regulators must be capable of interacting as equals with company risk managers when conducting these inspections. Former HSE staff

359 See http://www.nopsema.gov.au/safety/safety-case/safety-case-approach/ (accessed May 31, 2013). 360 You will find a more detailed discussion of regulator independence in the CSB’s upcoming investigation report on the Macondo incident. 361 The UK HSE requires offshore installations to define “safety critical elements,” which are the technical barriers in place for the prevention, detection, control, and mitigation of major accident risks. Lauder, Bob. Major Hazard (Asset Integrity) Key Performance Indicators in use in the UK Offshore Oil and Gas Industry. Paper at the CSB Indicators Public Hearing. July 24, 2012. 362 In the UK, duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to “put in place and keep under continual review a verification scheme by means of which assurance is obtained from an independent competent person (ICP) that safety critical elements and PFEER [Offshore Installations ) Prevention of Fire and Explosion, and Emergency Response] specified plant are suitable and remain suitable for the lifetime of the installation.” See http://www.hse.gov.uk/offshore/verification.htm (accessed November 14, 2013). 363 HSE. The Health and Safety Executive Annual Report and Accounts 2011/12; July 2012; p 30. http://www.hse.gov.uk/aboutus/reports/1112/ar1112.pdf (accessed June 3, 2013). 364 For 2013/2014, HSE’s budget is listed as 308.1 £million. HSE recovers approximately 40 percent of its costs through income mainly in the nuclear, offshore, and chemical sectors, and the remainder is funded from Grant-in- Aid pursuant to the Health and Safety at Work etc. Act 1974, and fee for intervention (FFI).364 See HSE, “HSE Business Plan 2012-15,” July 2012; page 17. Available at http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021-forex.html (accessed June 4, 2013). 365 Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021- forex.html (accessed June 4, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

67

have communicated to the CSB that the HSE seeks new employees with good communication skills in addition to education and experience, as the job of a safety case regulator requires encouraging companies to aspire to make safety improvements that they may not want to make. One message that current and former HSE staff have repeated is that the industry believes having competent regulatory staff adds significant value to their business.366 In any country, competent offshore regulatory staff can persuade companies to manage risks in a rigorous manner, knowing that if not done properly, their risk management practices will be challenged.367 This competence is also essential for companies’ confidence in the accuracy of the regulatory staff’s advice, inspections, and citations. According to a literature review on the safety case in the UK, “[s]ome companies see as positive the requirement to have ‘someone external to the company keeping you on your toes by regularly asking if you have done all you can,’ and that it ‘forces you to convince yourself’ that you have covered all the risks.”368 In the US, the federal government has used extensive resources to retain the best available talent to focus on health and safety oversight of US commercial and defense nuclear facilities.369 For instance, many nonsupervisory technical staff at the US Nuclear Regulatory Commission370 (NRC) and the Defense Nuclear Facilities Safety Board are paid at the top of the General Schedule pay schedule.371 Virtually all technical staff at the Defense Nuclear Facilities Safety Board hold technical master’s degrees and approximately 25 percent hold doctoral degrees.372 The federal government has a unique category of non-executive positions that involve high-level research and development in the physical, biological, medical, or engineering sciences, or a closely-related field.373 These are known as “Scientific or Professional” positions, and they are classified above the highest general schedule pay level.374 These special salary authorizations contribute to the technical agencies’ ability to compete with private industry to recruit and retain highly competent staff. The NRC also has a type of funding mechanism that ensures that the agency’s budget adequately covers its regulator activities, as the NRC is required by law to recover at least 90 percent of its budget through licensing and inspection fees.375

366 Based on conversations between the CSB staff and Magne Ognedal (Norway PSA), Ian Whewell (the UK HSE), Peter Wilkinson (Australia NOPSA [forerunner of NOPSEMA]), and John Clegg (inaugural CEO of NOPSA). 367 Peter Wilkinson, Manager Review Implementation Team, Offshore Safety Section, Australia Department of Industry, Tourism and Resources and “architect” of NOPSA. Presentation to the National Research Centre for Occupational Health and Safety, ANU (May 15, 2002). 368 Vectra Group Limited. Literature Review on the Perceived Benefits and Disadvantages of UK Safety Case Regimes; 2003; p 40. 369 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 370 Presentation by NRC Executive Director Bill Borchardt, January 2011. 371 $123,758 to $155,500 per year in 2012 in Washington, DC. See https://www.opm.gov/oca/12tables/html/dcb.asp (accessed May 15, 2013). 372 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013). 373 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 374 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 375 Section 6101 “NRC User Fees and Annual Charges,” Omnibus Budget Reconciliation Act, Pub. L. 103-66. 107 Stat. 312 (Aug. 10, 1993).

Chevron Richmond Refinery Regulatory Report May 2014

68

Another method by which the NRC is able to attract and retain competent technical staff is its extensive training programs. For new inspection staff, the NRC requires a series of courses, assessments, and simulation, all of which takes approximately two years to complete.376 Inspectors must have a bachelor’s degree in engineering or a degree in a relevant scientific field and Professional Engineer certification.377 The agency operates a technical training center in Chattanooga, Tennessee, with various control room simulators that mirror licensees’ facilities. The NRC staff is expected to sufficiently understand this equipment so that they are able to conduct sufficient audits and investigations.378 Before he or she is fully qualified to conduct inspections, inspector candidates must be recommended by the NRC inspector qualification board and certified by the regional administrator or division director.379 As will be discussed in greater detail under Section 5.0, at the time of the Chevron incident, a majority of the regulators responsible for oversight of Chevron and other petroleum refineries in California did not have sufficient, sustainable funding or staffing to oversee major accident prevention activities. An effective safety case regulatory system would necessitate that the California industry regulator be well- resourced and retain a sufficient number of competent, well-trained and experienced staff to critically assess a company’s safety case. The overall knowledge and expertise of the regulator must at a minimum match that of industry in order for the regulator to successfully assess a company’s safety case with the ultimate goal of preventing major accidents.

376 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) at 4, available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed May 28, 2013). 377 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001 378 See, e.g., http://www.iaea.org/ns/tutorials/regcontrol/regbody/reg2124.htm (accessed May 28, 2013). 379 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf

Chevron Richmond Refinery Regulatory Report May 2014

69

1. 0 Oversight of Petroleum Refineries in California

In California, there currently exists a patchwork of primarily activity-based federal, state, and local laws and regulations aimed at preventing harmful releases of hazardous materials at facilities such as petroleum refineries. This regulatory framework does not foster continuous improvement by driving companies to reduce risks of their hazardous activities to ALARP, nor does it have the requisite number of regulatory staff with the skills, knowledge, and experience to provide sufficient oversight. 5.1 Cal/OSHA 5.1.1 Background Information Section 18 of the OSHAct380 encourages states to develop and implement their own job safety and health programs. Twenty-five states (including California), Puerto Rico and the Virgin Islands currently implement OSHA-approved State Plans.381 States must set job safety and health standards that are “at least as effective as” comparable federal standards; most adopt standards that are identical to the federal standards.382 California was certified as an OSHA State Plan state on August 12, 1977.383 California’s Division of Occupational Safety and Health (Cal/OSHA) administers the California Occupational Safety and Health Program. A PSM District Office384 within Cal/OSHA enforces California’s PSM standard, which is established under Title 8, Section 5189 of the California Code of Regulations (CCR) and entitled Process Safety Management of Acutely Hazardous Materials.385,386 The PSM District Office is comprised of seven inspectors, known as Associate Safety Engineers, and one District Manager to regulate nearly 1,700 PSM-covered facilities in California, including 14 petroleum refineries. Only one of these individuals has a technical background, with a degree in Chemical Engineering. Appendix B of this report summarizes the key differences between the federal and California PSM standards and the safety case regulatory regime. A more detailed analysis of those differences will be provided in the remainder of Section 5.1.

The CSB in its Interim Report identified a number of weaknesses of Chevron’s process safety performance. In many of these causal issues, Chevron was not required to perform at a more effective level by the existing California PSM regulations. In Table 1 below, the CSB identifies the causal issues or findings, which highlight the gaps in the California and federal PSM regulations, and how each issue is more effectively managed in the safety case regulatory regime. In this section of the report, some of these examples will be examined in relation to key features of an effective regulatory approach such as the

380 29 U.S.C. §667 (2004). 381 These are referred to informally as OSHA State Plans. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs 382 29 U.S.C. §667 (c)(2) (2004). Also see http://www.osha.gov/dcsp/osp/faq.html (accessed May 13, 2013). 383 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed June 17, 2013). 384 The California PSM District Offices were established in 2001 after the February 1999 Tosco refinery incident in which four workers were fatally injured following the ignition of a highly flammable material during a turnaround operation. In January 2012 the two district offices were combined into one PSM District Office. 385 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed May 13, 2013). 386 8 CCR §5189 (2012).

Chevron Richmond Refinery Regulatory Report May 2014

70

safety case. More information on these causal findings can also be found in the CSB Chevron Interim Report.

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** MOC Inspection recommendation to upgrade pipe to 9- Chrome not implemented. The MOC to implement the recommendation narrowed the scope allowing the 52- inch component that failed to remain in service. Implementation of 9- Chrome could have prevented the incident.387 MOC element requires implementation of written procedures to manage changes that shall address the impact of the change on health and safety; however the element is activity based and there is no requirement to implement effective recommendations or control hazards. There is no requirement in the MOC element to consider inherent safety. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Description of MOC procedures and demonstration of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Implementation of the concept of inherent safety is required.388

 Unless otherwise noted, California and federal PSM requirements are nearly identical. ** Regulatory regimes such as offshore in Norway have many attributes of the safety case regulatory regime but are not called the safety case regulatory regime. 387 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 41 and 42. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 388 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report May 2014

71

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** MOC Chevron conducted MOCs to evaluate proposed changes to crude feed that introduced higher sulfur concentration. However, Chevron failed to thoroughly evaluate the change of increasing sulfur weight percentage in crude oil feed and to assess how it might affect corrosion rates within the 4-sidecut piping circuit. Cal/OSHA did not issue any citations for failing to consider the impact of corrosion in the MOC process when sulfur composition in the crude oil feed was increased.389 MOC element is activity- based rather than performance based and requirements in RAGAGEP such as API 570390 do not apply to the MOC element of PSM. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Duty holder must identify in the safety case report the standards that they are using to reduce risk such as API 570. The implementation of those standards can be enforced by the regulator to achieve ALARP. PHA In its 2009 crude unit PHA, Chevron simply cited non- specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances. The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. While the PHA element requires addressing the control of hazards, it does not require addressing the effectiveness of the controls or using the hierarchy of controls. For example, the standard would not require the use of improved metallurgy or inherent safety to mitigate corrosion hazards. Cal/OSHA did not cite Chevron for this issue. Requires the use of the most effective practical safeguards to achieve ALARP. The safety case requires the use of inherently safer design and the hierarchy of controls.391

389 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 34, 35 and 36. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013). 390 API 570. Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems. November 2009. 391 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report May 2014

72

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** PHA The 4-sidecut line was analyzed in the most recent crude unit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping. Damage mechanism hazard reviews are not required by the PSM regulation. The process hazard analysis element does not require consideration of RAGAGEP such as API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. Cal/OSHA did not cite Chevron for this issue. For example in the UK the HSE has worked with the industry to develop guidance on damage mechanism hazard reviews in the UK's offshore petrochemical industry. The implementation of best practice standards referenced by a duty holder’s safety case report may be enforced by the regulator to achieve ALARP. Incident Investigations Chevron made recommendations following its investigation of sulfidation incidents at Richmond, Salt Lake City and Pascagoula refineries requiring 100 percent component inspection in high risk piping systems. These recommendations were not implemented in the Richmond refinery crude unit prior to the incident. In 2007 Chevron identified the inherently safer solution of improved metallurgy to prevent sulfidation corrosion but only applied it to the crude unit small spool piece that failed. Neither California nor federal PSM regulations require root cause investigations or recommendations to be developed as the result of incident investigations. While California does require taking action to prevent reoccurrence, (goes beyond federal OSHA) it does not drive risk to ALARP. Cal/OSHA did not cite Chevron for this issue. Federal PSM does not require the development of recommendations or the prevention of future incidents. Investigation of incidents is required to demonstrate legal compliance with framework legislation. ALARP requirement would require remedial action including cross- company learning from incident investigations. HSE can require safety case duty holder compliance with investigation report recommendations (e.g. Buncefield Report- “determine SIL level requirements for overfill protection”).

Chevron Richmond Refinery Regulatory Report May 2014

73

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Mechanical Integrity Chevron was instrumental in the development of API RP 939-C, which suggests ("should") but does not require ("shall") that 100 percent component inspection be performed. API states that the use of "shall" denotes minimum requirements in the use of the standard - API RP 939- C has no minimum requirements (no substantive "shalls" are used in the recommended practice). The mechanical integrity element of PSM requires that for inspection and testing procedures, employers follow RAGAGEP. However, API RP 939-C has no minimum requirements. Nonetheless, Cal/OSHA cited Chevron for failure to follow API RP 939-C under this mechanical integrity provision. In the federal regulatory context, this approach has been called into question by the recent administrative law judge decision in BP Products. This case is scheduled for review by the full commission. In a safety case regime, the regulator can reject the use of weak and inadequate standards referenced in a safety case report (by rejecting the report) and can require more rigorous performance to achieve ALARP.

Chevron Richmond Refinery Regulatory Report May 2014

74

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Inherent Safety Chevron employees have recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past employee recommendations. However, the CSB has not identified any documented, thorough analysis of the proposed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. Had Chevron implemented these recommendations, the incident could have been prevented. Neither California nor federal PSM regulations require the use or implementation of inherent safety. Cal/OSHA did not cite Chevron for this issue. In its Interim Report, the CSB made a recommendation to the California legislature and the Governor of California to use inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. Safety case requires the implementation of inherently safer systems analysis.392 Regulator Enforcement Despite numerous safety system deficiencies the Cal/OSHA regulator failed to identify these issues prior to the incident. Cal/OSHA conducted three planned inspections prior to the incident that resulted in no citations or fines. The CSB determined Cal/OSHA lacked sufficient resources and numbers of highly qualified inspectors. California is adding 15 additional inspectors to its PSM unit. The Governor's Interagency Task Force on Refinery Safety will be proposing to implement additional recommendations from their draft report. A key feature of the safety case is a rigorous review of the safety case report that may be accepted or rejected by the regulator. Preventative audits of covered facilities are regularly performed by technically competent, well resourced regulators.

392 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs…”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8.

Chevron Richmond Refinery Regulatory Report May 2014

75

Process Safety Element Causal Finding California PSM Regulation The Safety Case Regulatory Regime** Workforce Involvement The workers in previous loss of containment incidents raised concerns about the level of corrosion in the Crude and RLOP incidents, but their concerns were not effectively addressed prior to the August 6, 2012, incident. The workforce participation element requires an employer to develop a written plan to "ensure employee participation in process safety management…” including "consultation with employees and their representatives on the conduct and development of the elements of process safety management...” However, development of a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company's safety management system such as PHAs, MOCs, and investigation activities. Safety case sets out a legal framework for the participation of employees on health and safety-related matters, the election of safety representatives, and the establishment of safety committees to serve health and safety related functions. Workforce participation practices are documented by the duty holder and submitted to the regulator.

Table 1. CSB Causal Findings.

1. 1.2

Analysis 5.1.2.1 ALARP Unlike the OSHAct, the California Occupational Safety and Health Act does not have a General Duty Clause. Rather, Section 5189 was established to “eliminate to a substantial degree, the risks to which employees are exposed in petroleum refineries, chemical plants and other facilities.”393 By focusing on the significant reduction of risk, this language supports the principle of ALARP, which requires a showing by the company that “there are no other practical measures that could reasonably be taken to reduce risks further.”394 However, this section, which lays out the “scope and purpose” of the regulation, is not an enforceable element of the regulation that is subject to citations, and the remaining PSM regulation elements do not lead in practice to that result. Rather, California’s PSM standard has remained activity-based, with many activity-based elements almost identical to the federal PSM standard. For example, an employer must “perform a hazard analysis [PHA] appropriate to the complexity of the

393 8 CCR §5189 (a) (2012). 394 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

76

process for identifying, evaluating, and controlling hazards involved in the process....”395 The PHA must address hazards of the process; engineering and administrative controls applicable to the hazards and their relationships; consequences of failure of these controls; facility siting; human factors; a qualitative evaluation of a range of the possible safety and health effects of the failure of controls on facility employees; and the identification of any previous incident which had a likely potential for catastrophic consequences in the workplace.”396 This language does not support the principle of ALARP, and makes no mention of risk or continuous improvement in any way. As a result, PHAs satisfy the California PSM regulatory requirement by merely listing safeguards; there is no requirement to evaluate or document the effectiveness of these safeguards, or to show that the safeguards in place are effectively reducing risks. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron cited in its 2009 crude unit PHA non-specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances.397 The effectiveness of these safeguards was neither evaluated nor documented. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation- induced failure of carbon steel piping could have been recommended. In addition, while the 4-sidecut line was analyzed in this PHA, corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added). A corrosion review, also referred to as a damage mechanism hazard review, analyzes hazards presented by all process failure mechanisms such as corrosion and cracking. This type of review, while considered to be good practice,398 is not required by the PSM regulations either federally or in California, and as such the CSB made a recommendation in its Interim Report to require these in future California PHAs. Under a safety case regulatory regime, the regulator has the ability to drive industry to adapt new technologies and safer practices as soon as they are developed; new rulemaking is not required for immediate improvements, because companies are obligated to continually work toward specified performance goals such as reducing risks to ALARP. Therefore, under a safety case regulatory regime the regulator could require these types of reviews to be conducted to reduce risk without requiring additional legislation. Cal/OSHA does not typically review a company’s PHA as part of its routine oversight of process safety management unless there is a specific complaint, accident, or targeted inspection. Nor does it “accept” a company’s PHA and proposed hazard mitigations. Therefore, prior to the August 2012 incident, Cal/OSHA inspectors did not require any additional information or analysis to be provided in the Chevron crude unit PHA. Highlighting the reactive nature of the PSM standard, Cal/OSHA inspected the Chevron facility post-incident and issued 17 citations related to the incident and eight additional citations, with a total proposed fine of nearly $1 million. Only one citation related to PHAs, and it was not associated with evaluating the effectiveness of safeguards or failure to control the 4-sidecut corrosion hazard. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units

395 8 CCR §5189 (e)(1) (2012). 396 8 CCR §5189 (e)(2) (A) through (G) (2012). 397 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. 398 API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, describes common process failure mechanism and is considered to be good practice for analyzing risks presented by process failure mechanisms such as corrosion and cracking.

Chevron Richmond Refinery Regulatory Report May 2014

77

associated with the crude unit. This again highlights the lack of a requirement for Chevron to demonstrate that risks have been reduced to ALARP, or for Chevron to provide this type of analysis to Cal/OSHA to review.

1. 1.2.2

Adaptability and Continuous Improvement

Of the 25 Cal/OSHA citations mentioned above, two were issued to Chevron for its failure to follow API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries as RAGAGEP. This voluntary API standard will be discussed in greater detail in the CSB’s Final Investigation Report on the Chevron incident. However, it is important to note for purposes of this report that API RP 939-C is a permissive and voluntary standard merely intended to provide guidance to industry personnel on how to address sulfidation corrosion in petroleum refining operations. Existing safety guidelines use words “shall” and “should” to denote either requirements or recommendations. API RP 939-C does not use the word “shall”; as such, it contains no requirements for industry. While the regulator in a safety case regulatory regime has the authority to analyze and challenge the requirements of API RP 939-C with the goal of driving continuous improvement and risk reduction (note the Buncefield examples discussed in Section 4.3), in the present case Cal/OSHA utilized the voluntary practice as an opportunity to issue a citation to Chevron post-incident. Cal/OSHA did not analyze API RP 939-C to determine whether its provisions are sufficient to reduce risks and manage hazards. It also remains to be seen whether this citation will be upheld considering the permissive language contained within the standard. Chevron has investigated a number of sulfidation incidents at its refineries over the years, including Richmond, Salt Lake City, and Pascagoula. Figure 2 shows a timeline of Chevron’s key sulfidation events. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron Richmond Refinery crude unit resulting in a CWS Level 3 alert, injuring one worker and initiating a shelter-in-place for the surrounding community. As a result of these investigations, Chevron made internal recommendations to require 100 percent component inspections in high-risk piping systems. However, these recommendations were not implemented in the Richmond Refinery crude unit prior to the incident, highlighting a lack of learning from previous incidents by Chevron.

Chevron Richmond Refinery Regulatory Report May 2014

78

Figure 2. Chevron's key sulfidation events between 1974 and 2013.

In addition, as a result of the January 2007 incident, Chevron informed Contra Costa Health Services’ Hazardous Materials Program399 (CCHMP) in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently safer solution. However, the CSB learned that this upgrade was limited to only the immediate piping spool400 that failed. Cal/OSHA also did not require Chevron to update the crude unit PHA to address the findings from this incident. Under a safety case regulatory regime, the regulator would work with the company to improve its practices following such an incident. The company would also be required to update its safety case report to address these corrosion hazards and demonstrate how the company has reduced risks to ALARP.

The CSB also noted in its Chevron Interim Report that despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction, Chevron’s 2006 Management of Change (MOC) analysis limited the application of those recommendations. Instead of replacing the entire piping segment identified by the original recommendation, the 2006 MOC considered only the replacement of a small section. Although the recommendation was intended to more broadly apply inherently safer materials of construction, the final implementation under the 2006 MOC limited the application of this more corrosion resistant

399 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). CCHSHMP also implements the CalARP and ISO programs, which will be discussed in greater detail later on. 400 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits.

Chevron Richmond Refinery Regulatory Report May 2014

79

metallurgy.401 As the mere completion of an MOC and the implementation of any action item satisfy the California PSM standard requirements, regardless of its adequacy or effectiveness, Cal/OSHA did not evaluate the MOC or cite Chevron for narrowing the scope of the MOC, despite its disregard of internal recommendations. Neither the California nor the federal PSM standards allow citations for inadequate MOCs. In addition, RAGAGEP does not apply to the MOC PSM element.

This can be contrasted with the safety case regulatory regime in the UK, where the HSE includes the adoption of inherently safer designs as an essential consideration for determining whether a duty holder has reduced risks to ALARP.402 The HSE also notes that the guidance to COMAH Regulation 4, (the COMAH General Duty provision) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).”403 5.1.2.3 Process Safety Indicators As the CSB has noted in its BP Texas City Investigation Report, Chevron Interim Report, and Section 4.5 of this report, process safety indicators are a significant element of process safety management systems and are critical for reducing process safety incidents. A major goal of process safety indicators is to drive continuous process safety improvement. Regulators can utilize these indicators to focus inspections, audits, and investigations.

Federally and in the state of California, neither the PSM standard nor the RMP rule require companies to utilize or report process safety indicators. Chevron voluntarily utilizes both leading and lagging indicators internally in its US petroleum refineries, in a system called Operational Excellence and Reliability Intelligence (OERI), which tracks 26 different process safety indicators. OERI was implemented in May 2009. However, Chevron is not required to report the status of its indicators to California regulators. Nor is Chevron held accountable to use the indicators to drive performance or continuous improvement. As a result, the CSB made a recommendation in its Chevron Interim Report to the California State Legislature to identify and require the reporting of leading and lagging process safety indicators to state and local regulatory agencies, with the goal of improving mechanical integrity and process hazard analysis performance at all California petroleum refineries, and preventing major chemical incidents. 5.1.2.4 Inspections As noted in Section 4.6, safety case regulators utilize preventative inspections and audits to monitor compliance with legislation and to ensure that the facility and its operations are consistent with information provided in the safety case. However, like federal OSHA, California regulations require Cal/OSHA to prioritize accident, complaint, and referral-based inspections over planned inspections. As such, Cal/OSHA’s inspection program of the nearly 1,700 PSM-regulated facilities in California,

401 As discussed in the Interim Report, only the section of piping downstream of the pumps was replaced with 9- Chrome. 402 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013). 403 Ibid at 8.

Chevron Richmond Refinery Regulatory Report May 2014

80

including 14 petroleum refineries, 404 has been reactive in nature rather than proactive to maximize prevention. OSHA State Plan states405 were strongly encouraged but not required to implement the federal Petroleum Refinery NEP. Cal/OSHA did not adopt the NEP “because of its dedicated PSM Unit.”406 Between 2006 and August 6, 2012, the Cal/OSHA PSM District Office conducted only three planned inspections of the Chevron Richmond facility, totaling only 150 inspector hours of effort. Cal/OSHA has acknowledged that these were not PQV inspections, as envisioned in its mission statement and in the federal PSM compliance directive. None of these inspections resulted in citations or fines. According to statistics provided by OSHA, federal NEP refinery inspections conducted between 2007 and the end of 2011 required roughly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehensiveness between the planned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA and other OSHA State Plan States. The federal NEP, which represented a more robust and intensive inspection program, ended in 2011 due to the stated great demand on OSHA resources. 5.1.2.5 Workforce Participation Like the federal PSM standard, California’s PSM standard provides for workforce participation in a company’s process safety management program. 8 CCR §5189 (p) requires an employer to develop a written plan to “ensure employee participation in process safety management” including “consultation with employees and their representatives on the conduct and development of the elements of process safety management…”407 However, developing a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company’s process safety management systems. In its investigation of the Chevron incident, the CSB noted that the Chevron Richmond Refinery workforce and its representatives, the United Steelworkers (USW), had expressed concerns regarding sulfidation corrosion and broader workplace safety issues, but were not consistently listened to by Chevron managers, and their concerns regarding corrosion were not adequately acted upon. In November 2011, Cal/OSHA investigated a complaint of unsafe working conditions during the fourth quarter Richmond Lube Oil Plant (RLOP) turnaround at the Richmond Refinery. The RLOP receives feedstock from the crude unit where the August 6th incident occurred and has similar sulfidation corrosion concerns. During the shutdown of the RLOP, a fire occurred at one of the RLOP furnaces. According to Cal/OSHA’s inspection report, Chevron employees told Cal/OSHA that “OPERATORS GET IGNORED.” Many of the employees were concerned about increased corrosion they were finding during the turnaround, and believed that increased temperatures and throughput rates had an adverse effect on

404 Also see the California Labor Code Sections 6309 to 6315 (The California Occupational Safety and Health Act of 1973). 405 Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors State plans and provides up to 50 percent of an approved plan's operating costs. 406 Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety Management District Office. Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012. 407 8 CCR §5189(p)(1) (2012).

Chevron Richmond Refinery Regulatory Report May 2014

81

equipment integrity. According to the interview notes, many operators had raised issues of corrosion in the RLOP to higher level supervisors to no avail; according to one, if you raise an issue a couple of times, “you get labeled a ‘pest.’” The CSB has not identified evidence indicating that Cal/OSHA took further action to respond to these concerns, and Cal/OSHA did not issue any citations as a result of its investigation.408 Post-incident, significant sulfidation corrosion was found in the RLOP and piping and equipment were replaced. The CSB found other significant evidence that increased workforce participation could have reduced the likelihood that unchecked corrosion would lead to the August 2012 incident. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron technical staff has considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. In 2009, Chevron Energy Technology Company (Chevron ETC)409 created an internal document on the subject of sulfidation corrosion. Chevron ETC metallurgists released a formal report dated September 30, 2009 (nearly 3 years prior to the incident) to Chevron refinery-based reliability managers and chief inspectors entitled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries. Sulfidation experts explained in the Chevron ETC report that, “[u]ntil now, Chevron has not directly addressed the risk of low Si[licon] carbon steel…”410 and that the report introduced a program that “seeks to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic failure from sulfidation corrosion and calls out Chevron’s need for action. The Chevron ETC report specifically recommended that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 100 percent component inspection program was not implemented at the Richmond refinery prior to the August 6, 2012, incident. The Chevron ETC report defined a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4-sidecut pipe placed it in the highest priority for inspection. Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the potential consequence of sulfidation failures. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut piping. The newsletter stated: Sulfidation corrosion failures … are of great concern because of the comparatively high likelihood of ‘blowout’ or catastrophic failure. This typically happens because corrosion occurs at a relatively uniform rate over a broad area, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition, the

408 Post-incident, there were significant mechanical integrity improvements and piping replaced in the RLOP unit. 409 The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that provides technology solutions and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013). 410 A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident.

Chevron Richmond Refinery Regulatory Report May 2014

82

process fluid is often above its auto ignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents have reinforced the need for revised inspection strategies and a robust PMI (Positive Materials Identification) program. The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, established in 2009, was not implemented at Richmond, and the thin-walled low silicon 4-sidecut piping component remained in service until it catastrophically failed on August 6, 2012. Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. They educated personnel and advocated for identification and control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. These individuals did not participate in the crude unit PHA and did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround process.411 Despite the history of sulfidation corrosion incidents and the recommendations by Chevron’s workforce to implement better inspection methodologies, Cal/OSHA did not evaluate these recommendations or determine whether Chevron management ensured that the hazards of this damage mechanism were addressed and mitigated in Chevron’s PHAs. In addition, Cal/OSHA issued no citations to Chevron post- incident regarding the failure to address sulfidation corrosion in its crude unit PHA. Finally, when Chevron employees raised concerns, Cal/OSHA did not effectively address them. The examples highlighted in this section speak to the need for California to develop more effective regulation similar to the UK legislation discussed in Section 4.4, to ensure strong workforce involvement in health and safety matters at petroleum refineries. This will not only help prevent incidents such as the one that occurred at Chevron, but it will also help improve communication and ensure that workers are represented in the decisions that affect them. 5.1.2.6 Funding and Regulator Competency Cal/OSHA has not received sufficient funding to employ a well-staffed, multi-disciplinary team capable of conducting thorough inspections of PSM-covered facilities in California. This is apparent when examining the lack of preventative, planned inspections of petroleum refineries being conducted by the PSM team in the state. In order for a safety regulatory regime to successfully regulate with the goal of major accident prevention, there must be a technically competent, well-resourced regulator in place to sufficiently review, scrutinize, and challenge the hazard identification and evaluation that has been conducted and controls that have been put in place to reduce risk, to help drive continuous improvement and ensure that risks are being controlled. It is not an acceptable outcome for society that petroleum refineries with the potential for catastrophic accidents be inspected only after an accident occurs or a complaint is filed.

411 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown.

Chevron Richmond Refinery Regulatory Report May 2014

83

Compensation is one important factor for recruiting and retaining technically competent personnel. The CSB found that California regulators are significantly less compensated when compared to their industry counterparts. Based on information Chevron provided to the CSB, the average annual salary of refinery personnel who would interact with a California regulator performing an audit or safety inspection is $187,630. Table 2 below provides the 2012 salaries of California regulatory personnel that the CSB determined would likely perform a safety inspection or a hypothetical safety case assessment. These figures indicate a substantial compensation gap between the regulator and the regulated. A Cal/OSHA PSM team of associate safety engineers receive an average annual salary that is 46 percent lower than the refinery employees they would likely interface with during an inspection. EPA RMP inspectors receive an annual salary that is 33 percent lower than their facility counterparts and Contra Costa County accidental release prevention engineers and their supervisor are paid 48 percent less than these industry personnel.412

Entity Average Annual Salary Refinery Personnel $187,630 Cal/OSHA $100,536 Contra Costa County $96,875 EPA $125,000 Table 2. Average 2012 salary for individuals selected by the CSB as representative of the professional staff within each California regulator and of the refinery professional staff who interface with the regulators regarding audits or safety inspections at the Chevron Richmond Refinery. As noted in the introduction of this report, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a fee by March 31, 2014, to support an increase in funding and to pay for at least 15 new positions in Cal/OSHA’s PSM Unit.413 The CSB considers this to be a positive step towards improving process safety management in the state of California, as it will provide the team the opportunity to conduct more thorough inspections. However, it is imperative that these additional inspectors have the skills, knowledge, and experience to provide sufficient direct oversight over PSM- covered facilities. Despite the additional funding, there remains a longstanding salary cap on associate safety engineers within Cal/OSHA. This will continue to make it difficult for Cal/OSHA to consistently attract or retain the necessary talent and expertise to effectively oversee these facilities.

412 Compensation information is based on salary only. It does not take into account non-salary information such as bonuses, retirement programs, or benefit programs. 413 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

84

1. 2

U.S. Environmental Protection Agency According to the EPA OIG, as of May 2012, only eight states and five local agencies had accepted full or partial RMP program delegation from EPA.414 As such, EPA regions directly implement the RMP program in most states. As no state agency has requested or received delegation to implement the RMP program within EPA Region 9, the federal EPA regional office is responsible for RMP program implementation for California as well as Arizona, Nevada, Hawaii, the Pacific Islands, and 148 Tribal Nations. 5.2.1 Risk Management Plan (RMP) Program As of March 2013, there were 1,137 RMP-covered facilities in Region 9: 957 in California; 118 in Arizona; 42 in Nevada; 16 in Hawaii; and four in Guam.415 The Chevron Richmond Refinery has many processes covered by the RMP rule, including Program 3 processes, 416 such as the crude unit. As such, Chevron is required to submit an RMP every five years to EPA Region 9, and EPA is expected to audit the facility against this RMP to ensure compliance. According to Chevron’s most recent RMP submitted to EPA Region 9 in October 2011, its crude unit contained 400,000 pounds of a flammable mixture of propane, pentane, butane, ethane, and methane, well above the 10,000-pound threshold quantity for flammables.417 EPA Region 9 employs four full-time and two part-time RMP inspectors to implement the RMP program for the roughly 1,100 RMP-covered facilities in the entire region. Region 9 staff informed the EPA OIG that to most effectively utilize their resources, they “place an additional focus on facilities in States, such as Arizona, that do not have their own risk management or accident prevention programs.418 The EPA’s mandates to conduct a certain number of inspections at high-risk facilities plus a lack of resources and staffing prevent the inspectors from fully auditing many of the petroleum refineries in each state; thus, the inspectors aim to visit each refinery every three years, where they pick one process to evaluate for two to three days. These inspectors target their inspections towards a specific industry issue during these visits. For example, when they last inspected Chevron in 2010, the inspectors focused on the issue of high temperature hydrogen attack (HTHA) due to the Tesoro incident that occurred in April 2010.419

414 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013; p 2. 415 US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March

1. See http://www.condorearth.com/files/08-Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14,

2013). 416 Processes not eligible for Program 1 and either subject to OSHA’s PSM standard or classified in one of ten specified North American Industrial Classification System (NAICS) codes are placed in Program 3, which imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and emergency response requirements. 417 EPA List of Regulated Chemicals and Threshold Quantities for RMP program available at http://www.epa.gov/R5Super/cepps/pdfs/rmp-listed-chemicals-200708.pdf (accessed May 17, 2013). 418 California has its own RMP program, called CalARP. See EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 23. 419 On April 2, 2010, a heat exchanger ruptured due to high temperature hydrogen attack, resulting in seven worker fatalities at the Tesoro Anacortes Refinery in Anacortes, Washington. The CSB is set to release its investigation report on this incident near the end of January 2014.

Chevron Richmond Refinery Regulatory Report May 2014

85

1. 2.2

Implementation of the RMP Program In order for a safety regime to function well, there must be a competent, well-resourced regulator in place to implement the regime. However, the EPA Region 9 RMP group is extremely understaffed and under- resourced, as there are only six full-time inspectors to cover over 1,100 facilities across many states. Instead of fully inspecting or auditing petroleum refineries, the group is able to inspect one process at each refinery for two to three days every three years, which makes fully inspecting these facilities or auditing against the RMPs submitted by these facilities impossible. In addition, this group has other responsibilities beyond the RMP program, including the management of contracts, emergency prevention and preparedness training and outreach, and reporting violations under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). The CSB has learned that because this group has such limited resources, it hopes to delegate RMP inspection authority to other agencies throughout the region, as long as it maintains power to enforce violations. Like the federal and California PSM standards, the RMP regulations provide for workforce participation420 and require facilities to prepare a written plan of action regarding employee participation. It is the RMP program’s policy to invite employee representatives to participate in all parts of onsite inspections. EPA Region 9 RMP staff told the CSB, however, that the limited amount of time they were able to spend onsite at refineries made speaking with facility inspectors and operators a difficult task. They expressed that a lesson learned from the Chevron incident was that EPA RMP inspectors should commit more time onsite during facility inspections and audits, which will allow them more time to speak with workers to gain a better insight into how any issues within the facility are being addressed and resolved.421 As mentioned above, EPA guidance on the RMP program states that the owner or operator’s duty to “prevent accidents and ensure safety at [their] source…” may require steps to be taken “beyond those specified in the risk management program rule.”422 While this principle appears to be similar to ALARP requirements of the safety case, in practice this is not required, and whether this is done is not subject to regulation or review. Similar to the PSM standard, RMP regulations require each facility with Program 3 processes to conduct a PHA as part of its prevention program that is “appropriate to the complexity of the process…and[] identify, evaluate, and control the hazards involved in the process.”423 However, these regulations do not require facilities to include these analyses in the RMPs they submit to EPA. Rather, facilities with Program 2 or 3 processes are only required to include in the RMP very high-level, simplified information on their prevention programs and their PHAs. The Chevron Richmond Refinery’s most recent RMP submission from October 2011 included the following information on the PHAs for each relevant process: the date of the last PHA for that process; what technique was used; what major hazards were identified; what process controls were in use (i.e. automatic shutoffs, interlocks, alarms, emergency power); what mitigation systems were in use (i.e. dikes, fire walls, water curtain); what monitoring/detection systems were in use (i.e. process area detectors); date of the most recent review or

420 See 40 CFR §68.83 (2000). 421 This need for greater interface with worker is a professional opinion by EPA staff, but has not resulted in EPA policy modifications to ensure effective worker input in future inspections. 422 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 423 40 CFR §68.67(a) (1998).

Chevron Richmond Refinery Regulatory Report May 2014

86

revision of training programs; and maintenance. Chevron included one paragraph entitled “E.5. General Accidental Release Prevention Program,” which stated that PSM is applied to the entire refinery, and the PSM program is documented in Refinery Instruction (RI)-360, “Richmond Refinery PSM Policy.” No additional information or analysis could be located concerning the identification or control of hazards, or risk reduction, as, unlike the safety case model, there is no requirement for the company to demonstrate to the regulator that it is effectively ensuring that the safety systems are functioning as intended. Under the EPA RMP program, there is no regulatory requirement to reduce risks to ALARP. In addition, there is no requirement to submit to the regulator detailed information relating to risk reduction or hazard assessments. Finally, the Region 9 EPA RMP inspection team does not have the resources to fully audit petroleum refineries and other high hazard facilities subject to the RMP program. As a result, the EPA RMP program is not comprehensive or rigorous enough to control major accident hazards and reduce risks. Instead, facilities submit high-level summary information providing evidence that the activity- based requirements contained within the RMP regulations have been completed by the facility. 5.3 Unified Program Chevron’s Richmond refinery was also subject to process safety regulatory requirements at the county and city level. The facility had to adhere to additional requirements above the PSM and RMP regulations, but these requirements were not sufficient to prevent the Chevron incident. The following sections will discuss those county and city requirements. In 1993, Chapter 418, Statutes of 1993 (Senate Bill 1082) established Chapter 6.11 of the California Health and Safety Code (HSC), which required the Secretary of the California Environmental Protection Agency (Cal/EPA) to adopt regulations creating a “unified hazardous waste and hazardous materials management” regulatory program, or Unified Program, by January 1, 1996, to consolidate and make consistent six existing hazardous materials and hazardous waste programs within the state.424 The Secretary of Cal/EPA was charged with ensuring that the Unified Program was established and implemented by a Certified Unified Program Agency, or CUPA, in all counties in California. Cal/EPA adopted the Unified Program regulations under Title 27, Division 1 of the California Code of Regulations, which integrated six existing programs: the Hazardous Waste Generator and Onsite Hazardous Waste Treatment programs; the Aboveground Storage Tank program; the Underground Storage Tank program; the Hazardous Materials Release Response Plans and Inventory program; the California Accidental Release Prevention (CalARP) program; and the California Uniform Fire Code.425 The CalARP program, which was created through Assembly Bill AB1889 with the goal of major accident prevention, will be discussed at greater length below. There are currently 83 CUPAs in the state of California that implement the Unified Program at a local level.426 5.3.1.1 Contra Costa County Hazardous Materials Programs The Chevron Richmond Refinery is located in the City of Richmond, within Contra Costa County. The local CUPA responsible for implementing the Unified Program in all areas of the country is the Contra

424 California Health and Safety Code §25404(b) (1993). Also see http://www.calepa.ca.gov/cupa/Reports/2002/ReimbAcct.pdf (accessed May 16, 2013). 425 27 CCR §15100 (a)(1) through (6) (1994). 426 See http://www.calepa.ca.gov/cupa/Documents/2012/FactSheet.pdf (accessed May 16, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

87

Costa Health Services’ Hazardous Materials Programs (CCHMP).427 CCHMP is responsible for implementing the Unified Program in all areas of Contra Costa County. CCHMP implements two programs that are relevant to this investigation: the CalARP program and the City of Richmond Industrial Safety Ordinance (RISO). CCHMP also implements the county’s own Industrial Safety Ordinance (ISO), which covers seven facilities. CCHMP has five full-time engineers, known as accidental release prevention engineers, who are responsible for implementing these programs for the county. While all have technical degrees in engineering, only two of these engineers have past refinery experience. 5.3.1.1.1 CalARP The California Health and Safety Code Article 2 (Chapter 6.95, Sections 25531 – 25543.3) was amended effective January 1, 1997, to implement EPA’s RMP program at the state level through the creation of the CalARP program regulations. Modeled after EPA’s RMP program and California’s Risk Management and Prevention Plan, which was enacted in 1986, the CalARP regulations (Title 19, Chapter 4.5 of the CCR) were implemented with the goal of preventing accidental releases of substances that can cause serious harm to the public and the environment, minimizing damage caused by a release, and to satisfy community right-to-know laws.428 California is one of at least three states that implement a state RMP program without delegation of the federal program from EPA.429 The CalARP regulations, including PHA requirements, are essentially duplicative in nature to EPA’s RMP program, with a few exceptions: the list of toxic chemicals covered is 276 instead of 77; the threshold quantities of some chemicals are smaller; CalARP requires a seismic analysis; and there is more interaction with the public and other agencies.430 The CalARP regulations require that businesses that produce, handle, process, distribute, or store certain chemicals over a certain threshold quantity develop a Risk Management Plan (RMP) and submit the RMP to a local CUPA for review. Like the EPA RMP program, facilities with a Program 3 process must develop a management system that includes a PHA and emergency response program.431 State oversight authority and responsibility for the CalARP program is with the California Emergency Management Agency.432 The CalARP regulations apply to roughly 45 facilities in Contra Costa County, including the Chevron refinery in Richmond. Each covered facility is required to submit an updated RMP to CCHMP at least once every five years.433 The group of CCHMP engineers reviews these plans and is required to

427 Contra Costa County’s Hazardous Materials program is responsible for responding to emergencies and monitoring hazardous materials in Contra Costa County. It is the duty of CCC to safeguard the Contra Costa County ecosystem from the release of hazardous materials and other pollutants. For more information see http://cchealth.org/hazmat/ (accessed May 21, 2013). 428 Information available at http://www.calema.ca.gov/HazardousMaterials/Pages/Accidental-Release-Prevention- (CalARP).aspx (accessed May 16, 2013). 429EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 20. 430 Information on differences between EPA’s RMP program and CalARP available at http://cchealth.org/hazmat/differences-rmp-calarp-iso.php (accessed May 16, 2013). 431 22 CCR §2735.5(f) (2004). 432The California Emergency Management Agency is responsible for the coordination of overall state agency response to major disasters in support of local government. For more information see http://www.calema.ca.gov/Pages/default.aspx (accessed May 21, 2013). 433 22 CCR §2745.10(a)(1) (2004).

Chevron Richmond Refinery Regulatory Report May 2014

88

“periodically audit RMPs”434 against the regulations to ensure compliance. This group has told the CSB that it audits each facility at least once every three years. It last audited Chevron in February 2011, and has been conducting another audit in October and November 2013. Although CCHMP is authorized to issue enforcement actions for violations uncovered during facility audits, in practice CCHMP engineers issue “ensure” action items that list the deficiencies and recommend improvements. They then work with the facility to make sure that these action items are implemented. CCHMP has rarely issued fines or citations to facilities for violations. If the engineers identify other gaps or areas for improvement that are not actual regulatory violations, they can issue “consider” action items, which are essentially suggestions to the facility for improvements that are not technically required to be implemented by the regulation. Whether these types of action items are issued is dependent upon the knowledge and experience of the engineer conducting the audit. Once CCHMP engineers have completed the audit, CCHMP issues a final audit report on the facility, which they also supply to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.1.2 Industrial Safety Ordinance The Contra Costa County Industrial Safety Ordinance (ISO) became effective January 15, 1999. Adopted as County Ordinance Chapter 450-8, the ISO expands on the CalARP program in Contra Costa County for facilities meeting the following criteria: 1) the facility is within an unincorporated area of the County; 2) the facility is either a petroleum refinery or chemical plant; 3) the facility is required to submit a Risk Management Plan (RMP) to the EPA and the Contra Costa County Health Service; and 4) the facility has at least one Program 3 process.435 Seven of the 45 CalARP facilities in the county are currently required to comply with the ISO requirements. The ISO was adopted to improve industrial safety by, among other things, requiring more comprehensive coverage of the whole facility rather than only certain processes; providing review, inspection, auditing and safety requirements more stringent than are currently in effect; requiring the development and implementation of a human factors program; and preventing and reducing the number, frequency and severity of accidental releases in Contra Costa County.436 Facilities subject to the ISO are essentially required to treat every process as subject to the CalARP Program 3 prevention program requirements. Covered facilities have additional requirements as well, including developing and implementing a human factors program, considering inherently safer technologies and systems for new and existing facilities or processes, submitting a safety plan to CCHMP, and conducting a Management of Organizational Change (MOOC) prior to changes in permanent staffing levels or reorganization in operations, maintenance, health and safety, or emergency response.437

434 22 CCR §2775.2(a) (2004). 435 See http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 436 County Ordinance Chapter 450-8.004(a)(1) through (10) (2006). http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 437 Information available at http://cchealth.org/groups/hazmat/industrial_safety_ordinance_risk_management.php (accessed May 22, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

89

1. 3.1.1.3 City of Richmond Industrial Safety Ordinance

On December 18, 2001, the City of Richmond adopted an Industrial Safety Ordinance (RISO) under Municipal Code Chapter 6.43 that was almost identical to the ISO. In February 2013, the City of Richmond Council amended the RISO to make it equivalent to the ISO. Chevron is one of two facilities subject to RISO requirements. Pursuant to an agreement with the City of Richmond, CCHMP implements and enforces the RISO within the city. Like the ISO, the RISO requires that a covered facility submit a safety plan to CCHMP that includes safety elements such as process safety information (PSI), operating procedures, mechanical integrity, employee participation, and management of change (MOC).438 CCHMP has posted a Safety Plan Guidance Document on its website to assist facilities in developing these plans. Each facility is also required to comply with safety requirements including performing PHAs, and must include a description of the manner of compliance with these in the safety plan.439 In performing a PHA, facilities are required to address the hazards of the process, identify any previous incident, identify controls applicable to the hazards, and identify consequences of failure of those controls, human factors, and a qualitative evaluation of a range of possible safety and health effects of failure of controls.440 The CCHMP engineers are required to review each facility’s safety plan as well as audit each facility to determine compliance with ISO or RISO. CCHMP engineers conduct the CalARP and ISO/RISO audits concurrently at each covered facility. CCHMP generally audits each facility once every three years. To aid in the auditing process, CCHMP engineers have entered all the CalARP program requirements into a database. They have taken each of these requirements and turned them into questions. When the engineers go onsite, they perform three main functions: 1) they identify and review any policy statement that directs how people should handle a particular piece of equipment; 2) they identify and review records of procedures, such as MOCs and permits; and 3) they randomly select and interview individuals about their familiarity with various aspects of different programs. If the engineers find a regulatory deficiency, they issue an ensure action item to the facility. Once the engineers have completed their facility audit, they issue a preliminary determination to the facility. The facility has 90 days to review the draft and provide a proposed remedy with specifics on how they will fix each deficiency, and the timeline. Once the report is finalized it goes out for public comment. Following public comment, it is issued to the facility and provided to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 5.3.1.2 Analysis Chevron submitted its most updated safety plan to CCHMP on February 25, 2013. Section 3.12 of the plan discusses PHAs and Action Items. Under this section, Chevron lists eight objectives of its PHAs, including identifying possible failures or releases, evaluating potential consequences, and proposing recommendations that would reduce the risks. Chevron also discusses its possible justifications for declining recommendations from PHAs, including the fact that an alternative measure would be sufficient, and that the recommendation may be infeasible. There was no additional information or

438 Richmond Municipal Code Section 6.43.090 (a) (2013). 439 Ibid at Sections (a) through (e) (2013). 440 Ibid at (d) (2013).

Chevron Richmond Refinery Regulatory Report May 2014

90

analysis contained in this section concerning the identification or control of hazards, or risk reduction, as there is no requirement to do so. The RISO and CalARP regulations require that PHAs list controls and possible consequences of failure of those controls, but there is no specific requirement to include evaluations of the safeguards and controls in the PHA. As CCHMP engineers are only required to audit against the regulatory requirements, they would only examine the evaluation of safeguards if such an evaluation were performed and documented in the facility’s PHAs. As noted previously, Chevron’s most recent crude unit PHA ineffectively listed qualitative safeguards for corrosion and mechanical integrity. While CCHMP engineers are able to issue “consider” action items to the facility recommending actions above and beyond regulatory requirements, CCHMP engineers did not do this regarding Chevron’s Crude Unit PHA or its evaluation of safeguards. After reviewing CCHMP’s most recent audit of Chevron, the CSB could find nothing referring to sulfidation corrosion, reduction of risk, or safeguard evaluation. While CCHMP is able to utilize these “consider” action items to encourage facilities to go above and beyond regulatory requirements to reduce risk, CCHMP engineers have stated to the CSB that they do not make sufficient use of this mechanism. Rather, they tend to audit against the existing regulatory requirements to ensure compliance. Unlike the safety case regulatory approach, which requires a reduction of risk to ALARP or equivalent, facilities covered by RISO or ISO are only required to “consider [emphasis added] the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis [PHA] and in the design and review of new processes and facilities.”441 Despite multiple internal recommendations to replace its piping due to the risk of sulfidation corrosion, Chevron failed to replace the piping prior to the incident with an inherently safer material. Again, the CSB has not found evidence that CCHMP effectively encouraged Chevron to go above and beyond regulatory requirements by utilizing inherently safer systems to reduce risk. As emphasized repeatedly in this report, a regulatory regime is only as strong as its regulators, and must employ individuals with the requisite skills, knowledge, and experience to provide sufficient oversight over facilities. In the case of CCHMP, there are only five engineers for nearly 45 facilities in the county, and only two have previous refinery experience.442 In addition, while the CCHMP is funded mostly through CUPA fees, ISO fees, and other means of cost recovery, the engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which has experienced annual budget reductions in the millions.443 This has unnecessarily resulted in a decrease in the CCHMP engineers’ salaries and has made it extremely difficult for CCHMP to fill a current position that has been open over three years because of its inability to offer competitive salaries to attract its engineers. Overall, CCHMP suffers from a lack of resources and funding, limiting its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County.

441 City of Richmond Municipal Code §6.43.050(g) (February 5, 2013). 442 Two of the other engineers have chemical plant experience and have led or participated in refinery compliance audits in the past ten years.

Chevron Richmond Refinery Regulatory Report May 2014

91

1. 0 Conclusion

This report has focused on several aspects of the safety case regulatory approach that the CSB believes differentiate it from existing US and California process safety regulations: safety responsibility on the part of the facility, including a written case for safety; continuous risk reduction to ALARP; adaptability and continuous improvement; active workforce participation; the effective use of process safety indicators that drive performance; regulatory assessment, verification, and intervention; and an independent, competent, well-funded regulator. These attributes together enable industry and the regulator to ensure that facilities are developing and implementing comprehensive, robust safety management systems to prevent major accidents. Implementation of the safety case regulatory regime in California for petroleum refineries will require a commitment of extensive resources to fund a regulator that has the requisite skills, knowledge, and experience to ensure petroleum refineries in the state continually assess their practices and reduce risks to ALARP. However, the CSB believes that effective implementation of this regulatory approach will achieve greater major accident prevention in California and, in the process, provide greater protection for its workers and the public. The safety case provides the adaptability necessary to keep current with improving standards and advancing technology, without requiring lengthy and often unproductive rulemaking on the part of the regulator. With the safety case regulatory regime in place, a competent regulator will independently ensure that California refineries have taken all practical measures that can be reasonably taken to reduce risks. For example, the regulator would have the ability to work with these facilities to implement recommendations and lessons learned from significant petroleum refinery incidents throughout the world without requiring extensive rulemaking or legislation, as regulators have done post-incident in the UK, Norway, and Australia. If questions remain regarding the safety case regulatory regime after reading this report, see Appendix C for additional information and discussion. The safety case regulatory regime will require a full commitment and extensive effort by the California legislature, regulators, and California petroleum refineries. However, the CSB believes that this effort is necessary to ensure that California, like other regions around the world, is effectively managing process safety and risk, and in the process, preventing major accidents such as the August 6, 2012, Chevron pipe rupture and hydrocarbon release.

Chevron Richmond Refinery Regulatory Report May 2014

92

1. 0 Recommendations

Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer operations at California petroleum refineries and protecting workers and communities from future accidents, the CSB makes the following safety recommendations: California State Legislature, Governor of California 2012-03-I-CA-R21 Develop and implement a step-by-step plan to supplement the existing process safety management regulatory framework for petroleum refineries in the state of California with a more rigorous safety management regulatory framework based on the principles of the “safety case” type regulatory regime in use in countries such as the United Kingdom, Australia, and Norway, and as described in this report, with the following minimum components: a. A case for safety written by the duty holder that includes a systematic analysis and documentation of all major hazards and effective control methods implemented to reduce those risks as low as reasonably practicable (ALARP); b. A thorough review of the safety case report by technically competent regulatory personnel that requires modifications and improvements to the document as necessary prior to acceptance; c. Audits and preventative inspections by the regulator to verify effective implementation of safety case elements; d. A risk management approach that requires analysis and effective implementation of safeguards, using the hierarchy of controls, to protect people and the environment from major accident hazards. The effectiveness of the safeguards will be demonstrated through the use of leading and lagging process safety indicators; e. Ability to adapt and implement safety requirements in response to newly identified hazards, advances in technology, lessons learned from major accidents, and improved safety codes without the need for new rule-making; f. Determines when new or improved industry standards and practices are needed and initiates programs and other activities such as forums to prompt the timely development and implementation of such standards and practices; g. Uses a tripartite model where the regulator, the company, and workers and their representatives play an equal and essential role in the direction of preventing major accidents; h. A regulatory model and accompanying guidance based on the UK’s The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996, which set out the legal framework for the rights and responsibilities of workers and their representatives on health and safety-related matters, and the election of safety representatives and establishment of safety committees to serve health and safety-related functions. The elected representatives should have a legally recognized

Chevron Richmond Refinery Regulatory Report May 2014

93

role that goes beyond consultation in activities such as the development of the safety case report, process hazard analysis, management of change, incident investigation, audits, and identification and effective control of hazards. The representatives should also have the authority to stop work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to address the safety concern.444 Workforce participation practices should be documented by the duty holder and submitted to the regulator; i. Requires reporting of information to the public to the greatest extent feasible such as a summary of the safety case report, the process hazard analysis, a list of safeguards implemented and standards utilized to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards and management systems;445 j. An independent, well-funded, well-staffed, technically competent regulator; and k. A compensation system to ensure the safety case regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with California petroleum refineries.

2012-03-I-CA-R22 Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the state of California to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from operators and contractors to promote continuous safety improvements. At a minimum, this program shall: a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness of process safety management systems and safeguards for major accident prevention. Include leading and lagging indicators that are measureable, actionable, and standardized. Require that the reported data be used for continuous process safety improvement and accident prevention; b. Analyze data to identify trends and poor performers and publish annual reports with the data at facility and corporate levels; c. Require companies to publicly report required indicators annually at facility and corporate levels; d. Use process safety indicators (1) to drive continuous improvement for major accident prevention by using the data to identify industry and facility safety trends and deficiencies and (2) to determine appropriate allocation of regulator resources and inspections; and e. Be periodically updated to incorporate new learning from world-wide industry improvements in order to drive continuous major accident safety improvements in California.

444 See Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) Section 35. http://www.ptil.no/framework- hse/category403.html#_Toc357595266 (accessed April 14, 2014). 445 Certain information such as the process hazard analysis may contain trade secret or confidential business information that would have to be identified and protected from public disclosure.

Chevron Richmond Refinery Regulatory Report May 2014

94

The Chemical Facility Safety and Security Working Group and the Occupational Safety and Health Administration 2012-03-I-CA-R23 This report highlights significant advantages of the safety case regime over the existing Process Safety Management standard to prevent potentially catastrophic chemical accidents that are relevant to OSHA’s response to Executive Order (EO) 13650. In the development of the OSHA EO response, incorporate a written plan that includes the evaluation of issues raised from the findings, conclusions and recommendations in this report concerning the safety case regime.

Chevron Richmond Refinery Regulatory Report May 2014

95

References

Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004. http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationRe port_2004.pdf (accessed May 8, 2013).

Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007.

Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 2013).

Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; October 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; March 2007.

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., December 2008.

Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990.

Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013).

EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009.

EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19,

1. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012.

Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online].

Chevron Richmond Refinery Regulatory Report May 2014

96

http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%2 0presentation/Lonford%20talk.PDF (accessed May 8, 2013).

Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999;.

Hopkins, Andrew. The Meaning of “Safety Cas”e; February 2013.

HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations;

1. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013).

HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013).

HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries; 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013).

HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,

1. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996.

The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

97

Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013. Citing Zimgast, Erst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-EXTRACT. Risk Engineering Services, Swiss Re. http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

98

Appendix A: Significant Petroleum Refinery Incidents in 2012 1. Tank failure at the ExxonMobil refinery in Beaumont, Texas on 11 January 2. Vessel pressure excursion at the Flint Hills refinery in St. Paul, Minnesota on 22 January 3. Hydrogen Sulfide release from mechanical integrity failure at the Northern Tier Energy refinery in St. Paul, Minnesota on 26 January 4. Sulfuric acid release from a mechanical integrity failure at the ConocoPhillips refinery in Wood River, Illinois on 27 January 5. Hydrogen Sulfide release from mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 31 January 6. Hydrocarbon and hydrogen fluoride release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 31 January 7. Sulfur dioxide and hydrogen sulfide release following a vessel pressure excursion at the Alon refinery in Big Spring, Texas on 1 February 8. Hydrocarbon release from a vessel pressure excursion at the ConocoPhillips refinery in Belle Chasse, Louisiana on 1 February 9. Benzene release from a mechanical integrity failure at the Husky refinery in Lima, Ohio on 16 February 10. Fire at the Tesoro refinery in Salt Lake City, Utah on 17 February 11. Fire at the BP refinery in Cherry Point, Washington on 17 February 12. Tank failure at the Shell refinery in Deer Park, Texas on 22 February 13. Tank failure at the Paulsboro refinery in Paulsboro, New Jersey on 23 February 14. Fire at the Citgo refinery in Corpus Christi, Texas on 24 February 15. Hydrogen Sulfide release from a mechanical integrity failure at the Flint Hills refinery in Rosemount, Minnesota on 28 February 16. Vessel pressure excursion at the Motiva refinery in St. Charles, Louisiana on 28 February 17. Benzene release from a mechanical integrity failure at the Chalmette refinery in Chalmette, Louisiana on 28 February 18. Crude oil release from a mechanical integrity failure at the Flint Hills refinery in North Pole, Alaska on 4 March 19. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 6 March 20. 1 worker was fatally injured and 2 other workers were burned at the Valero refinery in Memphis, Tennessee on 6 March 21. Fire during a hot work activity at the Tesoro refinery in Martinez, California on 7 March 22. Benzene release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 8 March 23. Heavy oil release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 13 March 24. Benzene release from a mechanical integrity failure at the Marathon refinery in Texas City, Texas on 14 March 25. Fire at the PBF Energy refinery in Delaware City, Delaware on 16 March 26. Hydrocarbon release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 19 March

Chevron Richmond Refinery Regulatory Report May 2014

99

Hydrocarbon release from a mechanical integrity failure at the Tesoro refinery in Anacortes, Washington on 23 March

Hydrocarbon release from a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 24 March

Fire at the ExxonMobil refinery in Billings, Montana on 25 March

Hydrogen fluoride release from a mechanical integrity failure at the BP refinery in Texas City, Texas on 27 March

Hydrocarbon release from a mechanical integrity failure at the Total refinery in Port Arthur, Texas on 11 April

Fire at the ConocoPhillips refinery in Rodeo, California on 13 April

Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 16 April

Crane fell over and damaged utility piping at the Citgo refinery in Lemont, Illinois on 17 April

Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 19 April

Fire at BP refinery in Texas City, Texas on 20 April

Hydrocarbon release from a mechanical integrity failure at the ConocoPhillips refinery in Sweeny, Texas on 24 April

Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 8 May

4 workers injured in fire at the Sinclair refinery in Sinclair, Wyoming on 8 May

Hydrocarbon release from a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 8 May

Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 9 May

Fire at the Motiva refinery in Port Arthur, Texas on 12 May

Hydrogen sulfide release from a mechanical integrity failure at the CVR Energy refinery in Wynnewood, Oklahoma on 11 May

Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in Corpus Christi, Texas on 15 May

Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 17 May

Benzene and hydrogen sulfide release from a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 21 May

Fire at the Montana Refining Company refinery in Great Falls, Montana on 24 May

Hydrocarbon release from a mechanical integrity failure at the Valero refinery in Memphis, Tennessee on 25 May

2 workers injured from a fire at the Sinclair refinery in Sinclair, Wyoming on 28 May

Propylene release from overpressure event at the PBF Energy refinery in Delaware City, Delaware on 29 May

Hydrocarbon release from a mechanical integrity failure at the Valery refinery in Houston, Texas on 31 May

Hydrogen and hydrocarbon release due to loss of containment event at the Shell refinery in Deer Park, Texas on 7 June Chevron Richmond Refinery Regulatory Report May 2014

100

Hydrogen sulfide and hydrocarbon release due to flare failure at the Motiva refinery in Norco, Louisiana on 7 June

Fire at the Motiva refinery in Port Arthur, Texas on 9 June

Hydrocarbon release due to a mechanical integrity failure at the BP refinery in Texas City, Texas on 9 June

Fire at the ExxonMobil refinery in Torrance, California on 11 June

Fire at the Total refinery in Port Arthur, Texas on 13 June

Hydrogen sulfide release from a tank failure at the ConocoPhillips refinery in Rodeo, California on 15 June

Hydrocarbon release at the Shell refinery in Deer Park, Texas on 20 June

Fire at the BP refinery in Whiting, Indiana on 21 June

Hydrocarbon release due to a mechanical integrity failure at the Valero refinery in Corpus Christi, Texas on 23 June

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 25 June

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 28 June

Propane release due to a mechanical integrity failure at the Valero refinery in McKee, Texas on 28 June

Sulfuric acid release due to a mechanical integrity failure at the Chevron refinery in El Segundo, California on 2 July

Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Westlake, Louisiana on 14 July

Fire at the Citgo refinery in Corpus Christi, Texas on 16 July

Fire at the Valero refinery in Meraux, Louisiana on 22 July

Sulfuric acid release due to a mechanical integrity failure at the Sunoco Point Breeze refinery in Philadelphia, Pennsylvania on 22 July

Fire at the BP refinery in Whiting, Indiana on 23 July

Hydrocarbon and hydrogen fluoride release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 24 July

Fire at the HollyFrontier refinery in Tulsa, Oklahoma on 2 August

8,614 lbs of hydrogen sulfide were released to the atmosphere due to a mechanical integrity failure on a compressor suction line at the Chevron refinery in Richmond, California on 2 August.

Hydrogen sulfide release from an overpressure event at the Valero refinery in Texas City, Texas on 5 August

Fire at the Sinclair refinery in Sinclair, Wyoming on 5 August

Fire at the Chevron refinery in Richmond, California on 6 August

Fire at the Shell refinery in Martinez, California on 13 August

Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Martinez, California on 14 August

2 workers injured from a fire at the BP refinery in Whiting, Indiana on 14 August

Hydrogen sulfide release due to a mechanical integrity failure at the Phillips 66 refinery in Wood River, Illinois on 22 August Chevron Richmond Refinery Regulatory Report May 2014

101

Fire at the Sinclair refinery in Sinclair, Wyoming on 24 August

Hydrocarbon release due to a mechanical integrity failure at the LyondellBasell refinery in Houston, Texas on 25 August

Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 26 August

Hydrogen sulfide and propylene release due to a mechanical integrity failure at the ExxonMobil refinery in Beaumont, Texas on 29 August

Fire at the Phillips 66 refinery in Rodeo, California on 29 August

A high pressure excursion in a vessel resulted in a hydrocarbon release with offsite consequences at the Holly refinery in Woods Cross, Utah on 30 August

Worker injured following a fire at the Marathon refinery in Detroit, Michigan on 5 September

Chemical release with offsite consequences at the Marathon refinery in Detroit, Michigan on 8 September

Sulfuric acid release due to a mechanical integrity failure at the Tesoro refinery in Martinez, California on 10 September

Carbon monoxide and hydrogen sulfide release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 11 September

Hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 11 September

Hydrocarbon release due to a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 14 September

Unspecified leak at the Tesoro refinery in Martinez, California on 15 September

Hydrocarbon release due to a mechanical integrity failure at the PBF Energy refinery in Delaware City, Delaware on 21 September

Hydrogen sulfide release due to a mechanical integrity failure at the Motiva refinery in Norco, Louisiana on 24 September

1 worker killed and another worker injured from an explosion at the CVR Energy refinery in Wynnewood, Oklahoma on 28 September

Fire at the Motiva refinery in Convent, Louisiana on 1 October

Hydrogen fluoride release at the Placid refinery in Port Allen, Louisiana on 1 October

Hydrogen sulfide release from a high pressure excursion at the Valero refinery in Port Arthur, Texas on 1 October

Fire at the ExxonMobil refinery in Baytown, Texas on 3 October

Vapor cloud release at the Hess refinery in Port Reading, New Jersey on 3 October

Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in Rodeo, California on 8 October

Fire at the Citgo refinery in Corpus Christi, Texas on 9 October

Vapor cloud release with offsite impact from the Kern Oil refinery in Bakersfield, California on 17 October

Hydrocarbon and hydrogen sulfide release from a pressure excursion at the ExxonMobil refinery in Joliet, Illinois on 19 October

Hydrocarbon release due to a mechanical integrity failure at the Citgo refinery in Sulfur, Louisiana on 22 October Chevron Richmond Refinery Regulatory Report May 2014

102

Hydrogen sulfide release at the Chalmette refinery in Chalmette, Louisiana on 23 October

Fire at the Tesoro refinery in Martinez, California on 21 October

Fire at the BP refinery in Texas City, Texas on 30 October

Fire at the Valero refinery in Port Arthur, Texas on 3 November

Benzene release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 8 November

Vapor release at the Tesoro refinery in Martinez, California on 8 November

Hydrogen sulfide release due to a mechanical integrity failure or a high pressure excursion at the Shell refinery in Martinez, California on 24 November

Hydrogen sulfide and hydrocarbon release at the Northern Tier Energy refinery in St. Paul Park, Minnesota on 27 November

Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 1 December

Hydrogen fluoride release that killed one worker, injured 2 other workers and 7 emergency responders at the Valero refinery in Memphis, Tennessee on 3 December

Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 5 December

Hydrogen sulfide release at the Phillips 66 refinery in Wood River, Illinois on 8 December

Fire at the Motiva refinery in Port Arthur, Texas on 11 December

Benzene release due to a mechanical integrity failure at the Alon refinery in Big Spring, Texas on 11 December

Hydrocarbon release due to a mechanical integrity failure at the Shell refinery in Deer Park, Texas on 11 December

Hydrocarbon release at the Shell refinery in Anacortes, Washington on 12 December

Hydrogen sulfide release due to a pressure excursion at the PBF Energy refinery in Paulsboro, New Jersey on 14 December

Hydrocarbon and hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 15 December

Fire at the Motiva refinery in Port Arthur, Texas on 17 December Note -Incidents of hydrocarbon leaks into a cooling tower or releases to a flare system are not included in the above list. Chevron Richmond Refinery Regulatory Report May 2014

103

Appendix B: Regulatory Comparison Table OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime Scope Covered processes excluding oil and gas well drilling and servicing Covered processes excluding oil and gas well drilling and servicing Applies to offshore and onshore oil and gas operations Specific PSM/ Major Accident Focus Yes Yes Yes ALARP or Equivalent No No Yes Adaptability to New or Revised Codes, Standards, Technology, Hazard Information, Lessons Learned, etc. Limited to RAGAGEP –only addresses equipment and mechanical integrity (2 of 14 elements); RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Limited to RAGAGEP – only addresses equipment and mechanical integrity; RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Yes via safety case and supporting framework legislation PSM Indicators Req. No No Yes for Companies Competent Regulator 50% or more Engineers/PSM OSHA-some progress but no Cal/OSHA – some progress but no Yes Sufficient Funding for Competent Regulatory staff OSHA-No California is increasing funding to support additional staff on Cal/OSHA PSM team Yes Hazard Analysis Required – “shall identify, evaluate, and control the hazards involved in the process.” Required – “appropriate to the complexity of the process for identifying, evaluating, and controlling hazards involved in the process.” Is a specific aspect of SC and supporting framework regulation and is required for all onshore and offshore facilities. To meet legislative goal-setting requirements, a structured risk assessment including HA as appropriate is required from all “employers.”

Chevron Richmond Refinery Regulatory Report May 2014

104

Incident Investigation Requires a report but activity- based; requires including “any recommendations resulting from the investigations” (what if there are none?); system required to “resolve the incident report findings and recommendation; no explicit requirement to prevent a similar occurrence or controlling hazards. Requires a report including “any recommendations resulting from the investigation.” System required to “establish a system to promptly address and resolve the report findings and recommendations and…implement the report recommendations in a timely manner, or take action to prevent a reoccurrence.” Investigation of incidents required to demonstrate legal compliance with framework legislation. ‘Reasonably practicable’ requirement would require remedial action and cross company learning from incident investigations. HSE can require SC duty holder compliance with investigation report recommendations (e.g. Buncefield Report-“determine SIL level requirements for overfill protection”) Management of Change Activity-based; the employer “shall establish and implement written procedures to manage changes;” “the procedures shall assure the following considerations are addressed…impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Activity-based: the employer “shall establish and implement written procedures to manage changes…;” “the procedures shall assure that the following are addressed prior to any change…technical basis for proposed change; impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Description of MOC procedures and demonstrations of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Workforce Participation “Employers shall develop a written plan of action regarding the implementation of the employee participation;” Employers shall consult with employees and their representatives on the conduct and development of PHAs and the other elements of PSM in this standard.” “Employer shall develop a written plan of action to ensure employee participation in process safety management;” includes employer consultation with employees and their representatives on the conduct and development of the elements of process safety management required by this section; and providing employees and their representatives with access to all information required to be developed by this section…” Provides for the election of protected safety representative positions and safety committees.

Chevron Richmond Refinery Regulatory Report May 2014

105

Inherent Safety No No Yes

Chevron Richmond Refinery Regulatory Report May 2014

106

Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach

1. Is it true that the safety case regulatory approach leads to self-regulation by industry?

Critics of the safety case regulatory approach have noted that this type of regulatory regime is likely to result in mere industry self-regulation.446 Critics have also noted that this is at least partly due to the fact that there is no will in the US to ensure that regulators have the tools, resources, and competence to effectively regulate workplaces. The CSB and those with experience in developing and implementing the safety case regulatory regime have repeatedly stated that the purpose of the safety case regulatory approach is to ensure that all hazards have been identified, evaluated, and controlled so that risks are reduced to as low as reasonably practicable, or ALARP. In simple terms, the safety case report is a series of claims as to how an installation is being safety operated. The real strength of the safety case regulatory regime is testing the validity of those claims through strategic intervention by competent, well-funded regulators. Advanced performance-based regulatory regimes in the United Kingdom (UK) and Norway, for example,447 incorporate a list of regulator-accepted standards and good practices that provide companies with the minimum performance that is expected. Companies must demonstrate that they meet or exceed those standards. Therefore, companies are aware of minimum performance expectations they must meet as they work to reduce risks to ALARP. If a competent regulator is not in place, then the safety case report equates to nothing more than a lifeless document sitting on a shelf, and the criticism of self-regulation becomes valid.

It is also important to point out that in a letter from the USW Local 5 to the CSB dated November 22, 2013, it was stated that “[t]he current system is truly a self regulated system, with the industry setting the rules, changing the rules, and monitoring themselves.” Individuals are noting that the current system in place has actually led to self-regulation despite the intent of the PSM standard and RMP program to be performance-based.

Critics have also argued that there is a lack of transparency with the safety case regime. However, under the existing PSM standard, none of the PSM elements are made public by the company or the regulator, including the process hazard analyses and management of change documents. To improve transparency, many safety case regimes collect and report indicator data, and companies are required make safety case report summaries publicly available. These are high level documents that are published online and summarize safety assessments, hazardous materials, hazards and control measures, potential major incidents, emergency response, and safety management systems.

Rather than accepting the inevitability of catastrophic events, we should act to prevent them from happening. As discussed in this report, there is a movement in California to improve oversight of

446 See e.g. Rena Steinzor. Lessons from the North Sea: Should “Safety Cases” Come to America? Vol. 38: 417; 2011; p 439. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1735537 (accessed September 4, 2013). 447 Norway requires many similar aspects of a safety case regime offshore but there are differences in implementation and style and content of the regulations. The UK implements a safety case regime both onshore and offshore.

Chevron Richmond Refinery Regulatory Report May 2014

107

petroleum refineries. There has also been increased dialogue in the US in recent years surrounding the regulation of the oil and gas industry and how to make improvements. As such, the support exists to not only shift the current activity-based regulatory structure to a more goal-based safety case regulatory regime, but to also ensure that competent, well-funded regulators are in place to implement and enforce such a regime.

• How does the safety case regulatory regime in the US allow for changes to be made without requiring

rulemaking under the Administrative Procedure Act? The Administrative Procedure Act, or APA, was passed in 1947, and lays out the basic framework under which federal rulemaking is conducted. It defines “rule” as “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency…”448 “Rulemaking” is defined as the “agency process for formulating, amending, or repealing a rule.”449 Federal agencies often impact their specific area of jurisdiction by publishing rules promulgated through notice and comment rulemaking, or informal rulemaking, under the APA. Unfortunately, as this report discusses at length, the rulemaking process in the US is cumbersome and some federal agencies, such as OSHA and the EPA, are subject to additional requirements and more stringent review standards that go above and beyond those contained in the APA. To avoid these additional burdens, many agencies provide further guidance to regulated parties through more informal means, such as answering questions and issuing policy statements, guidance, or opinion letters. Another way to lessen the burden on regulating agencies and their regulated entities is to adopt performance or goal-based regulations rather than prescriptive regulations. Performance-based standards state the objective or outcome to be achieved, such as risk reduction, without describing the specific means of obtaining that objective. This provides the regulated entities with the freedom and flexibility to work to achieve a stated goal, such as reducing risks to as low as reasonably practicable, or ALARP, through their chosen and preferred means.450 Performance-based standards also provide flexibility to the regulator; for example, in a safety case regulatory regime, should the regulator determine through assessment of the safety case report and/or inspection that the facility has not reduced risks to ALARP with regard to a specific hazard, he or she may require that the facility take additional steps to further reduce risk without needing to propose and adopt a new rule or regulation to address it. The regulator must accept the safety case report in order for the facility to operate.

The Regulatory Flexibility Act was passed in 1980 during the Carter Administration. It requires agencies to prepare and make available for public comment regulatory flexibility analyses of proposed rulemaking, and also encourages agencies to consider alternatives to rulemaking, including “the use of performance rather than design standards…”451 Executive Order 13272 then directed federal agencies to establish procedures and policies to comply with the Act.452 Federal agencies have been encouraged to adopt

448 5 U.S.C. §551(4) (2011). 449 5 U.S.C. §551(5) (2011). 450 Such as reliance upon qualitative assessments, quantitative assessments, semi-quantitative risk assessments, and good practice guidance. 451 5 U.S.C. §603(3) (2010). 452 Exec. Order No. 13272, 67 Fed. Reg. 159 (August 13, 2002). http://www.gpo.gov/fdsys/pkg/FR-2002-08- 16/pdf/02-21056.pdf (accessed September 24, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

108

performance-based standards in the US for decades. Recognizing the inefficient process of federal rulemaking in the US, President Clinton signed Executive Order 12866 in September of 1993, which, among other things, directed federal agencies to “identify and assess alternative forms of regulation…[and] specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt.”453 Executive Order 13563, entitled Improving Regulation and Regulatory Review, supplemented and reaffirmed Executive Order 12866 by ordering agencies to “identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of choice for the public.”454 Its stated goal was to “protect public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.”455 Its seven guiding principles are as follows:  Increase predictability and reduce uncertainty;  Use and rely on best available science;  Ensure public participation and open exchange of ideas;  Use the most innovative and least burdensome tools;  Consider cost benefit analysis (quantitative and qualitative);  Ensure regulations are publicly available, consistent, written in plain language and easy to understand; and  Measure results and seek to improve actual results.456

The safety case regime aims to satisfy all of these principles.

California has adopted its own version of the APA, known as the California Administrative Procedure Act (CAPA) (California Government Code §11340 et seq.).457 Among its many requirements for California state agencies that adopt regulations, CAPA directs them to consider the substitution of performance standards for prescriptive standards.458 CAPA defines “performance standard” as “a regulation that describes an objective with the criteria stated for achieving the objective.”459

Federal agencies that are engaged in and responsible for regulating high hazards, such as NASA and the Nuclear Regulatory Commission (NRC), have adopted goal or performance-based standards that require risks to be reduced to “as safe as reasonably practicable” (ASARP) and “as low as reasonably achievable,” (ALARA), respectively. The OSHA Process Safety Management (PSM) standard also contains performance-based elements to some extent; for example, it provides regulated entities with flexibility in how to perform a process hazard analysis (PHA). However, it contains no risk reduction goals such as ALARP. This has resulted in an activity-based regulatory scheme that emphasizes completing activities, such as a PHA or a Management of Change (MOC) analysis, rather than actual risk reduction. Without a risk reduction goal such as ALARP in place, the PSM standard will not have the

453 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.archives.gov/federal- register/executive-orders/pdf/12866.pdf (accessed September 24, 2013). 454 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.gpo.gov/fdsys/pkg/FR-2011-01- 21/pdf/2011-1385.pdf (accessed September 24, 2013). 455 Ibid. 456 Ibid. 457 Available at http://www.oal.ca.gov/administrative_procedure_act.htm (accessed September 18, 2013). 458 California Government Code, §11340.1(a) (1995). 459 California Government Code, §11342.570 (1995).

Chevron Richmond Refinery Regulatory Report May 2014

109

ability to successfully drive continuous improvement and adaptation of industry safety management advances.

• Can the safety case regulatory approach work in the US when workforce involvement is emphasized

less than other regions and unionization rates are lower than other countries? A majority of the workforce in California petroleum refineries is unionized, as the unionization rate for the 14 petroleum refineries in California is actually 73 percent,460 which is significantly higher than the 2012 rates for the US as a whole (11.1 percent), Australia (17.9 percent), the UK (25.8 percent), and Norway (54.7 percent).461 Despite a declining unionization rate in the UK, the region has developed strong onshore and offshore regulations that provide for the creation of protected safety representative positions and safety committees for unionized and non-unionized facilities. These positions are meant to create a healthier and safer workplace, and result in better decision-making regarding health and safety, increased productivity, higher workforce motivation, a stronger commitment to implementing decisions or actions (as employees have been actively involved in reaching these decisions), and greater cooperation and trust.462 The HSE has devoted extensive time and resources to ensuring employers are complying with these regulations and understand the importance and benefits of involving workers in health and safety-related matters.

The UK also has a standard establishing the minimum level of training that elected safety representatives offshore should receive to enable them to fully perform their functions as defined in the Safety Representatives and Safety Committees Regulations – SI 1989/971. This training standard, entitled the OPITO Approved Standard, was developed by an industry workgroup facilitated by OPITO.463 In June 2013, Det Norske Veritas (DNV)464 became accredited by OPITO to offer newly developed training courses to more than 2,000 elected safety representatives in the offshore industry. The training, which has been driven and supported by HSE, Oil and Gas UK, and the Offshore Industry Advisory Committee’s Workforce Involvement Group, consists of four separate Modules run over the course of eight days.465 The training covers topics such as Understanding and Identifying Major Accident Hazards and Investigating Incidents and Applying Root Cause Analysis.

The CSB recognizes the HSE’s effort to improve workforce involvement through regulations, protected positions, and training, and has recommended in this report that California develop regulations and guidelines to establish similar protected safety positions to ensure effective workforce participation. The

460 In September 2013, the USW provided the CSB with a list of California petroleum refinery locations as of October 2012 and the existing unionization representation at those refineries. Of the 15 petroleum refineries operating in California as of October 2012, 11 of those were unionized, with USW providing the union representation at all 11 facilities. 461 For complete statistics on trade union density for countries around the world see http://stats.oecd.org/Index.aspx?QueryId=20167 (accessed September 5, 2013). 462 HSE. Consulting employees on health and safety: A brief guide to the law. 2013; p 2. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 5, 2013). 463 OPITO is an industry-owned non-profit that serves the needs of the oil and gas industry in the UK and around the world. See http://www.opito.com/ (accessed September 10, 2013). 464 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 465 http://www.marinelink.com/news/launches-offshore355749.aspx (accessed September 10, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

110

CSB believes the HSE model can also be effective in the US as these regulations require effective safety representation regardless of unionization rates.

• Has the safety case regulatory approach resulted in fewer major accidents?

The CSB has identified a small number of independent studies conducted on the impact of the safety case regulatory approach on safety performance onshore and offshore. In 1999, a report commissioned by the HSE (“the Aberdeen Report”) which evaluated the impact of the offshore Safety Case Regulations on offshore safety was published.466 One of the purposes of the study was to review published safety data for trends in offshore accidents and incidents from 1990 until 1997.467 Upon this review, it was determined there had been a decrease in accidents since the implementation of the offshore safety case regulations in the UK, but cautioned it was difficult to distinguish the effect of the safety case regulations from other industry activities such as the level and type of exploration and production activity, oil prices, and industry-led initiatives.468 The Aberdeen Report also cautioned about the difficulties in analyzing offshore data that also hold true for the more current data presented in Figure 3. The total number of accidents and incidents recorded can be affected by industry attitudes toward reporting, changes in how and what data is reported, and the decrease or increase in offshore activity. As stated in the Aberdeen Report, “[d]espite these cautions, accident statistics play an important role in the analysis of the state of safety in any industry, since accidents represent the ‘bottom line’ in safety. It is therefore important to analyze the trends, but to also take the drawbacks into consideration.”469 As discussed in this report, the reporting and analyzing leading process safety indicators is important to gain a better understanding of how safety management systems are functioning, and thus a better idea of how well the various regimes are managing hazards and mitigating risk. Statistics from the seven years covered by the Aberdeen Report indicated an overall decrease in reported accident rates in the UK and Norwegian databases up until 1994. From 1994 to 1997, both the UK and Norway reported a slight increase in the number of reported accidents.470 Norway did report a drop in 1997 from 1996. The decrease reported up until 1994 for the UK appeared to be independent of the offshore production activities as those levels had been on the increase during the same time period. Drilling in the UK decreased during the same time frame, making the cause for the decrease in reported drilling accidents unclear. More recent reviews of accident data indicate decreasing trends in accident statistics. The Presidential Oil Spill Commission noted the following in its report to the President on the Macondo disaster: [f]rom 2004 to 2009, fatalities in the offshore oil and gas industry were more than four times higher per person-hours worked in U.S. waters than in European waters, even though many of the same companies work in both venues. This striking statistical discrepancy reinforces the view that the problem is not an inherent trait of the business itself, but rather

466 Evaluation of the Offshore Safety Legislative Regime—A study undertaken by AUPEC Ltd. For the Safety Policy Division, Health & Safety Executive, Ref: 8938/3714, June 1999. 467 Ibid at Ch 7. 468 Ibid at Ch 7, p 7-1. 469 Ibid at Ch. 7, p 7-11. 470 This was based on the number of accidents per million man hours for the two Continental Shelves (Ibid, Figure 7.8)

Chevron Richmond Refinery Regulatory Report May 2014

111

depends on the differing cultures and regulatory systems under which members of the industry operate.471

In September 2013, Det Norske Veritas (DNV)472 released a position paper discussing necessary improvements to reduce risk of major offshore accidents, and noted in the report that “there are no good globally accepted metrics for major accident hazards…”473 However, DNV was able to point to UK HSE’s Hydrocarbon Releases Database System (HCR)474 in the North Sea to provide an example of improving safety performance trends.475 The HRC contains detailed voluntary information of over 4,000 hydrocarbon releases offshore from close to 300 installations since 1992. The HRC data, plotted in Figure 3, show the total number of releases to be on the decline. Classifying the severity of a release is based on agreed-upon criteria with the offshore industry.476 The UK has defined significant events to be those that, if ignited, have the potential to cause a major accident where multiple casualties could occur. The occurrence of any hydrocarbon release is undesirable because of the potential to escalate, and so reporting data from minor incidents has also been included in Figure 3 below.

Figure 3. Hydrocarbon releases in the North Sea reported to UK HSE as dangerous occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations.477

471 National Commission on the BP Deepwater Horizon Oil Spill. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President; January 2011; Ch 8 p 225. 472 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 473 DNV. Enhancing offshore safety and environmental performance: Key levers to further reduce the risk of major offshore accidents. 2013; p 5. http://www.dnv.com/industry/oil_gas/services_solutions/offshore_safety.asp (accessed September 10, 2013). 474 https://www.hse.gov.uk/hcr3/ (accessed January 13, 2014). 475 In its position paper, DNV cited data from 1996, but UK HSE has noted that the criteria for severity classification was refined in 1999 so data since that date is presented here. 476 Hydrocarbon Releases System Internet Help File, https://www.hse.gov.uk/hcr3/help/help_public.asp (accessed September 10, 2013). 477 RIDDOR – Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 became effective offshore on April 1, 1996, http://www.hse.gov.uk/riddor/ (accessed September 10, 2013) 0 50 100 150 200 250 Reported Releases Financial Year (April‐March)  2000/01 to 2012/13 Minor Significant Major Total

Chevron Richmond Refinery Regulatory Report May 2014

112

It is important to note that major accidents are low-probability, high-consequence events, and as such they are difficult to measure. According to Dr. Andrew Hopkins, major accidents are more difficult to define than, say, a car accident, and they are rare, making it difficult to estimate the number of major accidents prevented.478 In addition, based on the data in existence, there is a continued need for improved data collection; key leading performance indicators development and implementation on a global scale would provide an improved glimpse into how safety is being managed for major accident prevention.

A team of three independent safety experts was asked to conduct an independent evaluation of the operational effectiveness of the National Offshore Petroleum Safety Authority (NOPSA), which was established in January 2005 to regulate offshore health and safety in Australia (it was superseded by NOPSEMA in January 2012). The 2008 report released as a result of the evaluation noted that the team of experts received submissions identifying issues surrounding the safety case regime from twelve stakeholders, including the Australian Workers Union, the Maritime Union of Australia, and the International Association of Drilling Contractors. The report states that a majority of the submissions expressed that the safety case regime had “generally been a success…” and “had led to improvements and already brought forth better consistency in many areas….”479 The report noted that there was general stakeholder agreement “that the regulatory processes have been improved.”480

As mentioned in Section 3.2.1.2 of the report, following the Macondo incident in April 2010, an independent review of the offshore safety case regime in the UK was conducted by a panel consisting of three independent appointees, including Professor Geoffrey Maitland at Imperial College London. A report was published discussing the review in December 2011, and it noted that, while not perfect, the offshore safety case regime was “robust and effective at identifying risks and appropriate measures for mitigation and response….”481 The report stated the following:

From its analysis of the existing UK framework and the information it gleaned from its discussion with those directly involved in the sector from both an operational and regulatory perspective, the Review Panel was reassured that the UK regime already incorporates a number of positive, key features which were not present in the US at the time of the Macondo incident. At a high level, the Panel notes and commends in particular:

• the UK’s “goal-setting” safety regime and its ability to foster innovation and continuous improvement in process integrity,

478 Hopkins, Andrew. The Cost-Benefit Hurdle for Safety Case Regulation: A discussion paper prepared for the US Chemical Safety Board. Add Date, Page, and Link. 479 Ognedal, Magne; Griffiths, Derek; and Lake, Bruce. Review of the National Offshore Petroleum Safety Authority Operational Activities. February-March 2008; p 14. 480 Ibid at 28. 481 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011; p 4. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed January 13, 2014).

Chevron Richmond Refinery Regulatory Report May 2014

113

• the strength of the mechanisms in place for independent, third party verification in the crucial areas of well design and integrity of safety critical equipment,

• the rigour with which the potential environmental impacts of the industry are examined and of the controls and procedures in place to mitigate them,

• the detailed and comprehensive emergency response framework which exists for managing the consequences of incidents should they occur,

• the high regard in which the UK authorities, in the form of DECC, HSE and MCA, are held both by UK operators and international observers,

• the fact that the events in the Gulf of Mexico have clearly acted as a catalyst for UK operators, working in concert with the regulators and other stakeholders, to redouble their efforts to improve safety and to strengthen response capabilities.482

• The UK HSE has published reports483 showing significant industry problems with maintenance of

safety critical equipment, poor understanding of the potential impact of degrading plant and utility systems on safety critical elements, and lack of understanding of the role of asset integrity and the concept of barriers in major hazard risk control. Don’t these reports developed by the UK regulator demonstrate that the safety case is not effective and is not working? The CSB recognizes that there have been critiques of the safety case regime and its implementation. The CSB acknowledges that the safety case is not perfect and that no regulatory system will be perfect in its implementation. Some have noted the issue of aging equipment due to many issues, including the harsh conditions that exist in the North Sea. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferrals of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters, rather than anticipating worst-case scenarios. However, the safety case regime’s adaptive nature has been able to address these concerns. The HSE has recognized asset integrity management and the issue of ageing equipment as key issues to address in its inspection programs, and has developed internal processes and priorities for these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life.484 The same year, the HSE published a report intended 482 Ibid at 3. 483 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf (accessed August 28, 2013). 484 The report is available at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

114

to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide,485 which provides an overview of ageing plant mechanisms and their management and presents the findings of an analysis of loss of containment incidents to indicate the extent to which ageing plant equipment may be a factor. This type of programmatic proactive approach and information dissemination is lacking in the US both on and offshore.

• How have other countries implemented the safety case regime? What challenges do the countries face

when transitioning to a safety case approach? From the international safety case community, the CSB has found that when transitioning to a safety case regime there are many obstacles that may hinder the transition, such as:

 Major stakeholders not being committed to the process, unconvinced of the need;  Lack of understanding that the safety case regime is a “process” to be undertaken by the duty holder and the workforce to improve understanding of the hazards, risks, and their controls, and to put in place measures for continuous improvement, rather than just creation of a “document”;  Lack of sufficient funding by government and industry; and  Lack of the necessary legislative timetable.

The transition to a safety case regime has significant challenges for both the duty holder and the regulator, including:

 The safety case report could be treated as a check-the-box exercise;  Documented safety management system does not reflect reality;  Poor identification of hazards and risks;  Poor understanding of the performance of control systems;  Attempting to justify existing controls rather than to seek opportunity to improve;  Insufficient workforce involvement in the process;  The safety case process is under-resourced;  The safety case report is “inaccessible” so the report simply lives on the shelf;  The regulator does not use the safety case report to inform the inspection or audit;  Limited requirement for the reporting of accidents, dangerous occurrences and precursors resulting in lack of comprehensive performance data; and  The regulator is under-resourced, technically challenged, poorly trained, has poor systems and procedures, and is inconsistent.

In implementing the safety case regime, there should be regard for the regulatory principles and frameworks which represent best practice. The underlying principles are:

 The legislation and regulation should be fit for purpose, not simply superimposed on existing prescriptive regulation;

485 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013).

Chevron Richmond Refinery Regulatory Report May 2014

115

 Regulation should be effective and efficient; and  Industry should move away from a culture of compliance with detailed prescriptive regulation to one of involving the workforce in understanding the hazards.

Some significant points worth noting from international experience in setting up the regulation are:

 Staff should be recruited against detailed job descriptions and should cover the full range of technical, management and regulatory requirements;  Pay rates and terms and conditions should be sufficient to attract highly qualified staff;  A competency framework needs to be developed reflecting the required knowledge, skills, and experience required to undertake;  Appropriate training programs must be in place;  An electronic dedicated safety case assessment procedure which captures the detail of the process to be followed and records the background to the decision-making process will be needed. This helps ensure good quality, consistent, and transparent assessment and provides a database of information which is used for future validation/topic facility inspections. It also provides a comprehensive record of the process which can be used in the event of an appeal against an assessment decision;  An accident and dangerous occurrence data base will be needed to store knowledge and data to provide reference information and the capacity to analyze trends; and  An emergency reporting and response process is necessary to ensure all significant events are properly logged and dealt with.

Chevron Richmond Refinery Regulatory Report May 2014

116

Appendix D: CSB Staff Response to the Board’s Motion to Postpone issued on January 15, 2014 Background

On January 15, 2014, the CSB held a public meeting in Richmond, California, to present the draft Chevron Regulatory Report for a vote by the Board. In the first CSB Chevron Report (the Chevron Interim Report), which was approved by the Board on April 19, 2013, the CSB staff committed to investigating additional issues which would be presented in a final report on the incident. These issues included the regulatory oversight of petroleum refineries in California. Due to deployments to West, Texas, and Geismar, Louisiana, the CSB Chevron investigation team produced a second interim draft report focused solely on the regulation of petroleum refineries. At the Richmond public meeting, the Board moved to postpone a vote on the draft regulatory report in order for the CSB investigation staff to address additional issues raised concerning regulatory oversight of petroleum refineries and the proposed safety case regime. The CSB staff was given 120 days from the date of the public meeting to respond to the motion. The following document contains the CSB staff’s response.

I.

Does Cal/OSHA have sufficient authority to require timely abatement of hazards associated with serious and willful violations? CSB Investigations Staff Response:

Following the August 6th incident at the Chevron Richmond Refinery, Cal/OSHA cited Chevron for, among other things, failing to replace pipe clamps at the refinery, and ordered Chevron to replace those pipe clamps by a certain date. The CSB Chevron Interim Report states that Chevron has a history of frequently using leak repair clams to externally stop process fluid leaks, and that following discovery of the leak on the 4-sidecut piping prior to the incident, “Chevron hoped to forestall a shutdown by installing a leak repair clamp.”486 The CSB determined that Chevron had more than 100 clamps on hydrocarbon and other piping components containing hazardous flammable process fluids at the Richmond refinery and that reliance on such clamps to mitigate leaks “identifies serious questions about its mechanical integrity program.”487 The interim report, which was approved by the Board on April 19, 2013, committed to evaluating the Chevron Richmond Refinery’s use of clamps and its mechanical integrity program as they relate to the refinery’s process safety culture in the final CSB report on the Chevron incident.

A letter written by California Representative George Miller dated January 15, 2014, which was delivered to Chevron investigators at the January 15th public meeting, discussed Chevron’s use of clamps and expressed concern that some of the clamps have not been replaced, and will not be replaced until late

486 CSB. Chevron Interim Report. April 19, 2013; p 62. 487 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

117

• The letter stated that under the California Labor Code, an employer is not obligated to correct a

Cal/OSHA safety violation if they appeal. According to Representative Miller, Chevron appealed its Cal/OSHA citations on February 19, 2013. In the letter Rep. Miller requested that given these facts, the CSB investigators should assess the issue of timely abatement, and consider making recommendations to the Legislature and Governor on this matter. The first question raised by the Board in its motion to postpone is the same as the first issue raised in Representative Miller’s letter. The CSB staff notes that while it has already committed to evaluating the use of clamps at the Chevron Richmond Refinery as it relates to mechanical integrity and process safety culture, we are not aware of a causal connection between the refinery’s use of the clamps to mitigate leaks and the August 6th incident. Regulatory bodies often cite companies for deficiencies following an incident that are not related to that incident. However, the CSB is directed under the Clean Air Act to “investigate (or cause to be investigated), determine and report to the public in writing the facts, conditions, and circumstances and the cause or probable cause” of an accidental release.488 (emphasis added). The CSB’s Board Order 040, Procedure G: Causal Analysis, discusses requirements of formal analysis tools that identify the multiple causes of an incident, including technical, organizational, and societal causes. Thus, while the CSB staff committed to analyzing the issue of clamps at the refinery as it pertains to safety culture, the staff did not analyze the usage of clamps and abatement in its regulatory report, as it was not determined to be causal and was therefore not within the scope of the regulatory investigation.

Should Contra Costa County Health Services have direct enforcement authority under the Industrial Safety Ordinance? CSB Investigations Staff Response:

This question mirrors the second issue Representative Miller raises in his letter – that enforcement under the Industrial Safety Ordinance (ISO) is through the District Attorney, while Contra Costa County has the authority to enforce the California Accidental Release Program (CalArp) regulations because CalArp is considered to be a CUPA program, while the ISO is not.

The CSB staff looked into this matter further, including interviewing key personnel, and determined that while having enforcement power is generally beneficial, a CSB recommendation on the issue is not warranted in this case, as Contra Costa County’s lack of enforcement authority under the ISO is not causal to the August 6th incident. According to Contra Costa County officials, the inspectors have never gone to the District Attorney to enforce the ISO. In addition, these officials have stated to the CSB that the Chevron Richmond Refinery has cooperated fully with past recommendations and has addressed any violations issued as a result of any audit conducted by Contra Costa County inspectors. While the CSB agrees that having enforcement power provides the regulator with another tool to ensure compliance with regulations, there is no causal connection to the August 6th incident and therefore no additional recommendation regarding this issue is warranted.

488 42 U.S.C. §7412 (r)(6)(C)(i) (1990).

Chevron Richmond Refinery Regulatory Report May 2014

118

Does Contra Costa County Health Services have sufficient resources to conduct comprehensive inspections and retain technically qualified personnel? CSB Investigations Staff Response:

This question mirrors the third issue brought up in Representative Miller’s letter – he would like to see additional resources allocated to the Contra Costa Hazardous Materials Program to allow for additional hiring of qualified inspectors. The draft report discusses on the bottom of page 90 the lack of resources and funding within the Contra Costa Hazardous Materials Program, which has limited its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County. The engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which has experienced annual budget reductions in the millions. Again, the CSB did not find that this lack of funding was necessarily causal to the incident. However, the CSB staff proposes to produce the following additional recommendations in the draft regulatory report for additional funding:

Mayor and City Council, City of Richmond, California

2012-03-I-CA-R21

Implement or cause to be implemented a compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with California petroleum refineries.

Board of Supervisors Contra Costa County, California

2012-03-I-CA-R22

Implement a compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with California petroleum refineries. 4. Does Contra Costa County Health Services have sufficient authority to require facilities to undertake feasible risk reduction measures, such as best practices, which go beyond minimum regulatory requirements?

CSB Investigations Staff Response:

This last question mirrors the fourth and final issue discussed by Representative Miller in his letter – the need to authorize Contra Costa regulators to require risk reduction measures that go beyond regulations. He requests that the CSB make recommendations to strengthen the ISO by authorizing the Contra Costa

Chevron Richmond Refinery Regulatory Report May 2014

119

County Hazardous Materials Program officials to require refineries to adopt best industry practices or standards as part of its tool kit.

The draft report discusses on page 89 that Contra Costa engineers conduct CalArp and ISO/RISO audits concurrently at each covered facility generally once every three years. The engineers are only able to audit against the regulatory requirements, and while they can issue “consider” action items to the facility recommending actions above and beyond regulatory requirements, they do this very infrequently.

The Chevron Interim Report addressed ISO regulatory deficiencies, including the fact that there is no required implementation of inherent safety (unlike in the safety case). The Interim Report issues recommendations R3, R4 and R6 and R7, which request the City of Richmond and Contra Costa County to revise the ISO to require damage mechanism hazard reviews and the documented use of inherently safer systems analysis and the hierarchy of controls “to the greatest extent feasible” in establishing safeguards for identified process hazards. The recommendations note that the goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable, or ALARP.

The ISO is currently being revised to implement these recommendations, and should be finalized as early as June 2014. The revised regulatory language would require facilities to reduce risk to “the greatest extent feasible,” which is a concept that is very similar to ALARP. Contra Costa County will have the ability to issue guidance that elaborates on what will be required to achieve that standard.

The CSB staff believes that these recommendations cover the issue raised in this question, and no additional recommendations are warranted.

II.

Note: CSB staff members Don Holmstrom, Cheryl MacKenzie, and Amanda Johnson traveled to the United Kingdom (UK) with Board Member Mark Griffon March 4th through the 14th to gather additional information on how the safety case is implemented and enforced in the UK for both the onshore and offshore oil and gas industry. The information gathered was produced in a notes document that was sent via email to CSB employees and Board members on March 31, 2014, and discussed with all agency staff and the Board on April 15, 2014. The information gathered by the CSB staff is also reflected in the responses to Part II of the Board Motion.

The CSB staff shall convene a multidisciplinary expert panel (selected by the full Board), similar to the Baker Panel established after the BP Texas City incident, to provide the agency with an assessment of the following topics regarding regulating process safety in refineries in California:

• To address questions raised in the comments received by the CSB, the panel shall assess the

available process safety performance data to evaluate the effectiveness of the safety case regulatory model for refineries. CSB Investigations Staff Response:

Chevron Richmond Refinery Regulatory Report May 2014

120

It is necessary first to address the issue of convening a panel. Creating a panel similar to the Baker Panel, which cost roughly $30 million (funds that were fully covered by BP), would require a considerable amount of time, money, and resources that the CSB cannot afford. In addition, there are a number of procedural steps that must be met in order to establish this type of panel, known as a Federal Advisory Committee Act, or FACA, committee -- drafting and approval of a charter (including publication in the Federal Register), selection of Panel Members, financial conflict checks for Panel Members, need to maintain Panel membership balance, public meeting notices, etc. An advisory committee under the FACA can be created only when it is essential to the performance of a duty or responsibility conveyed upon the executive branch by law or Presidential Directive. Finally, Executive Order 12838 issued by President Clinton ordered executive departments and agencies to refrain from creating or sponsoring a new advisory committee subject to FACA “unless the committee is required by statute or the agency head (a) finds that compelling considerations necessitate creation of such a committee, and (b) receives the approval of the Director of the Office of Management and Budget.489” The CSB staff advises that creating a panel in this instance is neither compelling nor feasible.

To address Question 1, it is important to note that the Chevron Regulatory Report Draft FAQ 4 addressed the data surrounding the safety case and the occurrence of accidents. The FAQ stated that UK Health and Safety Executive’s (HSE’s) Hydrocarbon Releases Database System (HCR)490 in the North Sea, which contains detailed voluntary information of over 4,000 hydrocarbon releases offshore from installations since 1992, shows the total number of hydrocarbon releases offshore to be on the decline. The draft report also stated on pages 57 and 58 that the Petroleum Safety Authority (PSA) in Norway conducts analysis of indicator data as well and produces results on its website. Its analysis showed a decreasing trend in the number of reported hydrocarbon leaks offshore between 2007 and 2010. According to the data the Oil & Gas UK is collecting, the number of hydrocarbon releases has decreased over the last three years (roughly cut in half), but now they are going back up again, and they working to determine why. This highlights the usefulness in the collection and publication of indicator data, and it helps the industry to work towards continuous improvement.

While in the UK, the CSB staff spoke with Peter Davidson of the UK Petroleum Industry Association (UKPIA), a trade association that represents 9 member companies in the downstream oil and gas industry. This includes seven onshore petroleum refineries and roughly 30 terminals in the UK.491 The CSB staff learned that API 754 was adopted by UKPIA for onshore facilities in the UK, except that it was improved by adding criteria for root causes, and a tier 3 for small fire was created. UKPIA collects indicator data annually from all facilities within the onshore downstream oil and gas sector, analyzes the data, and produces an external report that is published and shared with the companies and with the public on their website. A more detailed analysis is published internally, and it drives UKPIA’s agenda. The UKPIA’s most recent annual Statistical Review (2013 Statistical Review), which is currently available on the UKPIA website,492 includes a section entitled Process Safety, which UKPIA states was produced as one of the key objectives of the UKPIA’s commitment to process safety, and in response to improvements

489 Termination and Limitation of Federal Advisory Committees. Exec. Order No. 12838, 58 Fed. Reg. 28 (February 12, 1993). http://www.archives.gov/federal-register/executive-orders/pdf/12838.pdf (accessed April 3, 2014). 490 https://www.hse.gov.uk/hcr3/ (accessed April 3, 2014). 491 See http://www.ukpia.com/home.aspx for more information. 492 See http://www.ukpia.com/files/pdf/statsreview2013.pdf (accessed April 3, 2014).

Chevron Richmond Refinery Regulatory Report May 2014

121

being made post-Buncefield regarding the reporting of key process safety performance indicators. This section provides data based on the indicators gathered that are classified as Tier 1, Tier 2, and Tier 3. According to the published data, the number of Tier 1 and Tier 2 events at refineries has decreased between 2010 and 2012 as well as the number of Tier 1 fires or explosions by consequence and the number of Tier 2 events by consequence.493 They want more sharing and learning from incidents, and want to improve searchability of data on their website.

• Assess the challenges of making safety case operational and effective with regard to the following

topics: a. What is the role of transparency and community involvement under this regime? Are safety case reports made public?

CSB Investigations Staff Response:

In Australia, a summary of the safety case report is made public. In the UK, the CSB staff has learned that prior to 9/11 a similar summary was made publicly available. However, due to security reasons post- 9/11, the UK ceased to make that summary available under a Secretary of State order. A redacted version is available through the FOIA process in the UK. For example, the Elgin installation safety case was made available through a FOIA request following the 2012 Elgin blowout incident. Seveso III, the EU directive that will be effective as of June 2015, will broaden the availability of information. Seveso III “strengthens a number of areas such as public access to information and standards of inspection….”494 As the Chevron Regulatory Report Draft notes, the Seveso II Directive is currently implemented in the UK through the Control of Major Accident Hazards (COMAH) Regulations. Seveso III will be implemented through new COMAH Regulations as of June 1, 2015.

According to the HSE, the European Commission updated the Seveso Directive in accordance with the Aarhus Convention on public information, public participation in decision-making, and access to justice on environmental matters. The changes will mean that “the level and quality of information for the public will need to be improved…[and] the information will need to be available electronically and kept up to date.”495 In addition, “[r]equests from the public to see a safety report will be considered on a case-by- case basis as the current Secretary of State Direction will no longer apply.”496 The HSE told the CSB that Seveso III also calls for public reports which show how the performance of industry has improved or worsened.

In addition, as mentioned above, the UKPIA publishes numerous documents, including statistical reviews containing data analysis on its website to aid in transparency and community awareness. The HSE told the CSB staff that there is also transparency in the way the HSE does its work. For example, the HSE enforcement decision processes for the safety case are available to the public online. The decision

493 Ibid at 44 – 46. 494 See http://www.hse.gov.uk/seveso/introduction.htm (accessed April 3, 2014). 495 See http://www.hse.gov.uk/seveso/public.htm (accessed April 3, 2014). 496 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

122

process for accepting or rejecting a safety case is also public. Oil & Gas UK stated to the CSB staff that they publish a list of incidents on their website that includes the name of the operator, the type of release, and the quantity. They also have data on safety critical backlog and other metrics on their website.

The level of transparency the team saw in the UK is much greater than in the US – the regulator’s activities, standards, data, and other information is made available online to the public and is part of how these groups are continuously working in the UK to improve process safety. The potential recommendation to California in the Chevron Regulatory Report Draft addresses the importance of transparency and community involvement, as it includes a provision to require “reporting of information to the public to the greatest extent feasible such as a summary of the safety report, the process hazard analysis, a list of safeguards implemented and standards utilized to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards and management systems….”

b. How are workers empowered as part of the tripartite model? Have there been retaliatory actions taken against workers for their involvement, and what protective measures are in place?

CSB Investigations Staff Response:

The CSB staff spent one of its days in the UK at a launch of a workforce initiative of great importance called the Workforce Engagement Support Team, or WEST. WEST is a workforce-led organization with tripartite membership from industry, the workforce, unions, and the regulator with the goal of creating a single consistent workforce agenda. This event brought together hundreds of individuals from the offshore oil and gas industry, including safety representatives, unions, and the HSE. The CSB staff set up a booth at the event and held 30-minute sessions where we engaged in an open dialogue with attendees discussing workforce engagement and involvement issues offshore. The CSB staff heard a lot from workers and safety representatives about the various levels of workforce involvement. One individual stated that best practice was introduced by the safety case, and this does not exist with compliance-based regulation. Another person stated that if a safety case is deficient, that means there was likely a lack of workforce involvement. We heard that there is safety representative involvement in ALARP, bowtie development and review, hazard analysis, and other safety activities. We also heard that the level of involvement may depend on the culture of the installation. It was really a defining moment to experience this kind of open dialogue between different groups that have come together to work to improve safety offshore. The CSB staff has never seen this kind of communication or collaboration in the US.

In addition, two years ago Step Change launched the workforce engagement tool – a survey meant to measure workforce involvement and organizational culture of each offshore manned facility. Over 10,000 workers have taken the survey and the results are currently being analyzed. Workers at the WEST launch told the CSB that the surveys are helpful and allow each installation to drive forward and improve.

The potential recommendation in the Chevron Regulatory Report Draft reflects the importance of workforce involvement, as it proposes that California “[u]se[] a tripartite model where the regulator, the company, and the workers and their representatives play an equal and essential role in the direction of preventing major accidents.” The CSB has also noted that while workers do not have stop work authority

Chevron Richmond Refinery Regulatory Report May 2014

123

in the UK, they do in Norway. Unions in the UK, such as Jake Molloy with RMT, have argued for stop work authority for UK offshore workers. The CSB staff included language in its potential safety case recommendation to California reflecting the importance of this type of authority. The potential recommendation currently states: “The representatives should also have the authority to stop work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to address the safety concern.”

c. Are safety committees mandatory or optional in non-union workplaces? How are safety committee members selected, and under what authority?

CSB Investigations Staff Response:

The Chevron Regulatory Report Draft discusses on page 54 the fact that the law in the UK provides for consultation with employees or their safety representatives on health and safety matters at both unionized and non-unionized onshore facilities under the Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996. It is important to note, however, that all onshore oil and gas facilities in the UK are unionized. These regulations go further than the OSHA PSM standard in that they provide for the election of safety representatives by workers to serve many health and safety-related functions, including investigating complaints and accidents, and carrying out inspections. The regulations also require employers to establish a safety committee when one is requested by at least two health and safety representatives.

According to the HSE offshore division, it is up to the companies to decide how much they involve workers. Safety representatives have the legal right to initiate their own investigations, conduct inspections, resolve hazard complaints, and participate in risk management reviews and the development of safety case reports. The HSE also stated that an issue has been the competency and sufficiency of training of the safety representatives, and as such, the HSE is initiating more training to improve the involvement of safety representatives.

The Chevron Regulatory Report Draft proposes that California develop a regulatory model and accompanying guidance based on these UK regulations, and that the elected representatives should have a legally recognized role that goes beyond consultation in activities such as the development of the safety report, process hazard analysis, management of change, incident investigation, audits and identification and effective control of hazards. Workforce participation practices should be documented by the company and submitted to the regulator.

d. Is there a public data base of incident and near miss reporting? How are process safety performance indicators developed and used? Are these made public?

CSB Investigations Staff Response:

As discussed above, UKPIA collects Tier 1, Tier 2, and Tier 3 indicator data annually from all facilities within the onshore downstream oil and gas sector, analyzes the data, and produces an external report that

Chevron Richmond Refinery Regulatory Report May 2014

124

is published online and shared with the companies and with the public on their website. A more detailed analysis is published internally, and it drives UKPIA’s agenda. According to the COMAH Process safety performance indicators Operational Delivery Guide, by the end of 2015 all COMAH sites will measure their performance using “key leading and lagging performance indicators.”497 The expectation for COMAH sites as noted in this document is as follows:

– Have a programme for PSPIs [process safety performance indicators] – as one of the main ways the adequacy and performance of PS risk is managed, – PSPI’s are linked to effective Process Safety Leadership and should be used to inform high level decision making, – KPIs should be set according to risk profile of the activities undertaken – Adopt both Outcome (lagging) and Activity (leading) indicators, – Use the findings from the KPI programme to drive improvements on site, and – share sector performance data with the CA as part of a dialogue about performance.498

Inspectors are expected to monitor progress made towards the development of these indicators every 12 months and ensure it is “based on sound decisions/information.”499

Offshore, the HSE collects major accident data, hydrocarbon releases, and dangerous occurrence data. The offshore industry also collects a number of indicators and voluntarily provides them to Oil & Gas UK for annual industry data analysis. This data includes hydrocarbon releases, safety critical maintenance backlog, the number of failure identified by third party verification, the number of operational risk assessments in place, and employee involvement (scores of each facility based on safety culture survey). During the regulator’s inspection process, also known as the intervention, the HSE can ask for information on the company’s indicator’s system and for all of this industry-wide key performance indicators (KPI) data. The Oil & Gas UK is looking at what else could be usefully collected, and they are working on sharing more information. They want more sharing and learning from incidents, and want to improve searchability of data on their website. According to the data the Oil & Gas UK is collecting, the number of hydrocarbon releases has decreased over the last three years (roughly cut in half), but now they are going back up again, and they working to determine why. This highlights the usefulness in the collection and publication of indicator data, and it helps the industry to work towards continuous improvement.

e. How are standards for minimum levels of risk set (ALARP presumably goes beyond minimum levels)?

CSB Investigations Staff Response:

497 COMAH Competent Authority Workstream 2e, Process safety performance indicators (Operational Delivery Guide); p 3. http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed April 14, 2014). 498 Ibid. 499 Ibid.

Chevron Richmond Refinery Regulatory Report May 2014

125

For both the onshore and offshore safety case regime, a majority of the time ALARP is determined by existing best practices or standards. The regulator does have the ability to require a company to go above and beyond best practice to reduce risk. According to the HSE onshore division, ALARP is an active process and dialogue between inspectors and the duty holder. It is not simply a paper exercise; there is rigorous back and forth. The initial calculation of ALARP by the duty holder onshore is quantitative. Then the question becomes, “can I/you do more to reduce risk?” There is a risk carrot posted on the HSE website that illustrates the goal of moving risk down toward the bottom of the carrot. The aim is to get to the broadly acceptable risk level, which usually involves both quantitative and qualitative analysis tools. According to Peter Davidson of UKPIA, there has been increased focus onshore on ALARP since the 2005 Buncefield incident. If a new standard does come into existence, an existing facility must do a quantitative and qualitative gap analysis to demonstrate whether they can effectively mitigate risk without following the new standard.

A lead inspector with HSE onshore told the CSB staff that he has an initial safety report rejection rate of almost 100 percent, and that there is an ongoing dialogue/negotiation that occurs between the regulator and the duty holder as to reduction of risk. This ongoing dialogue of risk assessment and reduction was said to be more valuable than the safety report itself. As such, the credibility, persuasiveness, and personal communication are key attributes of HSE inspectors.

f. What are the enforcement methods used by regulators under the safety case?

CSB Investigations Staff Response:

Post-Buncefield, the HSE onshore stated to the CSB that they greatly emphasize interventions, or inspections, to ensure that companies are fulfilling their safety reports. Roughly 70 percent of an HSE onshore inspector’s time is spent inspecting. They greatly emphasized to the CSB staff importance of the inspections and dialogue between the inspector and the duty holder rather than the safety report document itself. They stated that the rest of an inspector’s time is spent on safety report assessment, investigation, and enforcement. To begin the safety report review process, the HSE initially assesses ALARP and the risks/hazards. They screen to see what they have and where, onsite and offsite, worst case scenarios, ALARP demonstration/analysis. Next the inspector(s) look at the measures and controls in place. This is done by discipline – process safety, human factors, etc. Inspectors use the Safety Report Assessment Manual (SRAM) as a guide during an assessment. This guide is also provided to duty holders. Next, the inspectors come back together after they have assessed the report for a conclusions meeting. They discuss whether there are any “serious deficiencies” in the report. A mechanical integrity issue is often a serious deficiency. If there are serious issues, the HSE will issue a formal improvement notice for the company to address any deficiencies. Issuing such a notice requires “clear evidence.”

If the HSE issues a COMAH prohibition notice, this stops a process in its tracks based on a serious deficiency. This results in the shutdown of the site. HSE issues three or four of these each year. Few regulators in the US have this direct power (Cal/OSHA does).

Chevron Richmond Refinery Regulatory Report May 2014

126

The initial safety report assessment helps form the HSE’s intervention plan for the facility. The HSE inspector uses this plan during the verification and inspection of the facility on site. Here, the HSE inspector can tell whether the company is actually doing what they say they are in their safety report. As discussed above, roughly 70 percent of an HSE inspector’s time is spent on inspections. Most inspections are planned, because inspectors review complex issues that require site specialists to be present during the inspections.

Each site visit has a detailed agenda and is provided to the facility roughly four weeks in advance of the visit. The HSE conducts 10 to 15 inspections per refinery per year; this results in an inspection report. The Goal is to inspect every COMAH facility once every three years; high hazard profile sites once per year, and refineries are visited monthly due to the regulator’s assessment of higher risk at refineries.

Offshore, the HSE can issue a prohibition notice if there is an immediate risk and “potential” for injury. During an appeal, this notice remains in effect. The HSE can also issue improvement notices that give the duty holder a period of time to make specific improvements. If they fail to make those improvements, the operation is stopped. Notices are placed on a public database once any appeal of a notice is resolved.

g. What are the key transition issues that were addressed with facilities in operation at the time the safety case was adopted?

CSB Investigations Staff Response:

The Chevron Regulatory Report Draft discusses key transition issues in FAQ 6 on pages 114-115. Major issues include lack of sufficient funding, lack of stakeholder commitment to the process, under resourcing of the safety case process, the regulator is poorly trained or technically challenged, and insufficient workforce involvement in the process.

It is also important to note that the CSB staff learned a lot of positives about the onshore COMAH and safety report process in the UK. For example, the staff learned that as a result of the Buncefield incident there has been an increased focus on inspections, there was a Process Safety Leadership Group formed that works to improve safety and share lessons learned, and there is more focus on ALARP. In addition, the staff learned from industry representatives that HSE onshore has a better reputation than HSE offshore in terms of inspections and challenging from the inspectors. HSE onshore is said to have a more robust, structured, inspection program, whereas HSE offshore needs to improve in that area. Overall, the CSB staff came away with a very positive view of the HSE onshore regime and COMAH. The amount of work that is put into continuous improvement, transparency, and workforce involvement is incomparable to what currently exists in the US.

As a result of the Board’s motion and expressed concerns regarding the proposed recommendation, the CSB staff proposes the following restructured proposed recommendations for the state of California.

California State Legislature,

Chevron Richmond Refinery Regulatory Report May 2014

127

Governor of California

2012-03-I-CA-R23

Based on the findings in this report, which detail effective features of chemical accident prevention regimes in other parts of the world, augment your existing process safety management regulations with a more rigorous regime that contains the following features:

a. A comprehensive process safety report written by the company that includes a systematic analysis and documentation of all major hazards and effective control methods implemented to reduce those risks to as low as reasonably practicable (ALARP);

b. A thorough review of the process safety report by technically competent regulatory personnel that requires modifications and improvements to the document as necessary prior to acceptance;

c. Audits and preventative inspections by the regulator to verify effective implementation of risk reduction measures;

d. A risk management approach that requires analysis and effective implementation of safeguards, using the hierarchy of controls, to protect people and the environment from major accident hazards. The effectiveness of the safeguards will be demonstrated through the use of leading and lagging process safety indicators;

e. Ability to adapt and implement safety requirements in response to newly identified hazards, advances in technology, lessons learned from major accidents, and improved safety codes without the need for new rule-making;

f. Determines when new or improved industry standards and practices are needed and initiates programs and other activities such as forums to prompt the timely development and implementation of such standards and practices;

g. Uses a tripartite model where the regulator, the company, and workers and their representatives play an equal and essential role in the direction of preventing major accidents;

h. A regulatory model and accompanying guidance based on the findings contained within this report on workforce engagement, which set out the legal framework for the rights and responsibilities of workers and their representatives on health and safety-related matters, and the election of safety representatives and establishment of safety committees (with equal representation between management and labor) to serve health and safety-related functions. The elected representatives should have a legally recognized role that goes beyond consultation in activities such as the development of the process safety report, process hazard analysis, management of change, incident investigation, audits, and identification and effective control of hazards. The representatives should also have the authority to stop work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to resolve the safety concern. Workforce participation practices should be documented by the company to the regulator;

Chevron Richmond Refinery Regulatory Report May 2014

128

i. Requires reporting of information to the public to the greatest extent feasible such as a summary of the process safety report, the process hazard analyses, a list of safeguards implemented and standards utilized to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards and management systems;

j. An independent, well-funded, well-staffed, technically competent regulator; and

k. A compensation system to ensure the regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with California petroleum refineries.

2012-03-I-CA-R24

To further implementation of the rigorous process safety scheme referenced in Recommendation 23, study or cause to be studied and implement the findings addressing issues and obstacles of implementation of a more rigorous regime such as transition, resources, funding, and methods to enhance transparency, community involvement, effective worker participation, and protecting workers from retaliatory action.

2012-03-I-CA-R25

Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the state of California to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from operators and contractors to promote continuous safety improvements. At a minimum, this program shall:

a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness of process safety management systems and safeguards for major accident prevention. Include leading and lagging indicators that are measureable, actionable, and standardized. Require that the reported data be used for continuous process safety improvement and accident prevention;

b. Analyze data to identify trends and poor performers and publish annual reports with the data at facility and corporate levels;

c. Require companies to publicly report required indicators annually at facility and corporate levels;

d. Use process safety indicators (1) to drive continuous improvement for major accident prevention by using the data to identify industry and facility safety trends and deficiencies and (2) to determine appropriate allocation of regulator resources and inspections; and

Chevron Richmond Refinery Regulatory Report May 2014

129

e. Be periodically updated to incorporate new learning from world-wide industry improvements in order to drive continuous major accident safety improvements in California.

FD06454 ｜ 2012_美国_final-investigation-report---chevron-refinery-and-fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

FINAL INVESTIGATION REPORT

REPORT NO. 2012-03-I-CA JANUARY 2015

CHEVRON RICHMOND REFINERY PIPE RUPTURE AND FIRE

CHEVRON RICHMOND REFINERY #4 CRUDE UNIT RICHMOND, CALIFORNIA KEY ISSUES: AUGUST 6, 2012  CHEVRON PROCESS SAFETY PROGRAMS  CHEVRON EMERGENCY RESPONSE  MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES  LEAK EVALUATION AND RESPONSE INDUSTRY STANDARD DEFICIENCIES

Chevron Richmond Refinery Investigation Report January 2015 ii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

[This page intentionally left blank.]

Chevron Richmond Refinery Investigation Report January 2015 iii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table of Contents 1.0  Executive Summary ......................................................................................................................... 1  1.1  Incident Summary .............................................................................................................................. 1  1.2 Chevron Interim Report ..................................................................................................................... 2 1.3  Chevron Regulatory Report .............................................................................................................. 4  1.4  Chevron Final Investigation Report ................................................................................................... 5  1.4.1  Technical Findings .................................................................................................................... 5  1.4.2  Organizational Findings ............................................................................................................ 7  1.4.3  Emergency Response Findings ............................................................................................... 12  1.4.4  Safety Culture Findings .......................................................................................................... 13  1.4.5  Industry Codes and Standards Findings .................................................................................. 14  1.4.6  Regulatory Findings ................................................................................................................ 14  1.5  Recommendations ............................................................................................................................ 15  2.0  Richmond Refinery Process Description ..................................................................................... 17  2.1  Chevron Background ....................................................................................................................... 17  2.2  Richmond Refinery .......................................................................................................................... 17  2.3  #4 Crude Unit ................................................................................................................................... 18  2.4  4-Sidecut Line .................................................................................................................................. 19  3.0  The Incident .................................................................................................................................... 22  3.1  Leak Discovery ................................................................................................................................ 22  3.2  Leak Response ................................................................................................................................. 25  3.3  Consequences ................................................................................................................................... 29  4.0  Technical Analysis ......................................................................................................................... 34  4.1  Sulfidation Corrosion ....................................................................................................................... 34  4.2  Sulfidation Corrosion Inspection Techniques .................................................................................. 41  4.3  Silicon Characterization Techniques ............................................................................................... 43  4.4  Inherently Safer Design ................................................................................................................... 45  5.0  Incident Analysis ............................................................................................................................ 48  5.1  Organizational Analysis ................................................................................................................... 50  5.1.1  Chevron Energy Technology Company .................................................................................. 53  5.1.1.1  ETC Sulfidation Failure Prevention Guidance ................................................................... 54  5.1.1.2  Chevron ETC Conclusions .................................................................................................. 56  5.1.2  Chevron Turnaround Management ......................................................................................... 58 

Chevron Richmond Refinery Investigation Report January 2015 iv U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.2.1 

2007 Crude Unit Turnaround .............................................................................................. 59  5.1.2.1.1  Recommendations Regarding 4-Sidecut Line for 2007 Turnaround .......................... 60  5.1.2.2  2011 Crude Unit Turnaround .............................................................................................. 64  5.1.2.2.1  Recommendations Regarding 4-Sidecut Line for 2011 Turnaround .......................... 65  5.1.2.3  Chevron Richmond Refinery Turnaround-Planning Conclusions ...................................... 66  5.1.3  Chevron Unit Reliability Improvement Process ..................................................................... 68  5.1.4  Chevron Fixed Equipment Reliability Business Improvement Network ................................ 71  5.1.5  Chevron Minimum Pipe Thickness Program .......................................................................... 74  5.1.6  Chevron Process Safety Indicators Program ........................................................................... 78  5.1.7  Stop Work Authority ............................................................................................................... 79  5.1.8  Chevron Organizational Conclusions ..................................................................................... 83  5.2  Industry Sulfidation Corrosion Guidance ........................................................................................ 85  5.2.1 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries ....................................................................................................................................... 85  5.2.2 API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry ..... 89  5.2.3  API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems ........................................................................................................................ 90  5.2.4  API RP 578: Material Verification Program for New and Existing Alloy Piping Systems .... 91  5.2.5  API RP 574: Inspection Practices for Piping System Components ........................................ 91  5.3  Chevron Emergency Response to Process Leaks ............................................................................. 92  5.3.1  Area Control and Hazardous Area Assessment ...................................................................... 92  5.3.2  Miscommunication regarding 4-sidecut properties ................................................................. 93  5.3.3  Leak Mitigation and Discovery Attempts Worsened Leak ..................................................... 94  5.3.4  Chevron’s New Leak Response Protocol ................................................................................ 97  5.3.5  Leak Response Conclusions .................................................................................................. 100  5.4  Industry Leak Response Guidance ................................................................................................. 100  5.4.1  API RP 574: Inspection Practices for Piping System Components ...................................... 100  5.4.2  API RP 2001: Fire Protection in Refineries ......................................................................... 101  5.4.3  API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems ...................................................................................................................... 103  5.4.4  ASME PCC-2-2011: Repair of Pressure Equipment and Piping .......................................... 103  5.4.5  Industry Leak Response Guidance Conclusions ................................................................... 104  5.5  Chevron Richmond Refinery Safety Culture ................................................................................. 104  5.5.1  Normalization of Deviance ................................................................................................... 105 

Chevron Richmond Refinery Investigation Report January 2015 v U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5.2 

Chevron Richmond Refinery Safety Culture Surveys .......................................................... 106  5.5.2.1  Stop Work Authority Safety Culture Survey Responses .................................................. 107  5.5.2.2  Mechanical Integrity Safety Culture Survey Responses ................................................... 108  5.5.2.3  Process Safety Analysis Safety Culture Survey Responses .............................................. 109  5.5.2.4  Regulator Overview of Safety Culture Survey Action Items ............................................ 110  6.0  Recommendations ........................................................................................................................ 112  6.1  American Petroleum Institute ........................................................................................................ 112  6.2  American Society of Mechanical Engineers .................................................................................. 115  6.3  Chevron USA ................................................................................................................................. 115  6.4  Board of Supervisors, Contra Costa County, California ................................................................ 116  6.5  Mayor and City Council, City of Richmond, California ................................................................ 116  Appendix A—Chevron Leak Response Protocol Developed Post-incident ............................................. 117  Appendix B—Contra Costa County Community Warning System .......................................................... 120  Appendix C—Usage of Clamps at Chevron Richmond Refinery ............................................................ 121 

Chevron Richmond Refinery Investigation Report January 2015 vi U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

List of Figures Figure 1. To-scale schematic of 4-sidecut piping identifying key wall thickness values. ....................... 11  Figure 2. Aerial view of the Chevron Richmond Refinery. ..................................................................... 18  Figure 3. Schematic of C-1100 Crude Unit atmospheric column and upstream process equipment. ...... 20  Figure 4. 4-sidecut line configuration and rupture location. .................................................................... 21  Figure 5. Photo of rupture on 4-sidecut 52-inch component. .................................................................. 22  Figure 6. CSB animation depicting operator identifying the leaking 4-sidecut pipe. .............................. 23  Figure 7. Photo taken of the leaking 4-sidecut pipe on August 6, 2012, at the Chevron Richmond Refinery ..................................................................................................................................... 24  Figure 8. Timeline of events on August 6, 2012. ...................................................................................... 25  Figure 9. Example leak repair clamp for piping. It is installed over the leak location to prevent process fluid leakage to the atmosphere. ............................................................................................... 26  Figure 10. CSB animation of contractors erecting scaffolding beneath the leak location. ........................ 27  Figure 11. CSB animation of firefighters attempting to remove the 4-sidecut insulation, the resulting fire, and fire extinguishing. ............................................................................................................... 28  Figure 12. CSB animation of firefighters who dropped to their hands and knees to escape the vapor cloud. ......................................................................................................................................... 29  Figure 13. CSB animation of firefighter who was inside the fire engine when the light gas oil ignited. .. 31  Figure 14. Photo of the burned remains of the fire truck that was consumed by the fire. .......................... 32  Figure 15. Initial vapor cloud formation (white cloud) and subsequent ignition (black smoke) as seen from a pier in San Francisco, California. ........................................................................................... 33  Figure 16. Vapor cloud and ignition seen from Marin County. ................................................................. 34  Figure 17. Graph of sulfidation corrosion rates with respect to silicon content in carbon steel ................. 36  Figure 18. Locations of metallurgical samples taken from 8-inch 4-sidecut piping post-incident. ........... 38  Figure 19. Locations of metallurgical samples taken from 12-inch 4-sidecut piping post-incident. ......... 39  Figure 20. 4-sidecut piping sample (E-017-8) analyzed by Anamet Labs showing the relative thickness of low silicon piping on the left and the high silicon piping on the right. ..................................... 40  Figure 21. CML placement on 8-inch 4-sidecut piping. ............................................................................. 42  Figure 22. Modified McConomy Curves from API RP 939-C. .................................................................. 45  Figure 23. Hierarchy of controls ................................................................................................................. 46  Figure 24. Acci-Map of August 6, 2012, Chevron Refinery Fire. .............................................................. 49  Figure 25. Organizational decision-making schematic showing attempts to have carbon steel 4-sidecut piping 100 percent component inspected or replaced with a higher chromium steel alloy ...... 50  Figure 26. Key events at the Richmond refinery between 2002 and 2012. ............................................... 51  Figure 27. Chevron Corporation refinery process safety programs. .......................................................... 52  Figure 28. Chevron Energy Technology Company (ETC) organizational roles ........................................ 54  Figure 29. Presentation slide of ETC training course that guided refinery staff to perform 100 percent component inspection on high-temperature lines susceptible to sulfidation corrosion. ............ 55  Figure 30. Presentation slide of ETC training course that guided refinery staff on ways to reduce risk from sulfidation corrosion. ........................................................................................................ 56  Figure 31. Work list criteria requirements specified in the Framing Document used during Chevron’s 2007 Crude Unit turnaround. .................................................................................................... 60 

Chevron Richmond Refinery Investigation Report January 2015 vii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 32. Sample Inspection Database report analyzed by unit inspectors when determining piping remaining life and when making piping replacement recommendations .................................. 61  Figure 33. Crude column schematic indicating the piping downstream of the 4-sidecut pumps that was replaced during the 2007 Crude Unit turnaround ..................................................................... 63  Figure 34. Work list criteria requirements specified in the Framing Document used during Chevron’s 2011 Crude Unit turnaround. .................................................................................................... 64  Figure 35. Presentation slide showing corporate reliability leader’s findings that the Richmond Refinery was not complying with the ETC Sulfidation Failure Prevention Initiative. ............................ 73  Figure 36. To-scale schematic of 4-sidecut piping original wall thickness (0.322-inch), Minimum Alert Thickness (0.13-inch), and Minimal Required Thickness (0.11-inch) using API RP 574 default values. ....................................................................................................................................... 75  Figure 37. Text from Chevron design engineer indicating structural minimum thickness (t(min)) calculation results for small sections of suction piping upstream of the 4-sidecut pumps. ...... 76  Figure 38. Photo from API RP 939-C of a low-silicon pup piece that ruptured at a BP refinery .............. 86  Figure 39. Schematic from API RP 939-C of the piping shown in Figure 38. .......................................... 87  Figure 40. Photo of undamaged (top) and burned during incident (bottom) pike pole used in early attempts to remove 4-sidecut insulation. ................................................................................... 95  Figure 41. Photo showing that tip of fire pole matches apparent puncture location in failed 52-inch component of 4-sidecut piping. ................................................................................................. 96  Figure 42. Ideal communication flow to Incident Commander during refinery process fluid leak incident. .................................................................................................................................................................... 98  Figure 43. Chevron’s new Leak Response Protocol, developed post-incident .......................................... 99 

Chevron Richmond Refinery Investigation Report January 2015 viii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

List of Tables Table 1. Silicon characterization technique. .............................................................................................. 43  Table 2. Total number of employees surveyed and job functions of respondents in 2008 and 2010 Chevron Richmond Refinery staff safety culture surveys. ......................................................... 106  Table 3. Chevron Richmond Refinery 2008 Safety Culture Survey responses to question of “Stopping Unsafe Work” by operators and mechanics ............................................................................... 107  Table 4. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to question of “Stopping Unsafe Work” by managers and engineers ............................................................... 108  Table 5. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to question of “How do people feel about stopping unsafe work?” by operators and mechanics ..................... 108  Table 6. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to the question: “How do we take care of equipment?” ....................................................................................... 109  Table 7. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to the question “Process Safety Issues Are…” .................................................................................................. 109 

Chevron Richmond Refinery Investigation Report January 2015 ix U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Acronyms and Abbreviations ⁰C degrees Celsius ⁰F degrees Fahrenheit ABU Area Business Unit A/C Additional Considerations AcciMap Accident Map API American Petroleum Institute API 570 Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems API RP 2001 Fire Protection in Refineries API RP 571 Damage Mechanisms Affecting Fixed Equipment in the Refining Industry API RP 574 Inspection Practices for Piping System Components API RP 578 Material Verification Program for New and Existing Alloy Piping Systems API RP 754 Process Safety Performance Indicators for the Refining and Petrochemical Industries API RP 939-C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries API RP API Recommended Practice ASME American Society of Mechanical Engineers ASME PCC-2-2011 Repair of Pressure Equipment and Piping ASTM American Society for Testing and Materials bpd barrels per day C/A Corrective Actions CML Condition Monitoring Location Cr Chromium CS Carbon Steel CSB U.S. Chemical Safety and Hazard Investigation Board CWS Community Warning System DRB Decision Review Board ETC Chevron Energy Technology Company FER BIN Fixed Equipment Reliability Business Improvement Network IMPACT Initiative for Managing Pacesetter Turnarounds ISO Industrial Safety Ordinance Mo Molybdenum

Chevron Richmond Refinery Investigation Report January 2015 x U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

MOC Management of Change NFPA National Fire Protection Association NFPA 471 Recommended Practice for Responding to Hazardous Materials Incidents OERI Operational Excellence and Reliability Intelligence PHA Process Hazard Analysis PMI Positive Material Identification PPE Personal Protective Equipment psig pounds per square inch gauge PSM Process Safety Management RAGAGEP Recognized and Generally Accepted Good Engineering Practices RISO Richmond Industrial Safety Ordinance RLOP Richmond Lube Oil Project RT Radiographic Testing S/D Shutdown Si Silicon SIP shelter-in-place SIS Safety Instrumented Systems SME Subject Matter Expert STL Shift Team Leader SWA Stop Work Authority T-min minimum thickness TML Thickness Measurement Location or Thickness Monitoring Location TOP Triangle of Prevention URB Unit Reliability Brief URIP Unit Reliability Improvement Process UT Ultrasonic Testing

Chevron Richmond Refinery Investigation Report January 2015 1 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Executive Summary
2. 1 Incident Summary

On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California (“the Chevron Richmond Refinery”) experienced a catastrophic pipe rupture in the #4 Crude Unit. The incident occurred from piping referred to as the “4-sidecut” stream, one of several process streams exiting the refinery’s C-1100 Crude Unit Atmospheric Column.1 The pipe rupture occurred on a 52-inch long component2 of the 4- sidecut 8-inch line (the 52-inch component). At the time of the incident, light gas oil3 was flowing through the 8-inch line at a rate of approximately 10,800 barrels per day (bpd).4 The ruptured pipe released flammable, high temperature light gas oil, which then partially vaporized into a large, opaque vapor cloud that engulfed 19 Chevron U.S.A. Inc. (Chevron) employees.5 At 6:33 p.m., approximately two minutes following the release, the released process fluid ignited.6 Eighteen of the employees safely escaped from the vapor cloud just before ignition; one employee, a Chevron refinery firefighter, was inside a fire engine that was caught within the fireball when the process fluid ignited. Because he was wearing full-body fire-fighting protective equipment, he was able to make his way through the flames to safety. Six Chevron employees suffered minor injuries during the incident and subsequent emergency response efforts. The release, ignition, and subsequent burning of the hydrocarbon process fluid resulted in a large plume of vapor, particulates, and black smoke, which traveled across the surrounding area. This chain of events resulted in a Community Warning System (CWS) Level 3 alert,7 and a shelter-in-place8 advisory (SIP) was issued at 6:38 p.m.9 for the cities of Richmond, San Pablo, and North Richmond. It was lifted later

1 The atmospheric column separates crude oil feed into different streams through distillation. These streams are further processed in other units in the refinery. The location of the 4-sidecut, light gas oil stream was shown in Figure 4 (page 12) of the Interim Investigation Report Chevron Richmond Refinery Fire. See http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed January 21, 2015). 2 “Component” refers to a portion of piping between welds. It includes straight run piping and pipe fittings. 3 Light gas oil is a component of crude oil with a boiling point range between 401°F and 653°F. 4 This quantity is the equivalent of 315 gallons per minute (gpm). A barrel is equivalent to 42 gallons. 5 This number is based on statements made to the CSB by each of the 19 employees caught in the vapor cloud. 6 Surveillance footage was provided by Chevron. Chevron clarified to the CSB that the video time stamp is approximately 5 minutes out of sync. The video is available at http://www.csb.gov/videoroom/detail.aspx?VID=69 (accessed February 8, 2013). 7 A Community Warning System Level 3 alert indicates that a facility within Contra Costa County has had a release that has offsite impact and is categorized by any of the following conditions:

1. Off-site impact that may cause eye, skin, nose and/or respiratory irritation to the general population.
2. Fire, explosion, heat, or smoke with an off-site impact. Example: On a process unit/storage tank where

mutual aid is requested to mitigate the event and the fire will last longer than 15 minutes.

1. Hazardous material or fire incident where the Incident Commander or unified command, through

consultation with the Contra Costa Health Services Hazardous Material Incident Response Team, requests that sirens should be sounded. See http://cchealth.org/hazmat/pdf/incident_notification_policy.pdf (accessed April 9, 2013). 8 Contra Costa County considers a shelter-in-place to include going inside a home or nearest building, closing doors and windows, and turning off heating, ventilation, and air conditioning. See http://cchealth.org/emergencies/shelter- in-place.php (accessed February 6, 2013). 9 Chevron U.S.A. Inc. "30 Day Follow-Up Notification Report," September 5, 2012.

Chevron Richmond Refinery Investigation Report January 2015 2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

that night, at 11:12 p.m., after the fire was fully under control. In the weeks following the incident, approximately 15,000 people from the surrounding communities sought medical treatment at nearby medical facilities for ailments including breathing problems, chest pain, shortness of breath, sore throat, and headaches. Approximately 20 of these people were admitted to local hospitals as inpatients for treatment.10 1.2 Chevron Interim Report The U.S. Chemical Safety Board (CSB) released its first report on the Chevron incident in April 2013 (“the Interim Report”), which highlighted technical findings and safety system deficiencies. The report issued recommendations to Chevron; the city of Richmond, California; Contra Costa County, California; the State of California; the California Air Quality Management Divisions; the California Environmental Protection Agency; and the U.S. Environmental Protection Agency, summarized below. As of January 2015, these groups have made progress in implementing the recommendations, summarized below, to improve the regulatory requirements for petroleum refineries in California.

Chevron U.S.A (Urgent) At all Chevron U.S. refineries and as part of the Process Hazard Analysis cycle, engage a diverse team of qualified personnel to perform a documented damage mechanism hazard review that identifies potential process damage mechanisms and consequences of failure and ensures safeguards are in place to control hazards presented by those damage mechanisms. Include in this review applicable industry best practices, Chevron Energy Technology Company findings and recommendations, and inherently safer systems to the greatest extent feasible. Report leading and lagging process safety indicators at all California Chevron U.S.A. refineries to the applicable regulatory agencies.

Mayor and City Council, City of Richmond, California; Board of Supervisors, Contra Costa County, California; California State Legislature, Governor of California Require that Process Hazard Analyses include documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards intended to control hazards will be effective. Require the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP).

California State Legislature, Governor of California Require California petroleum refineries to engage a diverse team of qualified personnel to perform a documented damage mechanism hazard review as part of the Process Hazard Analysis cycle that identifies potential process damage mechanisms and consequences of failure and ensures safeguards are

10 Based on information provided to the CSB by local hospitals.

Chevron Richmond Refinery Investigation Report January 2015 3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in place to control hazards presented by those damage mechanisms. Require the analysis and incorporation of applicable industry best practices and inherently safety systems to the greatest extent feasible into this review. For all California oil refineries, identify and require the reporting of leading and lagging process safety indicators, such as the action item completion status of recommendations from damage mechanism hazard reviews, to state and local regulatory agencies that have chemical release prevention authority. Establish a multi-agency process safety regulatory program for all California oil refineries to improve the public accountability, transparency, and performance of chemical accident prevention and mechanical integrity programs.

The U.S. Environmental Protection Agency Jointly plan and conduct inspections with Cal/OSHA [California Division of Occupational Safety and Health], California EPA and other state and local regulatory agencies with chemical accident prevention responsibilities to monitor the effective implementation of the damage mechanism hazard review process.

The Board of Supervisors, Contra Costa County, California; The Mayor and City Council, City of Richmond, California; The California Air Quality Management Divisions; The U.S. Environmental Protection Agency; and The California Environmental Protection Agency Participate in the joint regulatory program to monitor the effective implementation of the damage mechanism hazard review process with Cal/OSHA and the U.S. Environmental Protection Agency.

Chevron Richmond Refinery Investigation Report January 2015 4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3 Chevron Regulatory Report

The CSB released its second finalized investigation report on the August 6, 2012, Chevron incident in October 2014 (the “Chevron Regulatory Report”). The report examines California process safety regulatory gaps and enforcement issues which contributed to the August 6th incident. The Chevron Regulatory Report also evaluates whether a rigorous goal-setting regulatory approach requiring employers to demonstrate that they have driven major accident risk to as low as reasonably practicable (ALARP) could be a more effective, prevention-focused regulatory system to reduce major accidents in California petroleum refineries. The Chevron Regulatory Report made the following recommendations:

California State Legislature, Governor of California Enhance and restructure California’s process safety management (PSM) regulations for petroleum refineries by including the goal-setting attributes identified in this report for petroleum refineries in the state of California.

Mayor and City Council, City of Richmond, California Implement or cause to be implemented a compensation system to ensure regulator capability in process safety oversight and policy development in Richmond, California.

Board of Supervisors Contra Costa County, California Implement a compensation system to ensure regulator capability in process safety oversight and policy development in Contra Costa County, California.

Chevron Richmond Refinery Investigation Report January 2015 5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4 Chevron Final Investigation Report

The following Chevron Final Investigation Report addresses additional investigation findings not covered in the two previous reports, including analysis of (1) the Chevron organization, emergency response, and safety culture; (2) industry leak response standards; and (3) mechanical integrity industry standards. This report supplements the information already published in the Interim Report and Regulatory Report. This is the third and final report the CSB is publishing on this incident. 1.4.1 Technical Findings This report highlights the following technical findings. (An in-depth discussion appears in the Chevron Interim Report.)

1. The rupture of the 4-sidecut piping resulted from the 52-inch component being extremely thin due

to a damage mechanism11 known as sulfidation corrosion. Sulfidation corrosion, also known as sulfidic corrosion,12 is a damage mechanism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450°F to 1,000°F.13 This damage mechanism causes pipe walls to gradually thin over time. (See Section 4.1.)

1. Sulfidation corrosion is common in crude oil distillation,14 where naturally occurring sulfur and

sulfur compounds found in crude oil feed, such as hydrogen sulfide,15 react with steel piping and equipment. Process variables that affect corrosion rates include the total sulfur content of the oil, the sulfur species present, the flow conditions, and the system temperature. Virtually all crude oil feeds contain sulfur compounds; as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled. (See Section 4.1.)

1. The Chevron Richmond Refinery 4-sidecut piping was constructed of carbon steel, which

corrodes at a much faster rate from sulfidation than other typical alternative materials of construction, such as higher chromium-containing steels. In addition to its inherently faster rate of sulfidation corrosion when compared with higher chromium steels, carbon steel also experiences significant variation in corrosion rates due to possible variances in silicon content, a component used in the steel manufacturing process. Carbon steel piping containing silicon

11 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g., corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems. 3rd ed., Section 3.1.1.5, November 2009. 12 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 3.1.6, May 2009. 13 Ibid., Section 1. 14 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 15 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion.

Chevron Richmond Refinery Investigation Report January 2015 6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

content less than 0.10 weight percent can corrode at accelerated rates,16 up to 16 times faster than carbon steel piping containing higher percentages of silicon. (See Section 4.1.)

1. Carbon steel piping components in refineries throughout the U.S. are susceptible to highly

variable sulfidation corrosion rates. Carbon steel piping is manufactured to meet certain specifications, including American Society for Testing and Materials (ASTM) A53B,17 ASTM A106,18 and American Petroleum Institute (API) 5L.19 ASTM A53B and API 5L do not contain minimum silicon content requirements for carbon steel piping,20 while ASTM A106 requires the piping to be manufactured with a minimum silicon content of 0.10 weight percent. As a result, manufacturers have used different levels of silicon in the carbon steel pipe manufacturing process. Thus, sulfidation corrosion rates could vary depending on the manufacturing specification for silicon content in the carbon steel installed in refinery processes. In the mid- 1980s, pipe manufacturers began to simultaneously comply with all three specifications, so most carbon steel piping purchased since then for refinery operations likely has a minimum of 0.10 weight percent silicon content. However, over 95 percent of the 144 refineries in the U.S., including the Chevron Richmond Refinery, were built before 1985. Therefore, the original carbon steel piping components in these refineries likely contain varying percentages of silicon, so they may experience highly variable sulfidation corrosion rates. (See Section 4.1.)

1. The Chevron Richmond Refinery 4-sidecut piping circuit containing the 52-inch component that

failed was constructed of ASTM A53B carbon steel, which had no minimum specification for silicon content. Post-incident testing of samples of the 4-sidecut piping from the Chevron Richmond Refinery identified silicon content ranging from 0.01 weight percent to 0.2 weight percent. Of 12 samples taken from the 8-inch and the adjacent 12-inch 4-sidecut line, six had a silicon concentration of less than 0.10 weight percent. The 52-inch pipe component that ruptured on the day of the incident had a silicon content of only 0.01 weight percent. The elbow component directly upstream of the 52-inch component that failed had a silicon concentration of 0.16 weight percent, showing considerably less thinning. (See Section 4.1.)

1. Determining silicon content in existing carbon steel piping and equipment in the field is a

difficult undertaking. Every component must be inspected to properly characterize the silicon content in each component of a piping circuit. This is known as 100 percent component inspection. Two techniques are used to inspect a component in an existing carbon steel piping circuit with unknown chemical composition for low silicon content and resulting variable corrosion rates: (1) performing laboratory-based chemical analysis of the carbon steel (a “destructive test,” meaning it requires removal of a sample of the steel), or (2) performing pipe

16 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 6.2.3.2, May 2009. 17 ASTM Standard A53/A53M-12: Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-Coated, Welded and Seamless. 2012. 18 ASTM Standard A106/A106M–1:Standard Specification for Seamless Carbon Steel Pipe for High-Temperature Service. 2011. 19 API Specification 5L: Specification for Line Pipe. 45th ed., December 2012.

1. ASTM Standard A53/A53M-12: Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-Coated,

Welded and Seamless. 2012.

Chevron Richmond Refinery Investigation Report January 2015 7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

wall thickness measurements. Measuring pipe wall thickness of every component is useful as a means to ascertain silicon content only if the piping circuit has been exposed to sulfidation corrosion for a long enough time period so that variances in corrosion rate caused by differences in silicon content may be detected. Steel alloys containing at least 9 weight percent chromium are more resistant to sulfidation corrosion than carbon steel and do not present the hazard of extreme variations in corrosion rates in components within the same piping circuit due to slight differences in chemical composition.21 Thus, alloys with higher chromium content are an inherently safer choice in high-temperature sulfidation corrosion environments.22 (See Section 4.2 and Section 4.4.)

1. Effectively implementing inherently safer design provides an opportunity for preventing major

chemical incidents. The August 6, 2012, incident at Chevron and other incidents23 throughout the refining industry highlight the difficulty in preventing failure caused by sulfidation corrosion in low-silicon carbon steel piping solely through inspection, a procedural safeguard that is low on the hierarchy of controls. Using inherently safer design concepts to eliminate the hazard of variation in corrosion rate in carbon steel piping due to hard-to-determine silicon content will prevent future similar failures in refineries. (See Section 4.4.) 1.4.2 Organizational Findings

1. Chevron did not effectively implement internal recommendations to help prevent pipe failures

due to sulfidation corrosion. In the 10 years prior to the incident, a small number of Chevron personnel with knowledge and understanding of sulfidation corrosion recommended on several occasions either a one-time inspection of every component within the 4-sidecut piping circuit— known as 100 percent component inspection—or an upgrade of the material of construction of the 4-sidecut piping. The recommendations were not implemented effectively, and the 52-inch component remained in service until it failed on August 6, 2012. (See Section 5.1.)

1. Chevron failed to perform internally recommended 100 percent component inspections. An

independent corporate entity within Chevron, the Chevron Energy Technology Company (ETC), provides technology solutions and technical expertise for Chevron operations worldwide. Chevron ETC metallurgists released within Chevron a formal report dated September 30, 2009 (nearly 3 years before the incident), titled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries (ETC Sulfidation Failure Prevention Initiative). The initiative specifically recommends that inspectors perform 100 percent component inspection on high-temperature carbon steel piping susceptible to sulfidation corrosion. The initiative defines a priority ranking system to help focus the inspection

21 The protective scale, FeCr2S4, begins to be the dominant scale formed in steels containing a chromium content of five weight percent. The 5Cr steel alloy can be manufactured to contain anywhere from 4 percent to 6 percent chromium. Thus, “the sulfidation corrosion rate can vary dramatically in 5Cr steels even in the same operating environment.” See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008. 22 Steels with higher chromium content are inherently safer than carbon steel with respect to sulfidation corrosion. However, analysis is still required to ensure that the best material of construction is selected. 23 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., May 2009.

Chevron Richmond Refinery Investigation Report January 2015 8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

implementation efforts. The process conditions of the 4-sidecut stream placed it in the highest priority for 100 percent component inspection. However, the 4-sidecut piping was not 100 percent component inspected prior to the August 2012 incident. (See Section 5.1.1.)

1. The CSB found that the Richmond refinery’s turnaround planning group rejected the

recommendations to 100 percent component inspect or replace the portion of the 4-sidecut piping that ultimately failed24. The turnaround work scope and approval process is guided by predetermined criteria in what Chevron calls a “Framing Document.” Turnaround work requests are approved or denied by the turnaround planning group based on the document criteria. The Framing Document sets the criteria for work items that can be automatically accepted as turnaround work items during the planned turnaround. Less urgent items and those that may be performed on the run (while the unit is operating) or during the next turnaround are not included by default in the turnaround work scope. Inspection data for the 4-sidecut piping, where measurements were historically taken on high-silicon fittings,25 indicated the 4-sidecut piping could safely operate through 2016. Therefore, recommendations to replace the 8-inch 4-sidecut piping during the 2007 and 2011 turnarounds were denied in accordance with the Framing Document criteria. The Sulfidation Failure Prevention Initiative developed by the ETC metallurgist experts was not considered a valid mandate for justifying turnaround work which otherwise fell outside the acceptance criteria of the Framing Document. (See Section 5.1.2.)

1. A Crude Unit metallurgical analysis recommendation to perform 100 percent volumetric

inspection26 of the 4-sidecut line submitted for the 2007 turnaround was approved by the Crude Unit’s Area Business Unit (ABU) Manager. Chevron installed experimental “Guided Wave bracelets”27 which were designed to continuously perform 100 percent volumetric inspection. However, the guided wave bracelets were only installed on a small portion of the 4-sidecut line which did not include the 52-inch component that ultimately failed. In addition, when the Guided Wave bracelets were found to be unreliable, manual 100 percent component inspection was not conducted in its place. (See Section 5.1.2.1.1.)

1. If a submitted turnaround work item recommendation was not accepted under the Chevron

Richmond Refinery turnaround Framing Document—for example, an “Industry Best Practice” that Chevron may not interpret as being supported by hard data needed to justify the work, or a profit-improvement project—there was an informal appeal process. A case for approval for the work had to be made to the ABU Manager for the unit where the turnaround was to occur. However, this approach was never attempted by Chevron inspection or metallurgical staff who submitted the recommendations to replace the 4-sidecut piping. In addition, no high-level manager was assigned responsibility to ensure that the ETC Sulfidation Failure Prevention Initiative or other ETC sulfidation recommendations were included in the turnaround scope, so all responsibility to implement the ETC recommendations was placed on lower-level employees, who did not have decision-making or funding authority. (See Section 5.1.2.3.)

24 Other portions of the 4-sidecut were replaced in 2007 and 2011. 25 A 2011 effort added an additional 12 CML locations on straight-run piping components. A CML was not placed, however, on the low-silicon 52-inch component that failed on August 6, 2012. 26 Common volumetric inspection techniques include ultrasonic and radiography testing. 27 Guided Wave bracelets are continuous monitoring probes that can, if proven reliable, remove the need for manual inspection of piping.

Chevron Richmond Refinery Investigation Report January 2015 9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Chevron relies on its Unit Reliability Improvement Process (URIP) and its associated programs,

including Unit Reliability Briefs (URBs) and Reliability Steering Committee meetings, to steward mechanical reliability at its various refineries. Employees meeting within the various URIP programs discussed the ETC Sulfidation Failure Prevention Initiative. However, the metallurgical and inspection staff assigned by the URB and Reliability Steering Committee to implement the ETC Sulfidation Failure Prevention Initiative routed all recommendations through the turnaround planning process. The turnaround planning group denied these recommendations because they did not meet turnaround Framing Document requirements. In addition, no high- level refinery managers who attended URBs and Reliability Steering Committee meetings took or were assigned responsibility for the ETC Sulfidation Failure Prevention Initiative and ETC sulfidation mitigation recommendations to assure their effective implementation within the Richmond refinery. (See Section 5.1.3.)

• Chevron’s Fixed Equipment Reliability Business Improvement Network (FER BIN) program did

not effectively gain the necessary commitment from refinery management to implement the ETC Sulfidation Failure Prevention Initiative or other ETC recommendations to upgrade susceptible carbon steel piping to inherently safer, higher chromium steel. The FER BIN is intended to be a “best practice” network across all Chevron refineries for bringing up-to-date changes in industry standards and best practices into the organization. The FER BIN is headed by a technically qualified subject-matter expert, the FER BIN Leader. The individual who was in the FER BIN Leader role when the ETC Sulfidation Failure Prevention Initiative was issued retired in September 2010, before the initiative was fully developed and implemented at the Richmond refinery. A replacement for the FER BIN Leader was not assigned until four months after the previous FER BIN Leader’s retirement—in January 2011. The onboarding process for the new FER BIN Leader’s roles and responsibilities took additional time because of the hiring delay. When the new FER BIN Leader visited the Chevron Richmond Refinery in early 2012, he identified that the refinery was not successfully implementing the ETC Sulfidation Failure Prevention Initiative. However, he met only with inspection and reliability personnel—not with refinery management who had the authority to implement his recommendations to adhere to the ETC Sulfidation Failure Prevention Initiative guidance. (See Section 5.1.4.)

• Sulfidation corrosion causes pipe walls to thin, which eventually leads to the need to replace the

thinned piping. Chevron determines the date for replacing thinned piping by using a piping “Minimum Alert Thickness” and a piping “Minimum Required Thickness” (Figure 1).28 When piping reaches its Minimum Alert Thickness, an engineering evaluation is triggered to calculate the piping’s Minimum Required Thickness, or the lowest thickness that can withstand the pressure and structural stresses of the piping circuit, to determine whether the piping must be replaced immediately or if replacement can be safely delayed. This evaluation may result in the lowering of the Minimum Alert Thickness to 0.1-inch. Evaluation of the inspection thickness data obtained on the 4-sidecut piping during the 2011 turnaround indicated that the 4-sidecut piping would thin below its 0.14-inch Minimum Alert Thickness before the next turnaround scheduled for 2016. A minimum structural thickness value of 0.036-inch had been calculated for 28 Chevron’s term for “Minimum Alert Thickness” is “Flag Thickness,” and its term for “Minimum Required Thickness” is “T-min.”

Chevron Richmond Refinery Investigation Report January 2015 10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a small piping component within the 4-sidecut piping earlier during the turnaround. This 0.036- inch value was applied to the full length of the 8-inch 4-sidecut piping circuit. This calculation was used as a technical justification to reduce the 8-inch 4-sidecut Minimum Alert Thickness to 0.1-inch, and the piping wall thickness was predicted to stay above this Minimum Alert Thickness until after the next turnaround. The 4-sidecut line was therefore allowed to continue operating with replacement scheduled for the next turnaround in 2016. API RP 574: Inspection Practices for Piping System Components provides users with a default minimum structural thickness of 0.11-inch for piping with a diameter of 8-inches—which can be used as the Minimum Required Thickness for piping in lieu of detailed engineering calculations.29 Chevron performed a detailed calculation to determine the 4-sidecut Minimum Required Thickness and the API RP 574 default minimum structural thickness was not used. However, had Chevron used the API RP 574 default minimum structural thickness value of 0.11-inch as the 4-sidecut Minimum Required Thickness, the remaining life of the piping circuit would have been predicted to be less than ten years, and a turnaround planning group discussion should have been triggered to discuss replacement options for the 8-inch 4-sidecut piping. Such a discussion could have resulted in the decision to replace the 8-inch 4-sidecut piping during the 2011 turnaround, and the August 6, 2012, pipe rupture could have been prevented. In addition, Chevron does not require a formal multi-person review process to be performed to verify that available inspection data is reliable considering the relevant piping circuit damage mechanisms prior to changing the minimum thickness values used to project the remaining life of a piping circuit. (See Section 5.1.5.)

29 This minimum thickness is specified for piping between 6 and 18 inches in diameter that operates at temperatures under 400 ⁰F. The 4-sidecut piping operated at a higher temperature, likely requiring a greater minimum thickness.

Chevron Richmond Refinery Investigation Report January 2015 11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 1. To-scale schematic of 4-sidecut piping identifying key wall thickness values. These include the original wall thickness (0.322-inch), “Minimum Alert Thickness” (0.13-inch), and “Minimum Required Thickness” (0.11-inch) using API RP 574 default values.

1. Inspection data obtained during the 2011 Crude Unit turnaround identified that components of the

12-inch portion of the 4-sidecut piping had become so thin due to sulfidation corrosion that much of it had to be replaced during the turnaround. Even though the 12-inch 4-sidecut piping was manufactured from the same specification of carbon steel, contained the same process fluid, and experienced similar process conditions30 as the 8-inch 4-sidecut piping, Chevron turnaround management did not consider that components in the 8-inch 4-sidecut piping could also be too thin to allow the piping to continue in operation. Chevron personnel involved with the decision to replace portions of the 12-inch 4-sidecut piping concluded, based upon available inspection data, that all of the 8-inch 4-sidecut piping that had not been inspected, including the 52-inch component that ultimately failed, was acceptable for continued operation. (See Section 5.1.2.2.1.)

1. Chevron does not effectively use its online dashboard, Operational Excellence and Reliability

Intelligence (OERI), which tracks 26 different process safety indicators, to track the implementation status of ETC recommendations and new industry guidance. OERI visually displays the status of many different process safety indicators. Management reviews these

30 The CSB notes that the process conditions of the 8-inch and 12-inch 4-sidecut piping were not identical.

Chevron Richmond Refinery Investigation Report January 2015 12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

metrics weekly and schedules monthly meetings to discuss the items that need attention. The Chevron Richmond Refinery leadership team is held accountable for the status of these metrics. The Refinery manager and the president of global manufacturing meet regularly with members of the Chevron Richmond Refinery leadership team to discuss status of the metrics they oversee, and they incorporate into all leadership team members’ performance reviews their effectiveness in managing these metrics. Chevron does not track in OERI the implementation status of ETC recommendations or new industry guidance. Such an indicator could have ensured that the status of the ETC Sulfidation Failure Prevention Initiative at the Chevron Richmond Refinery received greater management attention. (See Section 5.1.6.) 1.4.3 Emergency Response Findings

1. Chevron did not effectively identify in the Incident Command structure the damage mechanisms

that could have caused the 4-sidecut piping leak on the day of the incident. The OSHA Hazardous Waste Operations and Emergency Response (HAZWOPER) standard states that the Incident Commander “shall identify, to the extent possible, all hazardous substances or conditions present”31 in an emergency response situation. However, the appropriate technical expertise necessary to identify the potential for low-silicon, more rapidly corroding piping components in the 4-sidecut piping was not effectively consulted in the Incident Command structure on August 6, 2012. This lack of knowledge of all potential causes of the 4-sidecut piping leak led the Incident Commander to direct emergency responders to take actions that may have ultimately exacerbated the leak and put many Chevron personnel in harm’s way. It also led the Incident Commander to limit the “hot zone” to a small area that did not consider the possibility of pipe rupture. When the 4-sidecut piping ruptured, personnel and firefighting equipment positioned in the “cold zone” were engulfed in the large vapor cloud. (See Section 5.3.)

1. Process conditions were not effectively identified and communicated in the Incident Command

structure on the day of the incident. The 4-sidecut leak response and mitigation strategy developed following an assessment of the leaking pipe by Chevron Fire Department leaders and other key Chevron operations personnel involved stripping insulation from the hot piping to identify the leak location. The CSB found that several Chevron Fire Department personnel responding to the leaking 4-sidecut pipe were not properly informed of the operating temperature of the line. CSB interviews identified that some firefighters believed the line was operating at a temperature of about 130°F rather than the actual temperature approaching 640°F. CSB interviews indicate that, had the responders been aware of the actual operating temperature, some likely would have raised concerns to their supervisors about the safety of performing aggressive leak response actions on a hot pipe. (See Section 5.3.2.)

1. Chevron did not recognize or accommodate the shortcomings of reliance on Stop Work Authority

in averting major process hazards. The CSB learned that some personnel participating in the insulation removal process while the 4-sidecut line was leaking were uncomfortable with the safety of this activity because of potential exposure to the flammable process fluid. Some individuals even recommended that the Crude Unit be shut down, but they left the final decision

31 29 CFR §1910.120(q)(3)(ii) (2012).

Chevron Richmond Refinery Investigation Report January 2015 13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to the management personnel present. No one formally invoked their Stop Work Authority.32 In addition, Chevron safety culture surveys indicate that between 2008 and 2010, personnel had become less willing to use their Stop Work Authority. Regardless of how a Stop Work program is portrayed, there are a number of reasons why such a program may fail related to the ‘human factors’ issue of decision-making; these reasons include belief that the Stop Work decision should be made by someone else higher in the organizational hierarchy, reluctance to speak up and delay work progress, and fear of reprisal for stopping the job.33 (See Section 5.1.7 and Section 5.5.2.1.)

1. On the day of the incident, Chevron had no leak response guidance or formal protocol for

operations personnel, refinery management, emergency responders, or the Incident Commander to refer to when determining how to handle a process leak. Without a protocol, Chevron had no formal system to ensure the right people were gathering all important information before deciding on leak mitigation strategies. Such an evaluation could have led to the conclusion that the cause of the leak was general thinning due to sulfidation corrosion, and clamping the pipe—a mitigation strategy being considered—was not a viable solution because the pipe likely did not have the structural integrity to support a clamp. This realization likely would have resulted in deciding to immediately shut down the unit. Following this incident, Chevron improved its internal policies by developing and implementing a leak response protocol for determining how to assess and mitigate leaks within the refinery.34 The new leak response protocol would require unit shutdown if a similar leak were to occur in a Chevron refinery. (See Section 5.3.4.) 1.4.4 Safety Culture Findings

1. The CSB identified several contributing causes of the August 6, 2012, incident relating to the

Chevron Richmond Refinery’s safety culture: a. Decision making that encourages continued operation of a unit despite hazardous leaks. Examples include another leak incident in the Chevron Richmond Refinery in 2010, which was allowed to continue in operation, releasing high-temperature, flammable process fluid in an active unit, as well as continued efforts on August 6, 2012, to perform on-stream mitigation attempts despite high-temperature hydrocarbon vapor release and the occurrence of a flash fire; b. Reluctance among employees to use their Stop Work Authority. Recent safety culture surveys performed at the refinery indicate that employees had become less willing to use their Stop Work Authority between 2008 and 2010; and

32 Chevron defines “Stop Work Authority” as the “… responsibility and authority of any individual to stop work when an unsafe condition or act could result in an undesirable terms.” See http://upstream.chevron.com/contractorgom/forms_policies/stop_work_authority.aspx (accessed November 5, 2014). 33 A 2010 study by The RAD Group of 2,600 workers (primarily oil and gas service employees) found that the surveyed employees directly intervene in only 39% of the unsafe acts that they observe on the job. The study concluded people did not stop unsafe work were primarily because (1) they worry the person who is performing the unsafe work will become angry or defensive, and (2) they do not believe they can effectively stop unsafe work. See Ragain, R., Ragain, P., Allen, M. & Allen, M. “Study: Employees Intervene in Only 2 of 5 Observed Unsafe Acts.” Drilling Contractor. January / February 2011. 34 The entire Chevron leak response protocol is presented in Appendix A.

Chevron Richmond Refinery Investigation Report January 2015 14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

c. Substandard equipment maintenance practices. Those same surveys indicate that Chevron Richmond Refinery employees saw increased problems in how the refinery maintained its equipment between 2008 and 2010. (See Section 5.5.)  1.4.5 Industry Codes and Standards Findings

1. Industry falls short of requiring comprehensive inspection or effective facility upgrades.

American Petroleum Institute (API) Recommended Practice (RP) 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries is the primary industry guidance document on ways to monitor and control sulfidation corrosion. It states that carbon steel piping can contain components with low silicon concentrations, and these components can corrode at a faster rate than adjacent piping components. However, API RP 939-C does not specifically require users to perform 100 percent component inspection or recommend that facilities upgrade high-risk carbon steel piping circuits to steel alloys that are more resistant to sulfidation corrosion. (See Section 5.2.1.)

1. Industry guidance is inconsistent in the information presented about carbon steel piping

susceptible to sulfidation corrosion. API has published various codes and recommended practices in addition to API RP 939-C that discuss sulfidation corrosion, including API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems, API RP 578: Material Verification Program for New and Existing Alloy Piping Systems, and API RP 574: Inspection Practices for Piping System Components. While these documents provide some information on sulfidation corrosion, the information and guidance is varied and inconsistent. (See Sections 5.2.2, 5.2.3, 5.2.4, and 5.2.5.)

1. Industry guidance for responding to process leak incidents can be improved. API and the

American Society of Mechanical Engineers (ASME) have published several codes, standards, and recommended practices that provide information on how to safely control, mitigate, or respond to hazardous process fluid leaks. However, the guidance is inconsistent, and none of the documents provide overall, comprehensive guidance to emergency responders, operations personnel, and facility management to respond safely to hazardous process leak incidents. (See Section 5.4.) 1.4.6 Regulatory Findings

1. In the years leading to the August 6, 2012, incident, the Chevron Richmond Refinery identified

weaknesses in its Stop Work Authority program due to employee hesitation to use Stop Work Authority when witnessing an unsafe act. The Refinery also identified a decline in employee perception of its mechanical integrity programs. However, the regulator did not require the Chevron Richmond Refinery to take quality, constructive steps to improve these areas. Had steps been taken before the incident to encourage employees to use their Stop Work Authority or to determine why the refinery’s mechanical integrity programs were seen as deficient, the August 6, 2012, pipe rupture might have been prevented. (See Section 5.5.2.4.)

Chevron Richmond Refinery Investigation Report January 2015 15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5 Recommendations

As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized below, to the following recipients (see Section 6.0 for full language of the recommendations):

American Petroleum Institute Revise API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries to establish minimum requirements for preventing catastrophic rupture of low-silicon carbon steel piping. Revise API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry to increase awareness of sulfidation corrosion characteristics and refer users to specific API standards that provide important information to prevent catastrophic rupture of low-silicon carbon steel piping. Revise API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems to incorporate language consistent with API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries, increase awareness of sulfidation corrosion characteristics, provide additional information to prevent catastrophic rupture of low-silicon carbon steel piping, and require users to follow the proposed new leak response guidance in API RP 2001: Fire Protection in Refineries. Revise API RP 578: Material Verification Program for New and Existing Alloy Piping Systems, to require users to establish and implement a program to identify carbon steel piping circuits that are susceptible to sulfidation corrosion and may contain low-silicon components. Revise API RP 574: Inspection Practices for Piping System Components (3rd edition) to incorporate as a normative reference API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries and to follow the leak response protocol requirements established in API RP 2001: Fire Protection in Refineries. Revise API RP 2001: Fire Protection in Refineries to require users to develop a process fluid leak response protocol specific to their own facility that must be followed when a process fluid leak is discovered. Recommend users to incorporate key actions into their leak response protocol to effectively manage response to potential sulfidation corrosion piping failure.

American Society of Mechanical Engineers Refer users to follow the leak response guidance developed by the American Petroleum Institute prior to conducting leak repairs.

Chevron U.S.A. Develop an accountability method at Chevron to identify and track effective implementation of Chevron or industry best practices to ensure process safety or employee personal safety.

Chevron Richmond Refinery Investigation Report January 2015 16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Develop an auditable process for all recommended turnaround work items related to inspection or mechanical integrity recommendations that are denied or deferred. This process shall provide the submitter of the denied or deferred recommendation with a mechanism to further elevate and discuss the recommendation with higher level management. Develop an approval process that includes a technical review that must be implemented prior to resetting the minimum alert thickness to a lower value in the inspection database.

Board of Supervisors, Contra Costa County, California and Mayor and City Council, City of Richmond, California Revise the Industrial Safety Ordinance (ISO) regulations for petroleum refineries to require the development of an oversight committee comprised of the regulator, the company, the workforce and their representatives, and community representatives. Among the duties of this committee shall be to oversee the development and implementation of action items created as a result of safety culture assessment findings.

Chevron Richmond Refinery Investigation Report January 2015 17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Richmond Refinery Process Description
2. 1 Chevron Background

Chevron was originally founded as the Pacific Coast Oil Company in 1879.35 In 1906, Pacific Coast Oil Company merged with Iowa Standard to form a new company known as Standard Oil Company of California.36 The company then acquired Gulf Oil Corporation in 1984 and changed its name to Chevron.37 Headquartered in San Ramon, California, Chevron Corporation is the third-largest American company by revenue.38 Globally, Chevron employs over 60,000 people.39 Chevron includes petroleum operations, chemicals operations, mining operations, power generation, and energy services.40 It operates seven petroleum refineries, five of which are in the United States. The five U.S. refineries process a combined crude oil capacity of approximately one million barrels per day (bpd).41 2.2 Richmond Refinery Chevron’s Richmond Refinery is located in Richmond, California, approximately 25 miles northeast of San Francisco in Contra Costa County. The original refinery units were built in 1902 by Pacific Coast Oil Company. The Richmond refinery covers approximately 2,900 acres of the San Pablo Peninsula (Figure 2) and processes 250,000 barrels of crude oil per day. Approximately 1,200 people are employed at the refinery.

35 http://www.chevron.com/about/history/ Chevron Company History Page (accessed June 5, 2014). 36 http://www.chevron.com/about/history/1876/ (accessed June 30, 2014).

37 http://www.chevron.com/about/leadership/ (accessed June 30, 2014). 38 http://money.cnn.com/magazines/fortune/fortune500/2012/full_list/. This ranking is by annual revenue (accessed June 30, 2014). 39 http://www.chevron.com/about/leadership/ (accessed June 30, 2014). 40 http://www.forbes.com/companies/chevron/ (accessed June 30, 2014). 41 See http://www.chevron.com/documents/pdf/UnitedStatesFactSheet.pdf (accessed December 18, 2014).

Chevron Richmond Refinery Investigation Report January 2015 18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 2. Aerial view of the Chevron Richmond Refinery. 2.3 #4 Crude Unit The Richmond, California Chevron Refinery’s #4 Crude Unit (Crude Unit) performs the initial processing step in the refining process. Raw crude oil stored in storage tanks is pumped to the Crude Unit. After an initial “cleaning” of the oil through the use of a desalter, which removes corrosive salts, solids, and water,42 the oil is pre-heated and enters the C-1100 Crude Unit Atmospheric Column (Crude Column) at approximately 675 degrees Fahrenheit (°F). The Crude Column separates through distillation various hydrocarbon component mixtures in the crude feed, creating multiple streams coming off the column with differing boiling points. These streams include an overhead light hydrocarbon stream, jet oil streams, a

42 Removing chloride salts and water prevents the formation of hydrochloric acid, which can severely corrode downstream equipment. Other salts and solids are removed to prevent fouling within equipment such as heat exchangers, which can significantly reduce heat transfer.

Chevron Richmond Refinery Investigation Report January 2015 19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

diesel stream, a light gas oil stream, and a bottoms stream composed of heavy liquid hydrocarbons. Each stream is further refined and processed in subsequent units within the refinery. 2.4 4-Sidecut Line The August 6, 2012, incident occurred from the piping referred to as the “4-sidecut” line, one of several process streams exiting the Crude Column (Figure 3).43 As shown in Figure 4, light gas oil, the Crude Unit 4-sidecut process fluid, exits the atmospheric column via a 20-inch nozzle and is split into a 12-inch line and an 8-inch line. The pipe rupture (Figure 5) occurred on a 52-inch long component44 of the 4- sidecut 8-inch line (the 52-inch component). The line operated at a temperature near 640°F45,46 and had an operating pressure of approximately 55 pounds per square inch gauge (psig) at the rupture location. At the time of the incident, light gas oil was flowing through the 8-inch line at a rate of approximately 10,800 bpd.47

43 The atmospheric column separates crude oil feed into different streams through distillation. These streams are further processed in other units in the refinery. 44 The term “component” refers to a portion of piping between welds or flanges. It includes straight run piping and pipe fittings. 45 The autoignition temperature for this process, the temperature at which a material will combust in the presence of sufficient oxygen without an ignition source, was 640°F. This number is based on the Chevron Light Gas Oil Material Safety Data Sheet. Chemical testing of 4-sidecut samples following the incident indicated lower autoignition temperatures; however, these samples may not have been representative of typical 4-sidecut process fluid. 46 Chevron instrumentation indicates that the process fluid entered the 4-sidecut piping at a temperature near 640°F and cooled to 625°F before reaching the piping circuit pumps downstream of the rupture location. 47 This rate is the equivalent of 315 gallons per minute (gpm). A barrel equals 42 gallons.

Chevron Richmond Refinery Investigation Report January 2015 20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 3. Schematic of C-1100 Crude Unit atmospheric column and upstream process equipment.

Chevron Richmond Refinery Investigation Report January 2015 21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 4. 4-sidecut line configuration and rupture location.

Chevron Richmond Refinery Investigation Report January 2015 22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 5. Photo of rupture on 4-sidecut 52-inch component. 3.0 The Incident 3.1 Leak Discovery At approximately 3:50 p.m. on August 6, 2012, an outside operator performing routine checks of piping and equipment found an 18-inch puddle of what appeared to be a diesel-like material on the refinery concrete pad (Figure 6). Identifying that the leak was occurring from overhead, the operator observed intermittent drips as they accumulated on the underside of an insulated pipe 14 feet above ground level. The leaking pipe was identified to be a portion of the 4-sidecut piping that originated on the Crude Column. Visually analyzing the piping, the operator determined that the line could not be isolated from the process.

Chevron Richmond Refinery Investigation Report January 2015 23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 6. CSB animation depicting operator identifying the leaking 4-sidecut pipe. The operator’s supervisor arrived at the leak location, shortly followed by the shift team leader. These individuals observed that the leak was dripping at a rate of approximately 40 drips per minute. The piping was insulated, so the individuals gathered near the leak could not identify its precise source (Figure 7). They concluded that the leak was not significant enough to require a shutdown, but was still a serious situation. Shortly after 4:00 p.m., they called the Chevron Fire Department to the scene, a typical practice at the refinery when leaks are discovered. Firefighters began to arrive at approximately 4:07 p.m. and established an Incident Command structure. A hot zone of 20 feet by 20 feet was established and taped off around the leak location by the Incident Commander. The area outside of the hot zone was considered the cold zone, or safe zone.48

48 A decontamination corridor is often established in the warm zone, an area established between the hot zone and the cold zone. “Decontamination involves thorough washing to remove contaminants. It should be performed in an area upwind of the Hot Zone. An area that is uphill, with good drainage, and easily accessible for responders is preferred.” See http://chemm.nlm.nih.gov/decontamination.htm (accessed January 21, 2015).

Chevron Richmond Refinery Investigation Report January 2015 24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 7. Photo taken of the leaking 4-sidecut pipe on August 6, 2012, at the Chevron Richmond Refinery.49 Insulation obscured the actual leak location. Stain signifies where hydrocarbon process fluid was leaking from the 4-sidecut piping.

49 Photo from http://richmond.chevron.com/Files/richmond/Investigation_Report.pdf (accessed June 27, 2014).

Chevron Richmond Refinery Investigation Report January 2015 25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Beginning at approximately 4:15 p.m., many additional personnel were called to the scene of the leak to assist in the leak analysis. Various operations personnel were called to the leak. Two Chevron inspectors reported to the leak location to provide information on inspection history of the 4-sidecut line. The lead Crude Unit process engineer also arrived at the leak location to determine an estimate of the hole size and the quantity of material leaking so that proper environmental release calculations could be performed. At approximately 5:00 p.m., the shift team leader left the scene of the leak and went to the control room. He directed the board operator to reduce the feed to the 4-sidecut line by 5,000 bpd.

Figure 8. Timeline of events on August 6, 2012. 3.2 Leak Response Ultimately, a large group of Chevron employees—40 people in total throughout the hours leading to the incident—accumulated at the leak location. They began discussing their options to mitigate or stop the leak. The inspectors informed the group that the 4-sidecut pipe walls were thinning due to sulfidation corrosion, but data collected as recently as two months prior indicated the 4-sidecut line had sufficient wall thickness to last until the next turnaround in 2016. This assessment led the group to believe that a localized mechanism, such as abrasion on the line from a pipe support near the dripping location, was the likely cause of the leak. The group then called the leak repair contractor to the leak location to assess the possibility of clamping the line in an effort to stop the leak. A photo of a typical leak repair clamp is shown in Figure 9.

Chevron Richmond Refinery Investigation Report January 2015 26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 9. Example leak repair clamp for piping.50 It is installed over the leak location to prevent process fluid leakage to the atmosphere. The group then decided to remove the insulation from the 4-sidecut pipe to determine the cause of the leak, a practice Chevron personnel call “daylighting the leak.” This procedure, they determined, would help in the decision either to repair the leak on-line or to shut down the unit. During preparation for the daylighting activity, the fire engine was repositioned in the cold zone to a location approximately 65 feet from the leak, fire monitors51 were set up pointing towards the leak location, and two hose lines were run from the fire engine to a position near the 4-sidecut piping. Two teams of three firefighters operated the hoses. All hoses and monitors were at-the-ready, able to respond should any incident occur. The first attempt to remove insulation was made by pulling on the insulation bands from the ground using a pike pole.52 This was unsuccessful. Rather, the piping actually moved from the force of the pulling, so the group determined it was too dangerous trying to remove the insulation in that way. The group then decided that scaffolding should be built to provide easy access so that firefighters could manually cut loose the piping insulation. At this point, shift change was occurring. Some individuals left for the day, and some volunteered to stay past their shift end time after their relief showed up. This change resulted in an increase of people standing near the 4-sidecut leak location.

50 Photo from http://www.huwa.com/en/vervolgpagina/83/37/HUWA_Split_Barrel/ (accessed June 27, 2014). 51 A fire monitor is a piece of firefighting equipment that sprays water and can be manually aimed and operated. 52 A “pike pole” is a long pole with a hooked metal end commonly used by firefighters.

Chevron Richmond Refinery Investigation Report January 2015 27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Contractors arrived at the scene to build the scaffold (Figure 10). During a pre-response safety meeting consisting of the Incident Commander, a safety officer, firefighters, and key operations personnel, one group of firefighters operating a hose was directed to spray the scaffold builders should an incident occur, and the other group of firefighters operating the second hose was directed to spray the pipe if needed. Three scaffold contractors then built the scaffold beneath the leaking 4-sidecut pipe.

Figure 10. CSB animation of contractors erecting scaffolding beneath the leak location. Once the scaffolding was built, two firefighters were directed to climb the scaffold and remove the aluminum sheathing and insulation (shown in Figure 7) from the 4-sidecut pipe. The battalion chief was aware that vapors leaking from under the insulation could mix with air and “light off,” or catch on fire, as the insulation was removed, so the firefighters made preparations for such a possibility by being at-the- ready with fire hoses. The firefighters on the scaffolding began to remove the aluminum sheathing surrounding the insulation by using a hook to pull the bands securing the insulation and sheathing sufficiently away from the insulation to allow for snipping the bands with cutters. Using this technique, the firefighters were able to remove several three-foot sections of the aluminum sheathing surrounding the insulation. As the firefighters were removing the sheathing of the 4-sidecut line (shown in Figure 7), white hydrocarbon vapor visibly began to emerge from under the now-exposed insulation material. The firefighters continued to remove the sheathing despite the formation of hydrocarbon vapor. During the continued sheathing removal, insulation that was soaked with hot 4-sidecut hydrocarbon autoignited once exposed to oxygen—only feet from the firefighters. The hose teams immediately put out the fire, and both firefighters quickly came down from the scaffold (Figure 11).

Chevron Richmond Refinery Investigation Report January 2015 28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 11. CSB animation of firefighters attempting to remove the 4-sidecut insulation, the resulting fire, and fire extinguishing.

Chevron Richmond Refinery Investigation Report January 2015 29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The firefighters on the scaffolding successfully removed much of the aluminum sheathing surrounding the insulation; however, underlying insulation still obscured the location of the leak. Directed by the operations personnel, the Chevron Fire Department sprayed the insulation with hard, straight streams using the fire hoses in an attempt to knock the insulation off the pipe. The hose teams knocked off the insulation up to the location where the aluminum sheathing had been removed. At this point, they realized that the leak had significantly worsened; hydrocarbon liquid was now spraying from the pipe. Several operations managers present then decided to shut the unit down, an action that requires hours to complete. 3.3 Consequences A vapor cloud quickly began to accumulate. The hose teams attempted to keep the cloud at bay by spraying it with firefighting water. Suddenly, the vapor cloud worsened, engulfing 19 firefighters and operators standing in both the hot zone and cold zone in the hot hydrocarbon cloud. The cloud was dense and very hot, and many of the individuals caught in the cloud were not able to see anything around them. One person caught in the cloud told the CSB that he could not see his hand if he had held it directly in front of his face. Each person engulfed in the cloud began working their way out of the vapor cloud. Several of the firefighters operating the two hoses dropped to their hands and knees to follow their hose lines to safety, feeling their way out of the cloud (Figure 12).

Figure 12. CSB animation of firefighters who dropped to their hands and knees to escape the vapor cloud. At approximately 6:30 p.m., two minutes after the large vapor cloud formed, the light gas oil ignited.53 Eighteen employees safely escaped from the cloud just before ignition. One employee, a firefighter, was inside a fire engine that was engulfed in the fireball when the light gas oil ignited (Figure 13 and Figure

53 Shown by surveillance video recording.

Chevron Richmond Refinery Investigation Report January 2015 30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

14). He told CSB interviewers, “… All I could see [was] heavy hydrocarbon-type boiling fire in every window of that truck. I can’t even begin to describe how hot it was. It was very intense.” He called “MAYDAY” over his radio but received no response. He informed the CSB, “I figured that everybody else was dead.” Because he was wearing full body firefighting protective equipment, he was able to escape through the flames surrounding the fire truck and make his way to safety without physical injury.

Chevron Richmond Refinery Investigation Report January 2015 31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. CSB animation of firefighter who was inside the fire engine when the light gas oil ignited.

Chevron Richmond Refinery Investigation Report January 2015 32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 14. Photo of the burned remains of the fire truck that was consumed by the fire. A firefighter was in the cab when the light gas oil ignited. The fire truck was positioned in the cold zone approximately 65 feet from the leak location. The leak resulted in a large plume of vapor which traveled across the surrounding area. The ignition and subsequent burning of the hydrocarbon process fluid created a large black cloud of smoke, which also swept across the surrounding area (Figure 15). This situation resulted in a Community Warning System (CWS) Level 3 alert,54 and a shelter-in-place55 advisory (SIP) was issued at 6:38 p.m.56 for Richmond, San Pablo, and North Richmond. It was lifted later that night at 11:12 p.m. after the fire was fully under control. In the weeks following the incident, nearby medical facilities received over 15,000 members of the public seeking treatment for ailments including breathing problems, chest pain, shortness of breath,

54 A Community Warning System Level 3 alert indicates that a facility within Contra Costa County has had a release that has offsite impact and is categorized by any of the following events:

1. Offsite impact that may cause eye, skin, nose and/or respiratory irritation to the general population.
2. Fire, explosion, heat, or smoke with an offsite impact. Example: On a process unit/storage tank where mutual

aid is requested to mitigate the event and the fire will last longer than 15 minutes.

1. Hazardous material or fire incident where the Incident Commander or unified command, through consultation

with the Contra Costa Health Services Hazardous Material Incident Response Team, requests that sirens should be sounded. See http://cchealth.org/hazmat/pdf/incident_notification_policy.pdf (accessed April 9, 2013). 55 Contra Costa County considers a shelter-in-place to include going inside a home or nearest building, closing doors and windows, and turning off heating, ventilation, and air conditioning. See http://cchealth.org/emergencies/shelter-in-place.php (accessed February 6, 2013). 56 Chevron U.S.A. Inc. "30 Day Follow-Up Notification Report." September 5, 2012.

Chevron Richmond Refinery Investigation Report January 2015 33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

sore throat, and headaches. According to information provided to the CSB by local hospitals, approximately 20 people were admitted to local hospitals as inpatients for treatment.

Figure 15. Initial vapor cloud formation (white cloud) and subsequent ignition (black smoke) as seen from a pier in San Francisco, California.57

57 Photos are from Fototaker.net.

Chevron Richmond Refinery Investigation Report January 2015 34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 16. Vapor cloud and ignition seen from Marin County.58

1. 0 Technical Analysis

The CSB commissioned Anamet, Inc., a materials engineering and laboratory testing company, to conduct testing of the 4-sidecut pipe, including the failed 52-inch component. The testing concluded that the rupture was due to pipe wall thinning caused by sulfidation corrosion.59 4.1 Sulfidation Corrosion Sulfidation corrosion, also known as sulfidic corrosion,60 is a damage mechanism61 that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450°F to 1000°F.62 For pipe walls, this damage mechanism causes gradual

58 Photo is a screen capture from KTVU Channel 2 News. 59 Anamet, Inc. "Metallurgical Evaluation of Samples from the Chevron U.S.A. Inc., Richmond #4 Crude Unit 8 Inch and 12-Inch 4-Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013. 60 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 3.1.6, May 2009. 61 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects, thus affecting the integrity of piping (e.g., corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems. 3rd ed., Section 3.1.1.5, November 2009. 62 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 1, May 2009.

Chevron Richmond Refinery Investigation Report January 2015 35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

thinning over time. Sulfidation corrosion is common in crude oil distillation,63 where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide,64 are available to react with steel piping and equipment. Process variables that affect corrosion rates include the total sulfur content of the oil, the sulfur species present, flow conditions, and the temperature of the system. Virtually all crude oil feeds contain sulfur compounds; therefore, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled. Sulfidation corrodes carbon steel at a much faster rate in comparison with its effect on other materials of construction, such as steels with a higher chromium content. This issue is discussed in depth in the CSB’s Interim Investigation Report of the August 6, 2012, Chevron incident.65 In addition to its naturally faster rate of sulfidation corrosion when compared with higher chromium steels, carbon steel can also experience significant variation in corrosion rates due to variances in silicon content, a component used in the steel manufacturing process. Carbon steel piping containing silicon content less than 0.10 weight percent can corrode at accelerated rates,66 up to 16 times faster than carbon steel piping containing higher percentages of silicon. Figure 17 shows how carbon steel corrosion rates can greatly vary depending on silicon content.

63 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 64 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. 65 http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed April 2, 2014). 66API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 6.2.3.2, May 2009.

Chevron Richmond Refinery Investigation Report January 2015 36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 17. Graph of sulfidation corrosion rates with respect to silicon content in carbon steel. This graph shows how corrosion rates increase in carbon steel containing decreasing percentages of silicon. This information can be found in Annex C of API RP 939-C.67 The refining industry has been aware of increased susceptibility to sulfidation corrosion in low-silicon carbon steel piping since as early as 1974,68 nearly 40 years before the August 6, 2012, incident and two years before the Chevron Crude Unit was constructed. Before the incident, Chevron documented its understanding of the potentially catastrophic nature of failures caused by sulfidation corrosion, as reflected in Chevron’s Corrosion Prevention and Metallurgy Manual: Sulfidation corrosion has caused severe fires and fatalities in the refining industry, primarily because it causes corrosion over a relatively large area, so failures tend to involve ruptures or large leaks rather than pinhole leaks. It can be insidious in that moderately high corrosion rates can go undetected for years before failure. Finally, process changes that increase the temperature or sulfur content can creep up over time and multiply corrosion rates so that what was thought to be a low corrosion rate system becomes corrosive enough to fail before the increased corrosion rate is recognized.

67 The y-axis of this figure is in units of mils per year (mpy). A “mil” is 1/1000 inch. 68 API Publication 943: High-Temperature Crude Oil Corrosivity Studies. September 1974.

Chevron Richmond Refinery Investigation Report January 2015 37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Carbon steel piping is manufactured to meet certain specifications. Prior to the mid-1980s, multiple carbon steel specifications were commonly and independently in use for refinery piping, including American Society for Testing and Materials (ASTM) A53B,69 ASTM A106,70 and American Petroleum Institute (API) 5L.71 ASTM A53B and API 5L do not contain minimum silicon content requirements for carbon steel piping,72 while ASTM A106 requires the piping to be manufactured with a minimum silicon content of 0.10 weight percent. As a result, manufacturers have used different levels of silicon in the carbon steel pipe manufacturing process. Thus, depending on the manufacturing specification for carbon steel, sulfidation corrosion rates could vary depending on the silicon content within the steel. In the mid-1980s, pipe manufacturers began to comply simultaneously with all three manufacturing specifications (ASTM A53B, ASTM A106, and API 5L) when manufacturing carbon steel piping, which resulted in piping being manufactured with at least 0.10 weight percent silicon content due to the ASTM A106 requirement. As a result, the majority of carbon steel piping purchased following this time period for refinery operations likely has a minimum of 0.10 weight percent silicon content. However, piping purchased and installed prior to the mid-1980s could still contain low silicon components susceptible to high, variable sulfidation corrosion rates. The timing of this manufacturing change has a profound impact on the susceptibility of refineries to variable sulfidation corrosion rates today. Over 95 percent of the 144 refineries in operation in the United States, including the Chevron Richmond Refinery,73 were built before 1985,74 before piping manufacturers began producing carbon steel in compliance with all three manufacturing specifications. Therefore, the original carbon steel piping components in these refineries is likely to contain varying percentages of silicon content and may experience highly variable sulfidation corrosion rates. The Chevron Richmond Refinery 4-sidecut piping circuit containing the 52-inch component that failed was constructed of ASTM A53B carbon steel, which had no minimum specification for silicon content. Post-incident testing of samples of the 4-sidecut piping from the Chevron Richmond Refinery identified silicon content ranging from 0.01 weight percent to 0.2 weight percent. Of 12 samples taken from the 8- inch and the adjacent 12-inch 4-sidecut line, six had a silicon concentration of less than 0.10 weight percent (Figure 18 and Figure 19). The 52-inch pipe component that ruptured on the day of the incident had a silicon content of only 0.01 weight percent. Illustrating the inherent variability in ASTM A53B carbon steel sulfidation corrosion rates, the elbow component directly upstream of the 52-inch component that failed had a silicon concentration of 0.16 weight percent and showed considerably less thinning (Figure 20).

69 ASTM Standard A53/A53M-12: Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-Coated, Welded and Seamless, 2012. 70 ASTM Standard A106/A106M–11: Standard Specification for Seamless Carbon Steel Pipe for High-Temperature Service, 2011. 71 API Specification 5L: Specification for Line Pipe. 45th ed., December 2012. 72 ASTM Standard A53/A53M-12: Standard Specification for Pipe, Steel, Black and Hot-Dipped, Zinc-Coated, Welded and Seamless, 2012. 73 The Chevron Richmond Refinery was constructed in 1902. 74 See http://www.eia.gov/tools/faqs/faq.cfm?id=29&t=6 (accessed February 14, 2013).

Chevron Richmond Refinery Investigation Report January 2015 38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 18. Locations of metallurgical samples taken from 8-inch 4-sidecut piping post-incident. The seven samples taken are boxed in orange. Four of the seven components sampled (shown with an orange fill) were found to have a silicon content less than 0.10 weight percent.

Chevron Richmond Refinery Investigation Report January 2015 39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 19. Locations of metallurgical samples taken from 12-inch 4-sidecut piping post-incident. The five samples taken are boxed in orange. Two of the five components sampled (shown with an orange fill) were found to have a silicon content less than 0.10 weight percent.

Chevron Richmond Refinery Investigation Report January 2015 40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 20. 4-sidecut piping sample (E-017-8) analyzed by Anamet Labs showing the relative thickness of low silicon piping on the left and the high silicon piping on the right. The ruptured 52-inch pipe component (left) contained 0.01 weight percent silicon, and the upstream elbow component (right) contained 0.16 weight percent silicon.75 The initial nominal thickness of this piping was 0.322-inch.

75 Anamet, Inc. "Metallurgical Evaluation of Samples from the Chevron U.S.A. Inc., Richmond #4 Crude Unit 8- Inch and 12-Inch 4-Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for: The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013.

Chevron Richmond Refinery Investigation Report January 2015 41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2 Sulfidation Corrosion Inspection Techniques

As evidenced by the chemical analysis performed on the Chevron 4-sidecut piping post-incident, carbon steel piping components within a single circuit76 can contain varying percentages of silicon, resulting in a large variation in sulfidation corrosion rates by component. Current corrosion inspection guidance documents allow for the measurement of pipe thickness at a minimal number of permanent Condition Monitoring Locations (CMLs)77 along the piping length.78,79 These CMLs are most frequently placed on elbows and fittings80 because higher turbulence in these areas usually results in the fastest metal loss.81 However, due to details of the manufacturing process, carbon steel elbows and pipe fittings, even when manufactured to the ASTM A53B specification, generally contain relatively high percentages of silicon.82 When measurements are taken only at high silicon-containing fittings, the measurements can fail to identify high corrosion rates within a pipe circuit occurring within low-silicon, straight-run piping components. API Recommended Practice (RP) 939-C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries describes the challenges when attempting to inspect carbon steel lines susceptible to sulfidation corrosion. The recommended practice states that older ASTM A53B piping, such as the Chevron piping that failed on August 6th, creates a “major inspection challenge”83 and “unless the refinery is fortunate enough to have located an inspection point on that particular [low silicon] section of pipe or fitting, it is very difficult to detect the thinning component.”84 It states that in some applications, carbon steel will appear to be adequate based on measured corrosion rates until failure occurs at some undocumented or unidentified low-silicon component.85 At the Chevron Richmond Refinery, the 8-inch 4-sidecut piping had a total of 19 CMLs86 on piping and fittings. Historically, most of the CMLs measured corrosion rates at high silicon pipe-fitting components, such as elbow components. An effort in 2011 added additional CMLs on straight-run components within

76 A piping circuit is a length of pipe and the fittings associated with a particular process service that operate at similar conditions. A circuit usually begins and ends at either a branch or a piece of process equipment, such as a vessel or a pump. Reference to piping by circuits allows piping to be grouped conveniently by proximity and operating service. Piping circuits may also be referred to as piping runs. 77 A condition monitoring location (CML) is a designated area where periodic thickness examinations are conducted. Each CML represents as many as four inspection locations located circumferentially around the pipe. CMLs are also referred to as thickness monitoring locations (TMLs). CMLs were historically referred to as corrosion (rather than condition) monitoring locations, and that terminology is sometimes still used within the industry. 78 API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems, 3rd ed., Section 5.6.3, November 2009. 79 For most damage mechanisms that affect an entire piping circuit, the whole circuit loses metal at a similar rate. Monitoring pipe thickness at a minimal number of CMLs is considered representative of the entire pipe. 80 A fitting is a piping component usually associated with a change in direction or diameter. 81 API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems, 3rd ed., Section 5.6.2, November 2009. 82 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries, 1st ed., Section 7.1.5, May 2009. 83 Ibid., Section 9. 84 Ibid., Section 7.1.5. 85 Ibid., Section 6.2.3.2. 86 Many of these CMLs were added during the 2011 turnaround.

Chevron Richmond Refinery Investigation Report January 2015 42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the 8-inch 4-sidecut piping circuit, although 100 percent component inspection was not performed. The CSB found that, although a CML was located on the adjacent upstream elbow, no CMLs were placed on the low silicon piping component that failed (Figure 21). Chevron identified corrosion in the 52-inch component during a supplemental 2002 inspection,87 but the inspection results were not entered into the CML-tracking portion of the inspection database, and no new CML was required to be added to ensure future monitoring. As a result, the 52-inch component was never inspected again (Section 5.1.2.1.1).

Figure 21. CML placement on 8-inch 4-sidecut piping. Nineteen CMLs were used to monitor corrosion rates in the 8-inch 4-sidecut piping. A CML was not placed on the 52-inch component that ultimately failed. A CML was placed, however, on the upstream elbow adjacent to the 52-inch component. This inspection data gathered using the 19 CMLs did not reflect the corrosion rates of the quickly corroding, low-silicon components of the 4-sidecut piping. As illustrated by the Chevron incident, traditional inspection techniques alone—using only a limited amount of CMLs—may not accurately identify the most aggressive sulfidation corrosion rates throughout an entire circuit of carbon steel piping.

87 The inspector was supervising contractors who were conducting measurements on a CML located on the adjacent elbow. Prompted by a recent Chevron corrosion study, he decided to have them also measure the straight pipe about one foot before and after the elbow, on the other side of the welds, by radiographic thickness techniques (RT). These were not formal CMLs. In 2002, the 52-inch component had lost roughly a third of its original wall thickness. The only documentation of this measurement was a note in a history brief in the inspection database.

Chevron Richmond Refinery Investigation Report January 2015 43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Low-silicon components can remain uninspected and unidentified until failures such as the August 6, 2012, Chevron incident occur. As discussed in the CSB’s Interim Investigation Report of the Chevron incident and again in this report, upgrading material of construction to steels with higher chromium content is a more effective means of managing sulfidation corrosion. Indeed, Chevron’s internal “New Construction Guidelines” recommend that piping installed in high temperature and high sulfur service be constructed with 9-Chrome steel. 4.3 Silicon Characterization Techniques Determining silicon content in existing carbon steel piping and equipment in the field is a difficult undertaking. To characterize the silicon content in each component of a piping circuit properly, every component must be inspected. This is known as 100 percent component inspection. Two techniques are used to identify low-silicon content and resulting variable corrosion rates in existing carbon steel piping circuits with unknown chemical composition: (1) performing chemical analysis; or (2) performing pipe wall thickness measurements of every carbon steel component.88 Silicon Characterization Technique Description Chemical composition analysis of each component

Shavings of piping are analyzed in a laboratory to determine silicon content. Requires weld identification and insulation removal.

Thickness measurement of each component

Identifies gross differences in component thicknesses due to differing silicon concentrations. Must be performed on piping that has been in- service for long enough time to detect corrosion rate differences. Requires weld identification and insulation removal.

Table 1. Silicon characterization technique. Many field-portable instruments used for Positive Material Identification89 (PMI) cannot adequately identify silicon content.90,91 If original manufacturing quality assurance data92 are not available, as is

88 Pipe wall thickness measurement is difficult because of the high operating temperatures of piping subject to sulfidation corrosion. These measurements are commonly made only when the piping is out of service and cool, for example, during a unit maintenance activity. 89 Positive Material Identification is the identification and chemical analysis of various metal alloys through nondestructive methods. 90 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 7.1.5, May 2009. 91 Recent technological advances may allow for nondestructive silicon detection using a hand-held composition analyzer. See http://www.olympus-ims.com/en/applications/using-handheld-xrf-to-manage-sulfidation-corrosion- in-carbon-steel/ (accessed October 29, 2014)

Chevron Richmond Refinery Investigation Report January 2015 44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

generally the case with older plants, then chemical verification requires destructive testing. Metal shavings must be taken from each carbon steel piping component for chemical analysis in a laboratory.93 Care must be taken not to contaminate the sample with bits of metal from the tools used to gather the sample. Carbon steel components containing low concentrations of silicon can also be identified by performing one-time thickness measurements of every component within a carbon steel circuit.94 This practice is only useful as a means to ascertain silicon content if the piping circuit has been exposed to sulfidation corrosion for a long enough time period so that variances in corrosion rate caused by differences in silicon content may be detected. Chemical analysis is, therefore, the most reliable technique to identify low- silicon carbon steel components. Both characterization techniques require identification of each piping component, typically by removing insulation (so every weld seam can be located), a time consuming and costly undertaking. Weld seams can be located through insulation using specialized equipment and examination techniques, but this method can be less accurate than when weld seams are identified manually. Both silicon characterization techniques can be technically difficult and physically hazardous for inspectors because of the high operating temperatures of piping subject to sulfidation. It is common to make thickness measurements or take shaving samples only when the piping is out of service and cool, for example, during a unit maintenance turnaround.95 Unlike silicon concentration, the chromium concentration of steel can easily be verified in the field using portable positive material identification instruments. In addition, steel alloys containing at least 9 weight percent chromium are more resistant to sulfidation corrosion and do not run the risk of extreme variations in corrosion rates within components in the same piping circuit.96 This makes alloys with at least 9 weight percent chromium content an inherently safer choice97 in high temperature sulfidation corrosion environments because the hazard presented by varying corrosion rates within a single piping circuit is eliminated. As shown in the Modified McConomy Curves98 from API RP 939-C (Figure 22), higher chromium steels are also a better safeguard than carbon steel because sulfidation corrosion rates are

92 Manufacturing quality assurance data, also known as mill data, provides the chemical composition of the steel. 93 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., Section 7.1.5, May 2009. 94 Ibid., Section 7.1.5. 95 A “turnaround” is a scheduled shutdown of a process unit to perform maintenance, repairs, upgrades, and inspection of process equipment. 96 The protective scale, FeCr2S4, begins to be the dominant scale formed in steels containing a chromium content of five weight percent. The 5Cr steel alloy can be manufactured to contain anywhere from 4 percent to 6 percent chromium. Thus, “the sulfidation corrosion rate can vary dramatically in 5Cr steels even in the same operating environment.” See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008. 97 Steels with higher chromium content are inherently safer than carbon steel with respect to sulfidation corrosion because they can eliminate the hazard of gross variations in corrosion rates within a single piping circuit. However, analysis is still required to ensure that the best material of construction is selected. 98 Modified McConomy Curves are the set of curves API RP 939-C uses to predict sulfidation corrosion rates versus temperature for several steel alloys.

Chevron Richmond Refinery Investigation Report January 2015 45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

greatly reduced. Carbon steel99 corrodes approximately nine times faster than 9-Chrome steel, which contains 9 percent chromium, and carbon steel corrodes approximately 120 times faster than stainless steel, which contains 18 percent chromium.100,101

Figure 22. Modified McConomy Curves from API RP 939-C. 4.4 Inherently Safer Design Efforts to improve chemical process safety require the identification of process hazards, followed by the elimination, mitigation, or control of process hazards to reduce the overall risk of a process. A hazard can be defined as a “situation with the potential for harm.” Risk is then defined as a function of both the consequence (hazard) and likelihood (frequency).102 Risk reduction can be achieved by using, in order of robustness, inherently safer design, passive safeguards, active safeguards, and procedural safeguards.103 This can be thought of as a tiered or hierarchical approach to risk management, commonly referred to as a “hierarchy of controls.” The further

99 ASTM A53B carbon steel contains a maximum of 0.40 weight percent chromium. 100 9-Chrome contains 9 weight percent chromium. 101 These values were calculated using the McConomy Curves at 630°F. 102 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 2.1, 2009. 103 Ibid. 100.0

Chevron Richmond Refinery Investigation Report January 2015 46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

up the hierarchy, the more effective the risk reduction achieved (Figure 23). Inherently safer design104 reduces risk by permanently reducing or eliminating a defined hazard itself, while safeguards defined as passive (design features), active (detection and automatic response), and procedural (policies, procedures, training, inspection, use of personal protective equipment) reduce risk by reducing the ultimate consequence or likelihood of the hazard.105

Figure 23. Hierarchy of controls. The further up the hierarchy (further to the left as shown here), the more effective the risk reduction achieved. Figure developed from concept presented in Kletz, Trevor; Amyotte, Paul. Process Plants: A Handbook for Inherently Safer Design, 2nd ed; 2010. These definitions are published by the Center for Chemical Process Safety (CCPS), a not-for-profit corporate membership organization within the American Institute of Chemical Engineers that identifies and addresses process safety needs within the chemical, pharmaceutical, and petroleum industries.106 The CCPS book Inherently Safer Chemical Processes, 2nd ed. designates a process as inherently safer “if it reduces or eliminates the hazards associated with materials and operations used in the process and this reduction or elimination is permanent and inseparable.”107 A facility can approach its inherently safer design strategy by looking for opportunities to minimize, substitute, moderate, or simplify.108 The August 6, 2012, sulfidation corrosion pipe rupture at the Chevron Richmond Refinery highlights a missed opportunity to incorporate inherently safer design strategies through the use of more robust materials of construction. CCPS states: The concept of inherent robustness … applies to designing equipment to be impervious to the corrosion mechanisms that are present given the materials of construction and within the process, and the operating conditions (i.e., temperature, pH, concentration, viscosity, etc.). The use of certain alloys will eliminate certain types of corrosive attack. […] Although robust equipment design may be considered to be a passive safeguard rather than an inherently safer design, it considerably simplifies the remainder of the process design. Therefore, it fits within the definition of simplification [an inherently safer design strategy]. It is also highly effective in eliminating the possibility of an uncontrolled loss

104 The concept of “inherently safer design” was first established by Trevor Kletz in 1977 in response to the 1974 Flixborough explosion in England. He presented a lecture titled “What You Don’t Have, Can’t Leak” at the Jubilee Lecture for the Society of Chemical Industry. 105 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 2.1, 2009. 106 www.aiche.org/ccps/about (accessed February 14, 2013). 107 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 2.2, 2009. 108 bid., Section 3.5.

Chevron Richmond Refinery Investigation Report January 2015 47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of containment. In a general sense, the removal of this possibility from a process design must be considered to be inherently safer.109 Thus, the use of a higher chromium steel alloy, such as 9-Chrome, is an inherently safer design strategy that could have prevented the Chevron Richmond Refinery pipe rupture. Installation of 9-Chrome piping during turnaround opportunities prior to the August 6, 2012, incident to replace the 4-sidecut carbon steel would have both eliminated the hazard of silicon-based variable corrosion rates within the components of the 4-sidecut piping circuit and at the same time also greatly reduced the underlying inherent rate of sulfidation corrosion. The use of 9-Chrome steel also simplifies the procedural inspection safeguards required, as 100 percent component inspection would not be required to monitor corrosion rates in steels containing at least 9 percent chromium; the typical inspection strategy of monitoring corrosion rates using a minimal amount of CMLs would be sufficient. It is important to remember that inherently safer design strategies are relative; a specific design can only be described as inherently safer when compared to a different design with regard to a specific hazard or risk.110 A design may be inherently safer by eliminating one hazard, but can inadvertently introduce or aggravate another hazard.111 For this reason, performing a comprehensive, documented hazard analysis is vital for identifying the individual hazards and the likelihood of those hazards occurring, followed by identifying how they can be effectively controlled to minimize overall risk. The review should include risks of personal injury, environmental harm, and lost production, as well as evaluating economic feasibility.112 An inherently safer systems review incorporated as an integral part of this hazard analysis generates an optimized list of hazard control choices, offering various degrees of inherently safer design strategies. Effectively implementing inherently safer design provides an opportunity for preventing major chemical incidents. The August 6, 2012, incident at Chevron and other incidents113 throughout the refining industry highlight the difficulty in preventing failure caused by sulfidation corrosion in low silicon carbon steel piping solely through inspection—a procedural safeguard that is thus among the least effective on the hierarchy of controls. Implementing inherently safer design concepts to the greatest extent feasible by Chevron and other refiners and chemical plant operators will avoid hazards such as variation in sulfidation corrosion rate in carbon steel piping due to hard-to-determine silicon content, and it will provide a higher degree of protection from incidents similar to the one that occurred on August 6, 2012.

109 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 4.5.1, 2009. 110 Center for Chemical Process Safety (CCPS). Guidelines for Engineering Design for Process Safety. 2nd ed., Section 5.2, 2012. 111 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 3.6, 2009. 112 Ibid., Section 8.6.4. 113 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries. 1st ed., May 2009.

Chevron Richmond Refinery Investigation Report January 2015 48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Incident Analysis

The CSB investigation team developed an accident map (AcciMap)114 for the Chevron investigation (Figure 24). The AcciMap is a multilayered causal diagram that depicts immediate causes115 as well as higher level contributing causes at the corporate, governmental, and regulatory levels. This diagram includes five levels:

1. Outcomes: the impact of the August 6, 2012, event to workers present and the surrounding

community;

1. Physical Events and Conditions: the immediate causes of the incident as displayed in a traditional logic

tree;

1. Chevron: company rules and policies; conduct of turnarounds; risk management; identification of

hazards and evaluation of safeguards; adoption of internal recommendations; safety programs; and emergency response;

1. Industry Codes and Standards: good practice guidelines that provide safety requirements and

recommendations on topics including mechanical integrity and emergency response; and

1. Government: laws and legislation developed to regulate process safety at refineries.

Some of these contributing factors are discussed in the Chevron Interim Report and the Chevron Regulatory Report. Refer to the AcciMap in Figure 24116 as a guide to locating information.

114 The AcciMap was originally developed by Jens Rasmussen in the article Rasmussen, Jens. “Risk Management in a Dynamic Society: A Modelling Problem.” Safety Science. Vol. 27, No 2/3, 1997; pp. 183-213. The AcciMap was subsequently used and popularized by Andrew Hopkins, in Hopkins, Andrew. “Lessons From Longford: The Esso Gas Plant Explosion.” CCH Australia Limited: Sydney, 2000; Chapter 10. 115 Immediate causes are the events or conditions that lead directly to an incident, such as mechanical failure or human error. 116 A high-resolution graphic of the AcciMap can be found on the CSB website.

Chevron Richmond Refinery Investigation Report January 2015 49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 24. Acci-Map of August 6, 2012, Chevron Refinery Fire.

Chevron Richmond Refinery Investigation Report January 2015 50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1 Organizational Analysis

In the ten years prior to the incident, a small number of Chevron personnel with knowledge and understanding of sulfidation corrosion made recommendations to increase inspections or upgrade the material of construction in the 4-sidecut piping. Their recommendations were not effectively implemented. The process to implement important, safety-critical projects within the Chevron Richmond Refinery was not fully effective. As discussed in the following sections and depicted in Figure 25, a combination of (1) reliance on a turnaround management program that depended on only a fraction of necessary data to make important process safety decisions, (2) an unsuccessful bottom-up approach— with no management oversight or accountability—for implementing a crucial safety program, and (3) no formal method to track to completion the Chevron expert group’s findings and recommendations ultimately caused these recommendations to not be implemented.

Figure 25. Organizational decision-making schematic showing attempts to have carbon steel 4-sidecut piping 100 percent component inspected or replaced with a higher chromium steel alloy. Attempts failed due to lack of accountability and lack of authority to ensure recommendation implementation, and a rigid turnaround planning process that could not approve the 4-sidecut piping replacement recommendations. Figure 26 shows the sequence of sulfidation corrosion-related recommendations and events within Chevron Corporation and the Chevron Richmond Refinery between 2002 and the day of the incident. These events are discussed in subsequent sections of this report.

Chevron Richmond Refinery Investigation Report January 2015 51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 26. Key events at the Richmond refinery between 2002 and 2012. The following sections discuss Chevron programs designed to improve equipment reliability and process safety. These programs are summarized in Figure 27 and Figure 28.

Chevron Richmond Refinery Investigation Report January 2015 52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 27. Chevron Corporation refinery process safety programs.

Chevron Richmond Refinery Investigation Report January 2015 53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.1 Chevron Energy Technology Company

In this section:

Within Chevron is a separate business unit called the Chevron Energy Technology Company (ETC). This unit provides technology solutions and technical expertise for Chevron operations worldwide (Figure 28). Chevron ETC technical staff has considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron ETC employees have authored industry papers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. This recommended practice, first published in 2009,117 was developed under Chevron leadership. Metallurgists within ETC had shared their knowledge on sulfidation corrosion via many outlets over the years to employees at Chevron refineries, as discussed in the following sections. Despite all of this institutional expertise, the 4-sidecut line ruptured due to sulfidation corrosion at the Chevron Richmond Refinery.

117 As of January 2015, the 2009 edition of API RP 939-C is the active edition of this standard.

Chevron Richmond Refinery Investigation Report January 2015 54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 28. Chevron Energy Technology Company (ETC) organizational roles. ETC provides technology solutions and technical expertise throughout all Chevron (and affiliated companies) operations.

1. 1.1.1 ETC Sulfidation Failure Prevention Guidance

At the approximate time of publication of API RP 939-C, Chevron ETC metallurgists released within Chevron a formal report dated September 30, 2009, nearly three years before the incident, titled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries (hereinafter referred to as ETC Sulfidation Failure Prevention Initiative). The ETC Sulfidation Failure Prevention Initiative clearly indicates that Chevron technical experts understood the high likelihood that the consequence of a sulfidation corrosion failure could be a rupture or catastrophic failure. It specifically calls out Chevron’s need for action: Sulfidation corrosion failures are not common in Chevron or in the industry but they are of great concern because of the comparatively high likelihood of blowout or catastrophic failure…. This can happen because corrosion occurs at a relatively uniform rate over a broad area so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition the process fluid is often above its autoignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires.… [S]everal case histories of sulfidation corrosion failures … have occurred in Chevron or in the industry, several of which are blowouts. The Chevron ETC Sulfidation Failure Prevention Initiative specifically recommends that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. The initiative defines a priority ranking system to help focus the inspection efforts. The process conditions of the 4-sidecut stream—operating temperatures greater than 600°F— placed it in the highest priority category for inspection. In 2010, Chevron ETC technical experts issued a corporate newsletter focusing on materials and corrosion, again warning of the potential consequence of sulfidation failures. This newsletter reiterated

Chevron Richmond Refinery Investigation Report January 2015 55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the recommendation from the 2009 ETC Sulfidation Failure Prevention Initiative to conduct 100 percent component inspection of carbon steel piping systems that operated over 600°F. The Richmond Crude Unit 4-sidecut piping fell within this high-priority inspection category. This newsletter was accessible to all employees on Chevron’s company intranet. Chevron ETC also regularly hosted training sessions for refinery personnel. One of these classes, designed for refinery inspection staff but also attended by refinery engineers and senior operators, focused specifically on crude units and on corrosion mechanisms within crude units—including sulfidation corrosion. One of the main messages from this training was that sulfidation corrosion in piping containing low-silicon components can result in catastrophic rupture, and that the means to prevent rupture from occurring is performing 100 percent component inspection or upgrading to a higher chromium steel (Figure 29 and Figure 30).

Figure 29. Presentation slide of ETC training course that guided refinery staff to perform 100 percent component inspection on high-temperature lines susceptible to sulfidation corrosion.

Chevron Richmond Refinery Investigation Report January 2015 56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 30. Presentation slide of ETC training course that guided refinery staff on ways to reduce risk from sulfidation corrosion. The 2009 ETC Sulfidation Failure Prevention Initiative report was circulated to reliability managers and metallurgists at the individual refineries, as well as to the corporate reliability expert. The authors of the Chevron ETC report chose to send the report to these individuals specifically because they seemed to be the right people to perform and advocate for the necessary inspection and replacement work. However, the CSB discovered that the Reliability Department at the Chevron Richmond Refinery believed that the 100 percent component inspection initiative recommended by the ETC sulfidation failure prevention guidance, while important safety work, was an ambitious, unfunded, and unsupported initiative which could not be effectively performed solely within the normal budget and headcount resources of the Reliability group. Also, the Reliability group made attempts to forego the burdensome inspection initiative and simply implement the ETC alternative sulfidation mitigation strategy to improve sulfidation corrosion resistance through using higher chromium steel by recommending replacement of the 8-inch 4- sidecut piping with inherently safer higher chromium steel.118 However, these recommendations were denied on multiple occasions during the Chevron turnaround planning process (Section 5.1.2). As discussed in the following sections, the Chevron programs created to ensure that necessary work was performed to maintain reliable, safe operation and corporate-wide process safety were not successful in preventing the rupture that had the potential to seriously harm 19 Chevron employees on August 6, 2012. 5.1.1.2 Chevron ETC Conclusions Despite many attempts by Chevron ETC to warn and educate refinery personnel, neither 100 percent component inspection of high-risk carbon steel piping nor upgrading susceptible piping to an inherently safer material of construction was fully performed at the Chevron Richmond Refinery. In practical terms, because Chevron ETC was a separate business entity within the Chevron corporation and had no direct authority over the reliability management within the Chevron refineries, Chevron ETC sulfidation corrosion experts had limited influence on what actually occurred within refineries in their areas of expertise. These individuals did not participate in refinery-specific processes such as Process Hazard

118 Shown in Figure 30, ETC’s senior inspector and analysis training taught inspectors that sulfidation corrosion resistance could be improved by upgrading susceptible piping circuits to steels containing higher percentages of chromium.

Chevron Richmond Refinery Investigation Report January 2015 57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Analyses (PHAs)119 (see Chevron Interim Investigation Report) and did not affect decisions concerning monitoring and control of sulfidation corrosion during the Crude Unit turnaround process (Section 5.1.2). No formal system is in place at the Chevron Richmond Refinery to communicate to the refinery management and to track to completion ETC findings and recommendations. While Chevron does use an indicators tracking program (Section 5.1.6), the program does not measure the implementation status of ETC recommendations and new industry guidance determined by Chevron technical experts to be critical in ensuring continued safe operations at Chevron refineries.

119 A process hazard analysis is a hazard evaluation to identify, evaluate, and control the hazards involved in a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section

1. Process Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the

California Accidental Release Prevention Program and the federal EPA Risk Management Program. See the CSB’s Chevron Interim Investigation Report for a full analysis on this subject.

Chevron Richmond Refinery Investigation Report January 2015 58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.2 Chevron Turnaround Management

In this section:

Chevron uses a turnaround planning and implementation process called Initiative for Managing Pacesetter Turnarounds, known within Chevron as the IMPACT process. It is organized into several different phases, each with a specific objective. The IMPACT process begins several years before each scheduled turnaround. Chevron’s stated goal of the IMPACT process is to perform turnarounds efficiently and effectively, ensuring that only the necessary work items that must be performed during the turnaround are performed, and all other items that can be performed on-the-run (while the unit is operating) or during the next turnaround are not included in the work scope. The turnaround work approval process is guided by what Chevron calls a “Framing Document.” It is developed over a year before the planned turnaround, by a group including turnaround planning management, a decision review board, and specific process unit managers. An IMPACT “Core Team” comprised of an operations representative, inspector, design engineer, process engineer, capital project representative, and maintenance representative are the main decision makers regarding what potential work items meet the requirements of the Framing Document and thus have the potential to be automatically included in the turnaround. The work items that pass the

Chevron Richmond Refinery Investigation Report January 2015 59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Framing Document test are then prioritized.120 A group of refinery managers determine a priority cutoff, and only items in this high-priority, Framing Document-approved list are automatically included in the turnaround scope. The items below the priority cutoff are reviewed by refinery managers and can be included in the turnaround scope on a case-by-case basis. The Core Team follows the strict criteria described in the turnaround Framing Document when approving or denying requested turnaround work submitted by refinery employees. If the Core Team determines that a potential work item does not meet the Framing Document requirements, it never reaches the prioritization step, so it is not part of a review by the refinery managers. 5.1.2.1 2007 Crude Unit Turnaround The Framing Document used for the 2007 Crude Unit turnaround specified that the primary requirements for the turnaround included performing any work needed to assure a minimum of 10 years (two turnaround cycles) before the next inspection or maintenance was required, performing all required compliance inspections, and recertifying state operating permits for boilers. The detailed work list criteria for the turnaround are shown in Figure 31.

120 The prioritization was based on a combined severity and likelihood of impacts in four individually-weighted categories: health, safety, environmental, and production. The higher the sum of these four values, the higher the priority for the potential work item.

Chevron Richmond Refinery Investigation Report January 2015 60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. Work list criteria requirements specified in the Framing Document used during Chevron’s 2007 Crude Unit turnaround. 5.1.2.1.1 Recommendations Regarding 4-Sidecut Line for 2007 Turnaround The first recommendations to upgrade or 100 percent component inspect the 4-sidecut line were made for the 2007 Crude Unit turnaround. One such recommendation was based upon the findings from the 2002 turnaround. In August 2002, a Chevron Richmond Refinery employee analyzed sulfidation corrosion rates in the Crude Unit and identified potentially vulnerable areas based on process conditions. The employee discovered that the 4-sidecut operating temperature had increased, concluding this increase would cause more hydrogen sulfide to evolve, leading to increased sulfidation corrosion rates. The employee’s study recommended increased inspection of the 4-sidecut piping and noted that this piping might need upgrading from carbon steel to 5-Chrome, a steel alloy containing five percent chromium that is more resistant to sulfidation corrosion. In 2002, proactively following up on this study, the Crude Unit inspector conducted additional piping inspection and identified corrosion in a 52-inch 4-sidecut component, which is the component that ultimately failed on August 6, 2012. The corrosion was found during inspection on a component that was not a typical inspection location (i.e., not an official CML).

Chevron Richmond Refinery Investigation Report January 2015 61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Chevron inspection guidelines require that findings from additional discretionary inspection must be recorded only as notes in a “history brief” rather than input in the inspection database as is typically done for CMLs. Therefore, documentation of the corrosion identified in 2002 was recorded only as notes and was not formally input as data into the inspection database of permanent CML measurements. (An example of inspection database data appears in Figure 32.) The inspector formally recommended upgrading this piping during the next shutdown in 2007 to the IMPACT core team.

API does not require new CMLs to be established on components with non-uniform corrosion in potentially low silicon carbon steel piping circuits. Such a requirement in API RP 939-C would help to ensure that components experiencing non-uniform corrosion are effectively monitored, managed, and replaced to prevent sulfidation corrosion failures.

Figure 32. Sample Inspection Database report analyzed by unit inspectors when determining piping remaining life and when making piping replacement recommendations. This Inspection Database report is also analyzed by the IMPACT core team to determine Framing Document applicability.

Adhering to the Chevron turnaround work scope procedures, the IMPACT core team analyzed the available inspection data of the 4-sidecut line from the inspection database to determine whether upgrading the 4-sidecut piping met the Framing Document requirements. The recommendation to upgrade the 4-sidecut piping did not meet the 2007 turnaround Framing Document requirement #10, as all

Chevron Richmond Refinery Investigation Report January 2015 62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

recorded data in the inspection database (from existing CMLs on relatively high-silicon piping fittings) indicated that the 4-sidecut piping upstream of the pumps had sufficient thickness to continue to safely operate until the next turnaround before requiring further inspection or maintenance. The recommendation to upgrade the 4-sidecut piping also did not meet the 2007 turnaround Framing Document requirement #5, as the IMPACT core team believed it was not a substantiated high-risk reliability issue because existing inspection data did not indicate an imminent reliability problem. It was determined, however, that the 4-sidecut piping downstream of the pumps required replacement,121 based on the same process of analysis, and only that piping was replaced with an upgraded, inherently safer material of construction, 9-Chrome (Figure 33).

Also prior to the 2007 turnaround in February 2006, a team consisting of a materials and corrosion engineer, an inspector, a process engineer, a metallurgist, and a design engineer issued a Corrosion Mitigation Plan for the Chevron Richmond Refinery Crude Unit. This report was developed specifically for the Area Business Unit (ABU) Manager, the highest ranking manager for the Crude Unit. The report specifically identified the 4-sidecut piping to be at risk from high temperature sulfidation corrosion. The team issued the following recommendation: Recommendation – Install Guided Wave bracelets [on the 4-sidecut piping] during the [2007 Crude Unit] Turnaround so that 100% volumetric inspection of the line can be done to ensure that there are no piping sections in the line that are corroding faster than the majority of the line…. [The] piping needs to be monitored in anticipation of future replacement and additionally, industry experience shows that sections of piping with low silica [sic] content will corrode at higher rates. Monitoring this section of line using global inspection technique like guided wave is the fastest way to determine if there are thin piping pups in the system.

121 The piping downstream of the pumps operates at a higher pressure, and thus the Minimum Required Thickness calculated was thicker than for the piping on the suction side of the pumps.

Chevron Richmond Refinery Investigation Report January 2015 63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 33. Crude column schematic indicating the piping downstream of the 4-sidecut pumps that was replaced during the 2007 Crude Unit turnaround. The portion of the carbon steel line containing the component that failed on August 6, 2012 was not replaced. The recommendation to perform 100 percent volumetric inspection through the use of experimental guided wave technology was accepted and implemented by the ABU Manager. 122 The inspection recommendation met the framing document requirement #5 and requirement #8, as it was specified to be based upon past industry sulfidation experience and was approved by the ABU Manager. However, this recommendation was only partially implemented. The guided wave bracelets were installed only on a small portion of the 4-sidecut line, which did not include the 52-inch component that ultimately failed on

122 Common volumetric inspection techniques include ultrasonic and radiography testing.

Chevron Richmond Refinery Investigation Report January 2015 64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

August 6, 2012.123 Furthermore, when the experimental guided wave bracelet data proved to be unreliable, manual 100 percent component inspection was not implemented to address the low-silicon piping component corrosion concerns raised in the February 2006 recommendation. In addition, because the Crude Unit inspector’s discretionary inspection observations were not input into the CML-tracking portion of the inspection database as an official CML (discussed earlier in this section), the 52-inch component in which the inspector identified corrosion in 2002—the component that failed on August 6, 2012—was never inspected again. 5.1.2.2 2011 Crude Unit Turnaround The Framing Document for the 2011 Crude Unit Turnaround states that some of the goals of the 2011 turnaround were to perform work to ensure a five year run; perform compliance inspections and requirements; and perform safety, environmental, and process improvement work that required a shutdown. The work list criteria requirements for the turnaround appear in Figure 34.

Figure 34. Work list criteria requirements specified in the Framing Document used during Chevron’s 2011 Crude Unit turnaround.

123 It was later determined that the guided wave data was unreliable, so the Crude Unit inspector resumed inspections using ultrasonic thickness measurements.

Chevron Richmond Refinery Investigation Report January 2015 65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

A key change from the 2007 Framing Document directly affected whether work items such as 100 percent component inspection or replacement of the 4-sidecut could obtain Core Team approval. In 2007, the Core Team could approve a work item as meeting 2007 Framing Document criterion #10 for inspection, repair or replacement of equipment or piping if it was needed to ensure a minimum of 10 years (two turnaround cycles) before the next inspection or if maintenance was required. The guided wave inspection devices on the 4-sidecut met this criteria. In 2011, this Framing Document criterion was deleted. The Core Team in 2011 should refuse any work item for inspection, repair, or replacement of equipment or piping unless it required a rate cut or shutdown within only 5 years, before the next turnaround (items #2 and #6). 5.1.2.2.1 Recommendations Regarding 4-Sidecut Line for 2011 Turnaround Following the release of the Chevron ETC Sulfidation Failure Prevention Initiative report, discussed in Section 5.1.1, the Chevron Richmond Refinery materials group completed the risk-ranking of the carbon steel piping in the Richmond Lube Oil Project Unit (RLOP) and in the Crude Unit, two units with high temperature piping known to be susceptible to sulfidation corrosion. The group identified the Crude Unit 4-sidecut line as a high-risk line based on the report ranking guidance. Instead of requesting funding to perform the 100 percent component inspection, the group recommended the 4-sidecut for replacement with 9-Chrome. Just as when planning for the 2007 turnaround, the IMPACT team denied the recommendation because the inspection data available for the 4-sidecut piping did not support a material upgrade during the 2011 turnaround. The IMPACT team did not consider the lack of data on potentially more susceptible 4-sidecut straight-run pipe components. Chevron also conducts “Intensive Process Reviews” prior to turnarounds. This process involves knowledgeable individuals including Business Improvement Network leaders, process engineers, metallurgical engineers, design engineers, and turnaround planners. The review aims to identify key unit issues that should be addressed and repaired during the unit turnaround. Before the 2011 Crude Unit turnaround, Chevron personnel conducted an Intensive Process Review of the Crude Unit and specifically recommended that the 4-sidecut carbon steel piping “should be upgraded to [5-Chrome] […] due to sulfidation.” Although the Intensive Process Review identified sulfidation problems in the 4-sidecut line, this activity was ineffective. The 4-sidecut piping was not upgraded during the 2011 Crude Unit turnaround because the IMPACT core team determined that it did not meet the turnaround framing document requirements. During the 2011 turnaround, a portion of the 12-inch 4-sidecut piping was identified as unacceptably thin and was replaced. The 12-inch 4-sidecut piping was the same age, material of construction, and contained the same process fluid with similar process conditions124 as the 8-inch 4-sidecut piping. However, because Chevron relies on existing data to make equipment replacement decisions, employees did not consider that these significant sulfidation corrosion findings could be indicative of similar thinning that could be occurring in the 8-inch piping. This was another missed opportunity during the 2011 Crude Unit turnaround to identify that the 8-inch 4-sidecut piping needed replacement.

124 The CSB notes that the process conditions of the 8-inch and 12-inch 4-sidecut piping were not identical.

Chevron Richmond Refinery Investigation Report January 2015 66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.2.3 Chevron Richmond Refinery Turnaround-Planning Conclusions

There were no 4-sidecut line inspection data indicating that the 8-inch 4-sidecut piping had thinned significantly enough from sulfidation corrosion to require replacement of the piping. Rather, the limited CML data, extrapolated to apply to the entire pipe, including the portion containing the component that failed on August 6, 2012, indicated that the pipe could remain in service until the 2016 turnaround. This oversight occurred for two reasons: (1) 100 percent component inspection was never performed, and (2) recorded data existed only on high-silicon components that corroded at much slower rates than the low- silicon 52-inch component. Chevron’s data-driven turnaround management framework led to unintended negative consequences. The current Chevron Richmond Refinery turnaround planning framework denies potential, discretionary turnaround work that does not yet have hard data gathered from refinery equipment to support it, even if the work request is based upon guidance issued by the industry trade association, American Petroleum Institute. This rejection is true even if, as in the case of 100 percent component inspection for sulfidation damage, the purpose of the work request is to actually generate the hard data. The only way a Chevron employee can have a work request approved based solely on industry guidance is to appeal to the ABU Manager for the work as an exception to the turnaround framing document criteria. (See 2007 turnaround Framing Document work criteria #8 and 2011 turnaround Framing Document work criteria #9.) The CSB cannot conclusively state whether even this method would have resulted in the approval to replace the 4-sidecut line, but Chevron reliability and metallurgical staff never attempted it. These individuals had not previously been in the position of having to convince management of the importance of their turnaround work recommendations, so advocating the Sulfidation Failure Prevention Initiative and persuading upper management to implement the ETC recommendations would be a foreign work area for them. In addition, no high-level manager was assigned responsibility to ensure that the ETC Sulfidation Failure Prevention Initiative or other ETC sulfidation recommendations were included in the turnaround scope. As a result, lower level employees who did not have decision-making or funding authority were burdened with convincing Chevron Richmond Refinery management to implement new industry guidance and the ETC recommendations. The requirement for hard data to justify turnaround work even affected decisions to mitigate hazards identified during a turnaround. During the 2011 turnaround, thinning from sulfidation corrosion in the 12-inch portion of the 4-sidecut piping was found to be so severe that the 12-inch piping had to be replaced immediately. Yet, Chevron replaced only the portions where hard data was available on the specific pipe to support the replacement. The hazardous condition did not prompt Chevron turnaround management to inspect all of the 4-sidecut piping or to preemptively implement the longstanding recommendation to replace all of the carbon steel portions. Post-incident, Chevron performed 100 percent component inspection of all Chevron Richmond Refinery Crude Unit piping susceptible to sulfidation corrosion. Four carbon steel piping components out of the 4,600 components inspected were identified to have higher corrosion rates than adjacent piping.125 Each

125 Steve Wildman (Chevron) letter to Randall Sawyer (Contra Costa Health Services), April 12, 2013. http://www.ci.richmond.ca.us/DocumentCenter/View/26802 (accessed June 30, 2014).

Chevron Richmond Refinery Investigation Report January 2015 67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of these four piping segments of which Chevron was unaware might have ultimately failed like the 52- inch 4-sidecut segment. This inspection activity may have prevented additional pipe ruptures in the unit due to accelerated sulfidation corrosion in low-silicon carbon steel.

Chevron Richmond Refinery Investigation Report January 2015 68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.3 Chevron Unit Reliability Improvement Process

In this section:

Chevron’s Unit Reliability Improvement Process (URIP) formally integrates a broad range of reliability activities. This program applies to all of Chevron’s wholly owned refineries. The overall URIP consists of several sub-processes, including Reliability in Asset Integrity, Resolution of Significant Reliability Opportunities, Risk Assessment and Asset Strategy, Condition Monitoring and Surveillance, Proactive Maintenance, and Maintenance and Failure Prevention. Beginning in 2009 as part of the URIP process, Chevron refineries began holding monthly Unit Reliability Briefs (URBs) as a forum for discussing short-term and long-term equipment reliability issues. Participants in these meetings include operators, process engineers, area inspectors, materials engineers, machinery reliability employees, maintenance employees, and management, such as the ABU Manager. These meetings proved ineffectual in securing safety critical improvements on several occasions. Documentation indicates that the high risk of sulfidation corrosion in the 4-sidecut piping was discussed at least twice in the URB meetings in the years leading to the incident. In 2010, a discussion on the need

Chevron Richmond Refinery Investigation Report January 2015 69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to replace the 4-sidecut piping to 9-Chrome resulted in a recommendation to replace the piping during the 2011 turnaround. However, the IMPACT Core Team ultimately denied replacement (Section 5.1.2.2.1). In 2012, URB meetings raised the need for additional inspection of the 4-sidecut line. In early 2012, a plan was implemented to increase inspection on the 8-inch 4-sidecut line, but the plan did not include the complete 100 percent component inspection recommended by the ETC Sulfidation Failure Prevention Initiative. Upper management, with decision-making and funding authority, was not assigned to—nor took ownership of—assessing implementation of the ETC Sulfidation Failure Prevention Initiative or similar ETC strategies in the refinery. The net result was that the URB meetings were not successful in effectively advocating for the ETC Sulfidation Failure Prevention Initiative. The action items developed in the URB meetings were not implemented, and high-risk piping susceptible to sulfidation corrosion was not properly inspected or replaced. Also part of the URIP process is a Reliability Steering Committee (RSC) meeting which occurs twice per month at the Chevron Richmond Refinery. Participants include the reliability manager, operations manager, ABU Manager, and materials and design personnel. These meetings aim to help steward reliability in the Chevron refineries. Specifically, this committee is responsible for “[d]evelop[ing] a Long-Term Reliability Plan consisting of prioritized, sequenced, and resource scoped recommendations for achieving long-term reliability objectives.” This committee also monitors long-term reliability improvement plan work requests to completion. The RSC discussed the ETC Sulfidation Failure Prevention Initiative and assigned the refinery’s materials engineers to ensure its effective implementation at the Richmond refinery. The materials engineers risk-ranked piping in the Richmond refinery based on the ETC report’s guidance. In late 2010, the refinery materials engineers and the inspectors presented a case to the IMPACT core team for the Richmond Lube Oil Project (RLOP) turnaround to perform 100 percent component inspection of various piping segments during its 2011 turnaround. This group also presented the recommendations of the ETC Sulfidation Failure Prevention Initiative report to the IMPACT core team, informing the group that this initiative was what prompted the 100 percent component inspection recommendations. Because the IMPACT team concluded that the inspection could be performed on-the- run when the unit was operating, they denied the 100 percent component inspection work request for the 2011 RLOP turnaround. Nevertheless, disagreements surfaced among the IMPACT team and the individuals who submitted the recommendations regarding the feasibility, safety, and accuracy of measuring thickness on high-temperature piping while the unit was operating. Some employees felt that performing thickness measurements on-the-run was unsafe. In fact, the inspection database was set up to define any pipe over 450°F as too hot to safely inspect on-the-run. In addition to safety concerns, accuracy was also suspect. Thickness testing on hot piping is extremely difficult to do accurately. However, this objection was also overruled, in this case based on the belief that accuracy was not important because the on-the-run inspection would only be looking for gross differences in pipe component thicknesses. To implement the ETC recommendations in the Chevron Richmond Refinery Crude Unit, the unit’s materials engineer and inspector submitted a request to replace the 4-sidecut piping with 9-chrome, but as discussed in Section 5.1.2.2.1, this recommendation was denied because it did not meet the 2011

Chevron Richmond Refinery Investigation Report January 2015 70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

turnaround Framing Document requirement of performing only work to ensure a five-year run. As yet, no data supported that the 4-sidecut piping could not remain in operation for at least another five years. In the case of the 2011 RLOP and Crude Unit turnarounds, Chevron Richmond Refinery staff had attempted to include work items to implement the ETC Sulfidation Failure Prevention Initiative. They made recommendations based on their authority in the Chevron Richmond Refinery inspection and materials engineering departments, and under the auspices of the URIP process and its URB and Reliability Steering Committee programs. However, they were unsuccessful; they were thwarted by the IMPACT turnaround planning process and the rigidity of its Framing Documents. No additional implementation efforts or appeals to refinery management were attempted, and no high-level refinery managers who attended URBs and Reliability Steering Committee meetings took responsibility of the ETC Sulfidation Failure Prevention Initiative and ETC sulfidation mitigation recommendations to ensure their effective implementation in the Richmond refinery.

Chevron Richmond Refinery Investigation Report January 2015 71 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.4 Chevron Fixed Equipment Reliability Business Improvement Network

In this section:

Chevron uses a corporate-wide equipment reliability expert group, called the Fixed Equipment Reliability Business Improvement Network (FER BIN), to monitor ongoing reliability efforts at each Chevron refinery as well as to promote new reliability improvement programs and align reliability practices at all of the Chevron refineries. The FER BIN is intended to be a “best practice” network that brings up to date changes in industry standards into Chevron. It is headed by a technically qualified subject-matter expert, the FER BIN Leader, who advocates for the implementation of new industry best practices or new reliability initiatives, such as the ETC Sulfidation Failure Prevention Initiative. Significant change occurred in the Chevron Business Improvement Network (BIN),126 and the FER BIN in particular, right after the ETC Sulfidation Failure Prevention Initiative was issued. The individual who

126 The Chevron Business Improvement Network (BIN) incorporates all areas of expertise needed to ensure process safety and mechanical integrity in Chevron refineries (e.g., expertise in specific chemical processes, rotating equipment expertise, and fixed equipment reliability expertise).

Chevron Richmond Refinery Investigation Report January 2015 72 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was in the FER BIN Leader role when the ETC Sulfidation Failure Prevention Initiative was issued retired in September of 2010, before the initiative was fully developed and implemented. This previous FER BIN Leader had been in the role for many years, and had a close working relationship with ETC, including those responsible for developing the ETC Sulfidation Failure Prevention Initiative. Also in 2010, the organization to which the various BIN Leaders reported was restructured. They now reported to a new organization encompassing process safety, reliability, and energy management for the entire manufacturing organization. The structure of the new organization was changed as a result, and every position was filled “from a clean sheet of paper.” A replacement for the FER BIN Leader position was not assigned until four months after the previous FER BIN Leader’s retirement, in January 2011, and the onboarding process for the new FER BIN Leader’s roles and responsibilities took additional time because of the hiring delay. The FER BIN meets periodically to discuss status of ongoing reliability improvement strategies. One of the strategies that the FER BIN was tasked to focus on was implementing the ETC Sulfidation Failure Prevention Initiative at all of the Chevron refineries. The FER BIN 2012 business plan included a task item to develop and implement “shaping plans” at Chevron refineries to inspect for high temperature sulfidation. The FER BIN Leader was charged with tracking progress of the shaping plans at each refinery. However, the CSB found that the new FER BIN Leader had minimal authority to enforce implementation of the ETC Sulfidation Failure Prevention Initiative at the Chevron Richmond Refinery. No employees within the refinery directly reported to the FER BIN Leader. In addition, despite the IMPACT core team’s decision power, it did not analyze the fixed equipment reliability shaping plans when making turnaround work item decisions. No requirements existed in the IMPACT Framing Documents to comply with shaping document directives. In March 2012, five months prior to the incident, the FER BIN Leader visited the Chevron Richmond refinery and identified that inspection of all carbon steel components susceptible to sulfidation corrosion was not being performed as recommended by the ETC Sulfidation Failure Prevention Initiative (Figure 35). In addition to identifying that CML placement for piping may need to be reassigned, this review found that the IMPACT team was denying critical inspection recommendations during the turnaround planning process. The FER BIN Leader identified that Richmond refinery leadership needed to review and implement the 2009 Chevron ETC Sulfidation Failure Prevention Initiative report and recommendations.

Chevron Richmond Refinery Investigation Report January 2015 73 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 35. Presentation slide showing corporate reliability leader’s findings that the Richmond Refinery was not complying with the ETC Sulfidation Failure Prevention Initiative. When the FER BIN Leader visited refineries, he met solely with inspection managers and inspectors to track progress. He did not meet with higher management within the Richmond refinery, such as the ABU Manager, to give updates on whether the inspection group was meeting corporate expectations. His assumption was that the individual refinery lead inspectors would use the knowledge he provided to shepherd new safety programs outlined in the refinery FER shaping plan. However, that implementation strategy did not work at the Chevron Richmond Refinery. (See Section 5.1.2.) Despite the existence of the FER BIN, it was not successful in ensuring important fixed equipment reliability work was being performed at the Chevron Richmond Refinery. The FER BIN program did not effectively gain commitment from refinery management—the individuals capable of ensuring that the necessary reliability work was being performed—to implement the ETC Sulfidation Failure Prevention Initiative or other ETC recommendations to upgrade susceptible carbon steel piping to inherently safer, higher chromium steel.

Chevron Richmond Refinery Investigation Report January 2015 74 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.5 Chevron Minimum Pipe Thickness Program

In this section:

Inspection staff at the Chevron Richmond Refinery determines the necessary inspection practices, such as condition monitoring location (CML) placement, inspection time intervals, and minimum allowable pipe thicknesses, by following the Richmond Refinery Piping Inspection Guideline. The inspection staff followed this guideline when monitoring the 4-sidecut piping corrosion rates and “remaining life,” the amount of time before the piping would become unacceptably thin and require replacement. The Richmond Refinery Piping Inspection Guideline refers to two pipe thicknesses that must be known to properly determine remaining life of a pipe:  “Minimum Alert Thickness” (Chevron calls this Flag Thickness) – The “wall thickness value used for triggering the need for quantitative [“Minimum Required Thickness”] and

Chevron Richmond Refinery Investigation Report January 2015 75 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

half-life assessments.”127 The Richmond Refinery Piping Inspection Guideline assigns the 4-sidecut piping a “Minimum Alert Thickness” of 0.14-inch. This value may be reduced to 0.10-inch based upon a “thorough technical review.”  “Minimum Required Thickness” – The minimum thickness of piping that can withstand the existing pressure and structural stresses. Piping must be replaced before it reaches its “Minimum Required Thickness.” A visual depiction of the 4-sidecut original wall thickness, its Minimum Alert Thickness, and its Minimum Required Thickness appears in Figure 36. Chevron uses a database to store inspection findings, notes, and piping wall thickness values, and to track corrosion rates. This database allows the inspector to input a pipe’s “Min Value,” which can be either the piping’s Minimum Alert Thickness or Minimum Required Thickness—to help to determine a piping circuit’s remaining life.

Figure 36. To-scale schematic of 4-sidecut piping original wall thickness (0.322-inch), Minimum Alert Thickness (0.13-inch), and Minimal Required Thickness (0.11-inch) using API RP 574 default values.

127 API 570 Section 6.3.3 states, “thickness measurements should be scheduled at intervals that do not exceed the lesser of one half the remaining life determined from the corrosion rates…or the maximum intervals recommended” by API 570 Table 2.

Chevron Richmond Refinery Investigation Report January 2015 76 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Inspection thickness data obtained during the 2011 turnaround indicated that the piping corrosion rates would result in the 4-sidecut piping wall thickness being reduced to below its 0.14-inch Minimum Alert Thickness before the next shutdown scheduled for 2016. According to the Richmond Refinery Piping Inspection Guideline, the next step would be to calculate a Minimum Required Thickness for the 8-inch 4-sidecut line and then determine if it needed to be replaced immediately, or if replacement could be safely delayed. This evaluation can also be used to lower the Minimum Alert Thickness to 0.1-inch following a thorough technical review. A structural minimum thickness value of 0.036-inch had been calculated for a small piping component on the suction of a 4-sidecut pump earlier during the turnaround. The inspector received this calculation in writing (Figure 37).

Figure 37. Text from Chevron design engineer indicating structural minimum thickness (t(min)) calculation results for small sections of suction piping upstream of the 4-sidecut pumps. A communication breakdown occurred in reviewing these results. The design engineer understood “suction piping” to refer to only a small section of piping upstream of the 4-sidecut pump P-1149, while the inspector understood “suction piping” to refer to the entire 4-sidecut circuit upstream of pump P-1149. They never met to clarify the calculation results. The calculated minimum structural thickness value of 0.036-inch for a small portion of the P-1149 suction piping was applied to the full length of the 8-inch 4- sidecut piping circuit. This calculation was used as a technical justification to reduce the 8-inch 4-sidecut Minimum Alert Thickness to 0.1-inch, and the piping wall thickness was predicted to stay above this Minimum Alert Thickness for at least six years. The 4-sidecut line was therefore allowed to continue operating with replacement scheduled for the next turnaround in 2016. API RP 574: Inspection Practices for Piping System Components gives specific guidance to users on Minimum Alert Thickness and Minimum Required Thickness. API RP 574 provides guidance on minimum thickness values only for piping that operates under 400°F. Piping that operates above this reference temperature of 400°F, such as Chevron’s 4-sidecut piping circuit, could be expected to require even greater minimum thickness values. API RP 574 provides an example of a minimum alert thickness

Chevron Richmond Refinery Investigation Report January 2015 77 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of 0.13-inch for piping 6 to 18 inches in diameter. Chevron’s 0.14-inch Minimum Alert Thickness is a conservative value based on API RP 574’s guidance. API RP 574 also provides users with a default minimum structural thickness of 0.11-inch for piping with a diameter of 8-inches—which can be used as the Minimum Required Thickness for piping in lieu of detailed engineering calculations.128 Chevron performed a detailed calculation to determine the 4-sidecut Minimum Required Thickness and the API RP 574 default minimum structural thickness was not used. However, had Chevron used the API RP 574 default minimum structural thickness value of 0.11-inch as the 4-sidecut Minimum Required Thickness, the remaining life of the piping circuit would have been predicted to be less than ten years, and a turnaround planning group discussion should have been triggered to discuss replacement options for the 8-inch 4-sidecut piping. Such a discussion could have resulted in the decision to replace the 8-inch 4- sidecut piping during the 2011 turnaround, and the August 6, 2012, pipe rupture could have been prevented. Chevron allowed adjusting the minimum thickness value in the inspection database based upon an evaluation of existing inspection thickness data and minimum structural thickness calculations. However, its inspection procedures caution the inspector to validate the quality of the data. The Piping Inspection Guideline poses the questions “Were enough measurement points taken; [a]re measurements being taken at the right locations?” Had these questions been effectively considered, evaluation of the Chevron Sulfidation Failure Prevention Initiative could have aided in the determination that there was not sufficient thickness data gathered on the 4-sidecut piping to justify the minimum thickness value change. Chevron does not require a formal multi-person review process to be performed prior to changing minimum thickness values and remaining life predictions. Such a process may have identified that the inspection data was unreliable and insufficient for carbon steel piping susceptible to sulfidation corrosion, and the piping could have been replaced per Chevron’s policies during the 2011 turnaround. Chevron’s minimum pipe thickness program is intended to obtain the maximum life out of piping, yet replace piping before it becomes dangerously thin. However, the program allowed changes to minimum thickness values without a formal multi-person review process and lacked sufficient oversight to ensure the safety questions were adequately considered before minimum thickness values were altered. As a result, the 4-sidecut piping that ultimately failed in 2012 was allowed to continue in operation following the 2011 turnaround inspection findings. The Chevron Richmond Refinery should strengthen its minimum pipe thickness program when determining a piping circuit’s remaining life.

128 This minimum thickness is specified for piping between 6 and 18 inches in diameter that operates at temperatures under 400 ⁰F. The 4-sidecut piping operated at a higher temperature, likely requiring a greater minimum thickness.

Chevron Richmond Refinery Investigation Report January 2015 78 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.6 Chevron Process Safety Indicators Program

API RP 754: Process Safety Performance Indicators for the Refining and Petrochemical Industries states, “A comprehensive leading and lagging indicators program provides useful information for driving improvement and when acted upon contributes to reducing risks of major hazards….”129 Indicators can reveal safety gaps before an incident occurs. One goal of the use of indicators is to drive continuous safety improvement. Lagging indicators are facts about previous events, such as process safety incidents, that meet a certain severity threshold. Leading indicators are measurements that predict future performance. They help facilities maintain safety protection layers and operating discipline by monitoring items such as equipment selection, engineering design, and specification, technique, and frequency of inspection.130 The CSB’s 2007 BP Texas City investigation report describes the importance of analyzing leading and lagging indicators: Process safety [indicators] provide important information on the effectiveness of safety systems, and an early warning of impending catastrophic failure. The sole use of lagging safety indicators, such as injury rates or numbers of incidents, has been described as trying to drive down the road looking only in the rear view mirror—it tells you where you have been but not where you are headed. Process safety good practice guidelines recommend using both leading and lagging indicators for process safety. Leading indicators provide a check of system functioning—whether needed actions have been taken, such as equipment inspections completed by the target date or PSM action item closure. Lagging indicators, such as near-misses, provide evidence that a key outcome has failed or not met its objective. “Active monitoring” of both leading and lagging indicators is important to the health of process safety systems.131, 132 Chevron uses an online dashboard which was developed in 2009 called Operational Excellence and Reliability Intelligence (OERI) to track 26 different process safety indicators. OERI visually displays the status, represented in red, yellow, or green, of many different process safety indicators: green represents a good indicator status, yellow identifies a couple of action items are necessary, and red represents the need to complete many action items. Management reviews these metrics weekly and schedules monthly meetings to discuss the yellow or red items. OERI also has the ability to project 30 days into the future to show the status of metrics at that future date should no action be taken on these items. The Chevron Richmond Refinery leadership team is held accountable for the status of metrics that they oversee. The refinery manager and the president of global manufacturing meet regularly with the Chevron Richmond Refinery leadership team to discuss status of the metrics they oversee, and this is incorporated into each leadership team member’s performance review. Chevron tracks the following 26 process safety indicators in the OERI database:

129 ANSI/API RP 754: Process Safety Performance Indicators for the Refining and Petrochemical Industries. 1st ed., Foreword, April 2010. 130 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics. Section 3.1, 2010. 131 U.K. Health and Safety Executive (HSE). Developing Process Safety Indicators: A Step-By-Step Guide For Chemical And Major Hazard Industries, 2006. 132 U.S. Chemical Safety Board (CSB). Investigation Report: Refinery Explosion and Fire (15 Killed, 180 Injured), BP Texas City, Texas, page 185, March 2007.

Chevron Richmond Refinery Investigation Report January 2015 79 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

 PHA Recommendation Implementation Overdue  Safety Instrumented Systems (SIS) Functions Disabled  SIS Functional Test Overdue  Open Safety Work Requests  Overdue Preventative Maintenance  Inspections Overdue  Overdue training  Training due in 30 days  Permanent MOCs Overdue  Temporary MOCs Overdue  Mechanical Availability  Incident Solutions Overdue  Investigations  Audit Action Items  Pre-Startup Safety Review Exceptions  Overdue Testing of Over Speed Trips  Overdue PRDs (Pressure relief valves) Testing  Days Exceeding Alarm Limit  Critical Process Variable Deviations  Routine Duties not Completed  Work Order Schedule Adherence  Open Temporary Leak Repairs  Utilization (Mechanical Utilization)  Reliability Clock (Mechanical Reliability)  Industrial Safety Ordinance Recommendation Implementation Overdue  Overdue Compliance Assurance Program tasks While Chevron’s OERI database is an excellent framework for tracking leading and lagging indicators to continuously monitor and improve process safety, it does not track the implementation of ETC process safety recommendations or new industry guidance as determined, for example, by Chevron technical experts to be critical to ensuring process safety in Chevron refineries. Such an indicator could have ensured that the ETC Sulfidation Failure Prevention Initiative and its status at the Chevron Richmond Refinery were at the forefront of management’s attention. Including an indicator into the OERI system for tracking the implementation of key ETC process safety recommendations or new industry guidance will aid in preventing future incidents at Chevron refineries. 5.1.7 Stop Work Authority Chevron’s corporate-wide Stop Work Authority policy applies to upstream drilling operations and downstream refining and manufacturing processes. It states:

Chevron Richmond Refinery Investigation Report January 2015 80 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Stop Work Authority (SWA) establishes the responsibility and authority of any individual to stop work when an unsafe condition or act could result in an undesirable event. In general terms, the SWA process involves a stop, notify, correct, and resume approach for the resolution.133 In theory, Stop Work Authority is a safety critical power that workers can use to halt operations if they see an unsafe condition or act occurring. On August 6, 2012, Stop Work Authority was not used to require immediate and safe shutdown of the Crude Unit.134 Instead, the unit continued to operate for an extended time, during which the potentially risky removal of insulation from the 4-sidecut pipe took place. The CSB learned in interviews that some personnel participating in the insulation removal process while the 4-sidecut piping was leaking were uncomfortable with the operation and the possible exposure to flammable process fluid. Some individuals recommended that the Crude Unit be shut down, but they did not formally invoke their Stop Work Authority. They left the final decision to the management personnel present. One employee stated to CSB investigators: If we can’t isolate [the 4-sidecut piping] then we’re going to, you know, we should shut down…. At that time, once I gave my opinion, I walked away because I let the head operator handle the decisions, right? Stop Work Authority has been used successfully at the Chevron Richmond Refinery in unsafe work situations (e.g., skipping a step in a procedure, working in unsafe weather conditions, wearing improper personal protective equipment (PPE), employing improper safety precautions when working at heights). The difficulty arises when faced with a process safety situation—a leak, vibration, process upset— especially where shutdowns are being considered. Under these circumstances, there are significant limitations to a Stop Work Authority initiative, the most familiar being the reliance on the individual employee to assert a dissenting viewpoint in an atmosphere where a group of individuals may not agree. Groups of employees working together to solve a problem can be hindered by the “group think” mindset: Without conflict, or without enough conflict, a phenomenon called group think can result. This occurs when group members do not express their personal opinions but rather willingly submit to what the group as a whole thinks. Group think can lead to bad decisions and inappropriate actions.135

133 See http://upstream.chevron.com/contractorgom/forms_policies/stop_work_authority.aspx (accessed July 14, 2014). 134 In its Chevron Regulator Report, the CSB recommended that California enhance and restructure its process safety management (PSM) regulations for petroleum refineries by including specific goal-setting attributes. The recommendation included language to strengthen stop work authority, “The regulation should provide workers and their representatives with the authority to stop work that is perceived to be unsafe until the employer resolves the matter or the regulator intervenes.” http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf (accessed December 18, 2014). 135 Society of Manufacturing Engineers. “Personal Effectiveness,” Fundamentals of Manufacturing. 3rd ed. Philip D. Rufe, editor, 2013, page 596.

Chevron Richmond Refinery Investigation Report January 2015 81 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Regardless of how a Stop Work program is portrayed, there are a number of reasons why such a program may fail related to the ‘human factors’ issue of decision-making; these reasons include belief that the Stop Work decision should be made by someone else higher in the organizational hierarchy, reluctance to speak up and delay work progress, and fear of reprisal for stopping the job.136 Another significant limitation is that, by design, Stop Work Authority is a decision process embedded into the chaos of the event itself. It becomes an option only when all other barriers have failed—often during a stressful atmosphere such as an emergency situation. Another employee stated to CSB investigators: We asked them, you know, shouldn’t we reevaluate this job, you know, stop it and try to figure something else out, because I’m thinking the leak is not where you say it is. It could be leaking up higher, and it would be a safer thing to shut this line down…. [The operations management present] said ‘This is an emergency. We need it done right now.’ … Everybody seemed to be in agreement that it needed to get done, and I didn’t want to argue anymore, because I don’t want to take any flack for stopping the job myself. These significant shortcomings of Stop Work Authority have been identified in previous CSB investigations. The CSB’s Investigation Report analyzing the refinery fire that occurred at the Tosco Avon Refinery in Martinez, California, on February 23, 1999 states: Tosco management stated that workers had the authority to stop unsafe work activity and should have stopped the line replacement job. However, stop work authority— though a desirable safety policy if properly encouraged—is a less effective measure for incident prevention than good job preplanning for the following reasons:  It is exercised during the execution of work, when pressures to get the job done are generally greater.137  It relies on the assertiveness of individual workers. To attempt to stop a job, a worker may need to assert a position that runs contrary to direct instructions from a supervisor.  Once the job has begun the idling of contractors and equipment can result in significant financial cost to the facility, which can add to the pressure to get the job done without delay.138

136 A 2010 study by The RAD Group of 2,600 workers, primarily oil and gas service employees, found that the surveyed employees directly intervene in only 39% of the unsafe acts that they observe on the job. The study concluded that they did not stop unsafe work because (1) they worry the person who is performing the unsafe work will become angry or defensive and (2) they do not believe they can effectively stop unsafe work. See Ragain, R., Ragain, P., Allen, M. & Allen, M. “Study: Employees Intervene in Only 2 of 5 Observed Unsafe Acts,” Drilling Contractor, January / February 2011. 137 In discussing the management dilemma of production versus process safety, CCPS guidelines state: “The continuity of operations can be best addressed at the planning stage.” See American Institute of Chemical Engineers (AIChE), Center for Chemical Process Safety (CCPS). Plant Guidelines for Technical Management of Chemical Process Safety. 1995c. page 17. 138 U.S. Chemical Safety Board. Investigation Report: Refinery Fire Incident (4 Dead, 1 Critically Injured), Tosco Avon Refinery, March 2001, page 43. See http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf (accessed November 14, 2013).

Chevron Richmond Refinery Investigation Report January 2015 82 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Rather than relying on Stop Work Authority after an emergency process safety situation is identified, a more effective process is to rely upon formal procedures that reduce reliance on the individual,139 for example, having an established predetermined leak response plan. One should not rely on Stop Work Authority as a safeguard because it is not a formal procedure. Rather, it is a “residual reduction” technique, falling below “procedural safeguards” on the hierarchy of controls (Figure 23). With specific decision-making criteria in place, those responding to an emergency process safety event should not have to evaluate risk in the heat of an event, but only determine whether the event meets the predetermined criteria to stop operations and shut down a unit. At the time of the incident, Chevron did not recognize or accommodate the shortcomings of Stop Work Authority in averting major process hazards. The Chevron Stop Work Authority program was not designed to assist operations and emergency response personnel in determining whether taking aggressive emergency response actions to remove insulation from a leaking pipe was a wise decision. Since the incident, Chevron has created a Leak Response Protocol (Section 5.3.4) to lead emergency responders, operators, and other plant personnel in deciding how to handle a leaking pipe. Used effectively, this protocol could alleviate pressure from individuals to rely on their Stop Work Authority during potentially hazardous process operations. Other refiners and petrochemical producers should also take such action to develop process Leak Response Protocols for their facilities to help prevent incidents like the August 6, 2012, Chevron Richmond Refinery pipe rupture and fire.

139 “Experience indicates that effective systems require quite a high degree of formality. The purpose of these systems of work is to ensure a personal and collective discipline, to exploit the experience gained by the organization, and to provide checks to minimize problems and errors. The framework of such systems is typically a set of standing orders or instructions which lay down requirements for the conduct of particular activities.” Mannan, Sam. “Management and Management Procedures.” Lees’ Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control. Volume 1, 4th ed., 2005, page 6/5.

Chevron Richmond Refinery Investigation Report January 2015 83 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.8 Chevron Organizational Conclusions

The CSB found that Chevron management, engineers, inspectors, and operators all see the importance of having good process safety systems and the value of ensuring that work processes are safe and equipment is reliable. (See Section 5.1.) Despite this mindset and the existing programs, the Chevron Richmond Refinery was unsuccessful in preventing the 4-sidecut pipe from rupturing. A desire to be safe is not enough; to ensure process safety, organizations must have a well-designed, integrated system, rigorous programs, and strong leadership for these programs. The critical flaw in Chevron’s safety programs is their reliance largely on individual personnel assertions and initiatives to implement new important safety programs—a bottom-up approach. While this can occasionally be a successful method, it is not a reliable way to implement safety-critical programs. Lees’ Loss Prevention in the Process Industries states: It is fundamental that responsibility for [safety and loss prevention] should be shared by all concerned in the project…. This does not mean, however, that reliance should be placed simply on individual competence and conscientiousness. It is essential to support the competent people with appropriate systems of work. Experience indicates that effective systems require quite a high degree of formality.140 To get the necessary work implemented, the ETC Sulfidation Failure Prevention Initiative and other ETC training course recommendations relied on the persuasive abilities of individual inspectors and metallurgists—who did not have final decision-making and funding ability. The Chevron turnaround IMPACT process relied solely on a data-driven decision process that did not account for all information, such as ETC publications and industry best practices. Inclusion of any yet-to-be justified work into Chevron Richmond Refinery turnarounds, even under the auspices of industry guidance and company experts, required the willingness of individual engineers or inspectors to step forward and advocate for the effort in the face of an already official IMPACT core team rejection. The Unit Reliability Improvement Process and the Business Improvement Network, among other programs, were ineffective in encouraging implementation of initiatives, such as the ETC Sulfidation Failure Prevention Initiative. Even analytical programs based on hard data and analysis, such as the Richmond Refinery Piping Inspection Guideline and the Operational Excellence and Reliability Intelligence program were not successful. And when these failures resulted in a dangerous leak in the 4- sidecut line, the Stop Work Authority program was ineffective because it relied on individuals to step out of the group-think mindset to persuade others that insulation removal might be dangerous. The failure to prevent this incident is indicative of a fragmented process safety management approach that placed responsibility to implement key process safety recommendations on lower-level employees without sufficient recommendation-approval and funding authority. These systems might have been successful in other incidents before August 6, 2012. However, depending on non-formalized individual

140 Mannan, Sam. “Management and Management Procedures.” Lees’ Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control. Volume 1, 4th ed. 2005, page 6/5.

Chevron Richmond Refinery Investigation Report January 2015 84 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

employee performance to eliminate low frequency, high consequence events like the August 6, 2012, pipe rupture is often ineffective when systemic failures are present. Chevron can ensure the effectiveness of implementing new safety-critical programs at the refinery level, such as the ETC Sulfidation Failure Prevention Initiative, by developing a formalized system that identifies one individual or group with decision-making authority within each refinery to be responsible and accountable for program implementation. The implementation efforts can then be tracked as a leading indicator, such as in Chevron’s OERI system. CCPS’s Plant Guidelines for Technical Management of Chemical Process Safety states: Each technical element in a process safety management program needs to have a specific person or organizational unit clearly designated as responsible for its design, implementation, and maintenance as well as for proper review. Having this designated “champion” for the activity helps assure that it receives adequate management attention and support.141 At the Chevron Richmond Refinery, many individuals attempted to implement the ETC Sulfidation Failure Prevention Initiative and ETC training course recommendations either to 100 percent component inspect sulfidation-susceptible carbon steel piping or to replace sulfidation-susceptible carbon steel piping with an inherently safer, higher chromium material of construction. However, none of these individuals were held accountable for the implementation status of the ETC Sulfidation Failure Prevention Initiative or other ETC sulfidation prevention recommendations, nor did they have the authority to ensure the initiative and recommendations were implemented. As a result, the 4-sidecut piping was never 100 percent component inspected, nor was it ever upgraded to higher chromium steel before the incident.

141 Center for Chemical Process Safety of the American Institute of Chemical Engineers. Plant Guidelines for Technical Management of Chemical Process Safety. Revised Edition, Appendix 2A, 1995, page 10.

Chevron Richmond Refinery Investigation Report January 2015 85 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2 Industry Sulfidation Corrosion Guidance

Industry organizations and trade associations, such as the American Petroleum Institute (API), the American Society of Mechanical Engineers (ASME), and the National Fire Protection Association (NFPA), develop codes, standards, and recommended practices which define requirements and recommendations to conduct operations safely. Codes, standards, and recommended practices are developed by a committee of experts on the basis of consensus and are often updated on fixed-year intervals. Codes can be adopted as requirements by regulatory agencies or authorities having jurisdiction.142 In addition, since these requirements are often considered Recognized and Generally Accepted Good Engineering Practices (RAGAGEP), regulators can cite industrial facilities for not following them. Codes and standards developed by API give specific information and guidance to industry on the technical details of sulfidation corrosion and ways to inspect piping and equipment susceptible to it. However, the CSB identified significant gaps in these standards. There is varying, sometimes conflicting information in many of API’s standards and recommended practices that describe sulfidation corrosion. All of these publications should align to deliver a constant message to users on inspecting for sulfidation corrosion and preventing sulfidation failures in low-silicon carbon steel. 5.2.1 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries is the primary industry guidance document on ways to monitor and control sulfidation corrosion. It aims “to provide practical guidance to inspectors, maintenance, reliability, project, operations and corrosion personnel on how to address sulfidation corrosion in petroleum refining operations.”143 It was published in 2009 following a string of sulfidation corrosion-related incidents in the early 2000s. The recommended practice cautions that low-silicon carbon steel piping can corrode at an accelerated rate.144 It states that carbon steel will appear to be of sufficient thickness based upon measured corrosion rates, typically at CMLs placed on elbows and fittings with higher silicon content,145 until failure occurs at an unmonitored or unidentified low-silicon piping component.146 API RP 939-C specifically discusses risks associated with sulfidation corrosion in low-silicon carbon steel piping. It acknowledges that older carbon steel piping can have low silicon content, creating:

142 American Petroleum Institute: Procedures for Standards Development. 4th ed., 2009, Section 5.4. See http://www.api.org/publications-standards-and-statistics/~/media/Files/Publications/FAQ/2011-Procedures- Final.ashx (accessed September 15, 2014). 143 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries, Introduction, 2009. 144 Ibid., Section 6.2.3.2. 145 Ibid., Section 7.1.5. 146 Ibid., Section 6.2.3.2.

Chevron Richmond Refinery Investigation Report January 2015 86 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a major inspection challenge, because small piping sections (pups) or fittings with low [silicon] may corrode at rates 2 to 10 times faster than surrounding higher [silicon] piping. Unless the refinery is fortunate enough to have located an inspection point on that particular section of pipe or fitting, it is very difficult to detect the thinning component.147 The document also communicates the risk of sulfidation corrosion failures, stating “ruptures are possible leading to the potential release of large quantities of hydrocarbon streams,”148 and sulfidation corrosion “continues to be a significant cause of leaks leading to equipment replacements, unplanned outages, and incidents associated with large property losses and injuries.”149 It shows an example of a rupture that occurred due to unmonitored low-silicon carbon steel components (Figure 38 and Figure 39).

Figure 38. Photo from API RP 939-C of a low-silicon pup piece that ruptured at a BP refinery. The surrounding piping had higher silicon content, and the pup piece’s accelerated corrosion rate was unmonitored.

147 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries, Section 9, 2009. 148 Ibid., Section 4. 149 Ibid., Introduction.

Chevron Richmond Refinery Investigation Report January 2015 87 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 39. Schematic from API RP 939-C of the piping shown in Figure 38. The piping component that ruptured was significantly thinner than the surrounding piping. Despite the known risks of unmonitored sulfidation corrosion rates in potentially low-silicon carbon steel piping components, the CSB found that API RP 939-C specifically refrained from requiring companies to search for low-silicon piping components in their facilities. All guidance given on methods for identifying these components is written in a permissive way that does not require action by the operating companies. Specifically, API RP 939-C requires no action by the operating companies, as it states:  “Some refiners have instituted an approach similar to [positive material identification (PMI)] for identification of these materials. These approaches may involve an initial risk assessment to focus inspections on the circuits representing the highest risk. When mill certificates are

Chevron Richmond Refinery Investigation Report January 2015 88 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

available, some operators have used them to determine whether low-Si steels were procured and will try to locate the low-Si spools.”150  “Many field portable instruments used for PMI cannot identify silicon to the level needed to distinguish between high and low-Si-containing steel. Chemical verification requires that metal shavings of all components be taken and analyzed in a lab.”151  “As an alternative, insulation can be stripped and each piping segment can be exposed for UT inspection…. […] If a low-Si content material is identified, a risk assessment should be performed to determine if and when it should be replaced. Unless all components in a carbon steel system have been checked for either silicon content or thickness, the inspector should assume that low-Si steel may be present in the system and may corrode at much higher than nominal rates under some conditions.”152 While API RP 939-C informs the user that it “is preferable to specify higher alloy for better corrosion resistance to minimize the reliance on inspection,”153 it does not recommend that the user take such an approach. Susceptible piping contains sulfur species and operates between 450°F and 1000°F.154 Upgrading to a steel alloy that contains at least 9 percent chromium is an inherently safer choice in high- temperature sulfidation environments, and it is higher in the hierarchy of controls155 than inspection. High-chromium steels corrode due to sulfidation at a much slower rate than carbon steel and do not run the risk of extreme variations in corrosion rates within components of the same piping circuit.156 To ensure that a low-silicon carbon steel rupture does not again occur at a U.S. refinery, API RP 939-C should establish minimum requirements to prevent another catastrophic incident as a result of pipe rupture in low-silicon carbon steel piping. It should require 100 percent component inspection of existing in- service carbon steel piping susceptible to sulfidation corrosion that could contain low-silicon components,157 and should recommend users to replace carbon steel piping susceptible to sulfidation corrosion that could contain low-silicon components with a steel alloy that is more resistant to sulfidation corrosion to avoid the necessity to perform the 100 percent component inspection. Had API RP 939-C phrased these enhanced inspection strategies as requirements before the Chevron August 6, 2012, pipe rupture, the 100 percent component inspection and material of construction upgrade would not have been

150 API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries, Section 7.1.5, 2009. 151 Ibid. 152 Ibid. 153 Ibid., Section 7.1.9. 154 Ibid., Section 1. 155 An effectiveness ranking of techniques used to control hazards and the risk they represent as a hierarchy of controls. See U.S. Chemical Safety Board. Interim Investigation Report: Chevron Richmond Refinery Fire. April

1. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed November 15,

2013). 156 U.S. Chemical Safety Board. Interim Investigation Report: Chevron Richmond Refinery Fire. April 2013, page 22, paragraph 20. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed November 15, 2013). 157 Two techniques are used to inspect a component in an existing carbon steel piping circuit with unknown chemical composition for low silicon content and resulting variable corrosion rates: (1) performing laboratory- based chemical analysis of the carbon steel (a “destructive test,” meaning it requires removal of a sample of the steel), or (2) performing pipe wall thickness measurements.

Chevron Richmond Refinery Investigation Report January 2015 89 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

considered “discretionary work items,” and Chevron management likely would have ensured that its refineries complied with the API requirements. 5.2.2 API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry is a summary guidance document on the “most likely damage mechanisms affecting common alloys used in the refining and petrochemical industry and is intended to introduce the concepts of service-induced deterioration and failure modes.”158 Sulfidation corrosion is one of the 66 damage mechanisms159 summarized in the recommended practice. API RP 571 includes API RP 939-C as a reference document. However, the body of API RP 571 poses several clarity problems in its discussion of sulfidation corrosion:  Section 4.4.2, Sulfidation, summarizes API RP 939-C in a condensed format. While it does inform the reader that sulfidation corrosion can occur as localized corrosion160 and resistance is achieved by upgrading to a higher chromium alloy,161 its description of high-corrosion rate problems in low-silicon carbon steel is sparse. In fact, silicon is mentioned only once in this section, and this mention is in a figure caption,162 not in the text body.  Section 4.4.2.3, Critical Factors, does not explain that low-silicon carbon steel piping corrodes at a much faster rate than higher silicon carbon steel.  Section 4.4.2.5, Appearance or Morphology of Damage, does not specify that sulfidation corrosion rates can be significantly faster in just a few, individual piping components.  Section 4.4.2.7, Inspection and Monitoring, does not specify that 100 percent component inspection is necessary to identify any low-silicon components in a carbon steel piping circuit. API RP 571 should become more aligned with the content in API RP 939-C so that the information is presented to users in a more consistent way.

158 API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, 2nd ed., Section 1.2, 2011. 159 Ibid., Table of Contents. 160 Ibid., Section 4.4.2.5. 161 Ibid., Section 4.4.2.6. 162 Ibid., Figure 4-117.

Chevron Richmond Refinery Investigation Report January 2015 90 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.3 API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and

Alteration of Piping Systems API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems specifies “the in-service inspection and condition-monitoring program that is needed to determine the integrity of piping.”163 It discusses different inspection strategies that can be employed based on the type of damage mechanism the piping is susceptible to. The latest version of this document was released six months following the release of API RP 939-C, yet it fails to mention the localized corrosion possibilities in carbon steel susceptible to sulfidation corrosion, nor does it include API RP 939-C as a normative reference.164 Section 5.6.3, CML Selection, provides general guidance to inspectors for determining where to place piping CMLs for various corrosion mechanisms. It states: A number of corrosion processes common to refining and petrochemical units are relatively uniform in nature, resulting in a fairly constant rate of pipe wall reduction…. Examples of such corrosion phenomena include high-temperature sulfur corrosion …. In these situations, the number of CMLs required to monitor a circuit will be fewer than those required to monitor circuits subject to more localized metal loss.165 These statements directly oppose the inspection techniques required to identify low-silicon components in sulfidation-susceptible carbon steel piping circuits. Sulfidation corrosion in carbon steel piping can be localized to only a few components; therefore, 100 percent component inspection is required to identify low-silicon components. In addition, the use of “high-temperature sulfur corrosion” nomenclature rather than “sulfidation corrosion” (as is used in other API publications) can lead to confusion among users. To provide a consistent description of sulfidation corrosion throughout all pertinent API documents, content and nomenclature should be aligned. Sulfidation corrosion should be referenced using the same terminology in all API publications, and the potential for localized corrosion must also be emphasized. In addition, because API 570 is a piping inspection code, this document should also establish the 100 percent component inspection requirements necessary to identify low-silicon components in carbon steel piping circuits susceptible to sulfidation corrosion.

163 API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems, Section 1.1.2, 2009. 164 A “normative reference” is a reference to another code, standard, recommended practice, or regulation that provides additional useful information. 165 API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems, Section 5.6.3, 2009.

Chevron Richmond Refinery Investigation Report January 2015 91 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.4 API RP 578: Material Verification Program for New and Existing Alloy

Piping Systems API RP 578: Material Verification Program for New and Existing Alloy Piping Systems “provides the guidelines for material control and material verification programs….”166 This document does include API RP 939-C as a normative reference167 and discusses specifically the increased susceptibility of low-silicon carbon steel to sulfidation corrosion. Section 4.3.3.4, Process Units Susceptible to Sulfidation, states: Carbon steels with low silicon (<0.10%) content can corrode at an accelerated rate when exposed to hydrogen-free sulfidation conditions. These phenomena are discussed more extensively in API 571 and API 939-C. Owner/users with assets at risk from this type of degradation should consider the risks and the requirements to apply [positive material identification] control in order to determine silicon levels and the extent to which the material may corrode.168 While this guidance document does describe the accelerated corrosion rate that occurs in low-silicon carbon steel piping, it does not require facilities to establish and implement a program to identify low- silicon components that may not have been manufactured to ASTM A106 requirements in carbon steel piping circuits susceptible to sulfidation corrosion. Such a requirement is essential for facilities to successfully identify low-silicon components susceptible to sulfidation corrosion to prevent future pipe rupture incidents similar to the August 6, 2012, Chevron incident. 5.2.5 API RP 574: Inspection Practices for Piping System Components API RP 574: Inspection Practices for Piping System Components “supplements API 570 by providing piping inspectors with information that can improve skill and increase basic knowledge and practices.”169 The recommended practice lists 50 reference documents, including other API standards, that are “indispensible for the application”170 of the recommended practice. Several of these documents specifically discuss certain damage mechanisms. However, API RP 939-C is not listed among the reference documents. In addition, API RP 574 does specifically inform the reader that corrosion rates can be localized in carbon steel piping: “Nonsilicon-killed steel pipe (e.g. ASTM A53 and API 5L) can corrode at higher rates than silicon-killed steel pipe (e.g. ASTM A106) in high-temperature sulfidation environments.”171 However, it does not specifically point the reader to API RP 939-C to learn more information. To align the messages presented in all piping inspection-related API guidance documents, API RP 574 should refer the reader to the more enhanced information in API RP 939-C to increase understanding of important sulfidation corrosion characteristics and failure prevention strategies.

166 API RP 578: Material Verification Program for New and Existing Alloy Piping Systems, 2nd ed., Section 1, 2010. 167 API RP 578: Material Verification Program for New and Existing Alloy Piping Systems. 2nd ed., Section 2, 2010. 168 Ibid., Section 4.3.3.4. 169 API RP 574: Inspection Practices for Piping System Components, 3rd ed., Section 1, 2009. 170 Ibid., Section 2. 171 Ibid., Section 7.4.6.2.

Chevron Richmond Refinery Investigation Report January 2015 92 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3 Chevron Emergency Response to Process Leaks

Following the identification of the leak in the 8-inch 4-sidecut piping circuit on August 6, 2012, a series of decisions ultimately put many people in harm’s way. Chevron has since developed a leak response protocol to be used when determining how to respond to future leaks in the refinery. 5.3.1 Area Control and Hazardous Area Assessment While the 4-sidecut line was leaking high temperature flammable process fluid, 40 individuals entered the Crude Unit. Many of these individuals entered the unit to assist in determining how to handle the leak. Individuals who entered the Crude Unit included the hydroprocessing refinery business manager, the Crude Unit section head, 14 operations personnel, the process engineering team lead, a field safety coordinator, two inspectors, the pipe clamp contractor, three scaffold builders, a pipe fitter, and 15 firefighters. API RP 574: Inspection Practices for Piping System Components warns: “Those who investigate [on-stream piping leaks] may be particularly at risk to the consequence associated with release of the process fluid.”172 A safer practice is to establish a safe location away from the active process leak to perform an analysis of the situation and to determine a path forward. Occupational Safety and Health Administration (OSHA) regulations for emergency response require limiting the number of personnel in the immediate vicinity of the incident “to those who are actively performing emergency operations.”173 Typically, management coordination is provided from an emergency operations center located remotely from the hazards of the emergency situation.174 When Chevron fire department personnel took control of the leak response, the fire fighters created and taped off a 20 foot by 20 foot “hot zone” around the leak location. Chevron defines a hot zone as “the immediate release area [emphasis in the original] of the incident where there is risk of exposure or injuries due to flame contact, radiant heat, or hazardous materials.” The size and location of the hot zone is determined by the Incident Commander.175 For this incident, Chevron had also established a “cold zone” immediately outside of the hot zone perimeter. In this area, key operations staff, additional fire department staff, and the Incident Commander were positioned to provide expert support during the leak response decision-making. The Chevron fire truck that was ultimately destroyed in the fire was also located in the designated “cold zone.”176 When the 4-sidecut pipe ruptured, a very large vapor cloud formed which engulfed all personnel both within the hot zone and standing in what was considered the “cold zone,” or the area where personnel should be safe from the adverse affects of a fire.177 The hot zone designated prior to the pipe rupture was not of sufficient size to ensure that individuals outside of the hot zone were safe from the high- temperature, flammable 4-sidecut process fluid when the sulfidation failure of the pipe occurred. As

172 API RP 574: Inspection Practices for Piping System Components, 3rd ed., Section 9.3, 2009. 173 29 CFR §1910.120(q)(3)(v) (2012). 174 API RP 2001: Fire Protection in Refineries, 9th ed., Section 9.2, 2012. 175 Chevron defines the Incident Commander as the “senior emergency response official” at an incident site who is responsible for overall incident objectives and controlling emergency operations at the site. Additional responsibilities include site hazard assessment to the extent possible all hazardous substances or conditions present are identified, establish hot zone, and address exposure control and PPE selection.” 176 The fire truck was positioned approximately 65 feet from the leak location. 177 National Fire Protection (NFPA) 600: Standard on Industrial Fire Brigades, Section 3.3.30, 2010.

Chevron Richmond Refinery Investigation Report January 2015 93 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

discussed in subsequent sections of this report, it is beneficial for various personnel with differing areas of process expertise to report their knowledge of the leak properties and potential causes of the leak to the Incident Commander. Had this been effectively communicated on the day of the incident, the Incident Commander might have been informed that the 4-sidecut piping had the potential to catastrophically rupture. This information could have led the incident command team to establish a much larger hot zone area. 5.3.2 Miscommunication regarding 4-sidecut properties The CSB found that many personnel responding to the leaking 4-sidecut pipe were not properly informed through information disseminated in the Incident Command structure of the operating temperature of the line. Interviews show that some firefighters believed the line was operating at a temperature of about 130°F rather than the actual temperature which approached 640°F. The CSB identified that this misunderstanding might have occurred because, during the initial incident response, much of the focus was on determining the flash point of the 4-sidecut fluid. Little to no discussion occurred about the actual operating temperature of the 4-sidecut line, which could have provided the most insight into the hazards of the situation. Furthermore, in a “Scene Safety and Action Plan” that was developed immediately before the leak response, the “Hazard Evaluation” section only identified as a hazard the pressure of the 4-sidecut line, recorded as 25 psi. The temperature of the piping circuit was not recorded. This inattention to the temperature hazard likely resulted in the miscommunication and misunderstanding of the actual operating temperature of the piping. Following the incident, Chevron Fire Department personnel developed an “Event Critique,” which, in part, was used to document areas that did not go well during the response activities. The Event Critique states, “Somewhere in the process, impression was given to [the Chevron Fire Department] that [the 4- sidecut temperature] was only 130 degrees F. [The Chevron Fire Department] [b]elieved [the temperature] to be far below the autoignition temperature and below [the flash point].” Regarding the white vapor formation that occurred during insulation removal (referred to as “smoke”), the Event Critique also states that the firefighters felt they “[n]ever put two and two together that additional smoke [formation was] because product [was] much hotter than 130 degrees.” CSB interviews indicate that had the responders been aware of the actual operating temperature, some likely would have raised concerns about the safety of removing insulation from the hot, leaking piping and concerns regarding the responders’ close proximity to the leak to their supervisors. In addition, no individuals determining how to handle the leak were aware that the leak was coming from a pipe component that had thinned so severely so that it could no longer contain the process fluid. All emergency response activities were conducted under the assumption that the 4-sidecut pipe was of acceptable thickness beneath the insulation. This incorrect conclusion was based on measurements of an adjacent CML—a high silicon-containing elbow—which had been found to be of acceptable thickness during the 2011 turnaround. The OSHA Hazardous Waste Operations and Emergency Response (HAZWOPER) standard states that the Incident Commander “shall identify, to the extent possible, all hazardous substances or conditions

Chevron Richmond Refinery Investigation Report January 2015 94 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

present.”178 The Incident Commander, as well as the individuals providing technical input to the Incident Commander, did not realize that the leak could be due to a highly thinned, low-silicon carbon steel piping component that could exist within the 4-sidecut piping circuit. Had the potential for a pipe thinned to the point of leak and loss of containment been recognized and communicated, the emergency response would likely have been handled very differently. The group might have decided to immediately shut down the Crude Unit. The firefighter post-incident Event Critique document highlights the need for all individuals to be made aware of operating conditions and potential failure modes, stating that hazard assessments performed prior to response activities must ask “all the proper questions for the hazard being addressed.” This comment indicates that the Incident Command structure did not have sufficient technical expertise reporting to it to provide the necessary information to determine the safest response to the leaking pipe. In this case, that response would have been to shut down the Crude Unit. 5.3.3 Leak Mitigation and Discovery Attempts Worsened Leak Operations and fire department personnel discussed their options to stop the leak. Since the 4-sidecut line could not be isolated from the process, the team decided their options were to 1) install a clamp on the leak while the 4-sidecut line was operating, or 2) shut down the unit to stop the leak and perform maintenance while the line was not in operation. The decision-makers tried to visually confirm the leak location by removing insulation covering the piping before determining whether to clamp the line or shut down the unit. However, attempts to remove the insulation actually worsened the leak, resulting in the ultimate pipe rupture and endangerment to the lives of everyone responding. Post-incident metallurgical analysis indicates that the firefighter pike pole used in an attempt to remove insulation may have stabbed through the highly thinned pipe, worsening the leak (Figure 40 and Figure 41).

178 29 CFR §1910.120(q)(3)(ii) (2012).

Chevron Richmond Refinery Investigation Report January 2015 95 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 40. Photo of undamaged179 (top) and burned during incident (bottom) pike pole used in early attempts to remove 4-sidecut insulation.

179http://www.safetyfirstweb.com/firefighting/accessories.html?page=shop.product_details&flypage=flypage.tpl&pr oduct_id=2411&category_id=96 (accessed July 14, 2014).

Chevron Richmond Refinery Investigation Report January 2015 96 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 41. Photo showing that tip of fire pole matches apparent puncture location in failed 52-inch component of 4-sidecut piping. To note, because the 4-sidecut leaking component was so thin, clamping the line would not have been a viable option because the pipe likely did not have the structural integrity to support a clamp. However, the potential for a thin pipe was not known by or communicated to the responding operators and Chevron fire fighters. In addition, the high-temperature of the piping and the process fluid introduced a significant hazard to both the individuals who would install the clamp and to individuals who would work near the piping before the clamp installation. If the decision-makers had been aware that the leak might have resulted from pipe thinning to the point of loss of containment, they would have been more likely to shut down the unit without removing the insulation, and this incident could have been prevented. In addition, had it been unacceptable within the Chevron organization to allow high-temperature, flammable process lines to continue leaking until a clamp could be installed, the unit would have been shut down, effectively preventing this incident.

Chevron Richmond Refinery Investigation Report January 2015 97 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.4 Chevron’s New Leak Response Protocol

OSHA requires that all individuals and organizations performing emergency response operations to follow the HAZWOPER standard.180 In part, HAZWOPER details the organizational structure and response elements to be performed when planning for and responding to an emergency. It requires facilities to develop an Emergency Response Plan that “shall be developed and implemented to handle anticipated emergencies prior to the commencement of emergency response operations.”181 Pursuant to this requirement, Chevron developed an emergency response plan comprised of a number of Refinery Instructions182 outlining the required response activities for specific types of emergencies. For example, the Chevron Richmond Refinery developed Refinery Instructions to be followed in the case of a fire in the refinery, oil spills to the adjacent bay, and releases of hydrogen sulfide, among other emergency situations. However, at the time of the incident, the refinery did not have a specific Refinery Instruction on how to assess and respond to hazardous process fluid leaks in the refinery. Chevron did not recognize this gap in the Chevron Richmond Refinery emergency response plan before the incident. In addition, current industry guidance on developing response plans to hazardous process fluid leaks is limited (Section 5.4). During emergency response operations, such as to a process leak, it is difficult to recall all of the necessary safety precautions and to ensure they are performed. It is therefore essential that process safety emergency response procedures are pre-established and followed to ensure that all safety critical steps are taken before performing any mitigation attempts. If Chevron had used a pre-established response procedure that required consultation with various subject-matter experts (Figure 42), the Incident Commander could have identified that sulfidation-induced failures have historically resulted in large blowouts and catastrophic failures.183 A clamp to mitigate a sulfidation leak would thus have to encompass the entire affected piping segment. The time required to engineer and build a clamp for this type of specialized application can be several days. In addition, the 4-sidecut process fluid was at a temperature near 640°F, which made it very hazardous to work on while in operation. It also meant that if the anticipated catastrophic-type sulfidation failure did occur, the resulting large release would potentially auto ignite. The CSB analysis suggests that had an effective leak response protocol been in place during the August 6, 2012, incident, it likely would have been clear there was little to no chance that the 4-sidecut leak could be stopped and that the Crude Unit should not continue to operate for any significant period. The analysis of the end result for every potential leak mitigation action likely would have resulted in the same decision: to shut down the Crude Unit immediately.

180 29 CFR §1910.120. 181 29 CFR §1910.120(q)(1) (2012). 182 Chevron calls its important internal, refinery-wide policies and procedures “Refinery Instructions.” 183 Chevron ETC Sulfidation Failure Prevention Initiative. See the block quote in Section 5.1.1.1 of this report.

Chevron Richmond Refinery Investigation Report January 2015 98 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 42. Ideal communication flow to Incident Commander during refinery process fluid leak incident. In industrial process fluid leak emergency situations, it is essential that various personnel with different areas of expertise communicate their relevant knowledge to the Incident Commander. Since the incident, Chevron has developed a leak response protocol184 to assist operators and fire department personnel when they are deciding how to handle a process leak. The protocol will assist Incident Command in identifying and gathering the pertinent process information prior to the performance of any aggressive action. This new protocol has been incorporated into the Chevron Richmond Refinery emergency response plan as a Refinery Instruction that must be followed when a potentially hazardous process leak is identified in the refinery. Under the new protocol, when a process fluid leak is identified in a Chevron refinery, several steps must be taken immediately. The Chevron emergency response team must deploy to the leak site, the area must be cleared of non-essential personnel, and a group of individuals with various areas of expertise (e.g., operators, managers, unit inspectors, materials engineers, and chemical engineers) must gather in a safe location to discuss the likely cause of the leak and mitigation options.

184 The entire Chevron leak response protocol is presented in Appendix A.

Chevron Richmond Refinery Investigation Report January 2015 99 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Chevron’s new leak response protocol also includes a checklist to be completed during the pre-response meeting. It requires the group to answer questions including:  What is the likely cause [of the leak]?;   What is the current operating pressure and temperature?;   What is the pertinent pipe, vessel, structural integrity, or corrosion history of this leak?;   Is the product at or above its auto ignition temperature?;    Is the leak toxic?   This checklist facilitates evaluating all potential hazards when determining how to handle leaks in the refinery. This identification of hazards should allow the Incident Commander to more effectively determine an appropriately sized “hot zone” and safe distances to stage key equipment, such as responding fire engines. The new leak response protocol also provides examples of scenarios when it is required to shut down the unit. (See Figure 43) Effectively using it greatly reduces some of the inherent human factors concerns at play when invoking Stop Work Authority, as discussed in Section 5.1.7.

Figure 43. Chevron’s new Leak Response Protocol, developed post-incident. The new protocol advises plant personnel on when to shut down a unit due to a piping or equipment leak.

Chevron Richmond Refinery Investigation Report January 2015 100 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.5 Leak Response Conclusions

The piping rupture and subsequent hydrocarbon release occurred two hours after the original leak was identified, which would have been enough time to execute an emergency shutdown of the Crude Unit, or at a minimum, to initiate the shutdown and bring the unit to a much safer condition with no liquid in the 4-sidecut line. Early in this incident, Chevron personnel determined that the 4-sidecut pipe could not be isolated from the crude column. This resulted in the decision to reduce the feed rate to the Crude Column. However, had Chevron decided to shut down the unit once staff knew the line could not be isolated, the pipe rupture and the endangerment of the community and Chevron personnel could have been avoided. At the time of the incident, Chevron did not have procedures to direct when a unit should be shut down. Since the incident, Chevron has developed a leak response protocol that should be used to guide decisions in future leak incidents. If a similar leak were to occur in a Chevron refinery, the new leak response protocol would require unit shutdown. 5.4 Industry Leak Response Guidance API and ASME have issued several documents, discussed here, that provide guidance on leak response in refineries and chemical plants. 5.4.1 API RP 574: Inspection Practices for Piping System Components As specified in Section 5.2.5 of this report, API RP 574 is a guidance document for piping inspectors to improve their skills and practices. The CSB found that this document gives the most specific guidance on how to safely respond to leaks in refineries and chemical plants. Section 9.3, Investigation of Leaks, provides the following information: On-stream piping leaks in process units can occur for various reasons. Those who investigate the leak may be particularly at risk to the consequence associated with release of the process fluid. A site may want to create a general safety procedure to be followed during a piping leak investigation. A further precaution is to hold a safety review before any leak investigation. The review would consider the state of a piping system in terms of pressure, temperature, remaining inventory of process fluids, potential damage mechanisms and similar factors. The safety review team should define: a) a “hot zone” around the leak site, and establish PPE and additional firefighting equipment requirements to perform work inside this zone; b) decontamination requirements upon exit from the hot zone and other requirements necessary to protect personnel and the environment 185 API RP 574 even cautions the reader about potential consequence escalation: “The safety review team must be careful making assumptions about the leak’s cause. Incidents have occurred where investigative

185 API RP 574: Inspection Practices for Piping System Components, 3rd ed., Section 9.3, 2009.

Chevron Richmond Refinery Investigation Report January 2015 101 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

personnel assume they knew the cause of a small leak on an operating line and were caught unprepared when the leak suddenly became quite large.”186 Despite its positive aspects, API RP 574 should be improved to require facilities to develop a site-specific leak response protocol to be followed when a process fluid leak is discovered to help prevent and control future pipe leak incidents. For instance, users, such as Chevron, are not required to follow any of the guidance issued in Section 9.3, Investigation of Leaks. Permissive language informing users that they “may want to create” a safety procedure, or that a safety review “would consider” certain damage mechanisms requires no action by the operating companies. In addition, API RP 574:  Does not recommend limitation of site access around the leak to essential personnel only;  Does not specify employee job functions or leak analysis roles that should be established prior to performing the safety review of the leak (e.g., inspection staff, process engineers, metallurgical or mechanical engineers, operators, emergency responders);  Does not recommend evaluation of whether the leaking process fluid is near its autoignition temperature;  Does not recommend the determination of whether the leak is toxic; and  Does not recommend the user to evaluate the worst-case leak scenario. In addition, API RP 574 does not recommend the leaking piping circuit to be isolated—or recommend unit shutdown if the piping cannot be isolated—if leak response personnel cannot prove it is safe to continue operating the leaking line. Specifically, API RP 574 does not recommend piping isolation or unit shutdown if:  The leak poses immediate danger to safety, health, or the environment; or  The leak cannot be safely isolated or mitigated while the piping circuit is in operation. 5.4.2 API RP 2001: Fire Protection in Refineries API RP 2001: Fire Protection in Refineries “provide[s] a better understanding of refinery fire protection and the steps needed to promote safe storage, handling, and processing of petroleum and petroleum products in refineries. A basic principle of this standard is that fire prevention provides the fundamental foundation for fire protection.”187 This document also “examines fire protection concepts that should be covered in operating and maintenance practices and procedures ….”188

186 API RP 574: Inspection Practices for Piping System Components, 3rd ed., Section 9.3, 2009. 187 API RP 2001: Fire Protection in Refineries, 9th edition, Section 1.1, 2012. 188 Ibid., Section 1.2.

Chevron Richmond Refinery Investigation Report January 2015 102 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Like API RP 574, API RP 2001 gives guidance to users on techniques for responding to process fluid leaks. Section 7.4, Loss of Containment, gives users guidance for both liquid leaks (Section 7.4.2) and gas leaks (Section 7.4.3). Interestingly, in areas where API RP 574 is lacking, API RP 2001 fills in some of the gaps. API RP 2001 suggests that response to control a leak should consider: a) Protection of personnel against exposure, b) Utilization of emergency response personnel and resources, c) Isolation of the fuel release or leak at the upstream source, d) Isolation of transfer medium, e) Isolation of ignition sources, f) Containment of product, g) Downwind and off-site impact, h) Displacement and/or removal of liquids still at risk, i) Reduction of hazard zone via application of firefighting foam for vapor suppression, and j) Development of mitigation cleanup strategies.189 Like API RP 574, API RP 2001 does not require users to follow its good practice guidance. Rather, it uses language like “Considerations… should include,” requiring no effective action by the operating companies to develop their own site-specific leak response protocol. Furthermore, API RP 2001 does not provide sufficient guidance on other safety critical leak response actions. It does not recommend:  Conducting a pre-response meeting with knowledgeable personnel to analyze the pressure, temperature, remaining inventory of process fluids, or potential damage mechanisms in the piping or equipment;  Limiting site access around the leak to essential personnel only;  Evaluating whether the leaking process fluid is near its autoignition temperature;  Determining whether the leak is toxic; and  Determining the worst-case leak scenario.

189 API RP 2001: Fire Protection in Refineries, 9th ed., Section 7.4.1, 2012.

Chevron Richmond Refinery Investigation Report January 2015 103 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.3 API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and

Alteration of Piping Systems API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems specifies practices that must be performed regarding inspection, rating, repair, and alteration of metallic- and fiberglass-reinforced plastic piping systems.190 In Section 8, Repairs, Alterations, and Rerating of Piping Systems, the code specifies requirements when performing on-stream piping repairs, such as weld repairs, installing a clamp, or wrapping the piping. However, API 570 does not require safety evaluation of the leak—nor does it refer to any document that outlines the necessary safety precautions and evaluations—before attempting on-stream repairs. To better align the API standards that address leak repair and leak response, API 570 should require users to follow the process leak response safety requirements established in other standards. 5.4.4 ASME PCC-2-2011: Repair of Pressure Equipment and Piping ASME PCC-2-2011: Repair of Pressure Equipment and Piping is a standard that “provides methods for repair of equipment and piping within the scope of ASME Pressure Technology Codes and Standards after they have been placed in service.”191 It gives requirements for installing leak mitigation devices, such as clamps, which Chevron personnel considered installing on the 4-sidecut leak location before the pipe rupture. While the standard does discuss safety requirements before installing a clamp, they are vague and are lacking needed safety preventative measures. The safety requirements discussed in Article 3.6, Mechanical Clamp Repair state: Personnel shall be aware of hazards in installing clamps on degraded components, and shall take the necessary precautions to avoid unacceptable risks. A risk review shall be conducted before a clamp is installed. Personnel shall take any necessary precautions to avoid unacceptable risks. […] If the component is leaking or has the potential to leak during installation, and if the contents are hazardous, additional precautions should be taken and those precautions should be addressed during the pre-job hazard review meeting (e.g., need for fresh air suit, etc.).192 Article 2.4, Welded Leak Box Repair, gives similar safety guidance.193 This article goes on to state, “If the component is leaking prior to repair, consideration should be given to stopping the leak prior to welding the leak box.”194 Article 4.1, Nonmetallic Composite Repair Systems: High-Risk Applications, states the requirements for repairing leaks, or repairing piping and vessels that have defects from internal corrosion, among other

190 API 570: Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems, 3rd ed., Section 1.1.1, 2009. 191 ASME PCC-2-2011. Repair of Pressure Equipment and Piping, Section 1. 2011. 192 Ibid., Article 3.6. Sections 2.4 and 2.5. 193 Ibid., Article 2.4, Section 2.4. 194 Ibid., Article 2.4, Section 4.5.

Chevron Richmond Refinery Investigation Report January 2015 104 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

applications.195 It requires users to perform “an assessment of the risks associated with the defect and repair method.” It requires users before installation to consider: (1) Assessment of the nature and location of the defects (2) Design and operating conditions for the component and contents (including pressure, temperature, sizes, and combinations thereof) (5) Hazards associated with system service (9) Failure modes 196 While ASME PCC-2-2011 does describe general safety precaution requirements, they are not detailed enough to provide much value. Referencing other standards and recommended practices that give guidance on leak mitigation and response would add significant value to the user. 5.4.5 Industry Leak Response Guidance Conclusions Many industry standards, recommended practices, and guidance documents exist to aid refining and petrochemical personnel and facility management in industrial leak response. However, the documents are inconsistent, and none of them provide overall, comprehensive guidance or requirements for operations personnel and facility management to safely respond to hazardous process fluid leaks. The CSB found that existing API guidance language could be strengthened to control and prevent major process fluid releases and to ensure the safety of facility personnel. 5.5 Chevron Richmond Refinery Safety Culture The CSB found that weaknesses in the Chevron Richmond Refinery safety culture contributed to the August 6, 2012, pipe rupture. The CSB’s investigation report on the March 23, 2005, BP Texas City refinery incident presents the following definitions of the concept of safety culture: The U.K. Health and Safety Executive describes safety culture as “the product of individual and group values, attitudes, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization’s health and safety programs” (HSE, 2002). The CCPS cites a similar definition of process safety culture as the “combination of group values and behaviors that determines the manner in which process safety is managed” (CCPS, 2007, citing Jones, 2001). Well-known safety culture authors James Reason and Andrew Hopkins suggest that safety culture is defined by collective practices, arguing that this is a more useful definition because it suggests a practical way to create cultural change. More succinctly, safely culture can be defined as “the way we do things around here” (CCPS, 2007; Hopkins, 2005). An organization’s safety culture can be influenced by management changes, historical events, and economic pressures.

195 ASME PCC-2-2011. Repair of Pressure Equipment and Piping, Article 4.1, Section 1.2, 2011. 196 Ibid., Article 4.1, Section 1.3.

Chevron Richmond Refinery Investigation Report January 2015 105 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Expanding on the above definitions, which are often applied to the petrochemical industry, the nuclear industry has developed definitions of safety culture that can be applied to all industrial sectors. The U.S. Nuclear Regulatory Commission (NRC) defines safety culture as “the core values and behaviors resulting from a collective commitment by leaders and individuals to emphasize safety over competing goals to ensure protection of people and the environment.”197 The Institute of Nuclear Power Operations (INPO), a nuclear power industry group, further expands upon this definition:

Nuclear safety is a collective responsibility. The concept of nuclear safety culture applies to every employee in the nuclear organization, from the board of directors to the individual contributor. No one in the organization is exempt from the obligation to ensure safety first.198

Discussed in the following sections are several aspects of safety culture at the Chevron Richmond Refinery that the CSB found contributed to the occurrence of the August 6, 2012, incident. 5.5.1 Normalization of Deviance “Normalization of deviance” is the acceptance of events that are not supposed to happen.199 Objective, outside observers see a situation as deviant, while people inside the situation see it as normal and acceptable.200 The August 6, 2012, pipe leak and subsequent response, as well as a previous incident in 2010, demonstrate efforts by Chevron employees to try to keep a unit operating during a hazardous leak, suggesting a culture at the Chevron Richmond Refinery that normalized this behavior. During response activities on August 6, 2012, Chevron firefighters performed physical actions that placed them in hazardous conditions by removing insulation on the high-temperature 4-sidecut piping while it was leaking flammable hydrocarbon process fluid. Even when hydrocarbon vapor visibly emerged from the pipe and a flash fire occurred during insulation removal attempts, the group decided to continue efforts to remove insulation from the on-stream pipe. This activity was acceptable to the individuals making the leak response decisions on the evening of the incident. A similar incident occurred before the 2012 incident. In April 2010, a pipe was found to be leaking on a high-temperature jet fuel pipe in the hydroprocessing unit at the Chevron Richmond Refinery. The operations staff reported the leak to management. However, no timely action was taken to repair the leak or shut down the unit. Unit operators expressed serious safety concerns with keeping the unit online with an active hazardous process leak. Nevertheless, the pipe remained in operation, still leaking, until the

197 Nuclear Regulatory Commission Final Safety Culture Policy Statement, 76 Fed. Reg. 34773 (June 14, 2011). 198 Institute of Nuclear Power Operations. Traits of a Healthy Nuclear Safety Culture. INPO 12-012. December 2012. 199 Vaughan, Diane, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA, University of Chicago Press, 1996. 200 Interview: Diane Vaughan, Consulting Newsline, May, 2008. See http://www.consultingnewsline.com/Info/Vie du Conseil/Le Consultant du mois/Diane Vaughan (English).html (accessed July 20, 2014).

Chevron Richmond Refinery Investigation Report January 2015 106 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

leak significantly worsened two days later. The unit was then shut down, and the leak was repaired. Both the April 2010 and August 2012 incidents are examples of decision making that encouraged and tolerated continued operation of a unit despite the presence of hazardous leaks in the Chevron Richmond Refinery. 5.5.2 Chevron Richmond Refinery Safety Culture Surveys The Chevron Richmond Refinery facilitated safety culture surveys of its staff.201 The surveys were designed as tools “by which the [Chevron Richmond Refinery] personnel’s perceptions about safety are revealed, explored, and developed.” One company conducted the safety culture surveys of Chevron Richmond staff in 2008 and 2010,202 providing the opportunity to identify any areas in which workers’ perceptions changed significantly and areas the Chevron Richmond Refinery may need to improve. The employees’ responses were divided into five groups based upon job categories: Operators and Mechanics, First Line Supervisors, Second Line Supervisors, Managers and Engineers, and “Other.” The number of employees surveyed and the job functions of the respondents are shown in Table 2. Refinery Job Position 2008 Survey Number of Respondents 2010 Survey Number of Respondents Operator 208 163 Mechanic 181 202 First Line Supervisor 53 103 Second Line Supervisor 47 66 Manager 18 46 Engineer 29 93 Other 125 263 Total Respondents 661 936 Table 2. Total number of employees surveyed and job functions of respondents in 2008 and 2010 Chevron Richmond Refinery staff safety culture surveys. Two types of comparison data were collected during these surveys. First, for each topic in the survey, the employees selected a statement supplied in one of four categories, in order of improving safety culture, to indicate their perception of the culture within the refinery. In the tables in the following sections, these selections are labeled “Current Conditions.” The change in employee perception of safety culture can be determined by examining the change in these answers from 2008 to 2010. The second type of data compared the employees’ view of the current environment at the refinery, or “Current Conditions,” with how they think things should be at the refinery, or “Hoped-for Conditions.” Comparing answers in the “Current Conditions” with the “Hoped-for Conditions” provides insight into the gaps in safety culture as seen by the employees.

201 Safety culture assessments are required by the City of Richmond RISO (See Section 5.5.2.4). However, the Chevron Richmond Refinery performed these surveys before they were a regulatory requirement. Safety Culture Assessments were not required by the RISO on August 6, 2012. The City of Richmond adopted this requirement in February 2013. See http://www.ci.richmond.ca.us/ArchiveCenter/ViewFile/Item/4988 (accessed December 21, 2014). 202 A safety culture survey was also performed in 2009, showing similar results to the 2008 and 2010 surveys. However, the company conducting the safety culture survey did not include the 2009 results in its 2008 and 2010 comparisons.

Chevron Richmond Refinery Investigation Report January 2015 107 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Below is an analysis of three survey topics from the 2008 and 2010 safety culture surveys at the Chevron Richmond Refinery which evaluate two key safety culture characteristics having direct impact on an incident like the August 6, 2012, 4-sidecut piping failure: stop work authority and equipment maintenance. The CSB performed a statistical analysis of the results using a Chi-Square test.203 The information presented in the following section shows statistically significant changes in responses. 5.5.2.1 Stop Work Authority Safety Culture Survey Responses Both the 2008 and 2010 surveys polled workers on their perception of their own Stop Work Authority. The 2008 survey found that while 95 percent of operators and mechanics indicated that they desired to use their Stop Work Authority at any time they witnessed unsafe activity, only 68 percent said they would do so (Table 3). The analysis of this discrepancy concludes this “may imply a perceived barrier” to using one’s Stop Work Authority.

Question: Stopping Unsafe Work I would rarely, if ever do this. I would ask the safety person to do it. I do this with my own team. I do this with anyone and anytime there is unsafe activity. Operators & Mechanics 2008 Current Conditions 7% (27 responses) 6% (23 responses) 19% (74 responses) 68% (265 responses) Operators & Mechanics 2008 Hoped-for Conditions 0% 3% (12 responses) 2% (8 responses) 95% (369 responses) Table 3. Chevron Richmond Refinery 2008 Safety Culture Survey responses to question of “Stopping Unsafe Work” by operators and mechanics. Chevron Richmond Refinery 2008 process safety culture survey identified discrepancy between operators’ and mechanics’ desire and personnel willingness to use Stop Work Authority. A total of 389 operators and mechanics were polled for this survey.

Between 2008 and 2010, there also was a decrease in Chevron Richmond Refinery employees’ willingness to use their Stop Work Authority beyond their own work group. In 2010, a statistically significant portion of managers and engineers reported that they were less willing to use their Stop Work Authority at any time they witnessed unsafe activity (Table 4).

203 The Chi-Square test permits the determination of whether a significant difference exists between two sets of categorical data, an "observed" set and an "expected" set. It permits an answer to the question, "How well does our observed distribution fit the hypothetical distribution?"

Chevron Richmond Refinery Investigation Report January 2015 108 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Question: Stopping Unsafe Work I would rarely, if ever do this. I would ask the safety person to do it. I do this with my own team. I do this with anyone and anytime there is unsafe activity. Managers & Engineers 2008 Current Conditions 6% (3 responses) 2% (1 response) 15% (7 responses) 77% (36 responses) Managers & Engineers 2010 Current Conditions 6% (8 responses) 4% (6 responses) 26% (36 responses) 64% (89 responses) Table 4. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to question of “Stopping Unsafe Work” by managers and engineers. Between 2008 and 2010, a significant portion of managers and engineers became less willing to use their Stop Work Authority at any time. In 2008, the survey polled 47 managers and engineers. In 2010, the survey polled 139 managers and engineers. A similar question was then asked about how the refinery as a whole perceives Stop Work Authority. Between 2008 and 2010, a statistically significant, increased portion of operators and mechanics began to feel that they could get in trouble when using their Stop Work Authority (Table 5). These trends could explain why no individuals used their Stop Work Authority on the day of the incident despite some participants reporting in interviews with the CSB that they were not comfortable with the hazardous work activity taking place.

Question: How do people feel about stopping unsafe work? It could get you in trouble. It’s probably best to point it out to a supervisor first. They do it and know it might slow down the job. They will do it and know they will be backed up. Operators & Mechanics 2008 Current Conditions 7% (27 responses) 26% (101 responses) 25% (97 responses) 42% (164 responses) Operators & Mechanics 2010 Current Conditions 12% (44 responses) 24% (88 responses) 25% (91 responses) 39% (142 responses) Table 5. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to question of “How do people feel about stopping unsafe work?” by operators and mechanics. Between 2008 and 2010, a significant portion of operators and mechanics began to feel they could get in trouble when using their Stop Work Authority. In 2008, the survey polled 389 operators and mechanics. In 2010, the survey polled 365 operators and mechanics. 5.5.2.2 Mechanical Integrity Safety Culture Survey Responses The 2008 and 2010 surveys polled Chevron Richmond Refinery employees on their perception of how equipment is maintained at the refinery. Table 6 summarizes the responses to this survey question.

Chevron Richmond Refinery Investigation Report January 2015 109 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Question: How do we take care of equipment? Equipment is not cared for, and we often have breakdowns and near misses. We have procedures for updating and maintaining our equipment but they are not always followed. We use procedures for updating and maintaining our equipment but they are not always up to date. We work hard to think about what can go wrong, and fix the equipment before it causes harm. All Employees 2008 Current Conditions 8% (53 responses) 26% (172 responses) 35% (231 responses) 31% (205 responses) All Employees 2008 Hoped-for Conditions 1% (7 responses) 5% (33 responses) 8% (53 responses) 86% (568 responses) All Employees 2010 Current Conditions 12% (112 responses) 27% (253 responses) 30% (281 responses) 31% (290 responses) All Employees 2010 Hoped-for Conditions 2% (19 responses) 4% (37 responses) 9% (84 responses) 85% (796 responses) Table 6. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to the question: “How do we take care of equipment?” Both surveys revealed that most employees felt procedures to maintain equipment were not always up to date, were not always followed, or that equipment was not properly maintained despite most individuals’ desire that the refinery fix equipment before it causes harm. Between the 2008 and 2010 surveys, a statistically significant portion of operators and mechanics began to feel that equipment was not cared for at the refinery. In addition, a statistically significant number of managers and engineers expressed that procedures for updating and maintaining equipment were not always followed. These results indicate that Chevron Richmond Refinery employees identified increased weakness in their mechanical integrity programs, which could result in equipment failures, such as the incident on August 6, 2012. 5.5.2.3 Process Safety Analysis Safety Culture Survey Responses The 2008 and 2010 surveys tasked Chevron Richmond Refinery employees to provide feedback on how process safety failures are investigated at the refinery. The survey results are shown in Table 7.

Question: Process Safety Issues Are… …usually not investigated. …investigated but not always resolved. …investigated and resolved if it’s in the budget. …routinely investigated, resolved and the lessons learned are shared with others. All Employees 2008 Current Conditions 2% (13 responses) 24% (159 responses) 21% (139 responses) 53% (350 responses) All Employees 2008 Hoped-for Conditions 1% (6 responses) 1% (7 responses) 3% (20 responses) 95% (628 responses) All Employees 2010 Current Conditions 3% (28 responses) 26% (243 responses) 17% (159 responses) 54% (506 responses) All Employees 2010 Hoped-for Conditions 2% (19 responses) 1% (9 responses) 4% (37 responses) 93% (871 responses) Table 7. Chevron Richmond Refinery 2008 and 2010 Safety Culture Survey responses to the question “Process Safety Issues Are…” Responses indicate employees desire process safety issues are investigated more thoroughly.

Chevron Richmond Refinery Investigation Report January 2015 110 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The survey responses show a discrepancy between the “Current Conditions” and “Hoped-for Conditions.” While nearly all of the employees polled desired that process safety issues were “routinely investigated, resolved and the lessons learned [were] shared with others”, only about half of the employees reported that they believed the refinery achieved that goal. The safety culture survey analysis of this difference concluded, “There continues to be a very strong desire to investigate more thoroughly to ensure there is adequate learning.” 5.5.2.4 Regulator Overview of Safety Culture Survey Action Items Contra Costa County issues regulations to covered facilities within the county through its Industrial Safety Ordinance (ISO).204 Although the City of Richmond is located in Contra Costa County, the county does not have jurisdiction over industrial facilities located within city limits. Thus, the ISO is not enforceable within the City of Richmond. On December 18, 2001, the City of Richmond adopted its own industrial safety ordinance (RISO), based on the ISO, to extend jurisdiction of a similar sort over facilities located in the city. The RISO covers two facilities—one of which is the Chevron Richmond Refinery. Pursuant to an agreement between the two parties, Contra Costa County inspects these two facilities and implements the RISO for the City of Richmond. Both the Contra Costa County ISO and the City of Richmond RISO require covered facilities to perform safety culture assessments at least once every five years.205 In addition, Contra Costa County published an “Industrial Safety Ordinance Guidance Document” that establishes additional requirements covered facilities must perform. Section F: Safety Culture Assessments requires facilities to maintain the following records, which can be audited by the regulator: a. Safety Culture Assessment reports; b. Stated facility goals and objectives regarding safety culture and related topics; c. Documentation of the appropriateness of the participation level targeted and achieved; d. Assessment methodologies used for each work group and criteria for successful implementation; e. Criteria used for rejection of any results or findings; f. Criteria used for determining if no action(s) will be taken on assessment results or recommendations; g. Summary of the assessment components with key findings; h. Improvement plan with clear list of action items and identifiable milestones; i. Rationale for prioritizing action items and justification for the action items;

204 For more information on the Contra Costa County Industrial Safety Ordinance, and the City of Richmond Industrial Safety Ordinance, see the CSB’s draft Regulatory Report, http://www.csb.gov/chevron-refinery-fire/ (accessed September 9, 2014). 205 The Contra Costa County ISO has required covered facilities to perform Safety Culture Assessments at least every five years since 2006, but Richmond did not adopt these requirements until February 2013. See http://www.ci.richmond.ca.us/documentcenter/view/26375, page 22 (accessed July 11, 2014) and http://www.ci.richmond.ca.us/ArchiveCenter/ViewFile/Item/4988 (accessed December 21, 2014).

Chevron Richmond Refinery Investigation Report January 2015 111 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

j. Documentation of communications to workforce; and k. Qualitative and quantitative comparisons in subsequent assessments of whether improvement plans affected observable safety behavior, or culture.206 As items (h) and (k) show, Contra Costa County and the City of Richmond require facilities to develop an improvement plan based on the safety culture assessment findings. The facilities must also monitor whether the improvement plan results in observable changes to safety behavior and culture. These items set a requirement for facilities to strive for continuous improvement in process safety culture. However, no means are in place for the regulator to ensure that the action items are of sufficient quality to promote cultural change. As is currently written in the Contra Costa County guidance document, the regulator only requires facilities to develop action items following the conduct of safety culture assessments. The quality of these action items can be subpar, lacking in capability to significantly change culture, yet the regulator must still approve them in its document-verification audits. In the years leading to the August 6, 2012 incident, the Chevron Richmond Refinery identified weaknesses in its Stop Work Authority program due to employees’ hesitation to use their Stop Work Authority when they witnessed an unsafe act occurring. The refinery also identified a deteriorating employee perception of the mechanical integrity programs used at the refinery. However, the Chevron Richmond Refinery was not required to take quality, constructive steps to improve these areas.207 Had steps been taken prior to the incident to find ways to encourage employees to use their Stop Work Authority or to determine why the refinery’s mechanical integrity programs were seen as deficient, the August 6, 2012, pipe rupture might have been prevented. Contra Costa County and the City of Richmond should enhance the ISO and RISO, respectively, to require the development of an oversight committee to monitor the development and implementation of action items created as a result of safety culture assessment findings. This committee should also assess whether the action items that result from the safety culture assessments have the potential to effectively lead to improved process safety culture in the facility. This oversight committee should be comprised of regulator representatives, company representatives, and members of the workforce and their representatives. Many citizens of Contra Costa County and Richmond, California, are concerned about the environmental impacts of industrial process incidents on their community, so they passionately advocate for improved industrial process safety at the petrochemical facilities in the county. For this reason, it is important that Contra Costa County community members play an active role in overseeing and providing input into process safety culture improvement efforts at petrochemical facilities in Contra Costa and Richmond. Ideally, one to two community members—who are selected by their peers based upon their ability to effectively (1) communicate the concerns of community members and (2) provide valuable input into the process safety culture improvement plans—will also be member(s) of this oversight committee.

206 http://cchealth.org/hazmat/pdf/iso/section_f.pdf (accessed July 14, 2014). 207 Under the RISO, Chevron was not required to conduct safety culture assessments until February 2013.

Chevron Richmond Refinery Investigation Report January 2015 112 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Recommendations

Under the authority of 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer operations at petroleum refineries and protecting workers and communities from future accidents nationwide, the CSB makes the following safety recommendations: 6.1 American Petroleum Institute 2012-03-I-CA-R26 Revise API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries to establish minimum requirements for preventing catastrophic rupture of low-silicon carbon steel piping. At a minimum: a. Require users to identify carbon steel piping circuits susceptible to sulfidation corrosion that may contain low-silicon components. These circuits have the potential to contain carbon steel components that were not manufactured to the American Society for Testing and Materials (ASTM) A106 specification and may contain less than 0.10 weight percent silicon content. b. For piping circuits identified to meet the specifications detailed in 2012-03-I-CA-R26(a), require users to either (1) enact a program to inspect every component within the piping circuit once, known as 100 percent component inspection (per the requirements established pursuant to recommendation 2012-03-I-CA-28(c)), or (2) replace the identified at-risk carbon steel piping with a steel alloy that is more resistant to sulfidation corrosion. c. If low-silicon components or components with accelerated corrosion are identified in a carbon steel piping circuit meeting the specifications detailed in 2012-03-I-CA-R26(a), require designation of these components as permanent Condition Monitoring Locations (CMLs) until the piping components are replaced.  2012-03-I-CA-R27 Revise API RP 571: Damage Mechanisms Affecting Fixed Equipment in the Refining Industry to: a. Describe the potential for increased rates of sulfidation corrosion occurring in low-silicon carbon steel in Section 4.4.2.3 Critical Factors;   b. Specify that sulfidation corrosion rates in carbon steel piping can be significantly faster in a few, individual piping components in section 4.4.2.5 Appearance or Morphology of Damage; and c. Refer the reader to the 100 percent component inspection or pipe replacement requirements detailed in API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries (pursuant to recommendation 2012-03-I-CA-26) and API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems (pursuant to

Chevron Richmond Refinery Investigation Report January 2015 113 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2012-03-I-CA-28(c)) for carbon steel piping circuits susceptible to sulfidation corrosion that may contain low-silicon components. 2012-03-I-CA-R28

Revise API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems to:

a. Use terminology consistent with API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries and other API standards and recommended practices discussed in this report. Replace the terminology “high-temperature sulfur corrosion” with “sulfidation corrosion”; b. Specify that sulfidation corrosion rates in carbon steel piping can be significantly faster in some individual piping components than in others; c. Establish a new section that details inspection requirements to identify low-silicon piping components in carbon steel circuits susceptible to sulfidation corrosion. This section shall require users to identify carbon steel piping circuits at risk to contain low-silicon components by following the requirements detailed in API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries (pursuant to 2012-03-I-CA-26(a)) and API RP 578: Material Verification Program for New and Existing Alloy Piping Systems (pursuant to 2012-03-I-CA-29). At a minimum, require users to either: i. Inspect every component within all carbon steel piping circuits susceptible to sulfidation corrosion that may contain low-silicon components once. The purpose of this practice is to identify any low-silicon components that are corroding at accelerated rates. Inspection may be performed through ultrasonic thickness measurements to establish corrosion rates for each component, destructive laboratory analysis, or other methods. Following the inspection, require users to follow the low-silicon corrosion rate monitoring requirements established in 2012-03-I-CA-R26(c); or ii. Replace the identified at-risk carbon steel piping with a steel alloy that is more resistant to sulfidation corrosion.

d. Incorporate as a “normative reference” API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries; and e. Require users to follow the minimum leak response guidance established in API RP 2001: Fire Protection in Refineries, developed in response to recommendation 2012-03-I-CA-R31.

Chevron Richmond Refinery Investigation Report January 2015 114 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2012-03-I-CA-R29 Revise API RP 578: Material Verification Program for New and Existing Alloy Piping Systems, to require users to establish and implement a program to identify carbon steel piping circuits that are susceptible to sulfidation corrosion and may contain low-silicon components. These circuits have the potential to contain carbon steel components that were not manufactured to the American Society for Testing and Materials (ASTM) A106 specification and may contain less than 0.10 weight percent silicon content. Refer the reader to the 100 percent component inspection or pipe replacement requirements detailed in API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries (pursuant to recommendation 2012-03-I-CA-26(b)) and API 570: Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems (pursuant to 2012-03-I-CA-28(c)) for carbon steel piping circuits susceptible to sulfidation corrosion that may contain low-silicon components. 2012-03-I-CA-R30

Revise API RP 574: Inspection Practices for Piping System Components (3rd edition) to: a. Incorporate as a normative reference API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries; b. Reference API RP 939-C: Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries when discussing that nonsilicon-killed carbon steel is susceptible to sulfidation corrosion; and c. In Section 9.3 Investigation of Leaks, require users to follow the leak response protocol requirements established in API RP 2001: Fire Protection in Refineries (pursuant to 2012-03-I- CA-R31). 2012-03-I-CA-R31 Revise API RP 2001: Fire Protection in Refineries to require users to develop a process fluid leak response protocol specific to their own facility that must be followed when a process fluid leak is discovered. Recommend users to incorporate the following actions into their leak response protocol: a. Establish an Incident Command structure upon identification of a process fluid leak; b. Conduct a pre-response meeting with personnel with specific technical expertise (e.g., inspectors, operators, metallurgists, engineers, and management) and the Incident Commander to determine pressure, temperature, remaining inventory of process fluids, potential damage mechanisms that caused the leak, and worst-case leak scenario;

Chevron Richmond Refinery Investigation Report January 2015 115 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

c. Establish a hot zone that identifies the area of risk of exposure or injuries due to flame contact, radiant heat, or contact to hazardous materials, taking into consideration the worst-case leak scenario; d. Limit site access around leak location to essential personnel only; e. Isolate the leaking piping or vessel, or if isolation is not possible, shutdown of the unit when the leaking process fluid poses immediate danger to safety, health, or the environment—such as piping fluid that is toxic or near the autoignition temperature. 6.2 American Society of Mechanical Engineers 2012-03-I-CA-R32

Revise ASME PCC-2-2011: Repair of Pressure Equipment and Piping to require users to follow the minimum process fluid leak response requirements established in API RP 2001: Fire Protection in Refineries, developed in response to recommendation 2012-03-I-CA-R31, before conducting process fluid leak repair. 6.3 Chevron USA 2012-03-I-CA-R33 Develop a method to assign accountability at Chevron to determine whether any new Energy Technology Company (ETC) recommended program or industry best practice, such as API guidance must be followed to ensure process safety or employee personal safety. This method shall include monitoring of these practices and guidance at a refining system level and at the refinery level. Develop a tracking system to monitor the progress of implementing these selected practices and guidance to completion. 2012-03-I-CA-R34 Develop an auditable process to be available for all recommended turnaround work items necessary to address mechanical integrity deficiencies or inspection recommendations that are denied or deferred. This process shall provide the submitter of the denied or deferred recommendation with the option to seek further review by his or her manager, who can further elevate and discuss the recommendation with higher level management, such as the Area Business Unit Manager. Maintain an auditable log of each of these potential turnaround work items, including the ultimate determination of approval, deferral, or rejection, justification determination, and the person or team responsible for that decision. 2012-03-I-CA-R35 Develop an approval process that includes a technical review that must be implemented prior to resetting the minimum alert thickness to a lower value in the inspection database.

Chevron Richmond Refinery Investigation Report January 2015 116 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4 Board of Supervisors, Contra Costa County, California

2012-03-I-CA-R36 Revise the Industrial Safety Ordinance (ISO) regulations for petroleum refineries to require a process safety culture continuous improvement program including a written procedure for periodic process safety culture surveys across the work force. Require an oversight committee comprised of the regulator, the company, the company’s workforce and their representatives, and community representatives. This oversight committee shall: a. Select an expert third party that will administer a periodic process safety culture survey; b. Review and comment on the third party expert report developed from the survey; c. Oversee the development and effective implementation of action items to effectively address identified process safety culture issues; and d. Develop process safety culture indicators to measure major accident prevention performance. The periodic process safety culture report shall be made available to the plant workforce. 6.5 Mayor and City Council, City of Richmond, California 2012-03-I-CA-R37 Revise the Richmond Industrial Safety Ordinance (RISO) regulations for petroleum refineries to require a process safety culture continuous improvement program including a written procedure for periodic process safety culture surveys across the work force. Require an oversight committee comprised of the regulator, the company, the company’s workforce and their representatives, and community representatives. This oversight committee shall: a. Select an expert third party that will administer a periodic process safety culture survey; b. Review and comment on the third party expert report developed from the survey; c. Oversee the development and effective implementation of action items to effectively address identified process safety culture issues; and d. Develop process safety culture indicators to measure major accident prevention performance. The periodic process safety culture report shall be made available to the plant workforce.

Appendix A

117 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix A—Chevron Leak Response Protocol Developed Post-incident

Appendix A

118 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix A

119 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix B

120 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix B—Contra Costa County Community Warning System Following the incident, Contra Costa County’s Community Warning System was used to notify the surrounding community of the hazardous material incident and order a shelter-in-place. But for many people, the warning came hours after the Chevron fire began. The Community Warning System uses sirens, the news media, and phone calls to residents to initiate the shelter-in-place. Contra Costa County issued the shelter-in-place advisory on August 6, 2012, at 6:38 p.m. for the cities of Richmond, San Pablo, and North Richmond, and lifted the shelter-in-place later that evening at 11:12 p.m. However, some phone calls notifying residents of the shelter-in-place advisory did not occur until over four hours after the release. This delay could have resulted in nearby residents unnecessarily and unknowingly being exposed to materials released to the atmosphere during the Chevron process leak and fire. Since the incident, Contra Costa County has made efforts to improve the Community Warning System. It has contracted with a new vendor that will automatically call Contra Costa County residents in an emergency.208

208 See http://concord-ca.patch.com/groups/politics-and-elections/p/contra-costa-county-testing-new-community- alert-system and http://www.contracosta.ca.gov/documentcenter/view/8161.

Appendix C

121 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix C—Usage of Clamps at Chevron Richmond Refinery The CSB committed to analyzing Chevron’s culture of using clamps to temporarily stop a process fluid leak in “Additional Issues Currently Under Investigation” in its Interim Investigation Report on the August 6, 2012, Chevron Richmond Refinery incident. Following the August 6, 2012 incident, Cal/OSHA issued a citation to Chevron for nine temporary nonwelding repairs that had not been removed at the most recent turnaround.209 The CSB analyzed this citation and all available evidence on clamp usage at the Chevron Richmond Refinery. The CSB could not take a conclusive stance on whether the refinery over-relied on temporary leak repair clamps in its mechanical integrity program based upon available evidence. In addition, the CSB did not find any direct or relevant linkage between the specific clamps for which the citations were issued and the incident. As a result, this report does not analyze the use of leak repair clamps at the Chevron Richmond Refinery.

209 Division of Occupational Safety and Health, Cal/OSHA Process Safety Management District Office. Citation and Notification of Penalty. Inspection Number 314332370; Citations Issued to Chevron U.S.A. Inc.; Issuance Date 01/30/2013. Citation 8 Item 1. See http://www.dir.ca.gov/dosh/citations/Chevron_314332370_cites_issued_1-30-13.pdf#zoom=100 (accessed November 5, 2014).

Chevron Richmond Refinery Investigation Report January 2015 122 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

FD06455 ｜ 2012_美国_tesoro-anacortes-refinery-fatal-explosion-and-fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Birring NDE Center, Inc. 515 Tristar Drive, Webster, TX 77598 Tel: (832) 533-8366 Fax: (281) 488-8485

September 5, 2012 Ultrasonic Inspection Report HTHA Inspection of Exchangers E 6600 E and E 6600 B

Introduction: Inspection for detection of High Temperature Hydrogen Attack (HTHA) was performed at selected locations of Exchangers E 6600 E and E 6600 B

Inspection Dates: August 31, 2012 Client:

US Chemical and Safety Board Location:

Cleveland, OH Contact:

Roger Evans Inspectors:

Anmol Birring, ASNT Level III

Technique: Ultrasonic inspection for detection of HTHA was conducted using the following techniques: Base Metal: Backscatter for initial scanning. Velocity-ratio for verification, if backscatter is positive

Scope: Base Metal backscatter ultrasonic data was taken at selected locations in Exchangers E 6600 E and E 6600 B. The locations were selected by Roger Evans. All locations were at least 9 inches away from the welds.

UT Equipment: Backscatter: USN Go in the RF mode

Velocity Ratio: Panametrics Pulser 5052 with the Tektronix 2012 oscilloscope

UT Transducers: Backscatter: 5 MHz, 10 mm dia Dual L-wave transducer. Velocity ratio: 5 MHz, 12.5 mm dia Single L and S-wave transducers

Calibration: Base metal calibration performed on step block and HTHA sample. The HTHA signal was set to 80 % FSH at 62 dB as shown in Figure 2. Testing was performed at a gain of 62 dB

Velocity ratio calibration was performed on a step block with no HTHA and a sample with HTHA. The readings are given in Table 1.

RESULTS Backscatter measurements were taken at eight selected areas on E 6600 E and about six areas on E 6600 B. Each of the areas is about 4 inches in diameter. Within each area, five backscatter measurements were taken.

Birring NDE Center, Inc. 515 Tristar Drive, Webster, TX 77598 Tel: (832) 533-8366 Fax: (281) 488-8485

Backscatter was detected at all points. An indication of backscatter can mean base metal HTHA or stringers in steel (inclusions in steel). To determine the cause of backscatter, follow up inspections were done to measure velocity-ratio. This was done on Exchanger E 6600 E and the results are given in Table 2. All of the velocity-ratio measurements turned out to be in the normal range, an indication that the backscatter was caused by stringers in steel.

No follow-up velocity ratio measurements were taken on E 6600 B

CONCLUSIONS No base metal HTHA was detected at the locations inspected in the exchanger shell. One has to note that all measurements were taken quite far from the weld HAZ.

Table 1. Calibration for Velocity Ratio. Step Block and sample with actual HTHA

Block Thickness Backscatter depth Ratio Step Block 19.0 mm 0 mm 0.546 HTHA 1 SK 21.5 mm 14 mm 0.560

Table 2. Ultrasonic Data taken on E 6600 E for detection of base metal HTHA.

No. Location Thickness Backscatter Vel Ratio Comments 1 E 01 22 mm Yes 0.546 No HTHA 2 E 02 22 mm Yes 0.543 No HTHA 3 E 03 22 mm Yes 0.546 No HTHA 4 E 04 21.6 mm Yes 0.545 No HTHA 5 E 05 21.7 mm Yes 0.546 No HTHA 6 E 06 21.6 mm Yes 0.547 No HTHA 7 E 07 29.8 mm Yes 0.539 No HTHA 8 EC 01* 22.5 mm Yes 0.546 No HTHA

• Location with ID clad

Birring NDE Center, Inc. 515 Tristar Drive, Webster, TX 77598 Tel: (832) 533-8366 Fax: (281) 488-8485

Figure 2. HTHA Backscatter Calibration at 62 dB. Top-left – Step block with no HTHA. Top- right and bottom - Representative HTHA backscatter signals from HTHA 1 SK sample

FD06456 ｜ 2013_CSB_2013_West_Fertilizer_Company_Fire_and_Explosion_Investigation_Report.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

FINAL WEST FERTILIZER COMPANY FIRE AND EXPLOSION (15 Fatalities, More Than 260 Injured)

WEST FERTILIZER COMPANY WEST, TX KEY ISSUES: APRIL 17, 2013 • REGULATORY OVERSIGHT • HAZARD AWARENESS • EMERGENCY PLANNING AND RESPONSE • FERTILIZER GRADE AMMONIUM NITRATE STORAGE PRACTICES • LAND USE PLANNING AND ZONING REPORT 2013-02-I-TX

[This page intentionally left blank.]

West Fertilizer Company Final Report January 2016

Dedication This report is dedicated to the 12 emergency responders and 3 members of the public who lost their lives as a result of the explosion at the West Fertilizer Company on April 17, 2013.

Morris Bridges Perry Calvin Jerry Dane Chapman Cody Frank Dragoo Kenneth Harris Adolph Lander James Matus Judith Ann Monroe Joseph Pustejovsky Cyrus Adam Reed Mariano C. Saldivar Kevin William Sanders Douglas Snokhous Robert Snokhous William Uptmor, Jr.

West Fertilizer Company Final Report January 2016 1 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Contents 1.0 EXECUTIVE SUMMARY ........................................................................................................... 13 1.1 Overview ........................................................................................................................................ 13 1.2 Federal and State Response ........................................................................................................... 14 1.2.1 Joint SFMO/ATF Investigation ........................................................................................ 14 1.2.2 CSB Response ................................................................................................................... 15 2.0 BACKGROUND ........................................................................................................................... 16 2.1 West Fertilizer Company ............................................................................................................... 16 2.1.1 Facility Operations Description ........................................................................................ 18 2.1.2 Facility Layout and Materials of Construction ................................................................. 23 2.1.3 Unloading of Fertilizer ...................................................................................................... 25 2.1.4 Housekeeping .................................................................................................................... 26 3.0 INCIDENT DESCRIPTION .......................................................................................................... 27 3.1 West Police Department ................................................................................................................ 27 3.2 West Volunteer Fire Department (WVFD) .................................................................................... 28 3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer Fire Departments .................... 29 3.4 Consequences ................................................................................................................................. 30 3.4.1 Fatalities and Injuries ........................................................................................................ 30 3.4.2 Property Damage .............................................................................................................. 32 3.4.3 West Independent School District .................................................................................... 39 3.4.4 West Rest Haven Nursing Home ...................................................................................... 49 3.4.5 West Terrace Apartment Complex ................................................................................... 53 3.4.6 Private Residences ............................................................................................................ 54 3.4.7 Infrastructure Damage to the City of West ....................................................................... 55 4.0 INCIDENT ANALYSIS ................................................................................................................ 57 4.1 Fertilizer Grade Ammonium Nitrate (FGAN) ............................................................................... 57 4.1.1 The Fertilizer Industry ...................................................................................................... 57 4.1.2 FGAN Properties .............................................................................................................. 57 4.1.3 FGAN Hazards ................................................................................................................. 58 4.1.4 Previous Incidents Involving FGAN ................................................................................ 61 4.1.5 Historical Knowledge of FGAN Fire and Explosion Hazards .......................................... 62

West Fertilizer Company Final Report January 2016 2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2

Factors Contributing to the Massive Fire and Explosion at the WFC ........................................... 64 4.2.1 Contamination of the FGAN Pile ..................................................................................... 64 4.2.2 Heating and Ventilation .................................................................................................... 66 4.3 Detonation Scenarios ..................................................................................................................... 68 4.3.1 Scenario 1: Detonation from the Top of the FGAN Pile .................................................. 69 4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to Fire ............. 71 4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin ......................... 73 4.4 Forensic Testing of West Fertilizer Company Samples ................................................................. 73 4.5 Blast and Impact Analysis ............................................................................................................. 78 4.5.1 Seismic Data ..................................................................................................................... 81 5.0 COMMERCIAL PROPERTY AND LIABILITY INSURANCE ................................................. 82 5.1 Triangle Insurance Coverage and Audits (2006–2010) ................................................................. 83 5.1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards ............................ 86 5.2 U.S. Fire Insurance Coverage and Audits (2010–2013) ................................................................ 86 5.3 Insurance Claims and Other Aid after the Explosion .................................................................... 87 5.4 FGAN Facilities in Texas and the Potential for Offsite Consequences ......................................... 88 5.5 Limits of Insurance Coverage in Texas ......................................................................................... 90 5.6 Insurance Services Office Rating ................................................................................................... 94 5.6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer Company ............ 95 6.0 INHERENTLY SAFER TECHNOLOGY ..................................................................................... 97 6.1 Alternative Formulations of FGAN ............................................................................................... 99 6.2 Inherently Safe Building Design and Storage .............................................................................. 102 7.0 EMERGENCY RESPONSE ........................................................................................................ 104 7.1 Firefighter Response .................................................................................................................... 105 7.2 Key Contributing Factors to Emergency Responders’ Fatality ................................................... 107 7.2.1 Lack of Incident Command System ................................................................................ 107 7.2.2 Lack of Established Incident Management System ........................................................ 108 7.2.3 Firefighter Training ......................................................................................................... 110 7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training ................................... 112 7.2.5 Lack of Situational Awareness and Risk Assessment Knowledge ................................. 116 7.2.6 Lack of Pre-Incident Planning at Facility ....................................................................... 117 7.3 Limited and Conflicting Technical Guidance on FGAN ............................................................. 119

West Fertilizer Company Final Report January 2016 3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1

Emergency Response Guidebook ................................................................................... 120 7.3.2 Safety Data Sheets .......................................................................................................... 125 7.4 Lessons Not Learned and Lessons Learned ................................................................................. 127 7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not Learned ........... 127 7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned ............................................ 131 7.5 Other Post-Incident Investigation Reports Related to Firefighting .............................................. 136 7.5.1 Texas State Fire Marshal’s Office (SFMO) .................................................................... 136 7.5.2 NIOSH Findings and Recommendations ........................................................................ 137 7.6 Summary of Incident Emergency Response ................................................................................ 138 7.7 Firefighter Training Grants and Programs ................................................................................... 139 7.7.1 Need for Training ............................................................................................................ 139 7.7.2 National Firefighter Training Funds and Programs ........................................................ 142 7.7.3 National Membership Firefighter Associations .............................................................. 163 8.0 REGULATORY ANALYSIS ...................................................................................................... 164 8.1 President Obama’s Executive Order 13650 ................................................................................. 164 8.2 OSHA Explosives and Blasting Agents Standard ........................................................................ 165 8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard .................. 171 8.2.2 Need for an Emphasis Program ...................................................................................... 173 8.3 Chemical Facility Anti-Terrorism Standards (CFATS) ............................................................... 173 8.3.1 AN Screening Thresholds ............................................................................................... 174 8.4 Safety Management Programs ..................................................................................................... 176 8.4.1 OSHA Process Safety Management Standard ................................................................ 176 8.4.2 EPA Risk Management Program Rule ........................................................................... 183 8.5 Emergency Planning .................................................................................................................... 195 8.5.1 Federal Emergency Planning .......................................................................................... 196 8.5.2 State Emergency Planning in the State of Texas ............................................................ 199 8.5.3 City Emergency Planning in the City of West ................................................................ 200 8.5.4 Other Emergency Planning Requirements ...................................................................... 204 8.6 Fire Protection Codes and Standards ........................................................................................... 205 8.6.1 National Fire Protection Association .............................................................................. 206 8.6.2 International Code Council ............................................................................................. 209 8.6.3 State Fire Codes .............................................................................................................. 210

West Fertilizer Company Final Report January 2016 4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7

Post-Incident State and Local Regulatory Developments ............................................................ 213 8.7.1 Texas Commercial Fertilizer Rules ................................................................................ 214 8.7.2 Texas House Bill 942 ...................................................................................................... 214 8.7.3 Athens City Ordinance .................................................................................................... 215 8.8 Industry Standards ....................................................................................................................... 216 8.8.1 The Fertilizer Institute (TFI) ........................................................................................... 216 8.8.2 Agricultural Retailers Association (ARA) ...................................................................... 218 8.8.3 Product Stewardship ....................................................................................................... 218 8.8.4 Efforts to Address FGAN Hazards Post-Incident ........................................................... 220 9.0 LAND USE .................................................................................................................................. 223 9.1 Land Use Planning: An Introduction ........................................................................................... 223 9.2 The City That “Came to” the WFC Over the Years .................................................................... 224 9.3 Lack of Zoning Regulations ......................................................................................................... 227 9.3.1 Importance of Land Use Planning in Siting Communities Near Facilities Storing FGAN and Other Hazardous Chemicals ..................................................................................... 233 9.3.2 International Perspectives ............................................................................................... 234 9.4 Efforts to Address Land Use Planning After the West Incident .................................................. 239 10.0 KEY FINDINGS .......................................................................................................................... 240 11.0 RECOMMENDATIONS ............................................................................................................. 242 12.0 APPENDIX A: REBUILDING OF THE WEST INDEPENDENT SCHOOL DISTRICT ........ 250 13.0 APPENDIX B: FGAN INCIDENTS TABLES ........................................................................... 252 14.0 APPENDIX C: TFI SAFETY AND SECURITY TOOLS .......................................................... 262 15.0 APPENDIX D: RESPONSIBLEAG ............................................................................................ 264

West Fertilizer Company Final Report January 2016 5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figures Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps) ............................................................... 18 Figure 2. Grain Silos (Source: WFC Insurer) ............................................................................................. 19 Figure 3. West View of Fertilizer Building (Source: Bing Maps) .............................................................. 20 Figure 4. Fertilizer Building Overview (Source: Atlas Engineering) ......................................................... 21 Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer) ............. 21 Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer) ............................................................... 22 Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer) .......................................... 23 Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB) ..................................................................... 24 Figure 9. Elevator System Recovered from Blast Debris (Source: CSB) ................................................... 25 Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public) ............................... 30 Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health District) ..................................................................................................................................... 31 Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol) .................................. 33 Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting) ..................................................... 34 Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting) ....................... 34 Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB) ............ 35 Figure 16. Liquid Fertilizer Tank Damage (Source: CSB) ......................................................................... 35 Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB) ............................................................ 36 Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB) ....................................... 37 Figure 19. Damaged Playground Equipment (Source: ABS Consulting) ................................................... 37 Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting) .......................................... 38 Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB) ............................................... 39 Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth) ... 40 Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB) ............................................................. 42 Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting) .......... 43 Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting) ................................................... 43 Figure 26. Embedded Glass in Assignment Poster in WIS Room 12 (Source: ABS Consulting) ............. 44 Figure 27. Interior of Burned Northeast Section of WIS (Source: ABS Consulting) ................................ 44 Figure 28. WIS Gymnasium (Source: ABS Consulting) ............................................................................ 45 Figure 29. WIS Classroom 20 (Source: ABS Consulting) .......................................................................... 46 Figure 30. WHS Evacuation Map (Source: WISD) .................................................................................... 47

West Fertilizer Company Final Report January 2016 6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps) ........................................................................................... 48 Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS (Source: ABS Consulting) 49 Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting) ..................... 50 Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB) ....................................... 52 Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West Rest Haven (Source: ABS Consulting) ..................................................................................... 53 Figure 36. West Terrace Apartment Complex East Façade (Source: CSB) ................................................ 54 Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting) ......... 55 Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) (Source: Member of the Public) .. 65 Figure 39. Dark and Heavy Smoke, Rich in Soot (Source: Member of the Public) .................................. 66 Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke and Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the Public) ....................................................................................................................................... 67 Figure 41. Plume of Smoke from AN Fire in Bryan, Texas (Source: College Station Fire Department).. 68 Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB) ..................... 70 Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the Public) ....................................................................................................................................... 72 Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: Forensic Laboratory) ................................................................................................................. 75 Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory) ........ 75 Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory) ............................... 75 Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory) ................................... 77 Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB) ................................................ 79 Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) ................ 80 Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering) .................. 81 Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering) ........... 81 Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National Earthquake Information Center (Source: USGS) ...................................................................... 82 Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey (Source: Triangle Insurance Company) .................................................................................................................................. 84 Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey (Source: Triangle Insurance Company) .................................................................................................................................. 85 Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: Google Earth) ............................................................................................................................ 89

West Fertilizer Company Final Report January 2016 7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) Within 1 Mile of a Texas School (Source: CSB) ............................................................................................................... 89 Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School (Source: Google Earth) ............................................................................................................. 90 Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO) .......... 95 Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO) ........... 96 Figure 60. Risk Control Hierarchy (Source: CCPS) ................................................................................... 98 Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB) ................................................. 104 Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB) ....................... 106 Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA) ................................................ 121 Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA) ................................................ 124 Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: Bryan- College Station Eagle) ............................................................................................................ 130 Figure 66. Dark Grey Smoke Originating from East Texas Ag Supply Facility in Downtown Athens, Texas (Source: Athens Fire Department) ................................................................................ 133 Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas (Source: Athens Fire Department) .......................................................................................... 134 Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke (Source: Athens Fire Department) ......................................................................................................... 135 Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA) ....... 141 Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA) ..................... 147 Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA) .................................................. 148 Figure 72. FP&S Grant Recipients in Texas (Source: FEMA) ................................................................. 148 Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS) ............................................ 175 Figure 74. Progressive Development of West (Source: GeoSearch) ........................................................ 226 Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: NBC News) ............................................................................................................................. 227

Tables Table 1. WFC Fertilizer Inventory in April 2013 ...................................................................................... 16 Table 2. Estimated Number of Students and Staff During School Hours .................................................. 41 Table 3. Infrastructure Repaired with FEMA Funding .............................................................................. 55 Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC ............ 76 Table 5. Minimum Insurance Requirements in Texas ................................................................................ 92

West Fertilizer Company Final Report January 2016 8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 6. Inherently Safer Approaches for Handling FGAN ....................................................................... 98 Table 7. Examples of AN Fertilizer Alternatives...................................................................................... 100 Table 8. Training and Experience Information of the Fatally Injured Firefighters ................................... 112 Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013 ................................ 126 Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program ................................ 158 Table 11. OSHA 29 CFR 1910.109(i) Citation History ............................................................................ 169 Table 12. CSB Investigations Involving Reactive Chemicals Since 2002 ............................................... 192 Table 13. EPCRA Chemicals and Reporting Thresholds ......................................................................... 196 Table 14. Relevant Siting Regulations ...................................................................................................... 228 Table 15. Investigations Involving Land Use Issues ................................................................................ 233 Table 16. Distribution of Grade Levels at the Old and New WISD Schools ............................................ 251 Table 17. FGAN Incidents at Stationary Sites .......................................................................................... 254 Table 18. Non-Stationary FGAN Incidents .............................................................................................. 259

West Fertilizer Company Final Report January 2016 9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Acronyms and Abbreviations

°C degrees Celsius °F degrees Fahrenheit AC air conditioning AFG Assistance to Firefighters Grant AHJ Authority Having Jurisdiction AN ammonium nitrate ANFO ammonium nitrate/fuel oil ANSI American National Standards Institute API American Petroleum Institute ARA Agricultural Retailers Association AS ammonium sulfate ATF Bureau of Alcohol, Tobacco, Firearms and Explosives CDC Centers for Disease Control and Prevention CDP Center for Domestic Preparedness CDT central daylight time CEPP Chemical Emergency Preparedness Program CERCLA Comprehensive Environmental Response, Compensation, and Liability Act CFATS Chemical Facility Anti-Terrorism Standards CFR Code of Federal Regulations CMU concrete masonry unit COI chemical of interest CSAT Chemical Security Assessment Tool CSB U.S. Chemical Safety and Hazard Investigation Board CTG Continuing Training Grant DHS U.S. Department of Homeland Security DOL U.S. Department of Labor DOT U.S. Department of Transportation DWC Division of Workers’ Compensation EDT eastern daylight time EHS extremely hazardous substance EMPG Emergency Management Performance Grant EMS emergency medical services EMT emergency medical technician

West Fertilizer Company Final Report January 2016 10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

EO Executive Order EPA U.S. Environmental Protection Agency EPCRA Emergency Planning and Community Right-to-Know Act ERDC Engineer Research and Development Center ERG Emergency Response Guidebook ERP Emergency Response Plan EU European Union FAST firefighter assist and search team FEMA Federal Emergency Management Agency FFFIPP Fire Fighter Fatality Investigation and Prevention Program FGAN fertilizer grade ammonium nitrate FP&S Fire Prevention and Safety FR Federal Register FRS Facility Registry Service g/cm3 grams per cubic centimeter GAO U.S. Government Accountability Office GPD Grant Programs Directorate HAZMAT hazardous material HAZWOPER Hazardous Waste Operations and Emergency Response HCS Hazard Communication Standard HUD U.S. Department of Housing and Urban Development HSE UK Health and Safety Executive HSNTP Homeland Security National Training Program HVAC heating, ventilation, and air conditioning IAFC International Association of Fire Chiefs IAFF International Association of Fire Fighters IAP Incident Action Plan IBC International Building Code IC incident commander ICC International Code Council ICS Incident Command System ICT Insurance Council of Texas IFC International Fire Code IME Institute of Makers of Explosives ISO Insurance Services Office

West Fertilizer Company Final Report January 2016 11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

IST inherently safer technology K-Mag potassium magnesium LEPC Local Emergency Planning Committee LNG liquefied natural gas MOU memorandum of understanding MSDS Material Safety Data Sheet NAICS North American Industry Classification System NEIC National Earthquake Information Center NERRTC National Emergency Response and Rescue Training Center NEW net explosive weight NFA National Fire Academy NFPA National Fire Protection Association NIMS National Incident Management System NIOSH National Institute for Occupational Safety and Health NOX nitrogen oxide NPD National Preparedness Directorate NTED National Training and Education Division NVFC National Volunteer Fire Council NYC New York City OSHA Occupational Safety and Health Administration OTSC Office of the Texas State Chemist PHMSA Pipeline and Hazardous Materials Safety Administration PPC Public Protection Classification PPE personal protective equipment PRV pressure relief valve PSI pounds per square inch PSM Process Safety Management (standard) PVC polyvinyl chloride Q&A question and answer RCRA Resource Conservation and Recovery Act RDPC Rural Domestic Preparedness Consortium RFI request for information RMP Risk Management Plan SAA State Administrative Agency SAFER Staffing for Adequate Fire and Emergency Response

West Fertilizer Company Final Report January 2016 12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SARA Superfund Amendments and Reauthorization Act SBA Small Business Administration SDS Safety Data Sheet SERC State Emergency Response Commission SFFMA State Firefighters’ and Fire Marshals’ Association SFMO State Fire Marshal’s Office SIC Standard Industrial Classification SOP standard operating procedure SPCC spill prevention, control, and countermeasures TAC Texas Administrative Code TCEQ Texas Commission on Environmental Quality TCFP Texas Commission on Fire Protection TDI Texas Department of Insurance TEEX Texas A&M Engineering Extension Service TFI The Fertilizer Institute TGAN technical grade ammonium nitrate TIESB Texas Industrial Emergency Services Board TNT Trinitrotoluene TR technical report TRANSCAER Transportation Community Awareness and Emergency Response TRI Toxics Release Inventory TX Texas U.K. United Kingdom USFA U.S. Fire Administration USGS U.S. Geological Survey VFD volunteer fire department WFC West Fertilizer Company WFD West Fire Department WIS West Intermediate School WISD West Independent School District WMS West Middle School WVFD West Volunteer Fire Department

West Fertilizer Company Final Report January 2016 13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Executive Summary
2. 1 Overview

On April 17, 2013, a fire and explosion occurred at the West Fertilizer Company (WFC), a fertilizer blending, retail, and distribution facility in West, Texas. The violent detonation fatally injured 12 emergency responders and three members of the public. Local hospitals treated more than 260 injured victims, many of whom required hospital admission. The blast completely destroyed the WFC facility and caused widespread damage to more than 150 offsite buildings. The WFC explosion is one of the most destructive incidents ever investigated by the U.S. Chemical Safety and Hazard Investigation Board (CSB) as measured by the loss of life among emergency responders and civilians; the many injuries sustained by people both inside and outside the facility fenceline; and the extensive damage to residences, schools, and other structures. Following the explosion, WFC filed for bankruptcy. The explosion happened at about 7:51 pm central daylight time (CDT), approximately 20 minutes after the first signs of a fire were reported to the local 911 emergency response dispatch center. Several local volunteer fire departments responded to the facility, which had a stockpile of between 40 and 60 tons (80,000 to 120,000 pounds) fertilizer grade ammonium nitrate (FGAN), not counting additional FGAN not yet offloaded from a railcar. More than half of the structures damaged during the explosion were demolished to make way for reconstruction. The demolished buildings include an intermediate school (552 feet southwest of the facility), a high school (1,263 feet southeast), a two-story apartment complex with 22 units (450 feet west) where two members of the public were fatally injured, and a 145-bed nursing home (500 feet west) where many of the seriously injured civilians resided. A middle school (2,000 feet southwest) also sustained serious but reparable damage. Section 3 describes the incident and its consequences in detail. The CSB investigated the factors that contributed to the detonation of FGAN. Section 4 describes the properties of FGAN and posits three scenarios that could lead to its detonation under the conditions present during the WFC fire. CSB concluded that the construction of the bins and other building materials as well as the lack of an automatic sprinkler system plausibly contributed to the detonation. Section 6 describes inherently safer approaches to FGAN use and storage that reduce the risk of an FGAN detonation. The total insurance-related losses from the explosion are estimated to be around $230 million and federal disaster assistance is estimated to exceed $16 million. WFC was only insured for $1 million, which fell far short of the incident’s damage. Section 5 presents CSB’s analysis of the policies and regulations that led to this as well as to the failure of the insurer to identify the risks posed by FGAN. A few years prior to the incident, WFC was dropped by one insurer for failing to address safety concerns identified in loss control surveys. The company that insured WFC at the time of the incident did not appear to have conducted its own safety inspections of the facility.

West Fertilizer Company Final Report January 2016 14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB’s analysis of the emergency response, found in Section 7, concludes that the West Volunteer Fire Department did not conduct pre-incident planning or response training at WFC, was likely unaware of the potential for FGAN detonation, did not take recommended incident response actions at the fire scene, and did not have appropriate training in hazardous materials response. CSB found several shortcomings in federal and state regulations and standards that could reduce the risk of another incident of this type. These include the Occupational Safety and Health Administration’s Explosives and Blasting Agents and Process Safety Management standards, the Environmental Protection Agency’s Risk Management Program and Emergency Planning and Community Right-to-Know Act, and training provided or certified by the Texas Commission on Fire Protection and the State Firefighters’ and Fire Marshals’ Association of Texas. CSB’s complete analysis is presented in Section 8. The location of the WFC relative to the surrounding community exacerbated the offsite consequences, leading CSB to assess whether other FGAN storage facilities could pose significant offsite risks. CSB’s analysis shows that the risk to the public from a catastrophic incident exists at least within the state of Texas, if not more broadly. For example, 19 other Texas facilities storing more than 10,000 pounds of FGAN are located within 0.5 miles of a school, hospital, or nursing home, raising concerns that an incident with offsite consequences of this magnitude could happen again. Section 9 explores the connection between land use planning and offsite consequences. 1.2 Federal and State Response In response to this incident, President Barack Obama issued Executive Order (EO) 13650, “Improving Chemical Facility Safety and Security” to coordinate federal actions to reduce the risks of another incident of this type.1 Details and updates on the status of the EO are included in Section 8.1. Early investigation activities focused on law enforcement efforts to determine if there was a criminal element to the incident. Responding governmental agencies included the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) National Response Team, Texas State Fire Marshal’s Office (SFMO), U.S. Occupational Safety and Health Administration (OSHA), Texas Commission on Environmental Equality, U.S. Federal Emergency Management Agency (FEMA), and U.S. Environmental Protection Agency (EPA). In addition, multiple state and local law enforcement and emergency response organizations responded to the scene. 1.2.1 Joint SFMO/ATF Investigation Immediately following the incident, ATF deployed to West at the invitation of SFMO and assumed control of the WFC site to conduct a joint investigation of the immediate cause and origin of the fire and explosion and determine whether the initiating fire was intentionally set. The two agencies retained

1 Executive Order 13650. “Improving Chemical Facility Safety and Security,” August 1, 2013. See: https://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facility-safety-and- security (accessed on December 8, 2015).

West Fertilizer Company Final Report January 2016 15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

control of the scene for about four weeks, interviewing witnesses, excavating the WFC site, and reconstructing the electrical system. To date, law enforcement has not made a final determination of the cause of the fire and ensuing explosion. Three possible scenarios remain under consideration: (1) faulty electrical wiring, (2) short circuit in an electrical golf cart, and (3) intentional act of arson.2 1.2.2 CSB Response CSB investigators from both the Washington, DC, and Denver, Colorado, offices deployed on April 18, 2013, supported by a contingent of contractors that included blast modeling, structural, urban search and rescue, and fire and explosion experts. The joint ATF-SFMO control of the site as a crime scene limited CSB site access and delayed CSB investigator execution of evidence-gathering protocols, chemical testing, and witness interviews. Despite the limited access in the initial stages, driven by the criminal investigation, CSB continued with its investigation. The investigation of the WFC incident analyzed several root causes and considered multiple contributing causes. Investigative teams partnered with urban search and rescue experts and fire and explosion consultants to survey damage to residences, schools, the nursing home, and other structures. The teams also conducted interviews with eyewitnesses, WFC managers, and hourly workers and gathered physical evidence for further laboratory testing and analysis. Key Findings The CSB’s analysis includes findings on the technical causes of the fire and explosion; regulatory changes that could have resulted in safety enhancements to the facility; the failure of the insurer to conduct safety inspections or provide an adequate level of coverage; shortcomings in emergency response, including pre-incident planning or response training of the volunteer fire fighters; and deficiencies in land use planning that permitted the City of West to encroach upon the WFC over the years. Section 10 presents the CSB’s key findings on the WFC incident. Recommendations As a result of the investigation of the WFC fire and explosion, CSB developed recommendations and directed them to the following recipients: • Environmental Protection Agency (EPA). • Occupational Safety and Health Administration (OSHA), U.S. Department of Labor. • Federal Emergency Management Agency (FEMA), U.S. Department of Homeland Security. • International Codes Council. • Texas Department of Insurance. • Texas Commission on Fire Protection. • State Firefighters’ and Fire Marshals’ Association of Texas. • Texas A&M Engineering Extension Services (TEEX).

2 See: http://www.tdi.texas.gov/news/2013/news201320.html (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• El Dorado Chemical Company (EDC). • West Volunteer Fire Department (WVFD).

Section 11 contains the complete set of recommendations. 2.0 Background 2.1 West Fertilizer Company The West Fertilizer Company (WFC) was located in the city of West, Texas. The city is approximately 80 miles south of Dallas, Texas, and has a population of about 2,800.3 The WFC stored and distributed fertilizers, chemicals, grains, and various other farming supplies. At the time of the incident, stockpiles of about 40 to 60 tons of FGAN were estimated to be onsite, and about 30 tons detonated. Table 1 shows the WFC inventory at the time of the explosion and fire. Table 1. WFC Fertilizer Inventory in April 2013 Fertilizer Name Amount (in tons) FGAN (fertilizer building) 40 to 60 FGAN (railcar) 100 Anhydrous ammonia 17 Potash4 45 Diammonium phosphate5 70 Diammonium phosphate and potash 25 Ammonium sulfate6 60 to 70 Zinc sulfate7 17.5

The fertilizer building was constructed in 1961, and business operations started in 1962. Photographs from 1972 show the closest residence about 265 feet from the WFC property. In addition, a baseball field

3 The 2010 U.S. Census data indicate that the population of West, Texas, is 2,807. See: http://www.census.gov/2010census/popmap/ (accessed on December 8, 2015). 4 Potash is an agricultural fertilizer and is a source of soluble potassium (K). 5 Diammonium phosphate (DAP), (NH4)2HPO4, is one of a series of water-soluble ammonium phosphate salts that can be produced when ammonia reacts with phosphoric acid. 6 Ammonium sulfate, (NH4)2SO4, is an inorganic salt with a number of commercial uses. The most common use is as a soil fertilizer. 7 Zinc sulfate, ZnSO4, is an inorganic compound and is a colorless solid that is a common source of soluble zinc ions.

West Fertilizer Company Final Report January 2016 17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 58 feet from the property. In 1972, the town nursing home and the nearest group of homes were constructed about 500 feet away.8 Over the years, growth in the city of West led to the development of land closer to the WFC property line, including a park (less than 150 feet), an apartment complex, the nearest aggregation of homes (about 370 feet), West Intermediate School (a little more than 200 feet), and West High School (about 500 feet). Sections 3.4.2 through 3.4.7 provide additional details on the property damage resulting from the explosion.9 Figure 1 shows the WFC facility before the fire and explosion in relation to the nearby community, including details on the site and the location of various structures.

8 This information was determined using Image 272-37A provided by McLennan County and distances calculated using Google Earth (accessed on June 6, 2013). 9 Calculated using Google Earth (accessed on June 6, 2013).

West Fertilizer Company Final Report January 2016 18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC Facility Legend Figures in Report 1 Grain Silos 2 2 Location of Overturned FGAN Railcar (post-explosion) 15 3

Corn Silo

4

Office/Chemical Storage

5 Fertilizer Building 3-5, 7 6 Liquid Fertilizer Tanks 16 7 Anhydrous Ammonia Pressure Vessels 6, 17, 21 8

Scale House

9

Nearest Fire Hydrant

City of West Legend Figures in Report Approximate Distance from Seat of Blast to Fenceline (Feet)

West Fertilizer Company 2-8, 12 0

West High School 30 1157

West Intermediate School 23-29 552

Basketball Court 20 249

Playground 19 366

West Terrace Apartment Complex 36 454

West Rest Haven Nursing Home 33-35 629

Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps) 2.1.1 Facility Operations Description The West, Texas, site consisted of two companies owned by the same family. Adair Grain, Inc., bought and sold grain while the WFC sold fertilizer, farming chemicals (pesticides and herbicides), and basic farm equipment (such as barbed wire, baling twine, and fencing). The WFC also rented farming equipment (fertilizer spreading equipment, tillage equipment) and spread fertilizer on farmland when needed, and its daily activities were largely based on season and weather.

West Fertilizer Company Final Report January 2016 19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Adair Grain bought grain (milo10 and corn) from farmers and stored it in four onsite silos (shown in Figure 1 and Figure 2). Adair Grain received grain from farmers’ trucks and deposited it into pits (Figure 3). An auger then transferred the grain from these pits, depositing it into the grain bin.

Figure 2. Grain Silos (Source: WFC Insurer)

10 Milo, also called grain sorghum, is a major feed grain for cattle.

West Fertilizer Company Final Report January 2016 20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Fertilizer Loading Pit and Conveyor Belt Railcar of Fertilizer

Figure 3. West View of Fertilizer Building (Source: Bing Maps) The WFC operated two buildings and a number of tanks (shown in Figures 1 and 3). One building served as a chemical warehouse, shop area, and office space. Most chemicals purchased by farmers were stored in that building. Such chemicals included Roundup®, Sevin®, and additives to make pesticides adhere to plants (such as Weedmaster® and Grazonnext®) and were stored in containers ranging in size from 2 to 300 gallons. The WFC also owned the fertilizer building, constructed in the 1960s, where dry fertilizer was stored (Figure 4). Fertilizers stored in that building included diammonium phosphate, ammonium sulfate, potash (potassium chloride), potassium magnesium sulfate (K-Mag), and FGAN. A seed room was located at the north end of this building (Figure 5).

West Fertilizer Company Final Report January 2016 21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 4. Fertilizer Building Overview (Source: Atlas Engineering) Bagged Fertilizer Abandoned Bin Primary Ammonium Nitrate Bin Palletized Zinc Golf Cart Front End Loader Hay Seed Hay Seed Hay Seed Old Seed Storage Top of Elevator Twine

Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer) The WFC facility had two 12,000-gallon anhydrous ammonia11 (NH3) storage vessels, located to the south of the fertilizer building, for distribution and sale of the product to farmers (Figure 6). The

11 Anhydrous ammonia is a colorless and extremely water-soluble gas at room temperature, with a strong irritating odor. Ammonia gas is lighter than air, but under certain conditions, ammonia vapor can settle close to the ground during a leak, forming a white cloud. Ammonia can be compressed into a liquid under pressure, and within a concentration in air range of 15 to 28 percent, it is flammable. This is known as the lower explosive limit (LEL) and upper explosive limit (UEL), respectively. Ammonia exposure at lower concentrations can irritate the skin, eyes, and respiratory system, and at high concentrations, exposure can result in pulmonary edema and death.

West Fertilizer Company Final Report January 2016 22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD anhydrous ammonia was primarily trucked into the facility, but delivery by rail was also possible. Although anhydrous ammonia is used in the manufacture of AN, the WFC stored it onsite solely for sale to consumers as liquid fertilizer. Adjacent to the anhydrous ammonia tanks, liquid fertilizer was stored outside in several vertical tanks. This type of fertilizer included a urea ammonium nitrate (UAN) solution or liquid phosphate, and could be blended to meet specific farmer needs. One outside tank was normally full of water to mix with chemicals or liquid fertilizer. No products were manufactured onsite; the WFC was essentially a distribution center for suppliers such as Mosaic, BASF, Agri-Phos, El Dorado Chemical Company (EDC), and CF Industries. EDC and CF Industries are the only manufacturers of FGAN in the United States. The WFC mixed and sold bulk fertilizer components or unaltered products such as pure FGAN and ammonium sulfate. Farmers came to the WFC and bought fertilizer that was weighed in a hopper, blended in a mixer, and distributed by conveyor belt (the mixer and conveyor belt can be seen in Figure 7). The WFC also delivered and applied fertilizer or chemicals to a farmer’s fields if needed. Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer)

West Fertilizer Company Final Report January 2016 23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer) 2.1.2 Facility Layout and Materials of Construction The fertilizer building (Figure 4) was a wood-framed structure with a concrete floor, at an elevation about 3 feet above grade. The building was constructed piecemeal over the years, starting with the original construction in 1961. The seed room was fabricated in the early 1980s, with a roof constructed of wooden rafters topped with plywood and covered with asphalt shingles. The only trench or drain in the building was in the cattle trough, which was used to collect fertilizer slurry when it became moist. A series of ladders were positioned adjacent to the elevator. FGAN was stored in two plywood bins along the west wall of the building and in one primary FGAN bin at the north end of building. The primary FGAN bin was normally no more than half full while the fertilizer bins on the west wall could be filled to the top of the containment. In the northeast corner of the building, an abandoned bin had been used to store fertilizer in the past but was unused at the time of the incident. The primary FGAN bin was constructed differently than the bins on the west wall. The bins on the west wall were composed of three walls rising to a height of about 10 feet and an open front. The primary bin was constructed by attaching plywood sheets to the inside of the exterior beams of the structure. The interior walls were also constructed of 6-inch beams with plywood attached. The main bin was estimated to be 8 feet wide, 20 feet long, and 30 feet high. A large hinged door covered the south end of the bin, with a 3-foot opening at the bottom. Holes were cut in the bin to provide air circulation, and a set of holes on the west wall allowed the bin to overflow into a smaller adjacent bin.

West Fertilizer Company Final Report January 2016 24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The door to the bin was normally closed when the bin was filled, and it could be opened to provide access after the inventory was reduced so that the fertilizer was not resting against the door. The bin was just wide enough (8 to 10 feet) to allow a front-end loader to drive in to access and gather the remaining FGAN. Like the west bins, the primary FGAN bin had plywood sheets (including some particle boards) and a wooden frame for support (shown post-explosion in Figure 8). The primary bin also had metal rods connected at opposite sides of the bin, providing internal stiffening support. About 2 years before the WFC explosion, the northeast corner of the north wall of the primary FGAN bin failed, and employees erected steel and concrete reinforcement around the bottom of the northeast corner to provide support and hold up the bin. As a result, the WFC never completely filled the primary bin to avoid another failure. A seed room,12 fabricated in 1980 and located at the north end of the fertilizer building served as the warehouse for seeds sold to consumers. Asphalt shingles covered the roof of the seed room of the fertilizer building. The seed room also stored more than 700 bags of zinc sulfate on the day of the fire and explosion. The zinc sulfate and seeds were stored in bags on pallets, with about 40 to 50 bags per pallet, stacked to a height of about 3 to 4 feet on each pallet. The seed room also contained two pallets of lawn and garden fertilizer (bagged at the WFC), twine, bailing wire, and fencing materials. At the west end of the seed room, 8 to 10 pallets of out-of-season seeds were segregated in an area cooled by an air

12 The seed room was used for storage of seed, bagged fertilizer, equipment, and vehicles, including a riding lawnmower, a golf cart, and a fork lift. It was constructed as an addition to the main fertilizer building in the early 1980s. . Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB)

West Fertilizer Company Final Report January 2016 25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

conditioner. The east end of the seed room stored twine and netting. At the time of the incident, the room held a relatively low inventory of seeds (approximately 30 percent of the room’s capacity, or 3,000 bags of out-of-season seeds). 2.1.3 Unloading of Fertilizer Historically, suppliers delivered bulk fertilizer product by truck or rail, but immediately before the incident, most shipments arrived by truck. All bulk fertilizer was transferred into the bins (located as shown in Figure 4), using the same conveyor belt system described in the previous section. Delivered fertilizer was first deposited into a loading pit. An uncovered 20-inch-wide rubber conveyor belt then transported the product into the fertilizer building. The belt was cupped to hold the fertilizer, which was transferred from this conveyor belt to a bucket elevator (pictured post-explosion in Figure 9).

Figure 9. Elevator System Recovered from Blast Debris (Source: CSB) The elevator lifted the fertilizer to the cupola (the highest structure) and deposited it into polyvinyl chloride (PVC) pipes, which in turn conveyed the fertilizer to either the main FGAN bin or a horizontal conveyor belt for distribution to the bins along the west wall. A valve was used to gravity-feed material to either the large FGAN bin by way of PVC piping (approximately 20 feet long by 1 foot in diameter) or through an approximately 40-foot downpipe toward the horizontal conveyor belt in the main portion of the building. A piece of PVC piping could be added to the downpipe to direct product from the horizontal conveyor belt and to direct FGAN to the two FGAN overload bins on the west wall. The horizontal conveyor belt transported product to the bins in the southern portions of the building. A 6- to 8-foot “kicker” conveyor belt transferred the fertilizer from the horizontal conveyor belt to its final destination in any of the west wall bins. Electric motors powered the conveyor belts. Every fertilizer product used the same conveyor system process for filling the respective bins.

West Fertilizer Company Final Report January 2016 26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Workers used a front-end loader to move the fertilizer within the fertilizer building. For a blended fertilizer product, the operator would place a load of each product in a predetermined quantity into the weigh hopper. After all of the ingredients were weighed, the product was sent via a conveyor belt to a mixer, which had the appearance of a stationary concrete mixer. The mixed product was deposited on a conveyor belt and loaded into a truck or spreader. A yellow auger next to the conveyor mixed seed with fertilizer. Zinc sulfate could also be added to fertilizer. 2.1.4 Housekeeping Because unloading operations in the fertilizer building created a dusty environment, the first task of the day in the fertilizer building was cleaning the floor after work during the previous day and evening. To address these conditions during operating hours, the WFC used fans to control the dust during unloading, and on some occasions, workers added a vegetable oil coating to the ammonium phosphate to reduce the dust.13 An employee reported to CSB that some products were dustier than others and that floor sweeping compound was also applied to the fertilizer building floor on very wet days. When mixing fertilizer, operators usually added phosphate to the hopper and mixer first to eliminate any moisture. The employees reported that because FGAN tends to absorb moisture and dissolve, the WFC used air conditioning to cool and remove moisture from the primary FGAN bin. After the FGAN bin was emptied, it was swept to remove moisture. On damp or humid days, operators minimized handling FGAN unless necessary because it would “melt” and become lost product. When the fertilizer became damp and began to “sweat” onto the floor, it was swept into a trench (cattle trough) on the east side of the fertilizer building. The liquid captured as slurry in the trough was then pumped into a liquid fertilizer tank for disposal. Employees reported that the plywood walls between the bins “stayed pretty clean” and did not require any housekeeping. After a shipment of one type of fertilizer was unloaded, no cleaning process was used to clear the conveyor belt before the next load was transferred. During the unloading process, the fertilizer occasionally spilled because the conveyor belts got off track or ripped. In such cases, operators attempted to separate the products as best they could, but intermixing and cross-contamination nonetheless would occur. The fertilizer in the west bins was occasionally changed out, and if the product became damp and moist, it might have been emptied out with a “drier” product such as K-Mag placed into that bin. The K- Mag would dry out the bin, and afterward, the bin could revert to storage space for another product. Occasionally, the bin walls developed holes or cracks, and when that occurred, either new wood walls were put in place to replace the old ones or caulk was used to fill the holes.

13 Ammonium phosphate was the only product at the WFC with an oil coating.

West Fertilizer Company Final Report January 2016 27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Incident Description

On April 17, 2013, at approximately 7:29 pm, citizens reported signs of smoke and fire at the West Fertilizer Company (WFC) facility to the local 911 dispatch center. Within 20 minutes, a massive explosion occurred, killing 15 people and sending a blast wave through the town that damaged or destroyed many buildings and homes. The fire was witnessed from several vantage points by different individuals associated with the West Police Department, Dallas Fire-Rescue Department, and volunteer fire departments (VFDs) from West, Abbott, Bruceville-Eddy, Mertens, and Navarro Mills. These accounts assisted CSB in determining how the events of the day transpired. 3.1 West Police Department One of the first responders to the incident was a West Police Department officer who was on routine patrol that evening. The officer reported that he smelled smoke as he was driving through the city park14 but was not able to identify the exact location of the smoke until he encountered a concerned citizen who advised him that smoke was venting from the highest portion of the WFC building. The officer advised the dispatch center of the smoke and requested that the West Volunteer Fire Department (WVFD) be dispatched to the WFC facility. Once the officer arrived on scene, he witnessed flames that were visible through the wall, extending upward from the lower level to the upper level of the northeast corner of the two-story fertilizer storage building. Then he called dispatchers again and asked them to inform the WVFD that the smoke had escalated to a structure fire. The WVFD contacted the officer via radio and requested that he establish traffic control to prevent citizens from driving over the fire hoses once the fire engines arrived and laid down fire hoses. The officer agreed but notified the WVFD that he needed to evacuate the city park first. As the officer proceeded to the city park, the responding West firefighters drove past him, heading toward the facility. Once the officer reached the city park, he used his public address system to order an evacuation of the park. After the park was evacuated, he left the area to establish traffic control on the north end of the fertilizer facility. There was no traffic control at the south end toward West High School (WHS), so the officer asked a nearby resident to assist by using his truck to block that intersection. At this time, the officer contacted the police chief and another officer who had called to determine whether he needed assistance. The officer asked the police chief to establish traffic control by the West Intermediate School (WIS) and requested that the other officer relieve the resident who was helping near the high school. Numerous citizens began parking their cars at WHS to watch the fire. The WVFD truck left the WFC facility and headed toward the police officer. The manager of the WFC arrived on scene to assist the WVFD. Via radio traffic, the officer learned that the entire fertilizer storage building was engulfed in flames, and shortly thereafter he saw and felt the explosion. The officer was briefly disoriented and then unsuccessfully attempted via radio and cell phone to notify the dispatch center of the explosion. An

14 The city park consisted of the basketball court and the playground.

West Fertilizer Company Final Report January 2016 28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injured member of the public and an injured firefighter approached the officer, who assisted them. The possibility of further explosions or toxic releases was a concern because of the anhydrous ammonia pressure vessels on the south side of the WFC property. On the basis of this information, the officer decided to evacuate homes within a 1-mile radius. Because the officer’s patrol car would not start, he proceeded on foot along Jerry Mashek Drive and Main Street to alert people to evacuate (refer to Figure 1 for a map of the area). By the time the officer made his way to Reagan Street, he had become aware that other emergency responders had initiated the evacuation of the northern portion of the city. 3.2 West Volunteer Fire Department (WVFD) Emergency dispatchers paged the WVFD, and firefighters responded to the scene with two fire engines, two initial attack apparatus or brush trucks,15 and a water tender truck16 at various times. Dispatchers also paged mutual aid personnel from neighboring counties, including Abbott, which responded. Many of the firefighters also responded by using their personally owned vehicles (POVs). According to eyewitness accounts, the fire intensified very quickly and was described as a rolling fire that moved from the northeast end of the fertilizer building (in the seed storage area north of the office) toward the southern end of the building. Five firefighters arrived on scene in two fire engines at different times. The first fire engine arrived on scene and staged east of the burning structure while one of the brush trucks staged to the north of the first fire engine. Four other firefighters directed water (using two 1.5-inch hoses) from the first fire engine’s internal tank onto the fire through the northeast doorway of the bagged fertilizer room, where fire was present. Once the second fire engine arrived on scene, the two firefighters from that fire engine began laying 1,000 feet of 4-inch hose line from the fire hydrant near the high school (1,600 feet away) toward the fertilizer facility. After laying all of the hose lines from the second fire engine, they discovered that the hose was approximately 700 feet short of the length needed to effectively fight the fire. After assessing the situation, one firefighter arranged to take the first fire engine, which had a better pump with greater pressure capabilities and additional hose that would allow him to continue to reverse-lay the lines.17 However, rather than resuming where the first fire engine ran out of hose, the firefighter went back to the fire hydrant near the high school to connect the first engine to the hydrant without laying the additional length of hose needed to supplement the hose that had already been laid from the second

15 Initial attack fire apparatus as defined in NFPA 1901 is fire apparatus with a permanently mounted fire pump of at least 250 gallons per minute (gpm) capacity, water tank, and hose body whose primary purpose is to initiate a fire suppression attack on structural, vehicular, or vegetation fires and to support associated fire department operations. Normally, most initial attack fire apparatus are constructed on commercial-style chassis. NFPA 190:1 Standard for Automotive Fire Apparatus, 2016 Edition. Quincy, MA: NFPA, 2016. 16 A water tender is the National Incident Management Systems (NIMS) approved term for a wheeled vehicle carrying water for fire suppression. 17 In firefighting, reverse lay refers to the nozzle end of the hose being laid from the fire to a water source. This method is used when the pumper must first go to the fire location to size it up before laying supply line, and it is the most expedient way to lay hose if the apparatus must stay close to the water source.

West Fertilizer Company Final Report January 2016 29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

engine. He saw flames (40 to 50 feet high) coming out of the cupola atop the fertilizer storage building and out of the door on the northeast corner of the building. Before the firefighter could make his way back to the end of the hose run, the explosion occurred. Before the explosion, the WVFD assistant chief arrived at the WFC facility, spoke with the police officer on scene, and advised him to begin evacuating nearby homes. He also made a radio request to the dispatch center, asking for a ladder truck to set up at the West Terrace Apartments in case a fire started there, but a ladder truck was not available. The WVFD chief and assistant fire chief were assessing the situation just before the explosion and were considering a total evacuation, even though neither believed that the FGAN would explode.18 On the basis of interviews that CSB conducted after the incident, the WVFD came to understand that it did not have enough water to effectively fight the fire.19 Accordingly, the WVFD was considering the appropriate course of action—possibly standing down, letting the structure burn, and focusing on evacuation. 3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer Fire Departments On the evening of the incident, a group of volunteer firefighters from neighboring city fire departments (including Bruceville-Eddy, Mertens, and Navarro Mills), who were taking an Emergency Medical Technician (EMT)–Basic class at the West Emergency Medical Services (EMS) building, responded to the fire. The West EMS facility is located a few blocks west of the WFC facility.20 When these volunteer firefighters heard the sirens activated in the city, they immediately made their way to the site. In addition, an ambulance responded with two EMTs and a volunteer firefighter. According to interviews that CSB conducted with emergency responders, radio and cell phone capabilities at the scene were limited after the explosion. Following the explosion, officials established two different staging areas. The first staging area, at the high school football field about 0.25 miles from the blast site, was used as a triage area for injured residents. Injured personnel and residents were relocated from the football field to the second staging area, at the community center about 1 mile away.21 After the explosion at approximately 8:15 pm, additional volunteer firefighters from the neighboring cities of Abbott, Bruceville-Eddy, Mertens, and Navarro Mills responded to the WFC facility. Figure 10 shows the WFC explosion as it unfolded.

18 Section 7 of this report provides further details on how the evacuation occurred. 19 Employees and emergency responders should not fight AN fires past the incipient stage. Further details on responding to AN fires is available in Section 7.5 and Section 7.6 of this report. 20 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 21 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West Fertilizer Plant Explosion,” October 8, 2013.

West Fertilizer Company Final Report January 2016 30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public) 3.4 Consequences 3.4.1 Fatalities and Injuries The violent explosion at the WFC facility fatally injured 12 emergency responders and 3 members of the public. All of the fatalities except one resulted from fractures, blunt force trauma, or blast force injuries sustained at the time of the explosion. Two fatally injured members of the public lived at a nearby apartment complex while the third resided at the nursing home and died from injuries brought on by the trauma of the explosion shortly after the incident. According to the Waco-McLennan County Public Health District’s report, 22 the incident resulted in more than 260 injured victims, including emergency responders and members of the public.23 Hill County (Hill Regional Hospital and Lake Whitney Medical Center) and McLennan County (Hillcrest Baptist Medical Center and Providence Health Center) hospitals received 81 percent of patient visits, with 104 injury visits at Hillcrest Baptist Medical Center, 82 visits at Providence Health Center, 41 injury visits to Hill Regional Hospital, and 1 injury visit at Lake Whitney Medical Center.24 The injuries ranged from relatively minor wounds (such as contusions, abrasions, and lacerations) to more serious injuries (such as fractures, closed head injuries, traumatic brain injuries, and skin burns). The majority of patients were treated and released after their initial visit to a hospital, medical center, or mobile medical unit. Figure 11 categorizes all injury types sustained by the 252 patients injured directly by the explosion; many patients received multiple types of injuries. The Waco- McLennan County Public Health report also identified the location where 76 percent of the reported 252

22 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014. 23 The number of injured victims includes patients who were treated after the explosion and sustained injuries during clean-up or by debris in the neighborhood. 24 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014: 7.

West Fertilizer Company Final Report January 2016 31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injuries occurred, outside or inside of a structure. More than half of the injured patients reported being inside a structure (55 percent), and the rest said they were outside (13 percent) or inside of a vehicle (8 percent). The locations cited by the injured also reflected the most common types of injuries. Patients who were inside a structure were twice as likely to suffer abrasions, contusions, and lacerations. People who were outside or inside of a vehicle were eight times more likely to have hearing loss or tinnitus, tympanic membrane rupture, or inhalation injuries. The majority of the injured were within 1,500 feet of the blast, although some were more than 2,000 feet from the explosion; people who were hospitalized were closer to the center of the blast than those who were not admitted. Notably, eye injuries—and traumatic brain injuries and concussions—were equally distributed among the injured, regardless of location.25 Detailed information regarding the cause of nonfatal injuries was not collected and analyzed. Possible causes of injuries include being struck by primary fragment projectiles, by secondary fragments from remote structures and vehicles, or directly by the blast wave.

Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health District)26 During the investigation, CSB noted two potential scenarios that could have led to more severe consequences. First, if the fire had started during the middle of a normal school day instead of the

25 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014. 26 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014). 141 134 53 34 31 30 29 21 12 12 6 0 20 40 60 80 100 120 140 160 Abrasions/contusions Lacerations/penetrating trauma Traumatic brain injuries/concussions Tinnitus/hearing problems Eye injuries Inhalation injuries Sprains/strains Fractures/dislocations Blast injuries Tympanic membrane ruptures Burns Number of Injuries

West Fertilizer Company Final Report January 2016 32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

evening and if all other conditions remained unchanged (specifically, if onsite WFC employees were unable to extinguish the fire), students would have been present at the intermediate and high schools. Had the schools evacuated, students likely would have assembled in areas such as the gymnasium and multipurpose rooms within the schools (and in other pre-designated areas outside of the schools) before the evacuation to conduct a head count. Given the short time that elapsed before the explosion, many students and staff members might have been injured in the 20 minutes from the first discovery of a fire until the explosion. Second, a railcar loaded with more than 100 tons of FGAN toppled during the explosion but did not detonate. If the contents of the railcar had detonated, the damage, injuries, and fatalities would have been significantly worse. These scenarios are important to consider because throughout the United States, there are many facilities that, like WFC, are located near public structures such as schools.27 3.4.2 Property Damage The West incident caused considerable property damage, including the complete destruction of the WFC facility (Figure 12). An initial estimate by the Texas Department of Insurance set total property damage resulting from the explosion and fire at $100 million. CSB hired a consulting firm28 to perform an assessment of the structural and property damage caused by the fire and explosion. The assessment involved a thorough examination of damage to the WFC facility and to the community structures and facilities.29 As of the publication of this report, neither the owners of the WFC nor the city of West has decided whether the WFC facility would be rebuilt. Currently, the local farmers are using fertilizer from another fertilizer facility in Leroy, Texas, seven miles east of the city of West.

27 Section 5.4 provides further details on the location of schools in relation to FGAN facilities throughout Texas. 28 ABSG Consulting Inc. See: http://www.absconsulting.com/ (accessed on June 26, 2015). 29 Sites examined included the West Intermediate School (WIS), West High School (WHS), West Middle School (WMS), West Rest Haven nursing home, and the park.

West Fertilizer Company Final Report January 2016 33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol) The explosion, overpressure, and debris completely destroyed a WVFD brush truck, water tender, and fire engine (Figure 13). The water tender was located southeast of the crater and likely moved about 6 inches south as a result of the blast overpressure. The explosion propelled the door from the water tender to the east. A large farm truck south of the fertilizer storage building and toward the scale house moved about 6 inches south of its original location because of the blast wave (Figure 14). All of the POVs belonging to responding volunteer firefighters who parked onsite were damaged or destroyed in the explosion. In addition, the explosion overturned and destroyed the railroad car loaded with FGAN, approximately 190 feet to the north of the crater (Figure 15).

Overturned FGAN Railcar Vertical Liquid Fertilizer Tanks Fire Department Water Tender EMS Vehicle Damaged Railroad Anhydrous Ammonia Pressure Vessels Overturned FGAN Railcar Vertical Liquid Fertilizer Tanks Fire Department Water Tender EMS Vehicle Anhydrous Ammonia Pressure Vessels

West Fertilizer Company Final Report January 2016 34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting)

Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB) The explosion completely demolished the scale house; the roof and all four walls failed. The explosion flattened the chemical storage and office building east of the fertilizer storage building—all that remained was a stack of metal debris where the building once stood. The explosion also destroyed the corn silo north of the fertilizer storage building. In addition, the blast heavily damaged the above-ground vertical liquid fertilizer storage tanks. As shown in Figure 16, the liquid level during the explosion in the tank to the left is clearly visible by the crease at the top of the tank where the deformation begins. The tank on the right in Figure 16 clearly shows a large debris impact that folded and crushed the tank.

Figure 16. Liquid Fertilizer Tank Damage (Source: CSB)

West Fertilizer Company Final Report January 2016 36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The two 12,000-gallon anhydrous ammonia pressure vessels were approximately 30 percent full of ammonia at the time of the explosion. As shown in Figure 17, the anhydrous ammonia pressure vessels were south of the crater. The pressure relief valves (PRVs) on the northern anhydrous ammonia pressure vessel still had their weather caps on and consequently did not relieve the pressure. The weather caps were missing on the PRVs in the middle of the southern anhydrous ammonia pressure vessel.30 Two additional liquid fertilizer storage tanks sat parallel to the railroad track southwest of the anhydrous ammonia pressure vessels. The blast of the explosion also damaged the tracks on the railroad between the WFC property and the park. The blast was sufficiently powerful to shift the tracks more than 2 feet to one side, creating a prominent curve in the tracks (Figure 18).

Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB)

30 The condition of the anhydrous ammonia pressure vessels is discussed in further detail in Section 3.4.2.1 of this report.

West Fertilizer Company Final Report January 2016 37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB) The explosion damaged a playground and basketball court in a park located a few hundred feet west of the WFC facility (Figure 19). The blast destroyed equipment on the playground, including damaging the basketball goal posts on the basketball court (Figure 20). In addition, the trees in the vicinity of the park showed evidence of scorching,31 likely from the fireball when the explosion occurred. The trees were directly downwind of the anhydrous ammonia pressure vessels and were not within the smoke plume from the fire. Pre-explosion video of the fire shows the smoke traveling with the wind but crossing the playground equipment to the north of the basketball courts.

Figure 19. Damaged Playground Equipment (Source: ABS Consulting)

31 The ABS damage assessment did not include making a determination about whether the trees were scorched by the fire or by another source.

West Fertilizer Company Final Report January 2016 38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting) 3.4.2.1 WFC Anhydrous Ammonia Vessels The two 12,000-gallon anhydrous ammonia vessels were located at the south end of the storage building, about 150 feet from the site where the initial fire and smoke were observed. Each vessel was more than 46 feet long, with two affixed PRVs set to vent the tanks to the atmosphere if the pressure inside the tanks exceeded predetermined set points, estimated by one employee as between 250 and 300 pounds per square inch (psi). Both sets of PRVs were fitted with orange plastic caps intended to protect the devices from rain and dirt. The vessels shared a common pipeline that allowed switching between the tanks on occasion, but under normal operation, the connecting pipe was kept in a closed position. CSB observed the intact PRVs on top of the vessels (Figure 21) on May 28, 2013, although the polyvinyl chloride (PVC) protective caps were no longer in place on the PRVs of the southernmost tank. The absence of detectable residue of this protective material on the PRV suggested that it was exposed to fire to the degree that it melted. The caps were not found during any post-incident salvage or recovery activities. During salvage operations, a crane with lift bucket reportedly struck the PRV for the northernmost tank, knocking it to the ground where it was found.

West Fertilizer Company Final Report January 2016 39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB) From interviews with employees who were knowledgeable about the frequency of deliveries and volumes in the tanks, CSB learned that the site received as many as four deliveries of anhydrous ammonia per day under normal operating conditions with good weather and that each vessel was at 30 percent capacity, or about 7,200 gallons, at the time of the fire and explosion. After the incident, technicians removed all remaining contents in both vessels. When hazardous materials technicians in fully encapsulated personal protection equipment initially entered the area of the anhydrous ammonia vessels after the site was secured, they observed a leaking valve at the east end of the tanks. In light of a buildup of ice around the valve, it is thought that the material leaking was liquid anhydrous ammonia. Notably, anhydrous ammonia stored under pressure contains latent heat. As the liquid is released, it cools rapidly and interacts with moisture in the atmosphere and can freeze on the pipe and adjacent vessel. However, the vessels did not catastrophically fail on the night of the incident. The CSB considers this to be a near-miss of potentially significant consequence. 3.4.3 West Independent School District The WFC built its facility in 1962, before much of the surrounding community developed. In 1923, the West Independent School District (WISD) (Figure 22) built the West Middle School (WMS), which at the time served as the high school for the city of West. The WMS campus added a building in 1957 that served as supplementary classrooms and library space. The WISD also built West Elementary School (WES) in the early 1960s. WIS was built around 1985, and WHS was constructed in 2000, after the WFC facility was built. Four schools were in close proximity to the facility, including WIS (552 feet southwest

West Fertilizer Company Final Report January 2016 40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the facility), WHS (1,263 feet southeast of the facility), WMS (2,000 feet southwest of the facility), and WES (4,867 feet southwest of the facility).32

Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth)

32 The growth of the community around the WFC facility is discussed in further detail in Section 9 of this report. West Fertilizer Company West High School Playground West Rest Haven West Intermediate School West Middle School West Terrace Apartments West Elementary School

West Fertilizer Company Final Report January 2016 41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The overpressure from the explosion’s blast wave caused most of the damage, although some fires started post-explosion, including those at WIS and many nearby homes. At the time of the incident, school was not in session, which limited the number of fatalities and injuries to members of the public (including students, teachers, and other staff members). However, if the explosion had occurred during normal school hours, the number of injuries and fatalities from the blast wave could have been much higher. Table 2 indicates the projected number of students and staff members who would have been affected and could potentially have been injured or killed by the blast if school had been in session. If all enrolled students had been in school that day, approximately 1,486 students would have been present and vulnerable. Of this total, 665 students would have been at WIS and WHS, which suffered the most severe damage. If the explosion had occurred during school hours and all staff members had been present that day, approximately 191 staff members would have been vulnerable. Of this total, 86 staff members would have been at WIS and WHS. Because of the breadth of damage at the schools, the WISD decided to demolish WIS, WHS, and all WMS facilities except for the gymnasium and the 1923 building. The WISD also demolished select portions of the 1967 annex and the entire cafeteria at WMS. Appendix A includes a discussion of the details of WISD plans to restore and rebuild the school system. For a more complete understanding of the magnitude of the injuries and fatalities that the WFC incident could have caused, this report considers in greater detail the extent of damage at the schools. Table 2. Estimated Number of Students and Staff During School Hours School Grades Estimated Number of Students Enrolled Estimated Number of Staff Members West Intermediate School 4-5 246 22 West Middle School 6 320 40 West High School 7-12 419 64 West Elementary School K-3 501 45 Total Occupants

1,486 171

West Fertilizer Company Final Report January 2016 42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.3.1 Damage Assessment of the West Intermediate School

The original WIS was a pre-engineered metal building consisting of lightweight steel frames, cold-formed girts,33 and purlins34 supporting lightweight metal decks. The gymnasium and cafeteria were also pre- engineered metal buildings. The remainder of the school was constructed of precast concrete tilt-up load- bearing walls that supported open webbed steel joists and a metal roof deck with a built-up roof. Figure 23 shows the building room layout in the school evacuation plan and highlights in yellow some classrooms with extensive damage. A considerable amount of debris accumulated in the hallway outside of rooms 11 and 12 (Figure 24). An interior doorframe blocked the hallway; the acoustic ceiling had collapsed; and numerous obstacles would have made exiting the building difficult for students and staff. In addition, the original metal school building just south of this location was involved in a fire after the explosion at the WFC facility, so students and staff members also would have been exposed to smoke and heat. The acoustic ceiling, light fixtures, and other debris were thrown onto all of the desks in the interior of classroom 12 (Figure 25). Moreover, the window on the north facade failed violently, and a large shard of glass (approximately 3 inches long) was embedded in the assignment poster on the south wall of the classroom (Figure 26). Room 8 Room 7 Room 6 Room 5 Room 9 5th Grade Lab Room 10 Girls RR Book Room Boys RR Lounge Workroom Storage Ja Nurse Asst Princ Room 12 Room 11 PRR Room 13 4th Grade Lab Library Room 4 Room 3 Room 2 Tech Room 1 Tech Room 18 Room 17 Room 16 Room 15 Comp Labs Room 19 Cafeteria Gym Gym RRs Room 21 Room 22 Room 23 Room 20 RRs Princ Office Area West Intermediate School Evacuation Route N REAGAN ST.

Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB)

33 A horizontal structural member that spans columns or posts in framed construction and is used to support cladding. Dictionary of Construction, Surveying and Civil Engineering (2012). 34 A horizontal roof member that runs parallel to the ridge and spans the roof trusses and is used to support the roof covering. Dictionary of Construction, Surveying and Civil Engineering (2012).

West Fertilizer Company Final Report January 2016 43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting)

Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 26. Embedded Glass in Assignment Poster in WIS Room 12 (Source: ABS Consulting) The pre-engineered portion of the school in the northeast corner was heavily damaged by blast overpressure and was also fully engulfed in flames. At the time of the physical survey, blast damage to this portion of the building could not be evaluated because of the magnitude of the fire and associated heat; however, Figure 27 does provide a view looking east down the hallway of this part of the school after the fire.

Figure 27. Interior of Burned Northeast Section of WIS (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The WFC explosion heavily damaged the WIS gymnasium (Figure 28). There was evidence that some of the built-up roof over the gymnasium burned; however, the level of heat damage to the roof was minor compared to the damage from blast overpressure. The north half of the gymnasium roof failed. Within the gymnasium, the blast heavily damaged the pre-engineered frames, which were unstable as a result. The roof purlins were moderately deformed, with the exception of the failure that occurred on the north half of the frame spans. Furthermore, the windows from the south facade of the gymnasium failed, and the overpressure propelled them over the south bleachers and onto the gym floor. The explosion also heavily damaged the roof in the cafeteria to the south of the gymnasium.

Figure 28. WIS Gymnasium (Source: ABS Consulting) The interior of classroom 20 also sustained significant damage (Figure 29). The acoustic ceiling, light fixtures, and insulation were blown down onto the floor by a combination of the roof motion and the air blast entering through the heating, ventilation, and air conditioning (HVAC) duct after the explosion displaced the rooftop air conditioner. After the incident, the entire contents of the ceiling plenum were found on top of the desks. If the explosion had occurred during school hours, any students or staff members in the room would have been covered in this debris and would have had to climb over (or through) it to reach the exit. In addition, there was evidence that overpressure entered the room through the HVAC opening and was of sufficient magnitude to cause the door latch to fail. The damage to WIS decreased as the distance from the explosion source increased from the northeast to the southwest. WIS also housed the technical department where all of the school servers were kept. The servers and the data stored on them were lost in the explosion and fire.

West Fertilizer Company Final Report January 2016 46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 29. WIS Classroom 20 (Source: ABS Consulting) 3.4.3.2 Damage Assessment of West High School WHS was constructed of concrete masonry unit walls supporting open webbed steel joists and a metal deck with built-up roofing and gravel ballast.35 The building room layout (on the basis of the school evacuation plan) shows that the school was organized into two wings (Figure 31). The north wing contained the activities area, including the two gymnasiums, two weight rooms, boy’s athletics locker room, girl’s athletics locker room, and band hall. The south wing included the classrooms as well as a large lecture hall. Between the two wings were the entry hall, administrative offices, common areas, kitchen, and (to the rear) auditorium. A pre-engineered maintenance building sat directly behind the school to the east.

35 Small gravel placed on a built-up roof to protect the roof from ultraviolet light, heat, and weather and to protect the roof membrane from degradation.

West Fertilizer Company Final Report January 2016 47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

N

Figure 30. WHS Evacuation Map (Source: WISD) The WHS auditorium was a steel frame structure with masonry infill walls. After the WFC explosion, some of the masonry veneer on the exterior was loose near the northeast corner. Inside the auditorium, large areas of the hanging ceiling were unstable, and the supporting structure was compromised, especially one area of the ceiling (between the seating and the stage), which was near collapse because of the failed hanger connections. Viewed from underneath, evidence of damage to the ceiling was observable at light fixtures, and evidence of cracking and separation was visible near the walls. However, the severity of the damage and compromise to the ceiling hangers became fully evident when they were inspected from the catwalks above the auditorium. 3.4.3.3 Damage Assessment of West Middle School WMS was the school third farthest from the WFC site, and although it sustained less damage than WIS and WHS, it was nonetheless severely damaged in the explosion. WMS resided at the site of the original WHS, constructed in 1923. The athletic field east of WMS was the site employed for triage and evacuation of the wounded after the explosion (Figure 31).

West Fertilizer Company Final Report January 2016 48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps) The practice gymnasium was a lightweight pre-engineered metal building with a brick facade. The pre- engineered frames buckled after the explosion, resulting in a small permanent deformation of the roof purlins. In addition, the overpressure damaged the roof purlins and frames. An external assessment of the cafeteria and auditorium indicated damage to the ceiling components. Many of the windows on the west facade were unbroken. The original high school classroom building at WMS was constructed in

1. The windows facing north toward the WFC facility were broken, but only some of the remaining

windows had failed. The building originally was not air conditioned and had a high tin ceiling, but at a later date, a new drop ceiling was installed to accommodate central air conditioning. After the explosion, the new drop ceiling failed, but the original tin ceiling was still in place, and some of the windows were broken. Window hazards thus were low to moderate, and the damage to the exterior appeared to be superficial. The classroom annex building roof structures were open web steel joists supporting a built-up roof on metal deck. The roof structure showed no observable damage; however, the suspended ceiling failed because of the motion of the roof (Figure 32).

West Fertilizer Company Final Report January 2016 49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.3.4 Damage Assessment of West Elementary School

WES was the campus farthest from the WFC site and sustained very minimal damage. WES received minor renovations, such as removing and replacing damaged ceilings, replacing damaged windows, and performing general interior clean-up.36 3.4.4 West Rest Haven Nursing Home The explosion also destroyed the West Rest Haven nursing home, located west and within 600 feet of the WFC facility, at the corner of North Reagan Street and West Haven Street (Figure 33). Since 1967, the nursing home had provided residents with routine care and also treated patients with Alzheimer’s disease, diabetes, and hypertension, among many medical conditions. Approximately 20 of the 155 staff members and 130 patients37 were in the nursing home during the explosion. All were evacuated with the assistance of the nursing home staff and neighborhood volunteers, yet 72 patients sustained injuries. The level of severity of the injuries varied from cuts caused by broken glass and building materials to broken bones. An 87-year-old man succumbed to a stress-related heart attack; however, his death was not a direct result of the explosion. Before the explosion, the nursing home’s medical director came to the Reagan Street entrance and directed the charge nurse to begin evacuating residents to the other side of the facility in response to the ongoing fire at the WFC facility. As the charge nurse began the evacuation process, the explosion occurred. During the post-blast evacuation, staff members and volunteers removed many bedridden

36 See: http://www.restorewestisd.com/plans.html (accessed on December 22, 2015). 37 The nursing home had a capacity of 145 individual licenses.

Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

residents from the building through the windows instead of the hallways out of concern that the structure would collapse. The residents were moved from the back of the nursing home to the front during the fire, evacuated after the explosion to a helicopter pad and football field, and eventually moved to the community center. The 72 injured residents were transported to Providence Health Center and Hillcrest Baptist Medical Center to receive treatment. After the residents were treated and released, they were relocated to various nursing homes in the neighboring cities of Waco, Midway, Hewitt, Clifton, and Hillsboro. Uninjured residents were also relocated to these nursing homes. Within 2 months of the incident, 14 of the West Rest Haven nursing home residents died, a figure cited as unusually high by the facility’s administrator,38 and since the incident, approximately 50 patients have died. According to information the nursing home provided to CSB in May 2015, almost all of the 80 living patients who formerly resided at West Rest Haven tentatively planned to return to the nursing home once the new construction was complete.

Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting)

38 See: http://www.dallasnews.com/news/west-explosion/human-toll/20130617-some-say-west-blast-rushed-nursing- home-patients-deaths.ece (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.4.1 West Rest Haven Nursing Home Disaster and Evacuation Plan

West Rest Haven followed a disaster and evacuation plan that include policies and procedures39 to meet all potential types of emergency and nonemergency situations, including fires, disasters, explosions, toxic fumes, train derailments, broken gas mains, auto and truck collisions, and fire drills. The plan included detailed evacuation procedures in the event of a fire as well as shelter-in-place procedures for events such as severe weather. Depending on the location of the fire, patients could be evacuated to another portion of the building rather than being completely removed from the premises. The disaster and evacuation plan also contained transportation and sheltering agreements if needed during an emergency evacuation of the facility. The plan also provided guidance to the facility’s operators on responses to a derailed train or ruptured tank cars containing potentially hazardous liquids and on steps to shelter in place if the facility were exposed to hazardous gas or vapors.40 West Rest Haven scheduled monthly fire drills to meet the requirement to conduct fire drills during each of the three work shifts. In addition, the nursing home held a mock disaster drill approximately 3 months before the explosion, employing a scenario that assumed a toxic gas release from the WFC facility. 3.4.4.2 Damage Assessment of West Rest Haven Nursing Home The West Rest Haven nursing home was irreparably damaged (Figure 33), leading the city to completely demolish the structure 3 months after the incident.41 The nursing home was constructed of load-bearing wood stud walls (with brick veneer) and wood trusses that spanned the wings from exterior wall to exterior wall (east to west). The nursing home’s emergency exit plan (Figure 34) shows the floor plan and room layout. The explosion most heavily damaged the eastern-most corridor of the building. As a result of the explosion, the roof trusses collapsed, and the east wall failed. The eastern rooms were heavily damaged and subjected to flying wall debris and window fragments in addition to failing drywall, insulation, and light fixtures from the ceiling. Investigators observed high glazing hazards, including glass shards that penetrated the wall opposite the windows. The ceilings, insulation, and interior contents of rooms were lying on beds and blocking doorways, posing hazards to any occupants of these rooms. In addition, the air blast would have infiltrated the rooms through the failed windows. Pieces of broken glass littered the inside of the nursing home, with the exception of hallway corridors that were shielded from windows by interior partitions. The great rooms, lobby, and patient rooms were also subjected to significant hazards from broken shards of glass.

39 The disaster and evacuation plan also includes policy and procedures for severe weather, bomb threats, water shortages, electrical power outages, loss of comfort heating, heat and humidity, and floods. 40 West Rest Haven Inc. “Disaster and Evacuation Plan.” 41 See: http://video.dallasnews.com/Damaged-West-nursing-home-razed-3-months-after-blast- 24951515?freewheel=90850&sitesection=dallasnews_nws_non_non&VID=24951515#.Uv58DMKYbIU (accessed on January 4, 2016).

West Fertilizer Company Final Report January 2016 52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB) The blast also inflicted significant damage to the western portion of the nursing home, and the great rooms, such as the lobby, were hit particularly hard because of the large spans of the overhead trusses that failed and collapsed onto the furniture. In addition, hallways in this area presented many hazards, including hanging light fixtures, failed ceiling joists, and collapsed drywall and insulation on the floors. Moreover, the debris field of the nursing home contained secondary fragments from massive pieces of the WFC facility’s concrete foundation and also significant masses of earth. Observations indicated that a large piece of the WFC foundation, measuring 16 inches wide by 16 inches tall and 36 inches long (Figure 35, right) impacted room 79, traveling through the roof and the exterior wall (Figure 35, left). This debris fragment was calculated at a weight of approximately 800 pounds and had sufficient momentum after the impact to exit the nursing home, strike the ground, and then travel an additional 60 feet before coming to rest just to the west of North Davis Street.

West Fertilizer Company Final Report January 2016 53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West Rest Haven (Source: ABS Consulting) On April 4, 2014, the city of West broke ground at 503 Meadow Drive, a block away from the original site, on the new 120-bed West Rest Haven nursing home (with 75,000 square feet), which opened in summer 2015.42 The estimated construction cost is $11 million. West Rest Haven did not receive any grants or federal money to rebuild the facility. 3.4.5 West Terrace Apartment Complex The West Terrace Apartment Complex, a 22-unit apartment complex built in 1979 and owned by J&B Realty Ltd., was 450 feet due west of the epicenter of the explosion. Two members of the public were fatally injured at the apartment complex. One of the victims was most likely standing on the east side of the complex and watching the fire shortly before the explosion occurred. The second victim was most likely inside her lower-level one-bedroom apartment. The apartment building had four vacant units that were being used for storage. At the time of the explosion, a member of the cleaning staff was just finishing servicing one of the recently vacant units; she was injured in the blast while exiting the apartment building and walking down the stairs to her car. This worker’s mother accompanied her on the job that day and was in the just-serviced unit, waiting for her daughter to return with the car, when the explosion occurred; however, the worker’s mother was not injured. Four residents of the apartment

42 See: http://dfw.cbslocal.com/2014/04/04/groundbreaking-symbolizes-hope-in-west-one-year-later/ (accessed on April 4, 2014).

West Fertilizer Company Final Report January 2016 54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

complex were treated at Hillcrest Baptist Medical Hospital, and two residents were treated at Providence Health Center for injuries sustained. The explosion completely destroyed West Terrace. The roof and walls of the building completely failed (Figure 36).

Figure 36. West Terrace Apartment Complex East Façade (Source: CSB) 3.4.6 Private Residences According to the Texas Department of State Health Services, the fire and explosion affected many of the homes within a 2-mile radius of the WFC facility. West had a total of 700 homes, and 350 of those were impacted— with 142with homes damaged beyond repair,43 51 homes suffering major damage, 27 homes incurring minor damage, and 130 homes otherwise affected.44 CSB consultants examined damage to 190 single-family residential buildings within a radius of 3,500 feet of the explosion crater45 and documented broken windows, facade damage, and nonstructural and structural component (e.g., wall and roof system) failures (Figure 37). The damage assessments were performed in the majority of the cases by inspecting the perimeter of the property. Access to home interiors was limited because owners either were not present or were unwilling to grant access.

43 Not all homes that were damaged beyond repair have been rebuilt. 44 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West Fertilizer Plant Explosion,” October 8, 2013. See: http://www.astho.org/Preparedness/DPHP-Materials- 2013/WestTexasExplosion/ (accessed on January 18, 2016). 45 CSB contractors assessed damage that was measured to 3,500 feet from the WFC site, but damage occurred beyond that distance.

West Fertilizer Company Final Report January 2016 55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting) According to the city of West, 259 building permits were issued as of October 2014. Of those, 79 were for building new homes, 117 for remodeling homes, and 63 for making miscellaneous repairs (such as fence, shed, and carport restoration). 3.4.7 Infrastructure Damage to the City of West The explosion at the WFC facility damaged the West city infrastructure; it ruptured water lines, deformed sewer manholes, damaged water storage tanks, further rendered wells unusable, cracked walls of a pump house, and caused the loss of water supply to the community. Access to water was restored gradually as the affected infrastructure was repaired. As a result of the explosion, FEMA assisted the city in repairing some of the damaged infrastructure listed in Table 3, such as water facilities and water lines. Table 3. Infrastructure Repaired with FEMA Funding Affected Infrastructure Cost to Repair Damage Well 4, Ground Storage Tank $365,000

West Fertilizer Company Final Report January 2016 56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Well 4, Pump Station Door and Window $2,000 Davis Street Water Line $74,000 Walnut Street Sewer Manhole $9,200 Total $450,200

The West water system is fed by a 12-inch supply line from the city of Waco at a pump station 11 miles south of West. The pump station supplies 700 gallons per minute, with a storage capacity of 167,000 gallons. Water pressure for homes is usually 48 to 50 psi; however, on the morning after the incident, water pressure was measured at less than 20 psi because of damaged water lines. In response to the abnormal water pressure, the city issued a boil water order. West used two water wells to supply water to the community. The first well had a capacity of 250,000 gallons; however, it had been out of service for about 7 years at the time of the explosion. The second well also had a capacity of 250,000 gallons and was removed from service in January 2013 for rehabilitation.46 This well also was damaged as a result of the explosion but has since been repaired and was back online as of September 1, 2014. The city also has an above-ground water tower with a storage capacity of 150,000 gallons; the tower was nearly drained by the post-explosion fire department response.47 According to CSB interviews conducted with the Abbott Fire Department, West had a history of improperly working water hydrants and consistently low water pressure. Abbott firefighters had previously responded to fires in West and were unable to get hydrants to work adequately. The city had installed the above-ground water tower before the WFC incident to address the issue of low pressure. According to the Mayor of West, “The city generates its revenue in three ways—water and sewer rates, property tax, and sales tax.” During the first 2 months after the explosion, West experienced a loss of income (65 percent of water and sewer revenue and 30 percent of property tax values).48 As of June 2013, the city of West indicated that the fire and explosion at WFC had cost the city $17 million in actual damages; however, the total cost-to-date may be greater as additional demolition, renovation, and construction projects continue throughout the city. On April 15, 2014, the State of Texas provided additional disaster grant assistance49 to the city of West in the amount of $4,853,500 to fund the disaster recovery work on the water plants, water tank rehabilitation, wastewater outfall interceptor, and disaster zone infrastructure repairs.50 The first infrastructure project (costing $400,000) was completed in August 2014 and involved installation of a new well and upgrading of a storage tank located by the new nursing home.

46 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 47 Ibid. 48 See: http://www.cityofwest.com/wp-content/uploads/2012/12/June-2013.pdf (accessed on December 22, 2015). 49 The State of Texas provided an initial $3.2 million disaster grant in August 2013. 50 The State of Texas. Office of the Governor, “Letter to the City of West,” April 15, 2014.

West Fertilizer Company Final Report January 2016 57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Incident Analysis
2. 1 Fertilizer Grade Ammonium Nitrate (FGAN)
3. 1.1 The Fertilizer Industry

The Fertilizer Institute defines fertilizer as a “collection of elements needed for plants to grow well.”51 The application of fertilizer to soil provides nutrients for plants to enhance fertility and the production of crops. The primary nutrients for plant nutrition are nitrogen (N), phosphorous (P), and potassium (K). Nitrogen is considered the most important of the three nutrients because it is critical to the formation of protein, which composes the tissue of most living things. Although nitrogen exists in the composition of air, it does not exist in a form that plants can readily absorb. Accordingly, farmers apply fertilizers containing nitrogen compounds to their soils to enhance crop production. Nitrogen is most readily available for plants in its inorganic forms, such as ammonium (NH4+) or nitrate (NO3-) ions. It is applied to crops in different forms such as dry granules, liquid, or injection into the soil as a gas. The largest source of nitrogen by volume in commercial fertilizer is anhydrous ammonia, which is applied directly to crops.52 Other important nitrogen fertilizers include aqueous ammonia (NH3), ammonium sulfate ((NH4)2SO4)), ammonium thiosulfate (H8N2O3S2), calcium nitrate (Ca(NO3)2), sodium nitrate (NaNO3) and FGAN. FGAN, the substance in the fertilizer involved in the West Fertilizer Company (WFC) explosion, is primarily used on pastureland, hay, and fruit and vegetable crops. FGAN is most commonly used in the Southeast and Midwest in the United States, and the largest AN consumers are Missouri (20 percent), Tennessee (14 percent), Alabama (10 percent), and Texas (8 percent). 53 4.1.2 AN Properties AN (NH4NO3) is a salt compound produced by neutralizing nitric acid (HNO3) with anhydrous ammonia (NH3). The AN manufacturing process involves several steps, including solution formation and concentration; solids formation, finishing, screening, and coating; and product bagging, bulk shipping, or both. AN is marketed in different forms depending on its use, but it is primarily manufactured for use in fertilizers or as a precursor in the manufacture of explosives. Liquid FGAN can be sold as a fertilizer or may be concentrated to form a dry solid product. This solid product may be used for fertilizer or fertilizer blends or may be incorporated as part of an explosive. Pure solid AN is a white or grey odorless material that is marketed in several different forms, such as prills, grains, granules, or crystals. Prills are the most commonly produced form and take the shape of spherical pellets. High-density prills are used for FGAN;

51 The Fertilizer Institute. Fertilizer 101, Nourish, Replenish, Grow. Washington, DC: The Fertilizer Institute, 2010: 13. 52 See: https://www.tfi.org/safety-and-security-tools/get-know-fertilizer-retailer/infographics/ammonium-nitrate- infographic (accessed on November 18, 2015). 53 Ibid.

West Fertilizer Company Final Report January 2016 58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

low-density porous prills are generally considered technical grade ammonium nitrate (TGAN) or explosive grade ammonium nitrate, both of which are used in the manufacturing of explosives. Chemically, however, these prills are identical; the difference is that small quantities of coatings and stabilizers are added to FGAN to prevent caking and degradation. 4.1.3 AN Hazards Under normal conditions, pure solid AN is a stable material; it usually is not sensitive to mild shock or other typical sources of detonation (such as sparks or friction). However, AN exhibits three main hazards in fire situations:

1. Uncontrollable fire.
2. Decomposition with the formation of toxic gases.
3. Explosion.54

These hazards arise in part because AN is an oxidizer. This classification is demonstrated both by the U.S. Department of Transportation (DOT), which categorizes AN as a Class 5.1 oxidizer,55 and by OSHA, which describes it as an oxidizer in its Explosives and Blasting Agents standard, 29 CFR 1910.109. 56 Significantly, AN is classified as an “explosive” when the prills are produced with more than 0.2 percent carbonaceous material. Carbonaceous material is a substance rich in carbon, such as a hydrocarbon. OSHA defines “oxidizer” as a chemical that “initiates or promotes combustion in other materials, thereby causing fire either of itself or through the release of oxygen or other gases.”57 As an oxidizer, AN can increase the flammability or explosibility (or both) of other combustible substances when it decomposes after exposure to heat. As AN decomposes when in contact with heat or fire, the reactions can release gases such as nitric acid (HNO3), ammonia (NH3), nitrogen oxides (NO, NO2), nitrous oxide (N2O), nitrogen, oxygen, and water vapor, depending on the heat and pressure. Some by- products can be toxic when emitted. During fires, AN presents serious risks of explosion beyond those attributed to its oxidizing properties and ability to decompose and emit toxic gases. When AN is contaminated with organic carbon- containing materials or certain inorganic chemicals, its behavior can become dangerously unpredictable,

54 Resources Safety, Division of Mines and Petroleum. Safe Practice: Safe Storage of Solid Ammonium Nitrate. East Perth, Western Australia: Government of Western Australia, 2013. See: http://www.dmp.wa.gov.au/documents/Code_of_Practice/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on August 4, 2015). 55 U.S. DOT. “Hazardous Material Table,” 49 CFR 172.101. See: http://www.phmsa.dot.gov/portal/site/PHMSA/menuitem.6f23687cf7b00b0f22e4c6962d9c8789/?vgnextoid=d84ddf 479bd7d110VgnVCM1000009ed07898RCRD&vgnextchannel=4f347fd9b896b110VgnVCM1000009ed07898RCR D (accessed on August 4, 2015). 56 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9755 (accessed on January 13, 2016). 57 OSHA. See: https://www.osha.gov/dsg/hazcom/ghoshacomparison.html (accessed on August 4, 2015).

West Fertilizer Company Final Report January 2016 59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

especially when the AN is confined and in the presence of fire or high heat.58 Thus, when AN is combined with contaminants, its explosive sensitivity increases sharply, and the result can lead to detonation.59 Examples of contaminants include organic chemicals, acids, and flammable and combustible materials.60 4.1.3.1 Decomposition of AN AN has a melting point between 311°F and 337°F (155°C and 169°C). It begins to rapidly decompose at a significant rate soon thereafter.61 When it is exposed to high heat and pressure, AN experiences endothermic (heat-absorbing) and exothermic (heat-producing) reactions simultaneously, causing the compound to split into its constituent molecules and also transforming it from solid state to molten, or liquefied, state. When AN decomposes or breaks down under thermal conditions, at least seven unique reactions can occur at varying temperatures, with different heat outputs and rates of reaction.62 Some reactions can produce toxic and detonable by-products. All of the reaction pathways begin with the AN splitting into gaseous ammonia (NH3) and nitric acid (HNO3), although that step is usually not explicit. In the following main exothermic reaction (Eq. 1), which can occur in conditions up to 482°F (250°C), AN yields nitrous oxide and water: NH4NO3 (s)  N2O (g) + 2 H2O (g) (Eq. 1) Above 482°F (250°C), a reversible endothermic reaction (Eq. 2) takes place at a significant rate, splitting the AN to form ammonia and nitric acid: NH4NO3 (s) ↔ NH3 (g) + HNO3 (g) (Eq. 2) This endothermic reaction is accompanied by a number of exothermic reactions between gaseous ammonia (NH3) and nitric acid (HNO3) that vary by degree, depending on reaction conditions. As previously described, AN is in a liquid or molten state, which is aerated with off-gases such as nitrogen oxides (NO, NO2), water vapor, and nitrous oxide (N2O). This bubbly liquid is much more sensitive to detonation than solid prills or unaerated liquid. Depending on the rate of these endothermic and

58 Greiner, Maurice. “Ammonium Nitrate: Hazards and Handling.” Fertilizer Progress January/February (1983): 26– 38. 59 Sun, J. et al. “Catalytic effects of inorganic acids on decomposition of ammonium nitrate.” Journal of Hazardous Materials B127 (2005): 204–210. 60 The OSHA Explosives and Blasting Agents Standard, 29 CFR 1910.109)(i)(5)(i)(a), lists examples of combustible materials or other contaminating substances, including animal fats, baled cotton, baled rags, baled scrap paper, bleaching powder, burlap or cotton bags, caustic soda, coal, coke, charcoal, cork, camphor, excelsior, fibers of any kind, fish oils, fish meal, foam rubber, hay, lubricating oil, linseed oil, or other oxidizable or drying oils, naphthalene, oakum, oiled clothing, oiled paper, oiled textiles, paint, straw, sawdust, wood shavings, or vegetable oil. 61 CF Industries. “FGAN.” Material Safety Data Sheet Number 004. See: http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on August 4, 2015). 62 U.S. Department of the Army. Department of the Army Technical Manual, Ammunition, General, TM 9-1300-214. Washington, DC: U.S. Department of Defense, September 1984.

West Fertilizer Company Final Report January 2016 60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

exothermic reactions, detonation can occur. Conditions other than heat and pressure, such as pH levels and the presence of impurities, can also influence the rate of reaction.63 The decomposition of AN can be controlled to the extent that the main exothermic reaction (Eq. 1) can be used to produce hospital-grade nitrous oxide.64 However, if the rate of reaction is uncontrolled (which happens, for example, when FGAN is exposed to fire), other reactions can occur as AN decomposes and melts. As the temperature rises over 482°F (250°C), liquid AN becomes less dense and contains many small bubbles of gaseous decomposition products and their reactants, primarily water vapor and nitrous oxide. At 500°F (260°C), liquid AN becomes much more sensitive to shock because these bubbles act as “hot spots” that focus the shock or magnify the energy input. Many tests have shown the direct correlation between temperature and sensitivity in molten AN.65 In other words, molten AN becomes more sensitive as the temperature under which it is kept rises. Although the exact sequence of chemical reactions is variable, the primary end products of the detonation process are consistently water, nitrogen (N2), and oxygen (O2). As reactions involving nitric acid (HNO3) and ammonia (NH3) (Eq. 2) produce these end products, heat is released, which adds energy to a detonation. The nitrous oxide (N2O) production process (Eq. 1) combines all of the internal fuel (hydrogen) with the oxygen from nitric acid to form water, so no additional oxidation can take place in the pure AN during the detonation reaction. The difference between the uncontrolled detonation reaction and the nitrous oxide reactions is the rate of the reaction and the formation of the triple bond in N2 and the double bond in O2, which are exothermic and therefore add to the energy yield during detonation. The following formula (Eq. 3) describes this overall decomposition reaction from the intermediate reactions where AN yields nitrogen, oxygen, and water: NH4NO3 (s)  N2 (g) + ½ O2 (g) + 2H2O (g) (Eq. 3) When mixed with AN, many combustible contaminants—including organic materials, fuels, and finely divided materials (e.g., flour, seed or grain dusts, asphalt or fuel oil, or very small metal flakes)—will provide additional fuel that can combine exothermically with the oxygen produced during detonation. Thus, for explosive uses, AN is nearly always combined with a fuel source. This approach increases the energy of the intended explosion and also reduces the toxicity of the end products by reducing nitrogen

63 Lees, F.P., and M.L. Ang (eds.). Safety Cases Within Control of Industrial Major Accident Hazards (CIMAH) Regulations, Chapter 9. Butterworth-Heinemann, 1984; January 1, 1989: 160. 64 Asia Industrial Gases Association. Safe Practices for the Production of Nitrous Oxide from Ammonium Nitrate, AIGA 080/13. Singapore: Asia Industrial Gases Association, 2013. See: http://www.asiaiga.org/docs/AIGA%20080_13%20Safe%20practices%20for%20the%20production%20of%20nitro us%20oxide%20from%20ammonium%20nitrate.pdf (accessed on November 19, 2015). 65 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos ure.pdf (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

oxide (NOx) production. Nitrogen oxides are produced, for example, by the following reaction (Eq. 4), which shows AN yielding nitrogen, water vapor, and nitrogen oxides: 4NH4NO3 (s)  2NO2 (g) + 8H2O (g) + 3N2 (g) (Eq. 4) An example of fueling AN to produce a blasting agent is the addition of fuel oil at around 6 percent by weight to produce ammonium nitrate/fuel oil (ANFO). ANFO may be used for mining and other purposes. Moreover, the military uses a mixture of fuel-rich trinitrotoluene (TNT), AN, and sometimes aluminum to produce a more effective explosive than TNT alone.66 4.1.4 Previous Incidents Involving FGAN AN-related explosions have occurred ever since large-scale AN production began in the late 19th century.67 One of the earlier notable explosions involving FGAN took place in Oppau, Germany, in 1921, when workers fired explosives into a caked mixture of fertilizer to loosen 4,500 tons of ammonium sulfate (AS) and FGAN. The explosion killed 500 to 600 people, injured an additional 2,000 more, and caused as much as $1.7 million (US) in property damage, destroying 80 percent of the city.68 Today, that property damage would equate to more than $22 million.69 Since then, a number of other FGAN incidents have occurred that involved a major fire, explosion, or both. This report highlights the following four incidents involving FGAN because they provide important information about the behavior of FGAN when exposed to fire: • Cherokee incident (1973). A fire in the storage building of FGAN producer Cherokee Nitrogen resulted in an FGAN detonation in Pryor Creek, OK. Of the 14,000 tons of FGAN in storage, only a few tons were involved. The detonation was believed to have been underneath a front-end loader parked in an area with FGAN on the floor and might have been initiated by one of the loader’s components exploding. It was theorized that contamination of the FGAN with flammable fluids in the loader occurred before the detonation. The detonation occurred 25 minutes after the fire was discovered but did not propagate into the main pile.70 • Cory’s Warehouse incident (1982). A fire in a warehouse storing wooden furniture, charcoal, and more than 3,000 tons of bagged FGAN and mixtures based on FGAN produced some deflagration of the FGAN but no detonation.71 Several small explosions occurred but were thought to be due

66 Ibid. 67 Barbrauskas, Vytenis. “Explosions of Ammonium Nitrate Fertilizer in Storage or Transportation Are Preventable Accidents.” Journal of Hazardous Materials 304, 5 (2016): 134–149. 68See: http://www.aria.developpement-durable.gouv.fr/wp-content/files_mf/FD_14373_oppau_1921_ang.pdf (accessed on December 19, 2015). 69 The CPI Inflation calculator. See: http://data.bls.gov/cgi- bin/cpicalc.pl?cost1=1%2C700%2C000&year1=1921&year2=2014 (accessed on December 30, 2014). 70 Freeman, R. “Cherokee Ammonia Plant Explosion.” Chemical Engineering Progress 71, 11 (1975). 71 A deflagration occurs when a combustion wave propagates at a velocity less than the speed of sound. A detonation is a combustion wave that propagates at a velocity greater than the speed of sound. Detonations create high-pressure shock waves that can cause damage at large distances from the source.

West Fertilizer Company Final Report January 2016 62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to reactions between sodium nitrate and charcoal. More than 1,000 people were evacuated, and controlling the fire took 6 hours. • EDC incident (2009). A fertilizer distribution facility in Bryan, Texas, caught fire and completely burned. Firefighters withdrew and evacuated the area. Unlike the West fire, the Bryan AN-related fire produced light-colored smoke as burning progressed, indicating that the fire was ventilated. No explosion occurred, and after the fire, much of the FGAN was still there. Some of the FGAN melted, spread away from the pile, and then re-solidified in a dark mass. The FGAN remaining in the pile had a black crust on it, but beneath that crust, the prills appeared to be unaffected.72 • East Texas Ag Supply incident (2014). A fertilizer warehouse in Athens, Texas, caught fire and burned. The warehouse was near the center of town, and the first responders evacuated the area as rapidly as possible. No explosion occurred. The walls of the structure were masonry, but the bins and roof structure were wood.73

A more comprehensive list of FGAN incidents involving fires and explosions is provided in Appendix B. 4.1.5 Historical Knowledge of AN Fire and Explosion Hazards Over the years, the explosibility and fire hazards of AN have been the subject of a number of research papers. Some of those papers were first published through the U.S. Department of Agriculture (USDA),74 U.S. Bureau of Mines,75 and other sources abroad. In 1945, a USDA-archived publication discussed in detail the properties of pure AN, based on worldwide research conducted up to that date.76 The paper notes the following: • Under favorable conditions of pressure, rapid heating, and retention of heat, AN may be exploded partially from heat alone near 300°F. • AN can detonate if subjected to a very strong initial impulse. • Six factors influence the sensitivity of AN toward an explosion: temperature, strength of initial impulse, density, packing, particle size, and moisture content of the material. Later, the Bureau of Mines (U.S. Department of the Interior) published reports on its investigation of the detonation of AN.77 Some of the key findings of a 1966 Bureau of Mines report indicated the following: • No transition to detonation of AN occurred in numerous burning experiments.

72 CSB conducted an assessment of the Bryan, Texas, incident. 73 CSB collected information after the Athens, Texas, incident. 74 Davis, R.O.E. “Explosibility and Fire Hazard of Ammonium Nitrate Fertilizer,” no. 719. Washington, DC: U.S. Department of Agriculture, 1945. 75 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: Bureau of Mines, 1966. 76 See: https://ia601703.us.archive.org/1/items/explosibilityfir719davi/explosibilityfir719davi.pdf (accessed on January 6, 2016). 77 In 1961, the Manufacturing Chemists’ Association asked the Bureau of Mines to investigate the potential explosion hazards of AN under the conditions of fire exposure that could occur in storage and transportation incidents.

West Fertilizer Company Final Report January 2016 63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• The critical diameter (minimum diameter to sustain detonation) of AN was quite small when just below the melting point. • Initiation of prills by oxygen-acetylene gas detonation was shown to be unlikely. • Detonations were achieved with fuel added in vessels with restricted vents. • The initiation of detonation in AN from fire exposure in normal storage is quite improbable. • The chance of modern AN detonating as the result of fire has been considered to be small or even nonexistent. • The initial shock need not have an amplitude adequate for immediate initiation of detonation. • Failure to detonate at a small scale should not be interpreted as meaning that the material is incapable of detonation. • An acetylene-oxygen mixture in a 3-inch tube failed to detonate hot pulverized AN prills. No attempt was made to initiate detonation in foaming liquid AN by using a gas mixture. • Large fire tests with bagged AN showed that heat penetrated less than 2 inches into the prills and that a crust formed, preventing liquid from penetrating the prills.78 The Bureau of Mines conducted a large-scale study (also in 1966) to determine distances for safe storage of AN. Cardboard tubes 1 meter in diameter were used as the donors and acceptors (the donor is detonated conventionally, and the acceptor, which is placed at a test-determined distance from the donor, either detonates or fails in each test). ANFO was the donor, and the acceptors were ANFO and straight AN. The tests were well documented and were of sufficient scale to produce reliable results. One of the findings was that sheet metal covering the donor increased the distance where sympathetic detonation (a follow-on detonation induced by the explosive effects of an initiating explosion) occurred. In a case with ANFO as the acceptor, a sympathetic detonation was produced over a 50-foot gap. With straight AN, the maximum gap was 19 feet. Without the metal, the gap was 12 feet for AN. The Bureau of Mines also conducted tests at smaller diameters, but no detonation was initiated in AN. One significant finding was that “strong evidence exists that the apparent insensitiveness of AN results largely from a manifestation of critical diameter effects,” highlighting the importance of scale. When evaluating test results, small-scale tests are not reliable indicators of large-scale behavior. In December 1997, EPA published an alert, “Explosion Hazard from Ammonium Nitrate,” with the following recommendations:79 • Avoid heating AN in a confined space (e.g., consider that processes involving AN should be designed to avoid this possibility). • Avoid localized heating of AN, which potentially leads to development of high-temperature areas. • Ensure that AN is not exposed to strong shock waves from explosives.

78 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: Bureau of Mines, 1966. 79 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Avoid contamination of AN with combustible materials or organic substances, such as oils and waxes. • Avoid contamination of AN with inorganic materials that can contribute to its sensitivity to explosion, including chlorides and some metals, such as chromium, copper, cobalt, and nickel. • Maintain the pH of AN solutions within the safe operating range of the process, in particular avoiding low pH (acidic) conditions. This alert was later expanded in August 2013 as a joint EPA, OSHA, and ATF advisory, “Chemical Advisory: Safe Storage, Handling, and Management of Ammonium Nitrate.” A June 2015 revision refers explicitly to AN prills.80 4.2 Factors Contributing to the Massive Fire and Explosion at the WFC Because of the unpredictable behavior of FGAN in fire situations, the scenario that contributed to the detonation at the WFC might never be precisely determined; however, several detonation scenarios are plausible. CSB identified two factors or conditions that likely contributed to the intensity of the fire and detonation: (1) the contamination of FGAN with materials that served as fuel and (2) the nature of the heat buildup and ventilation of the FGAN storage space. These factors and scenarios for how the FGAN behaved on the night of the incident are based on the physical evidence that remained, blast analysis commissioned by CSB, U.S. Army Corps of Engineers crater analysis of the WFC explosion, eyewitness accounts, and previous research on FGAN incidents and testing. 4.2.1 Contamination of the FGAN Pile In fire situations, the behavior of FGAN is unpredictable, in part because of the number of endothermic and exothermic decomposition reactions that take place with increasing temperature. FGAN decomposition reactions beyond the first step have yet to be uniquely defined, and subsequent decomposition reactions of FGAN can only be assumed.81 When contaminants are added to AN, the decomposition reactions become increasingly more complex.82 Possible sources of contamination in an FGAN storage area can include ignitable liquids, finely divided metals or organic materials, chloride salts, carbons, acids, fibers, and sulfides. These contaminants can increase the explosive sensitivity of FGAN.

80 EPA, OSHA, and ATF. “Chemical Advisory: Safe Storage, Handling and Management of Solid Ammonium Nitrate Prills.” See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on December 7, 2015). 81 Cagnina, Stefania; Rotureau, Patricia; and Carlo Adamo. “Study of Incompatibility of Ammonium Nitrate and its Mechanism of Decomposition by Theoretical Approach.” Chemical Engineering Transactions 31 (2013). See: http://www.aidic.it/lp2013/webpapers/141cagnina.pdf (accessed on December 7, 2015). 82 Ibid.

West Fertilizer Company Final Report January 2016 65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The molten FGAN at the WFC likely came in contact with contaminants that were stored in the fertilizer warehouse or were produced during the fire that preceded the explosion. Seed materials, zinc, and other organic products, including the wood-constructed bins, were present near the FGAN storage area or could have come in contact with molten FGAN. During the fire, soot from the smoke and also collapsing wood and roofing material might have mixed with the FGAN pile. The presence of possible contamination in the FGAN pile can be evidenced by changes in the smoke observed in the WFC fire before the explosion. The earliest sign of the WFC fire was white smoke streaming from vents in the elevator cupola on top of the fertilizer warehouse that stored the FGAN. Light-colored smoke is evidence of a well-ventilated fire, which would be typical of the early phase of a structure fire before it depletes the oxygen in the room. The initial smoke observed at the WFC was from the incipient fire, now believed to have started in the seed room. Shortly after authorities were notified, the smoke darkened and became opaque, indicating large quantities of soot83 or hydrocarbons burning (Figure 38). Such soot can be the result of a ventilation-limited fire or a soot-producing fuel such as plastic or asphalt, which produces large amounts of soot even in well-ventilated fires.84 The fact that smoke was observed coming from the same room that held the FGAN bin suggests that the bin was burning at that time. It is likely that soot or molten asphalt began accumulating on the AN shortly after the fire spread to the roof and the FGAN bin. The soot provided a source of fuel as it contaminated the surface of the pile. Soot also greatly increases the absorption of radiant heat from a fire.85

Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) (Source: Member of the Public)

83 Soot is finely divided carbon deposited from flames during the incomplete combustion of organic substances. 84 Fire Development and Behavior Indicators. See: http://cfbt-us.com/pdfs/FBIandFireDevelopment.pdf (accessed on November 19, 2015). 85 Glassman, Irvin and Yetter, Richard. Combustion. Burlington, MA: Academic Press, 2009: 458.

West Fertilizer Company Final Report January 2016 66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.2 Heating and Ventilation

As the fire progressed, the available oxygen in the building was depleted as it was consumed in the fire. Although the fertilizer warehouse structure had some ventilation louvers in the cupola at the top, ventilation at ground level was limited to only a few louvered vents and the normal infiltration that exists around doors. The limited ventilation increased the quantity of soot in the smoke and the potential contamination of the FGAN pile. The path of the fire from the seed room to the main structure is unknown, but an opening, perhaps resulting from an interior wall or the roof burning, seems to have allowed hot smoke and later flame to flow from the seed room into the main structure and out the cupola. Initially, no flames were visible at the cupola, but as the fire progressed, videos and photographs taken before the explosion show the fuel-rich smoke generated by the burning material inside the structure. Subsequently, asphalt roof shingles ignited and began burning vigorously. With limited ventilation inside the structure, a hot layer of smoke likely would have developed in the upper portion of the room containing the FGAN bin. Because cooler air settles below warmer air, the air temperatures would have remained relatively cooler inside the bin. The ground-hugging nature of the evolving smoke plume, as evidenced in Figure 39, is a characteristic of partially cooled smoke, perhaps cooling as it passed through the elevator structure before it exited the cupola. Because the elevator likely was filled with opaque black smoke, radiant heat from the fire on the FGAN pile would be reduced because the opaque black smoke shielded the pile from the heat.

Figure 39. Dark and Heavy Smoke, Rich in Soot (Source: Member of the Public) At some point around 5 to 6 minutes before the detonation, the character of the fire changed, according to eyewitness accounts and photographic evidence (Figure 40). This change was most likely caused by increased ventilation through an opening low in the building, possibly when the fire burned through the seed room doors or the roof. The fire also might have been enhanced by oxidizing gases from the heated FGAN pile.

West Fertilizer Company Final Report January 2016 67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke and Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the Public) The additional ventilation caused a marked decrease in dark smoke and probably was accompanied by a major increase in heat radiation inside the fertilizer building because of increased oxygen availability to the burning wood and other fuels. With the dark smoke inside of the structure reduced, radiant heat would reach the surface of the FGAN in the bin, and the increased airflow through the building would greatly increase the radiant heat flux by raising the temperature of the burning wood. The surface of the FGAN, covered with soot or molten asphalt, would absorb the heat flux and cause a very rapid heating of the surface of the FGAN pile. The very hot and contaminated surface of the pile was then sensitive to detonation. If the building had been well ventilated, the ventilation-limited phase of the fire would not have been as prolonged, reducing the amount of soot and creosote on the pile. In this scenario, the increased intensity of the fire would heat the FGAN pile. The lighter color smoke would allow more heat to be reflected, and the liquid FGAN might have run off as it developed. CSB collected data on similar incidents at the facilities in Bryan, Texas, and Athens, Texas. These incidents demonstrate that an FGAN pile can experience a major structure fire without detonating. The plumes of smoke at the Bryan facility (Figure 41) and Athens facility indicated cleaner-burning fires with less soot production. One source of the difference in the fire plumes might be the level of ventilation inside of the structure, as described to CSB investigators by the Athens fire chief. Some materials, such as asphalt and polyvinyl chloride (PVC), will

West Fertilizer Company Final Report January 2016 68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

produce dark plumes even when burning in the open air, but if that smoke production is outside of the structure, no contamination of the FGAN will occur.

Figure 41. Plume of Smoke from AN Fire in Bryan, Texas (Source: College Station Fire Department) 4.3 Detonation Scenarios CSB found that contamination (likely from the storage of nearby combustibles or the combustible materials used to construct the FGAN bins and building) and the lack of ventilation were contributing factors that ultimately led to the detonation. However, the exact behavior of the FGAN—specifically how the contaminants, decomposition by-products, ventilation issues, or a combination of those conditions led to the explosion—may never be known. Previous studies indicated that a detonation of modern FGAN prills under normal standard storage conditions when exposed to fire (unconfined storage without the potential for pressure buildup) was highly unlikely based on a number of factors. Therefore, the three scenarios in this section are considered plausible, but large-scale testing is needed to estimate their relative likelihood. One of the three scenarios (or a combination) is considered plausible as an explanation of event sequences: • Scenario 1: Detonation from the top of the FGAN pile. • Scenario 2: Detonation in heated FGAN along exterior wall exposed to fire. • Scenario 3: Detonation in elevator pit that spread to main FGAN bin.

West Fertilizer Company Final Report January 2016 69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1 Scenario 1: Detonation from the Top of the FGAN Pile

Based on the location of the pile and the properties of the bin along with the circumstances of other fire- induced incidents, one possible scenario is that a period of contamination with soot and other organics (possibly including molten asphalt and plastic dripping from the burning composite shingle roof and PVC drop pipe from the elevator mechanism) was followed by about 5 to 6 minutes of intense radiant heating from the flames above and adjacent to the main FGAN bin. During this time, a layer of very hot, contaminated, and sensitive liquid FGAN could have built up on the pile. The foaming FGAN likely produced oxidizing gases, and those mixed with flammable smoke to produce a detonable gas cloud over the FGAN pile in the main bin and possibly in an adjoining bin linked to the main bin through a series of holes cut in the partition between the bins. The cloud consisted of powerful oxidizers that would be expected when FGAN undergoes thermal decomposition—such as NO2, O2, and HNO3 as wells as fuel- rich smoke and pyrolysis86 products off-gassing from the molten FGAN. The gas cloud then might have ignited from above, undergoing a gas-phase deflagration-to-detonation transition (DDT) in the confinement of the bin. This transition could have been enhanced by the passage of the burning front through the openings between the main and secondary bins, which possibly contained a few hundred pounds of FGAN, in a process known as hot gas injection.87 Given the powerful oxidizers and mixture of fuels possible in this environment, a direct gas-phase DDT in the partial containment of the main bin by itself might be another possible initiator. This gas detonation then initiated an explosive train on the surface of the pile (Figure 42), moving through the contaminated and sensitive low-density foam, into the mixture of high-density foam and prills beneath, and then into the ambient prills composing the bulk of the pile.

86 Pyrolysis is the chemical decomposition of a substance by heat. 87 Byers, Kenneth J. “Pressure Piling and Other Issues Affecting Flameproof Enclosures.” Redbank, Australia: Testing and Certification Centre, SIMTARS, 1996.

West Fertilizer Company Final Report January 2016 70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB) In tests using 1-meter (diameter) cardboard tubes, ambient temperature FGAN has been detonated by a 10-centimeter layer of ANFO at the end of the tube, initiated by a flat shock wave.88 If a large portion of the surface of the AN pile was detonated by a gas explosion and if the sensitized layer detonated, then the minimum diameter for unconfined FGAN prills (around 1 meter) would be exceeded, and the detonation could potentially proceed through the pile in a complete detonation. In many historical accidents, only part of the AN detonates because of the inability of the detonation wave to spread from a small detonation source into the main pile.89 This type of incomplete or partial detonation does not seem to have occurred at the WFC; the crater and blast damage indicate a complete detonation of the main pile, however it is unknown how much of the FGAN burned prior to the explosion. Falling material from a roof collapse has been proposed as a possible initiator in previous accidents, but subsequent testing of falling objects and high-speed projectiles entering solid and molten FGAN did not support this scenario. Although tests have shown that high-velocity impacts (such as those from high-

88 Winning, C.H. “Detonation Characteristics of Prilled Ammonium Nitrate.” Fire Technology 1, 1 (1965): 23. 89 Freeman, R. “Cherokee Nitrogen Co., Pryor OK.” Chemical Engineering Progress 71, 11 (1975).

West Fertilizer Company Final Report January 2016 71 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caliber bullets) can detonate molten FGAN, the low velocities of falling objects do not appear to provide the energy density needed to detonate even sensitized FGAN.90 Fragments from a fire-induced explosion—such as the materials that might be produced in a hot steel roller with FGAN trapped inside—are another potential initiation source at the top of the pile but likely would not create the large flat shock wave required to fully detonate FGAN. No known vehicles or pressure tanks were close enough to the bin to produce high-speed fragments or a strong shock wave on the top of the FGAN pile. A golf cart was in the seed room, and fire extinguishers and an air conditioner could have failed from overpressure due to overheating, but they were separated from the FGAN bin by the substantial walls of the bin and are unlikely to have produced high-speed fragments. As other researchers have noted, the common element linking recent fire-induced FGAN detonations is some level of confinement.91 At the WFC building in West, the confinement was the wooden bin, whereas in the transportation accidents in Mexico and Romania cited in the reference, the confinement was the semitrailer. The confinement provided by a wooden bin or a trailer would not allow sufficient pressure to build up to support a solid-phase DDT92 but could allow the gases escaping the heated FGAN to accumulate over the pile. Additional field testing of this possibility would be useful. 4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to Fire Another possible scenario is that the detonation at the WFC facility was initiated along one of the exterior walls of the bin. The north and east sides of the bin were exposed to the fire and could have been heated through the walls. No evidence indicates that the bin failed during the fire, although that cannot be ruled out, so the side of the FGAN pile likely would have no direct contact with flame, but some heat could have penetrated through the wall of the bin—more heat if the exterior wall adjacent to the seed room was penetrated and fire entered the space between the exterior sheathing and the plywood bin lining. Figure 43 shows some of the features of the fire on the north side of the structure a few minutes before detonation. The structure above the bin had lost its siding and was burning with good air flow. Flames were appearing through the siding outside the bin, indicating that the wooden exterior sheathing and roofing were beginning to burn. The seed room was just a burning frame, and most of its roof had burned and collapsed.

90 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos ure.pdf (accessed on November 19, 2015). 91 Nygaard, E.C. “Large Scale Testing of Ammonium Nitrate.” 4th EFEE World Conference of Explosives and Blasting 4(1), 2007. 92 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateunderFireExpos ure.pdf.pdf (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 72 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the Public) Even with some heating of the pile through the bin wall, it is difficult to envision a potential detonation source; FGAN does not normally detonate when heated except under severe confinement.93 Contamination also would be less likely in the FGAN exposed to heat along the exterior seed room wall, but some liquid AN, contaminated by soot and roofing components, on the pile surface might have penetrated along the heated wall of the bin if the temperature was high enough or the wall was partially breached. A small amount of wood from the bin also might be nitrated by nitric acid off-gassing from the heated FGAN to form nitrocellulose, but such a reaction has not been observed in testing, and no research papers supporting such a scenario were found. The WFC facility had a concrete floor that would have prevented heating of the pile from the bottom. Bin failure, preceded by leakage of the FGAN or FGAN liquid onto burning material such as seed or plastic cannot be ruled out. Because the bin floor was well above the floor of the seed room, the falling material would have some momentum and could produce

93 Arthur D. Little, Inc. Study of Ammonium Nitrate Materials. Springfield, VA: National Technical Information Service, 1952: 1–49. See: http://www.dtic.mil/dtic/tr/fulltext/u2/786334.pdf (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 73 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

significant pressure under ideal conditions. Whether this situation could lead to a detonation is an open question. 4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin Another possible detonation scenario focuses on the elevator pit near the FGAN bin. A fiberglass lid covered the pit, and the floor sloped away from the pit to prevent runoff from entering it, but the fire might have melted the cover, and FGAN remnants could have been in the pit. The typical elevator mechanism would not provide any areas for strong confinement leading to high pressures, nor does it seem plausible that a small detonation in the pit could have initiated the main FGAN pile. If the detonation began in the pit, then the most feasible mechanism would be a collapse of the west wall of the bin, spilling FGAN into a mixture of burning rubber from the melted elevator belt and residual FGAN in the bottom of the pit. The mass of the falling FGAN, combined with the strong confinement of the concrete pit walls, might have provided the conditions for a solid phase DDT beginning in the bottom of pit and spreading into the main pile. The likelihood of sufficient FGAN near the door, where the pit was located, seems quite low. Liquid FGAN, if it somehow leaked into the pit, would have been under confinement conditions similar to those for liquid in the bin, with no obvious areas where pressure could build. The elevator itself is a belt with cups protected by a sheet metal box open at the top and bottom. The belt that brought the material in from the unloading pit outside provides no obvious containment other than the rollers, which are often hollow metal. Unlike the rollers above the bin, these rollers would have been shielded from the heat of the main fire but could have been heated by a fire (if it existed) in the pit. Molten and contaminated FGAN on the floor, initiated by an explosion from a burning loader, was suspected in the 1973 Cherokee FGAN storage explosion, but no known source of an initiating detonation existed at the WFC, and the detonation at Cherokee did not propagate into the main pile. The circumstances of the two accidents were too different to draw any firm conclusions about the role of molten AN in the detonations. Other fires involving FGAN (such as the fires in Bryan, Texas, and Athens, Texas) did not result in detonation, even though the fires totally consumed the structures housing the FGAN bins and the roofs collapsed. This evidence demonstrates the unpredictable behavior of FGAN exposed to fire. Possible differences between the fire incidents and the WFC are ventilation of the fire, which determines the degree of contamination from smoke products; level of confinement in the bin; and degree of direct heating on the FGAN pile. 4.4 Forensic Testing of West Fertilizer Company Samples On the day before the explosion, the WFC sold 8,000 pounds of an FGAN/AS blend of fertilizer to a farmer in Abbot, Texas. The farmer told CSB investigators that the fertilizer he received, which he estimated was about 75 percent FGAN and 25 percent AS, was dustier than usual during spreading. After

West Fertilizer Company Final Report January 2016 74 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the incident, the Office of the Texas State Chemist (OTSC) retained a portion of the fertilizer and provided a sample to CSB for further testing. The OTSC is part of the Texas A&M University System and administers the requirements of the Texas Feed and Fertilizer Control Service. The OTSC regulates the sale of fertilizer and also conducts laboratory testing of FGAN to ensure that it meets quality guidelines for fertilizer. The OTSC conducted testing of the samples and shared the results with CSB. The OTSC spectral analysis found no activated carbon or any evidence of contamination of the FGAN sample. According to the report, the testing concluded that the sample was a mixture of FGAN and AS. The OTSC ran a nitrogen analysis in the state’s combustion laboratory; this is a routine test run by the OTSC to check the concentration of nitrogen in fertilizers. The OTSC determined that the amount of nitrogen contained in the FGAN/AS sample mixture had nitrogen percentages that ranged from 34.33 to 34.61 percent.94 The laboratory also conducted tests to determine the particle size distribution of the prills in the farmer’s FGAN/AS sample. Results verified that the FGAN/AS samples had high concentrations of fines (smaller broken-down prills). Approximately half (50 to 55 percent) of the farmer’s sample consisted of particles smaller than 200 micrometers (0.2 millimeters). Operating under the assumption that the farmer’s sample was a blend of FGAN and AS prills, the laboratory obtained a control sample of FGAN and AS mixed in 70:30 portions, respectively. The control sample contained 10 percent particles smaller than 200 micrometers. Although the farmer’s sample included a larger than usual number of fines, the particle sizes in this sample are not necessarily representative of the FGAN in the main bin at the WFC because of the addition of AS to the farmer’s mixture. Mechanical action such as blending might have taken place when creating the FGAN/AS mixture, reducing the particle size, and further breakage might have occurred during transit. CSB investigators collected samples of the fertilizer remaining at the WFC facility and the OTSC and in March 2015 commissioned a forensics laboratory to characterize the composition of eight samples by semi-quantitative analysis. Samples 1 through 5 were categorized as solidified and pulverized fertilizer collected from various bins (Figure 44); sample 6 was collected from the FGAN railcar on the WFC property that was the least disturbed by the explosion and firefighting efforts (Figure 45); and samples 7 and 8 were collected from the FGAN mixture purchased by the farmer on the day before the incident (Figure 46). According to shipment records, the railcar contained pure FGAN manufactured by CF Industries. The railcar arrived at the WFC site in early April 2013. At the time of the incident, the WFC had not yet unloaded the railcar. The WFC also received truckloads of EDC pure FGAN product in early April 2013. CSB is unable to conclude whether the CF Industries or EDC product, or a mixture of both, was present in the FGAN main bin at the WFC facility at the time of the explosion.

94 The percent of nitrogen (34 percent minimum) is typical for a high-density FGAN prill.

West Fertilizer Company Final Report January 2016 75 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: Forensic Laboratory)

Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory)

Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory)

West Fertilizer Company Final Report January 2016 76 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The laboratory used infrared spectroscopy and electron microscopy methods to determine the elemental compositions of each sample. Results of this testing confirmed the presence or absence of AN and other salts in some of the samples. Four of the eight samples (1, 2, 3, and 5) contained no FGAN (Table 4). The sample collected from the railcar (no. 6) was determined to contain wholly AN with 36 percent95 nitrogen and had a prill density of 1.59 grams per cubic centimeter (g/cm3).96 The railcar sample consisted of prilled particles with a polyolefin coating, which is commonly applied to reduce caking.97 Magnesium nitrate or magnesium oxide is also occasionally used as an additive to FGAN prills during the manufacturing process.98 The purpose of the additive is to act as a desiccant (absorbs moisture) and also to protect against the breakdown of prills at higher temperatures.99 CSB concluded that the chemical composition of the FGAN obtained from the rail car (no. 6) was typical of FGAN prills commonly used for fertilizer and for creation of fertilizer blends.

Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC

95 FGAN prills typically contain about 34 percent nitrogen. The 36 percent nitrogen result in the sample is likely attributed to the percent error in the analytical method used. The laboratory conducted a linear regression analysis to determine the percentage error in the determination of elemental sulfur in the FGAN/AS samples compared to a control sample, and it estimated the error to be within +/- 0.3 percent of the sample. The laboratory concluded that the percentage error estimates would be similar for oxygen and nitrogen in the samples that underwent electron dispersive spectroscopy (EDS) methods. 96 FGAN is a higher-density prill in the range of 1.72 g/cm3. 97 According to the FGAN Safety Data Sheet (SDS) from CF Industries, the FGAN prills contain a 0 to 0.2 percent proprietary polyolefin conditioning agent. 98 Ammonium nitrate particulate fertilizer and method for producing the same. See: http://www.google.com/patents/US5720794 (accessed on November 25, 2015). 99 U.N. Industrial Development Organization. Fertilizer Manual, 3rd Edition. The Netherlands: Kluwer Academic Publishers, 1998: 227. No. Sample Location (if known) Sample Description Detected Compounds FGAN Detected 1 Unknown White and pink encrusted and prilled layers AS, magnesium phosphate (with iron), potassium sulfate No 2 Ammonium phosphate/potassium chloride bin White prilled particles, pink fragmented particles, and grey encrusted particles AS, ammonium phosphate, and possibly potassium chloride No 3 Space between FGAN and potassium chloride bins Dark pink fragments Ammonium phosphate, sulfate, alkali salts of fluoride, trace iron No 4 Backside of diammonium phosphate bin White powder with red streaks AN, AS, chlorides, ammonium phosphate, and trace amounts of potassium chloride Yes

West Fertilizer Company Final Report January 2016 77 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The FGAN/AS mixture purchased by the farmer on the day before the incident was the only available sample representative of materials stored in the fertilizer building before the incident. In addition to the testing conducted by the OTSC to determine the percentage of nitrogen and quantity of fine in these samples, CSB commissioned additional laboratory testing of the prills contained in the FGAN/AS mixture (samples 7 and 8 in Table 4) in October 2015. Because the FGAN sample from the railcar on the WFC property remained relatively undisturbed during the fire and explosion, the laboratory also selected a prill from that sample (no. 6 in Table 4) for comparison. An image from a macroscopic examination of an individual prill from sample items 6, 7, and 8 is shown in Figure 47. Item 6, which was collected from the railcar, had a smooth and uniform coating-like texture, whereas evidence items 7 and 8, which were sampled from the farmer’s mixture, had an uneven surface made up of an agglomeration of amorphous (formless) and semicrystalline particles.

Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory) 5 Backside of ammonium sulfate bin Sample containing gravel and pebbles (separated before analysis) AS, sulfates, and chlorides No 6 Railcar White prilled particles Prilled AN coated with polyolefin Yes 7 Farmer AS/FGAN mixture White prilled particles (partially agglomerated from wetting) AN, AS, sulfate, extractable polyolefin Yes 8 Farmer AS/FGAN mixture White prilled particles AN, AS, sulfate, extractable polyolefin Yes

West Fertilizer Company Final Report January 2016 78 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Under a microscope, the polyolefin coating was visually apparent on the surface of the item 6 prill. Through infrared spectral analysis, the laboratory was able to chemically identify the external prill coating as a polyolefin. However, the external polyolefin coating on the surface of sample items 7 and 8 could not be identified through the same analysis. To determine whether a coating had been present, the laboratory quantitatively extracted residues from the prills in a solvent that could be analyzed through infrared spectra analysis. Although direct surface scans of items 7 and 8 did not reveal the presence of the coating, solvent extracts indicated the presence of a polyolefin. This coating could have been applied to the prills at some point in time but was no longer acting as a prill coating on the observed sample items 7 and 8. 4.5 Blast and Impact Analysis CSB commissioned a consultant firm to survey the property damage to the WFC and the surrounding community. On the basis of information obtained from the survey, the consultants characterized the force of the blast and estimated the energy produced during the explosion. Using indicators from the observed damage to residences and community structures, the consultants applied a guideline100 from the U.S. Army Corps of Engineers and created a three-dimensional model to predict the blast overpressure and determine the explosive weight that was best explained by the physical damage observed in West, Texas. The computational models and calculations expressed the AN explosive energy estimation normalized against the explosive power of TNT,101 a high-explosive compound commonly used to quantify blast loads. A TNT equivalence calculation provides an approximation of explosive energy in pounds of TNT. Several TNT equivalent equations are used in industry that employ actual and estimated explosion parameters such as heat capacity, weight of explosive charge, and explosion percent efficiency. Many of the parameters are specific to the material involved. TNT equivalent values are a rough approximation of explosive effects, and the variability of TNT equivalence (20 to 40 percent) might be a result of the ways that it is calculated based on pressure, impulse, crater size, or other damage measures.102 The blast modeling consultants estimated the range of potential explosive yields from the WFC explosion to be equivalent to a range of 20,000 to 40,000 pounds of TNT, based on the blast damage indicators recorded and analyzed from 20 lightweight metal buildings, the deformed basketball goalposts, and the condition of the apartment complex and nursing home. To further refine a specific explosive weight most consistent with all of the observed damage, the consultants used another modeling tool that incorporates a number of different blast prediction methodologies, including the development of a computational fluid dynamic simulation to characterize the shock wave as it wrapped around structures and other obstacles during the explosion. The CSB-

100 U.S. Army Corps of Engineers. “Estimating Damage to Structures from Terrorist Bombs Field Operations Guide,” ETL 1110-3-495. Washington, DC: U.S. Army Corps of Engineers, 1999. 101 One ton of TNT has an explosive energy of 4.184 gigajoules. 102 National Assessment Group. “Ammonium Nitrate Detonability Review and Assessment, Final Report.” Prepared for the Technical Support Working Groups, For Official Use Only. Kirtland AFB, NM: September 2, 2011: 7.

West Fertilizer Company Final Report January 2016 79 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

commissioned blast experts determined that the explosive energy of the WFC explosion that is most consistent with the observed damage is 25,000 pounds (12.5 tons) of TNT. With an estimated 30 tons of FGAN in the main WFC bin at the time of the blast, the 12.5-ton TNT equivalent is based on a 42 percent efficiency of the material that contributed to the explosive energy. Because the quantity of FGAN consumed in the fire before the explosion was not determined, the exact quantity of FGAN that contributed to the explosion remains unknown. The ATF National Response Team also requested that the U.S. Army Engineer Research and Development Center (ERDC) conduct an assessment of the WFC explosion damage and then estimate the equivalent explosive yield of the blast. The ERDC team arrived in West on April 29, 2013. As part of the site study, the ERDC team conducted a detailed survey of the crater left by the explosion (Figure 48), using survey and three-dimensional scanning equipment to verify critical dimensions. The shape of the crater was asymmetric, with an apparent diameter of 75 feet and a depth of nearly 8 feet (Figure 49).

Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB)

West Fertilizer Company Final Report January 2016 80 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) The ERDC team compared the field crater measurements with experimental data for blast craters and other sources to produce an estimate of the net explosive weight of the FGAN. The experimental data also took into consideration the near-surface geology (soil type and underlying rocks) surrounding the explosion, which has an effect on the crater depth and size. The ERDC team compared the crater dimensions and soil types from the WFC explosion with similar experimental data to estimate the explosive weight of FGAN. The final report on this analysis concluded that this method entails a degree of uncertainty because none of the experimental data included the type of soil with limestone found in Texas.103 In addition, the experimental charge was C-4, which might have a different explosive or cratering efficiency than FGAN. The ERDC team made assumptions to account for the lack of available data and, on the basis of the crater analysis, estimated the WFC explosion to be within the range of 10,000 to 21,500 pounds of TNT. The center of the crater was almost directly under the WFC facility’s main FGAN bin, which was likely the source of fuel for the explosion. This main bin contained an estimated 20 to 30 tons of FGAN at the time of the incident; however, the blast analyses from consultants hired by CSB and from the Army Corps of Engineers indicate that the quantity of FGAN that contributed to the explosion could have been smaller, based on the observed damage. To demonstrate the location of the crater in reference to the fertilizer storage building and the main FGAN bin, CSB commissioned a structural engineering firm to create a three-dimensional rendering of the fertilizer facility over the crater location (Figure 50).104 Figure 51 shows an elevation view of the fertilizer building, with the underlying crater.

103 The soil at the WFC consists of limestone with varying amounts of chalk and clay. This soil type is consistent with what would be expected in West, Texas. 104 Crater and building location are estimated to be within +/- 2 feet, based on global positioning information.

West Fertilizer Company Final Report January 2016 81 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering)

Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering) 4.5.1 Seismic Data According to the United States Geological Survey (USGS), the WFC explosion registered as an earthquake of magnitude 2.1 on the Richter scale. The Lake Whitney seismic station in Meridian, Texas, about 25 miles west-northwest of the WFC site, recorded seismic signals from the April 17, 2013, explosion. ATF concluded that there were two separate explosions, “one smaller and one larger,” based

West Fertilizer Company Final Report January 2016 82 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

on eyewitness accounts and seismic evidence.105 After conversations with USGS seismologists, CSB later learned that a system error occurred, and only one event was recorded at the Lake Whitney station. According to USGS, seismic signals resulting from the WFC explosion were recorded on nine seismic stations within a range of 25 to 360 miles. Using the onset time of the seismic energy at these stations and the known location of the explosion, the USGS National Earthquake Information Center estimated that the time of the explosion was 7:50:38 pm local time. According to USGS, the seismic data recording shows both energy that propagated through the earth as well as later-arriving energy that propagated through the air (Figure 52). USGS concluded that the event was a single large explosion, but it could not rule out the possibility of multiple closely timed explosions.

Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National Earthquake Information Center (Source: USGS) 5.0 Commercial Property and Liability Insurance The West Fertilizer Company (WFC) had commercial property insurance to cover losses (such as building damage, damage to product, or loss of income due to property damage) from certain loss events, such as fires. The company also held a commercial liability insurance policy to protect itself against claims for bodily injury while onsite or while operating company automobiles. CSB examined available documentation of the WFC’s insurance coverage and inspections from 2007 until the April 2013 explosion. The WFC was insured by two different insurance companies, Triangle Insurance Company,

105 ATF. “ATF Press Conference Video,” May 16, 2013, minute 12:45. See: http://www.youtube.com/watch?v=OpLjSvcRqzU (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 83 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Inc. (Triangle) and the United States Fire Insurance Company (U.S. Fire). Triangle issued policies that included coverage for property damage, business interruption, bodily injury, and automobile accidents from 2007 to the end of 2009. In late 2009, Triangle decided not to renew the insurance policy because of the WFC’s lack of compliance with loss control recommendations. The WFC insurance policy expired on December 31, 2009. Thereafter, the WFC obtained similar coverage from U.S. Fire in January 2010 and renewed it in 2011, 2012, and 2013. The U.S. Fire insurance policy was in effect at the time of the 2013 explosion. 5.1 Triangle Insurance Coverage and Audits (2006–2010) Triangle conducted an initial onsite survey of the WFC facility in 2006 and provided insurance coverage from 2007 until 2010. The WFC had a $1 million commercial general liability policy and $2 million in coverage to cover onsite property and business losses. In 2009, Triangle gave notice to the WFC that it was not renewing the policy because of the WFC’s lack of compliance with loss control recommendations issued by Triangle following several onsite audits. Triangle conducted annual loss control surveys at the WFC facility from 2006 through 2009, and it issued a number of recommendations for suggested improvements to WFC operations. The Triangle loss control surveys included an evaluation of WFC automobiles and drivers, storage and application of dry and liquid fertilizers, grain and feed milling, and anhydrous ammonia. CSB investigators requested and reviewed insurance documentation from Triangle, including risk profiles, insurance audit reports, and communications from Triangle to the WFC. In 2006, Triangle performed an initial survey of the WFC facility before issuing coverage. Triangle loss control specialists made four recommendations to the WFC for safety improvements, including replacing missing guards on augers and conveyors and addressing visual damage to one of the grain bins. Triangle’s overall risk assessment categorized the facility as average, with housekeeping, maintenance, and grounds in average to fair condition. During the anhydrous ammonia survey, Triangle noted the close proximity of the WFC facility to schools, residences, and businesses and also documented concerns about the ammonia risk management plan (RMP) being out of date (discussed in Section 8.4.2.4). Triangle assigned a representative to work with the WFC to update and improve the RMP submission. In 2007, Triangle conducted another loss control survey and submitted 10 recommendations to the WFC; 4 of the 10 recommendations were restated from the 2006 survey because they remained unresolved. The loss control specialist identified several safety and compliance issues, including: • A corroded 440-volt wire ran from the pole on the north side of the plant through the bulk fertilizer facility to the anhydrous ammonia tank area on the south side of the facility. • An aluminum ground wire showed noticeable signs of corrosion from the fertilizer. The loss control specialist noted that the wire could lose its ability to ground, potentially causing shock and fire hazards (Figure 53). • Several temporary lighting sockets needed to be wired in permanently to reduce the potential for electrical shocks and fire hazards.

West Fertilizer Company Final Report January 2016 84 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

About 2 months later, the WFC responded to some of the Triangle recommendations and reported that 3 of the 10 recommendations were resolved, including replacing guards and repairing an electrical cord on an auger. The remaining seven recommendations, including the exposed 440-volt wire, remained outstanding. The Triangle loss control specialist’s overall opinion of risk, documented from this survey, was fair; housekeeping received a fair rating; and maintenance received a fair to poor rating.

Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey (Source: Triangle Insurance Company) In September 2008, a loss control specialist from Triangle conducted another renewal survey and made 14 recommendations, including several outstanding recommendations from the previous year. During this survey, Triangle identified additional damaged electrical wires at the facility in need of repair (Figure 54). The WFC submitted a completed recommendation form to Triangle later that month, stating that seven recommendations were addressed or in the process of being settled.

West Fertilizer Company Final Report January 2016 85 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey (Source: Triangle Insurance Company) In August 2009, Triangle identified six additional recommendations during the annual loss control survey. One recommendation was restated and designated as “critical” for a lack of safety chains on towing equipment. The Triangle consultant also noted that the WFC “seems to be resistant” to implementing a training program to address the frequency of vehicle and mobile equipment accidents. Triangle documented a large quantity of temporary exposed wiring in the WFC facility that needed to be run in conduits. When evaluating WFC safety programs in 2009, Triangle noted that the company had no positive safety culture and that “written programs are incomplete and outdated, there is no structured safety program.” In addition, Triangle found no accident investigation program and no evidence that the WFC held regular safety meetings for employees. The following excerpt from the 2009 survey indicates Triangle concerns: They need a SCMP (Safety and Compliance Management Programs) person to help them with safety issues, permits, etc. To my knowledge they have not had a safety meeting since we started insuring them in 2006…I have a concern with the wiring at both grain operation & the dry fertilizer plant. Only about 10% is run in conduit. The rest consist of a heavy flexible 4-wire cable, the type you would normally use to put outside on poles but it is not protected from cuts & abrasion.106 In September 2009, the loss control specialist stated in an internal Triangle email that “because of losses and non-compliance of recommendations, Triangle should non-renew Adair Grain, Inc./West Fertilizer Co. in West, Texas.”107 In September 2009, Triangle sent notification to the WFC that all policies would not be renewed for the following year. In 2010, the WFC retained U.S. Fire for insurance coverage.

106 Triangle Insurance Company Documentation, Loss Control Survey at Adair Grain/WFC. August 2009. 107 Triangle Representative. “Adair Grain,” email message to manager, Underwriting Services Triangle, September 14, 2009.

West Fertilizer Company Final Report January 2016 86 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards

CSB reviewed the WFC loss control survey documentation and the Triangle “Loss Control Best Practice Manual” for insurance inspectors and found no focus on FGAN fire and explosion hazards between 2006 and 2009. In the 2006 survey and subsequent surveys, Triangle documented the presence of ammonium nitrate (AN) onsite for security concerns and answered, “Yes” to the question, “Does the account meet state regulations for the storage and transportation of product?” Although no state-specific regulations for AN storage existed at the time, the survey did not include federal regulations, such as the OSHA Explosives and Blasting Agents standard (29 CFR 1910.109, discussed in Section 8.2), or industry consensus standards, such as National Fire Protection Association (NFPA) 400, Hazardous Materials Code (addressed in Section 8.6.1). Triangle guidance included a description of combustible and noncombustible bulk fertilizer storage buildings for informational purposes, but Triangle did not provide guidelines or requirements for specific storage practices, such as separation from potential contaminants, materials of construction, or mechanism for fire and explosion prevention. Other survey focus areas, such as grain milling and anhydrous ammonia, included a more detailed review of federal requirements, such as the OSHA Grain Handling Facilities Standard (29 CFR 1910.272) for the prevention of grain dust explosions and the EPA Risk Management Program rule for anhydrous ammonia storage. In November 2013, Triangle updated the best practice manual to include compliance with federal regulations in addition to state regulations for fertilizer storage and transportation. 5.2 U.S. Fire Insurance Coverage and Audits (2010–2013) U.S. Fire started providing insurance to the WFC in 2010 and renewed coverage for 2011, 2012, and

1. The WFC was insured by U.S. Fire at the time of the April 2013 incident. The WFC general

liability policy had a maximum limit of $1 million, and the commercial property insurance policy had a limit of about $4.45 million, which included all buildings and equipment on the WFC property. In 2013, the WFC held U.S. Fire coverage for commercial property, general liability, inland marine,108 and commercial automobile. According to the insurance policy documentation for the WFC, U.S. Fire offered policyholders a loss control service that included onsite surveys of the facility to provide: • Safety information and educational material to minimize loss costs. • Initial survey and evaluation. • Specific suggestions for improving loss control practices. • Consultation and training to help management understand hazards associated with operations. • Follow-up surveys.

108 Commercial inland marine insurance covers property in transit or property that is movable or portable and is not at a fixed location.

West Fertilizer Company Final Report January 2016 87 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB requested additional information from U.S. Fire related to the WFC insurance policy, including claims, audits and inspections, and training requirements for U.S. Fire loss consultants. CSB also requested documentation of U.S. Fire’s onsite inspections at the WFC facility over the time period it was insured. To date, U.S. Fire has not provided CSB with the requested documentation. Outside counsel for U.S. Fire indicated to a CSB investigator that the $1 million policy amount did not necessitate much onsite activity, such as audits or inspections, during the time that the WFC was insured. 109 5.3 Insurance Claims and Other Aid after the Explosion The Texas Department of Insurance (TDI) regulates the business of insurance in Texas and provides resources for people and businesses to obtain insurance in the state. In response to the WFC explosion, TDI assisted in securing the scene and mobilizing a disaster response program to assist consumers with filing insurance claims related to the incident. The Texas State Fire Marshal’s Office (SFMO) and the Division of Workers’ Compensation are units within TDI. The total insurance-related losses due to the explosion are estimated to be in the range of $230 million.110 Many of the residents in the area did not have home or rental insurance. Those individuals relied on aid from FEMA, Salvation Army, and American Red Cross operations. FEMA received a total of 1,108 applications for assistance as a result of the fire and explosion at the WFC facility.111 Nearly 6 months after the incident, FEMA112 reported providing federal disaster assistance exceeding $16 million to eligible survivors. This sum included more than $9 million in federal disaster loans from the U.S. Small Business Administration (SBA), nearly $840,000 in individual assistance grants from FEMA, and more than $6.2 million in FEMA Public Assistance funding.113 Low-interest disaster assistance loans from the SBA114 were also available to homeowners, renters, businesses of all sizes, and private nonprofit organizations whose property was damaged or destroyed by the incident. On the basis of data provided by FEMA, 580 applications were submitted for individuals or families that had homeowners, homeowners with small business loans, and mobile home insurance. FEMA verified losses totaled about $9,052,308. The real property FEMA verified losses amounted to about $8,145,750. The personal property FEMA verified losses totaled roughly $906,557. Although all losses related to the fire and explosion totaled nearly $250 million, the

109 Outside Counsel for U.S. Fire, conversation with CSB Investigator, January 20, 2015. 110 Texas House of Representatives, 84th Texas Legislative Session. Testimony on House Bill 2470. See: http://www.house.state.tx.us/video-audio/committee-broadcasts/ (accessed on January 6, 2016). 111 Official data provided by FEMA. 112 FEMA—under the authority of Section 408 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. § 5174, and Title 44 of the Code of Federal Regulations (CFR)—may provide financial assistance and, if necessary, direct services to eligible individuals and households that, as a direct result of a major disaster, have necessary expenses and serious needs and are unable to meet such expenses or needs through other means. 113 See: http://www.fema.gov/news-release/2013/10/07/federal-disaster-assistance-tops-16-million-west-texas (accessed on January 6, 2016). 114 The SBA serves as the Federal government’s primary source of money for the long-term rebuilding of disaster- damaged private property. These disaster loans cover uninsured and uncompensated losses and do not duplicate benefits of other agencies or organizations.

West Fertilizer Company Final Report January 2016 88 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC carried a policy from U.S. Fire at the time of the incident with a limit of only $1 million for bodily injury and offsite property damage. 5.4 FGAN Facilities in Texas and the Potential for Offsite Consequences Under the Texas Commercial Fertilizer Rule (described in Section 8.7.1), facilities that sell or offer to sell FGAN or FGAN-containing materials must obtain annual registrations from the Office of the Texas State Chemist (OTSC) to do business. The OTSC collects information on each facility storing more than 10,000 pounds (5 tons) of AN in Texas. According to the OTSC list of facilities as of September 2014, 80 facilities statewide stored AN in quantities exceeding 10,000 pounds. Of those 80 facilities, 43 stored FGAN, and 37 stored technical grade ammonium nitrate (TGAN). In October 2015, the OTSC reported 40 FGAN facilities in Texas.115 Of those 40 facilities, only nine (23 percent) are located in jurisdictions with an adopted fire code. CSB found that West, Texas, is not the only town in the state with FGAN storage in close proximity to residential areas, schools, and hospitals. In fact, some of these occupancies are directly adjacent to, or across the street from, FGAN storage. Because the WFC operated in close proximity to schools, residences, and a nursing home, CSB plotted the 40 FGAN storage facilities in Google Earth™ to determine whether FGAN storage facilities are also in close proximity to residential areas, schools, or other large population clusters. CSB found that 19 (48 percent) of the facilities storing more than 10,000 pounds of FGAN are located within 0.5 miles of a school, hospital, nursing home, or a combination of those occupancies. Of the 40 FGAN facilities, 33 (83 percent) of the FGAN storage facilities are located within 0.25 miles of a residence or apartment building.116 The WFC facility was about 550 feet (0.16 miles) from the closest school, which sustained catastrophic damage as a result of the explosion, which could have resulted in additional loss of life had the school been in session at the time of the incident. CSB identified one other school in Texas that is 529 feet (0.12 miles) from an FGAN storage facility, even closer than the school destroyed in West, Texas (Figure 55). Of the 40 FGAN storage facilities, 16 (40 percent) are within 0.5 miles of an elementary school, secondary school, or high school (Figure 56).

115 CSB noted that two new FGAN facilities registered with the OTSC between September 2014 and October 2015 and that five facilities were listed in September 2014 that did not register to sell FGAN in October 2015. 116 The closest structures with obvious characteristics of a private residence were selected for this measurement using Google Earth and Google Street View.

West Fertilizer Company Final Report January 2016 89 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

529 Feet FGAN Facility School

Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: Google Earth)

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) Within 1 Mile of a Texas School (Source: CSB) 0 2 4 6 8 10 12 14 16 18 Less than 0.25 miles (< 0.4 km) 0.25 to 0.50 miles (0.4 to 0.8 km) 0.50 to 1 mile (0.8 to 1.6 km) Greater than 1 mile (> 1.6 km) Number of Texas FGAN Facilities Distance to Schools Fire Code No Fire Code

West Fertilizer Company Final Report January 2016 90 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The West Rest Haven nursing home was located about 600 feet from the WFC facility and sustained irreparable damage as a result of the blast. CSB measured distances between Texas FGAN storage facilities and nearby hospitals and nursing homes and found that 38 percent of the facilities are within 1 mile of a nursing home or hospital. In one case, a fertilizer facility is adjacent to a 50-bed hospital and a residence, also a few blocks from a school (Figure 57). Hospital 278 Ft. FGAN Facility Residence 220 Ft. School 1432 Ft.

Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School (Source: Google Earth) Findings from the analysis of the proximity of FGAN storage facilities to various community structures show that the risk to the public from a catastrophic incident exists throughout the state of Texas. Injury data published by the Waco-McLennan County Health Department supported the conclusion that people within 1,500 feet (or 0.28 miles) from the blast epicenter were the majority of those injured in the WFC fire and explosion, particularly those who were inside a structure at the time of the blast.117 5.5 Limits of Insurance Coverage in Texas Property and liability insurance companies can complement government oversight of industry by identifying hazards and reducing losses through the insurance process. In some ways, insurance can

117 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014).

West Fertilizer Company Final Report January 2016 91 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

augment government standards and safety monitoring.118 The insurance industry provides coverage for losses at established premiums but also has an incentive to reduce and manage risks. Insurers perform functions of risk reduction and risk management by using tools such as auditing and inspecting their clients, managing loss prevention efforts, analyzing loss histories, identifying causes of accidents, and teaching clients how to avoid premium increases (or how to secure premium reductions).119 Insurance reinforces existing government regulations by expecting that policyholders comply with existing requirements. This approach can be effective at reducing risk and preventing incidents because annual insurance audits can be more frequent than state or federal enforcement inspections, such as those by SFMO or OSHA. Texas law does not require facilities that store FGAN to obtain commercial general liability or property insurance; however, the WFC voluntarily obtained insurance. The WFC’s $1 million general liability policy with U.S. Fire did not include excess or umbrella coverage for the consequences of serious incidents, such as bodily injury and property damage. If the WFC is found responsible for this incident in civil cases, its insurance would not be sufficient to pay the full amount of insurance claims for the catastrophic consequences caused by the blast. Texas law requires some businesses to have liability insurance for operations that potentially pose a lower level of public risk than the WFC incident (Table 5). Air conditioning and refrigeration contractors, mold assessors, and plumbers are some of the businesses or services subject to commercial general liability requirements in Texas. For amusement ride owners and operators, Texas set the minimum requirements for insurance at $1.5 million per occurrence and requires proof of insurance to operate an amusement ride. For an amusement park ride to operate in the state, the ride must be inspected at least annually by the insurer.120 The ride also must meet the standards for coverage and have an adequate amount of insurance coverage.121 Operators of amusement park rides annually must file copies of the inspection certificate and insurance policy with the TDI Commissioner. The Texas amusement ride regulation also requires operators of coin-operated rides and bounce houses to obtain liability insurance. However, FGAN storage facilities such as the WFC facility can operate next to schools, residential areas, and hospitals with little or no general liability insurance. Adequate levels of coverage would likely prompt rigorous onsite loss control audits by insurers.

118 Ben-Shahar, Omri, and Kyle D. Logue. “Outsourcing Regulation: How Insurance Reduces Moral Hazard,” Michigan Law Review 111:2 (2012); University of Michigan Law and Economics Research Paper No. 12-004; University of Chicago Institute for Law and Economics Olin Research Paper No. 593. See: http://ssrn.com/abstract=2038105 (accessed on January 6, 2016). 119 Ibid. 120 Texas Occupations Code, § 2151.101, “Regulations of Amusement Rides: Requirements for Operation.” See: http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.2151.htm (accessed on August 4, 2015). 121 Ibid.

West Fertilizer Company Final Report January 2016 92 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 5. Minimum Insurance Requirements in Texas122 Business/Operation Minimum Amount Amusement ride operators $1.5 million Elevator/escalator contractors $1.5 million123 Mold assessors and remediators $1 million124 Electricians $600,000125 Residential appliance installers $600,000126 Plumbers $300,000127 Tow truck operators $300,000128 Structural pest control providers $300,000129 Used automotive parts recyclers $250,000130 Air conditioning service providers $200,000131

Previous incidents in Athens, Bryan, and West have demonstrated the risk imposed by FGAN facilities on Texas communities and the public. In the absence of a state fire code, there is limited state oversight to ensure that facilities are addressing conditions that could potentially lead to an incident similar to the WFC fire and explosion.

122 See: http://www.dallasnews.com/news/west-explosion/headlines/20130508-texas-makes-bounce-house-operators- carry-liability-coverage-but-not-plants-like-west-fertilizer.ece (accessed on January 6, 2016). 123 See: https://www.tdlr.texas.gov/elevator/Elevapp.pdf (accessed on January 6, 2016). 124 Texas Administrative Code Licensing Requirements. See: http://txrules.elaws.us/rule/title25_chapter295_sec.295.309 (accessed on January 6, 2016). 125 See: http://www.tdlr.texas.gov/electricians/forms/ElectricianCOI.pdf (accessed on January 6, 2016). 126 See: http://www.tdlr.texas.gov/electricians/forms/ELC012 Residential Appliance Installation Contractor License Application.pdf (accessed on January 6, 2016). 127 See: http://www.tsbpe.state.tx.us/common/CertificateofInsuranceForm-fillablefeb2012.pdf (accessed on January 6, 2016). 128 Administrative Rules of the Texas Department of Licensing and Regulation, § 86.400, “Insurance Requirements— Tow Truck Permits.” 33 TexReg 2940. New section adopted, effective April 15, 2008. 129 Texas Occupations Code, § 1951.312, “Liability Insurance.” See: http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.1951.htm (accessed on January 6, 2016). 130 See: https://www.tdlr.texas.gov/parts/aprrules.htm#8740 (accessed on January 6, 2016). 131 Proof of insurance is required only with an initial application for licensure, a change in license assignment (new company), or a request by the Department of Insurance.

West Fertilizer Company Final Report January 2016 93 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Triangle conducted annual inspections at the WFC facility and identified conditions that could result in potential losses, such as fires and worker injuries. Although Triangle did not focus specifically on hazards related to FGAN storage, it offered recommendations to the WFC to correct conditions, such as electrical hazards, that could result in a fire. CSB did not receive any documentation that U.S. Fire continued performing similar audits and inspections at the WFC facility after Triangle’s nonrenewal. It is not common for states to have prescriptive requirements for insuring specific industries. However, TDI does impose liability insurance and inspection requirements for amusement park rides and establishes minimum liability insurance coverage for certain operations and services, as listed in Table 5. CSB identified other FGAN storage facilities located in close proximity to community structures; however, the level of insurance carried by these facilities remains unknown. In response to the WFC incident, TDI conducted a voluntary survey of 95 Texas fertilizer facilities in June 2013 and requested the names of the companies that insure those facilities against general liability, property, and workers’ compensation losses. TDI received 12 responses to the 95 inquiries. Although the number of responses does not suggest that the remaining fertilizer facilities are uninsured, there is no way to determine whether these facilities have insurance policies that incorporate audits and inspections to focus on safe FGAN storage and handling conditions. On March 5, 2015, House Bill 2470 proposed amendments to the Texas Commercial Fertilizer Rules to require proof of liability insurance coverage for annual registration, similar to the requirements for amusement park rides. The bill proposed to amend the Texas Agriculture Code to require public liability insurance to produce, store, transfer, blend, or sell FGAN or FGAN-containing materials upon applying for a permit under the Texas Commercial Fertilizer Rules.132 However, this bill did not pass the state legislature. Without insurance and inspection requirements for FGAN facilities, operators can sell bulk quantities of fertilizer with little or no insurance coverage. The process of obtaining insurance could encourage both agricultural insurers and insured parties to assess current risks and to increase the awareness and rigor of insurance audits to ensure that companies are safely storing FGAN in accordance with guidance released as part of Executive Order 13650 (addressed in Section 8.1), OSHA standards, and industry consensus standards such as NFPA 400. Minimum coverage requirements will spur more realistic risk analysis by insurers that write coverage for FGAN bulk storage retail facilities. By providing agricultural businesses the guidance to identify and address FGAN hazards when underwriting and conducting annual loss control inspections, insurers can play a role in ensuring that FGAN facilities mitigate hazardous conditions.

132 The required liability insurance policy proposed by HB 2470 afforded bodily injury and property damage protection in an amount determined by TDI to compensate a person who incurred damages as a result of FGAN operations. The bill also directed TDI to coordinate with the Texas State Fire Marshal, Department of Health Services, Office of the Texas State Chemist, and other agencies to study the risk exposure for FGAN activities to determine the appropriate requirements for a liability insurance policy.

West Fertilizer Company Final Report January 2016 94 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 6 Insurance Services Office Rating

The Insurance Services Office (ISO)133 is an independent commercial enterprise and insurance industry advisory company that provides information, evaluation, and underwriting on safety and risk management related to community fire protection and building code effectiveness, serving insurance companies and other fire safety organizations. ISO adopts a public protection classification (PPC) system to develop fire insurance premiums for residential and commercial properties.134 ISO obtains information on municipal fire protection efforts in communities throughout the United States. Those data are then analyzed and evaluated for communities, using a standardized method and criteria known as the Fire Suppression Rating Schedule (FSRS). The FSRS assigns a PPC rating (from 1 to 10) to fire departments in each community. Class 1 represents exemplary public protection, and Class 10 indicates that the area’s fire suppression program does not meet ISO minimum criteria. ISO develops a split classification; for example, 5/9. The first class (Class 5 in the example) applies to properties within 5 road miles of a fire station and within 1,000 feet of a fire hydrant. The second class (Class 9 in the example) applies to properties within 5 road miles of a fire station but farther than 1,000 feet from a hydrant. ISO generally assigns Class 10 to properties farther than 5 road miles from a fire station. To determine a community’s PPC, ISO conducts a field survey, with ISO staff members visiting the community to observe and evaluate features of the fire protection systems. Using the FSRS, ISO objectively evaluates three major areas: fire department,135 water supply,136 and fire alarm and communication systems.137 When ISO allocates a high class rating to a fire department, ISO works with the affected fire department and the city to make improvements to the fire department, water system, and/or fire and alarm communication systems. Once these improvements are completed, the city then requests a new ISO reclassification. ISO reevaluates the city and then notifies the fire department of the new PPC rating. If a lower rating is received, the city notifies all homeowners and business owners to inform their insurance carriers to adjust their policies based on the new classification.

133 See: http://www.isomitigation.com/index.php/about-iso (accessed on January 7, 2016). 134 Insurance companies often rely on information from ISO about a community’s fire protection services to evaluate claims and damages. 135 A review of the fire department accounts for 50 percent of the total classification. ISO focuses on a fire department’s first-alarm response and initial attack to minimize potential loss. Here, ISO reviews items such as engine companies, ladder or service companies, distribution of fire stations and fire companies, equipment carried on apparatus, pumping capacity, reserve apparatus, department personnel, and training. 136 A review of the water supply system accounts for 40 percent of the total classification. ISO reviews the water supply that a community uses to determine the adequacy for fire suppression purposes. It also considers hydrant size, type, and installation as well as the inspection frequency and condition of fire hydrants. 137 An ISO review of the fire alarm system accounts for 10 percent of the total classification. The review focuses on the community’s facilities and support for handling and dispatching fire alarms.

West Fertilizer Company Final Report January 2016 95 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer

Company According to the West Fire Department, ISO rated the city of West at Class 5 before April 17, 2013. The pre-incident ISO classification and PPC rating of the West Volunteer Fire Department (WVFD) placed the city of West among the top 25 percent of all Texas communities (Figure 58). The average classification rating for communities and fire departments in Texas is Class 7.

Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO)138 On the national scale, the average PPC for cities, fire departments, and communities in the United States is Class 7 (the same as the average for Texas). The current ISO rating of the WVFD places the city of West among the top 30 percent of all communities nationwide (Figure 59).

138 See: http://www.isomitigation.com/index.php/ppc-program/how-the-ppc-program-works/facts-and-figures (accessed on December 20, 2015).

West Fertilizer Company Final Report January 2016 96 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO)139 Firefighters who responded to the WFC fire reported difficulty in extending their 4-inch fire hoses to the nearest fire hydrant, which was located at West High School, more than 1,500 feet from the burning fertilizer plant. A surviving firefighter testified that the emergency responders had to use one of their fire trucks as a connector line to reach the nearest fire hydrant at the high school. After dropping all of the hose lines on the engine, they discovered that they were about 700 feet short of the length needed to effectively fight the fire. Some of the volunteer firefighters then arranged to take the engine with hose and continue to string lines. One of the firefighters subsequently returned to the hydrant near the high school to attempt to establish a connection from the hose line to the fire hydrant. The explosion occurred just as the firefighter arrived at the fire hydrant, and he survived the explosion, although with severe injuries. The WFC plant was not incorporated into the West city limits,140 so an ISO assessment of the city of West did not capture the fertilizer plant as a high-risk facility. An ISO evaluation of the WFC plant would have increased the city’s ISO rating and would have compelled the insured residents141 and industrial facilities to carry higher homeowners and industrial hazard insurance premiums.142 The WFC

139 Ibid. 140 Section 9 discusses land use planning and zoning. 141 If the WFC plant had been included in the ISO rating, the city of West would have had a higher classification score, with an increased insurance premium for homeowners in West because of the proximity of the fertilizer plant to residential neighborhoods. 142 The rating directly impacts the premiums that insurance companies charge for commercial and industrial facilities as well as homeowner’s coverage. A lower ISO rating means a lower price for insurance coverage.

West Fertilizer Company Final Report January 2016 97 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

had insurance coverage of $1 million, without any prior evaluation from ISO. If ISO had evaluated the fertilizer plant, insurance underwriters would have charged a higher premium for the WFC plant based on the level of risks and hazards associated with the chemicals and operations at the WFC facility. Also, the ISO rating system would have revealed the distance from the nearest fire hydrant to the fertilizer plant, which would have increased the PPC rating. To obtain lower ISO PPC ratings, the city of West would have had to make adjustments by installing and regularly maintaining fire hydrants with ISO-minimum water flow rates closer to the fertilizer plant to enable ease of reach during emergencies.143 6.0 Inherently Safer Technology FGAN has certain risk characteristics that can make it inherently dangerous under some conditions. Ammonium nitrate (AN) by itself is a powerful oxidizer; when mixed with fuel oil, it can be used as an industrial explosive when exposed to fire or shock. Traditional safety practices to control FGAN fire and explosion hazards through procedures, hazard awareness, and emergency response are important. However, applying the concept of inherently safer technology (IST) or inherently safer design (ISD) can substantially reduce risk. IST and ISD are recognized approaches for decreasing risk by permanently reducing or eliminating the hazards associated with materials and operations used in an industrial process.144 Trevor Kletz, an acknowledged expert on IST and chemical process safety, defined IST as the avoidance of hazards rather than the control of hazards by adding protective equipment.145 Inherently safer processes can be achieved by strategies such as: • Substituting dangerous chemicals or processes with safer alternatives. • Simplifying processes. • Minimizing the quantity of a chemical on hand or in a process. • Moderating the operating conditions of a process. Before the widespread adoption of IST, plant designs in the chemical industry tended to address reduction of risk by relying on layers of protective equipment, procedures, and alarms.146 IST is preferable to adding layers of protection because, while this approach might reduce the likelihood or impact of an event, the inherent hazards remain.147 The concept of IST can be derived from a list of strategies for

143 To qualify for rating credit, fire hydrants must be capable of delivering a minimum of 500 gpm for 30 minutes. 144 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second Edition. New York: John Wiley & Sons, 2009. 145 Kletz, Trevor A., and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design. Boca Raton, FL: CRC Press, 2009. 146 Kletz, Trevor, and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design, Second Edition. Boca Raton, FL: Taylor & Francis, 2010. 147 Ibid.

West Fertilizer Company Final Report January 2016 98 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

reducing risk (Figure 60). IST is most effective when implemented during the earliest stages of the process design, but it can be applied at all stages of a life cycle (design, operation, shutdown, and demolition).148

Figure 60. Risk Control Hierarchy (Source: CCPS)149 Table 6 lists some IST approaches that can be applied to FGAN. Table 6. Inherently Safer Approaches for Handling FGAN150 Inherently Safer Strategy Description Examples Substitution Replacing a hazardous material with a safer option Use a fertilizer with less explosive potential than FGAN Minimization Reducing the quantity of a hazardous material used in a chemical process Store FGAN in purpose-built buildings holding smaller quantities of materials, well separated from one another and from potential sources of contamination Moderation Using a hazardous material under the least hazardous conditions Store FGAN in bins constructed of materials impervious to the effects of AN and in areas where electric service is not required Limitation of effects (a form of moderation) Changing designs or reaction conditions rather than adding protective equipment Construct FGAN storage bins to minimize the consequence of a possible explosion Simplification Eliminating process complexity to provide fewer opportunities for error and equipment failure Limit the types of FGAN blends sold to minimize the need for staff to handle FGAN.

148 National Research Council. The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience. Washington, DC: The National Academies Press, 2012. 149 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second Edition. New York: John Wiley & Sons, 2009: 3, 27. 150 Ibid.

West Fertilizer Company Final Report January 2016 99 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Once all hazards associated with a chemical process are identified and understood, IST can be applied in the design phase or to existing processes. According to Kletz, the concepts of IST are not sharply defined and can merge into each other, depending on how they are applied.151 Although not always feasible or cost-effective, substitution is often the most desired approach for reducing hazards because it involves replacing a hazardous material with a safer alternative. Minimization to reduce the quantity of a hazardous chemical stored or used within a process can often have a dramatic effect on risk, albeit usually only locally. The concept of moderation usually involves processing or storing chemicals under conditions that are less likely to add to or exacerbate risk—such as lower temperatures and pressures, removal of potential catalysts and sources of ignition, or use of materials of construction that minimize heat exposure near FGAN. In addition, the concept of simplification involves modifying procedures to reduce the likelihood of operator error and designing processes that require little or no operator actions to render the process safe in the event of a loss of control. The implementation of one or more of the inherently safer options, if feasible, can eliminate or minimize hazards instead of controlling them. IST might not eliminate all risks associated with a process, and some apparently inherently safer options might introduce new hazards that are of greater concern than those eliminated. For example, a reduced quantity of a hazardous chemical at a plant can lead to greater risk in transportation systems or at the originating plant. Elimination of large FGAN inventories at facilities similar to the West Fertilizer Company (WFC) is impractical because farmers rely on large quantities of fertilizer for their crops. Lower inventories could potentially introduce new hazards from the larger number of FGAN shipments needed to supply storage facilities. Accordingly, before implementation, IST options must be thoroughly analyzed and assessed, considering all risks and not only the interests of an individual facility. In terms of reducing the fire and explosion hazards associated with storage and handling of FGAN, two inherently safe measures are described in the rest of this section: (1) modify or substitute for the formulation of FGAN, making it less susceptible to fire or explosion, and (2) modify the conditions in which FGAN is stored to eliminate the possibility of a large fire and explosion. 6.1 Alternative Formulations of FGAN An alternative formulation of FGAN could reduce the potential for a detonation under fire conditions. However, more testing is necessary to ensure that these formulations are safer in bulk quantities, agriculturally compatible, and environmentally acceptable. In response to the 1947 FGAN explosion in Texas City, Texas, and to subsequent AN-based bombings across the United States,152 researchers have

151 Ibid. 152 Past AN-based bombings in the United States include the 1970 University of Wisconsin bombing, the 1990 Internal Revenue Service building bombing and other attempted bombings in California, the 1995 Murrah Federal Building bombing in Oklahoma City, and the 1996 attempted bombing of the FBI fingerprint database complex in Clarksburg, West Virginia.

West Fertilizer Company Final Report January 2016 100 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

explored several options for inerting or desensitizing FGAN to lower the detonation sensitivity of the material. One method introduced in 1968 claimed to render FGAN inert with the addition of 5 to 10 percent monoammonium phosphate and diammonium phosphate.153 However, in 1995, a test showed that the mixture was detonable with a larger charge diameter than the initially presented charge.154 In 1997, the International Fertilizer Development Center conducted a study for ATF to study the feasibility, practicability, and impact of making nitrate-based fertilizer chemicals inert. The study concluded that it is not feasible to inert AN without adversely affecting its effectiveness and efficiency as a fertilizer.155 In 1998, the National Research Council (NRC) released a report that addressed existing studies for inerting AN. The NRC examination concluded that FGAN with altered prill porosity, dilutants, or chemical additives could still be detonable156 and that no current technology would reduce the risk without seriously affecting the utility of AN as a fertilizer.157 The NRC recommends further examinations of the impacts of alternate formulations on agricultural suitability, costs to the end-user and environmental impacts of additives or inertants.158 Large quantities of inert materials mixed with AN might not be practical because of the cost and the reduction in fertilizer effectiveness. Adding a percentage of another chemical to AN can make it safer, but farmers might need to buy and transport more fertilizer to deliver the same quantity of nitrogen to their crops.159 CSB has reviewed documentation and publications that describe a few of those alternatives to AN based on the addition of inert chemicals (Table 7). Table 7. Examples of AN Fertilizer Alternatives Name Method Claims

153 Porter, S.J. “Method of desensitizing fertilizer grade FGAN and the product contained,” U.S. Patent 3,366,468, 1968. 154 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on June 26, 2014). 155 See: https://www.atf.gov/file/57516/download (accessed on January 20, 2016). 156 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on June 26, 2014). 157 Ibid. 158 Ibid. 159 Thompson, Steve. Dallas News. Quoting Bob Best, Pentagon scientist: “There are safer alternatives to FGAN fertilizer. But a safer form?” See: http://watchdogblog.dallasnews.com/2013/10/there-are-safer-alternatives-to- ammonium-nitrate-fertilizer-but-a-safer-form.html/ (accessed on June 26, 2014).

West Fertilizer Company Final Report January 2016 101 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Sulf-N® 26160 (ASN 26) FGAN fused with ammonium sulfate161 The addition of ammonium sulfate dampens the role of FGAN combustion.162 Ferti-Safe163 Fly-ash-coated and gypsum- coated fertilizer Detonation potential can be reduced or eliminated. Calcium ammonium nitrate (CAN) Mixture of FGAN and limestone (calcium carbonate) or dolomite (calcium magnesium carbonate) Some tests revealed less oxidizing capability than FGAN. CAN is less prone to thermal decomposition than FGAN.

Honeywell has developed a fertilizer called Sulf-N 26 (later marketed by J.R. Simplot Company as ASN 26), claimed to be inherently safer than FGAN. Sulf-N 26 is made of nitrogen and sulfur164 by fusing FGAN with ammonium sulfate (AS), a fire retardant. For the patent, tests were conducted according to United Nations Recommendations on the Transport of Dangerous Goods.165 The test method is designed to measure the potential for a solid substance to increase the burning rate or burning intensity of a combustible substance when the two are thoroughly mixed. The mixture of FGAN fused with AS did not burn in the test, and the mixture was not classified as an oxidizer. Sulf-N 26 contains significantly less nitrogen than FGAN (26 percent compared to 34 percent).166 This nitrogen level can be an issue for some farmers as the effective absorption rate of nitrogen is vitally important to plants. Sulf-N 26 also contains higher quantities of sulfur, which farmers can need for certain types of crops and soils but not for others. Further examination is necessary to fully assess the use of Sulf-N 26 as an inherently safer alternative to FGAN. Notably, a 50/50 mixture of AS and FGAN was involved in the 1921 Oppau, Germany, explosion. Researchers from the University of Kentucky developed a technology called Ferti-Safe to desensitize FGAN by coating it with an ash-like coal combustion by-product.167 They developed the technology with the intention of preventing the malicious use of FGAN for explosive devices. The Ferti-Safe formulation

160 Sulf-N 26 was not commercially available at the time of the WFC incident. 161 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 162 Ibid. 163 Ferti-Safe was not commercially available at the time of the WFC incident. 164 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 165 United Nations. Recommendations on the Transport of Dangerous Goods, Manual of Tests and Criteria, ST/SG/AC.10/11/Rev2, Section 34, Classification Procedures, Test Methods and Criteria Relating To Oxidizing Substances of Division 5.1, Test O.1: Test for Oxidizing Solids, 1995. 166 Bomgardener, Melody M. “Safer Fertilizer,” Chemical and Engineering News, December 6 (2011). See: http://cen.acs.org/articles/89/web/2011/12/Safer-Fertilizer.html (accessed on May-June 2015). 167 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National Institute of Hometown Security, Lexington, KY (2012).

West Fertilizer Company Final Report January 2016 102 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

involves coating FGAN with gypsum (calcium sulfate) and fly ash.168 Both coating options are claimed to be effective in stopping an explosion of a blend of ammonium nitrate/fuel oil (ANFO).169 Calcium ammonium nitrate (CAN) contains 26 percent nitrogen and about 25 percent inert calcium carbonate. Formulations of CAN have been used in Europe and other countries since the 1920s, but it is not manufactured in the United States. European safety data sheets state that CAN is not capable of self- sustaining progressive thermal decomposition.170 The scope of most existing studies on alternative forms of FGAN is focused on reducing or eliminating the security threats associated with using FGAN to construct improvised explosive devices with the addition of fuel oil, but such studies do not focus on FGAN used in agricultural operations. Although some of the available information on these options suggests that they might be inherently safer, only limited testing has been performed to characterize the behavior of the alternatives in fire situations similar to that at the WFC. FGAN is vital to the nourishment of crops across the country, and alternative formulations must also be capable of meeting agricultural fertilizer needs. Because of the lack of scientific literature to show that alternative formulations of bulk FGAN can resist detonation in fires, CSB concludes that FGAN detonations can currently best be avoided through better compliance with storage practices and the application of inherently safe building design and storage. 6.2 Inherently Safe Building Design and Storage In the United States, FGAN storage practices at facilities similar to the WFC have not significantly changed over time. Before the fires in Bryan, Athens, and West, these Texas FGAN facilities had similar construction, with combustible materials and construction and limited fire safety features. CSB visited another EDC facility in Itasca, Texas, in 2013 and also noted combustible construction for the storage facility and bins. Findings from the WFC incident demonstrate that inherently safer concepts can be applied to storage practices to significantly reduce the risk of a fire or explosion. Modifying existing facilities or constructing new storage facilities with inherently safe options—such as facility set-back distances and the use of noncombustible construction materials—can reduce such risks. Because FGAN behavior is unpredictable in fire conditions, the most immediately effective strategy for reducing risk in existing and future FGAN storage facilities is to use inherently safer building design options to avoid creating the hazardous conditions that can contribute to a large uncontrollable FGAN fire and detonation. CSB concluded that the storage of combustible materials near FGAN storage piles and the use of combustible bins likely facilitated the spread of the FGAN-related fire to other bins and nearby

168 Fly ash is a fine particle residue of coal combustion. 169 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National Institute of Hometown Security, Lexington, KY (2012). 170 See: http://www.eurochem.ru/wp-content/uploads/2012/08/SDB_27_KASweiss_0124_EU.pdf (accessed on January 7, 2016).

West Fertilizer Company Final Report January 2016 103 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

combustibles. The combustibles also likely acted as a fuel during the fire; the soot, creosote, and other contaminants from the burning wood materials mixed with the surface of the FGAN, potentially increasing its energy and sensitivity to detonation. By eliminating wood and other combustibles as construction materials for FGAN bins and storage facilities and also for the storage of nearby combustible materials, the possibility of contaminating FGAN during a fire or smoldering event is greatly reduced. However, organic materials (such as packing materials or seeds) that are commonly present with the storage of bulk fertilizer will increase the likelihood of an explosion and will make the FGAN explosion more energetic. Certain inorganic contaminants, including chlorides and some metals (such as aluminum powder, chromium, copper alloys, cobalt, and nickel), can also sensitize FGAN, increasing the likelihood of detonation.171 Current OSHA requirements in the Explosives and Blasting Agents standard in 29 CFR 1910.109(i) do not prohibit the use of wooden FGAN storage bins; instead, OSHA requires bins that are protected against FGAN impregnation (as noted in Section 8.2). The installation and use of concrete or metal172 storage bins would reduce the potential for a fire to spread throughout the facility and to other piles of FGAN or nearby combustible materials. It is also inherently safer to store FGAN in places where sources of ignition are not present. For example, a storage building without electric service eliminates the one of the possible sources of ignition and is thus inherently safer. In July 2009, an FGAN-related fire at the EDC fertilizer storage facility in Bryan, Texas, burned the facility to the ground, but the FGAN did not explode. The fire forced an evacuation of more than 80,000 residents in the Bryan area and students at the Texas A&M College Station campus. EDC rebuilt the facility, originally a wooden structure, with concrete bins surrounded by a concrete dome (Figure 61). EDC’s insurance company required the use of concrete construction materials instead of wood to minimize the fire risk.

171 EPA. “EPA Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills.” See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on November 30, 2015). 172 Galvanized iron, copper or copper alloys, lead, and zinc are not recommended metals for AN storage.

West Fertilizer Company Final Report January 2016 104 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB)

Use of concrete bins or external metal hoppers instead of wooden structures is considered an inherently safer option for FGAN storage. According to Kletz, the IST concept of moderation entails storing or transporting a hazardous material in a less hazardous manner.173 In this case, eliminating the presence of the combustibles removes an obvious and principal source of fuel and heat that contribute to detonation. Replacing bins with structures made of concrete instead of combustible materials also limits the quantity of FGAN available to support combustion by confining it to the bin and preventing the acceleration of a fire. It is well recognized that wood is not a preferred material of construction for buildings or bins storing FGAN, and untreated wooden bins should never be used to store FGAN because of the oxidizing properties of FGAN that will increase the burning temperature and rate of burn of the structure itself, facilitating the spread of a fire. Concrete or compatible metals should be used to avoid contamination during fires. The Health and Safety Executive in the United Kingdom states that FGAN storage “should be constructed of a material that does not burn, preferably concrete.”174 In March 2014, CSB responded to OSHA’s request for information (RFI) (at 78 Federal Register 73756) on future possible revisions to OSHA safety standards, including the Explosives and Blasting Agents standard in 29 CFR 1910.109(i) and the Process Safety Management standard in 29 CFR 1910.119. In response to the RFI, CSB urged OSHA to consider revising existing standards to provide more explicit requirements for the storage and handling of FGAN, including prohibiting wooden or combustible FGAN storage bins. 175 In May 2015, the NFPA issued a new edition of NFPA 400-2016, Hazardous Materials Code (Chapter 11, “Ammonium Nitrate”), which prohibits combustible construction materials for new FGAN storage facilities and establishes requirements for automated fire detection, fire suppression, alarm activation, and evacuation plans for existing facilities with combustible construction. CSB recommends that OSHA revise its standards to include requirements similar to those in NFPA 400-2016 for FGAN storage facilities to reduce the likelihood of a detonation when FGAN is exposed to fire. 7.0 Emergency Response The FGAN explosion at the West Fertilizer Company (WFC) facility killed 15 people and caused more than 260 injuries. Of the 15 fatalities, 12 were first responders (firefighters and emergency services) personnel who responded to the fire—eight volunteer firefighters, with five from the West Volunteer Fire Department (WVFD), two from the City of Abbott Fire Department, and one from the Mertens and

173 Kletz, Trevor, and Paul Amyotte. “Attenuation.” Process Plants: A Handbook for Inherently Safer Design, Second Edition. Boca Raton, FL: CRC Press, 2010: 103. 174 Health and Safety Executive (HSE). Storing and Handling Ammonium Nitrate. United Kingdom: Health and Safety Executive, 2004. See: http://www.hse.gov.uk/pubns/indg230.pdf (accessed on January 6, 2016). 175 CSB. “CSB Comments on the OSHA Proposed Rule: Process Safety Management and Prevention of Major Chemical Accidents.” See: http://www.regulations.gov/#!documentDetail;D=OSHA-2013-0020-0074 (accessed on November 30, 2015).

West Fertilizer Company Final Report January 2016 105 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Navarro Mills Fire Department; an off-duty career firefighter (captain) from the City of Dallas Fire Department; an emergency medical technician (EMT) from West; and two good Samaritans who supported the emergency response at the fertilizer plant.176 One of the deceased volunteer firefighters who responded to the fire was also an employee of the WFC. CSB developed this section of our report to provide information to fire departments across the country by evaluating the key factors that contributed to the firefighter fatalities and to share lessons learned so that similar events can be avoided in the future. Accordingly, to determine what went wrong, CSB used emergency response documents, interviews, and video footage to analyze in detail the actions that were taken before and during the approximately 20 minutes that elapsed from the first call for assistance until the explosion occurred. This analysis is not focused only on volunteer firefighters; it demonstrates the need for effective pre- incident planning and firefighter training. Firefighters are expected to make risk assessments and decisions under time pressure with limited visibility during an actual response to a fire, which is almost impossible without adequate training. Although this analysis indicates that the emergency responders involved in this incident accepted an extremely high level of risk that resulted in multiple deaths, CSB recognizes that they were attempting to develop a plan of action for a fire scenario that none of them had prior practical experience with. 7.1 Firefighter Response The chain of events—from the time the volunteer firefighters and other emergency responders arrived at WFC until the time of the explosion—can never be precisely known. On the basis of interviews with surviving firefighters and the evaluation of the incident scene, CSB was able to assess the emergency response process on April 17, 2013. On the evening of the incident, the emergency responders who were initially dispatched to the fire arrived at the scene at different times. CSB obtained a street surveillance camera video recording and also camera footage from the inside of a neighboring hardware store in West.177 The surveillance recording indicated that four emergency response vehicles were en route between 7:37 pm and 7:51 pm, when the explosion occurred, as shown in the timeline of events in Figure 62.

176 One of these Good Samaritans was familiar with the equipment used by the WVFD and volunteered to assist the second, who was in the area tending to cattle and offered his help to the firefighters. These two deceased Good Samaritans were made honorary volunteer firefighters at the memorial for the fallen West, Texas, firefighters and other emergency responders held in Waco, Texas, on April 25, 2013. 177 The convenience store and street surveillance camera are located about a mile from the WFC facility at the intersection between East Pine Street and North Roberts Street.

West Fertilizer Company Final Report January 2016 106 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB)

Emergency responders were notified and dispatched to the scene at about 7:29 pm on April 17. The firefighters arrived on scene over a span of about 14 minutes, as recorded on surveillance footage of emergency vehicles en route to the WFC site that night.178 In the video footage, the WVFD fire chief can be observed driving the water tender toward the incident scene at about 7:41 pm. Firefighters were dispatched to the scene of the emergency without anyone’s knowledge of how long the fire had been

178 Because the WVFD is a volunteer-based service, it should be noted that the volunteer firefighters were not at the station at the time of the incident. Several firefighters were at home, attending to other personal activities or participating in an EMT training class.

West Fertilizer Company Final Report January 2016 107 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

burning or smoldering before being noticed.179 Upon arrival, they concentrated their efforts initially on the incident scene, preparing to suppress flames that were visible at the northeast portion of the storage structure. Without a robust incident pre-planning process in place, without adequate hazardous materials awareness training, and with no previous FGAN-related fire emergency training or drills, the firefighters had no expectation of a possible FGAN explosion. The firefighters were advised by the career fire captain that they did not have the resources to combat the growing fire and should concentrate on cooling the liquid anhydrous ammonia tanks located near the burning building to prevent the tank from rupturing or venting. However, they had not established that stream of water when the explosion occurred because they had to shut off the attack lines while the pumpers were repositioned.180 7.2 Key Contributing Factors to Emergency Responders’ Fatality CSB identified the following seven key factors that contributed to the fatalities of firefighters and other emergency responders in West:

1. Lack of incident command system.
2. Lack of established incident management system.
3. Lack of hazardous materials (HAZMAT) and dangerous goods training.
4. Lack of knowledge and understanding of the detonation hazards of FGAN.
5. Lack of situational awareness and risk assessment knowledge on the scene of an FGAN-related

fire.

1. Lack of pre-incident planning at the WFC facility.
2. Limited and conflicting technical guidance on AN.
3. 2.1 Lack of Incident Command System

CSB found that none of the responding emergency response personnel trained and certified in the National Incident Management System (NIMS) process formally assumed the position of Incident Commander (IC) who would have been responsible for conducting and coordinating an incident command system (ICS). Senior emergency response personnel at the WVFD arrived at the scene of the WFC incident at different times and did not delegate an IC to be in charge of the incident. Also, there was no record that arriving firefighters conducted an initial incident size-up or risk assessment to determine initial actions (offensive or defensive) that would be most suitable in responding to the incident based on the situation and available resources without putting emergency personnel at risk. Despite multiple responders having ICS training, none of them reportedly established command or took control of the fire ground. On the basis of a review of radio communications and interviews with surviving firefighters, CSB found no clear messaging or discussion among the responding firefighters on who should assume the role of the designated IC. Without a delegated IC officially taking control of the

179 CSB was unable to determine how long the fire had been burning before the firefighters were notified. 180 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 108 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

fire ground operations, no ICS was established. Consequently, no senior emergency response personnel or IC was responsible for coordinating the various response activities carried out by individual firefighters on the scene. The West fire chief arrived on scene at about 7:41 pm and did not critically assess the conditions on the ground before the explosion 10 minutes later, at about 7:51 pm. The fire chief and assistant chief provided support and advisory functions but did not actively engage in fire ground function or take control of the fire ground; no record indicated that the West fire chief took command of the incident upon his arrival.181 Without direction to the contrary, the firefighters immediately took offensive action against the flames coming from the doors on north end of the east side of the structure. CSB interviews with surviving firefighters indicated that before the arrival of the fire chief, the other senior firefighters who had reached the incident scene about six minutes earlier had not delegated senior personnel with the training and expertise needed to formally assume responsibility as the IC. The firefighters had not reached a conclusion about how to establish a best approach and how to respond to the fire when the explosion occurred. Despite being trained for the ICS and NIMS process, none of the certified firefighters had prior practical experience in establishing incident command or coordinating and maintaining control of any previous emergency that merited the same approach as an FGAN-related fire scene. 7.2.2 Lack of Established Incident Management System CSB found that the emergency response personnel who responded to the WFC incident did not take time to set up, implement, and coordinate an effective incident management system plan that would have ensured evacuation of the nearby residents. Because no formal IC was in charge of the incident, none of the firefighters took responsibility for formally establishing and coordinating an effective incident management system. Witness testimonies revealed that emergency alert systems for the public were not activated before the explosion, although McLennan County had such systems in place.182 Many of the injuries might have been avoided or might have been less severe if an immediate evacuation had occurred. When the fire was first detected by a police officer, he ordered people in the parks near the facility to evacuate, and he blocked off roads. In addition, employees from the nursing home took the initiative as part of their company emergency response policy to move occupants to the back of the building for fear of smoke or an ammonia release. However, without a formal evacuation order to the entire affected community, many of the residents were left unaware of the risk and chose to watch the fire from inside their homes or vehicles or from the street, placing them within range of the high-pressure blast wave and in the line of flight of debris. In a study conducted after the WFC incident of FGAN-related fires worldwide since

181 NIMS requires that the ICS should be established by the first arriving NIMS qualified personnel. Best practices indicate that the fire chief does not need to be on the scene of a fire before the ICS can be established. 182 See Section 8.5 of this report.

West Fertilizer Company Final Report January 2016 109 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1970, the majority of detonations occurred within 60 minutes of the initial fire report.183 Because this elapsed time to detonation might be shorter than the response times for emergency operations and potential firefighting, a ‘let-it-burn’ approach with a precautionary evacuation of the surrounding neighborhood is appropriate.184 An incident management system is intended to provide a standard approach to management of emergency incidents. The U.S. Department of Homeland Security (DHS) established NIMS in 2004.185 NFPA 1561 (2014 Edition) indicates, “[T]he incident management system shall provide structure and coordination to the management of emergency incident operations to provide for the safety and health of emergency services organization responders and other persons involved in those activities.”186 DHS developed the NIMS program to standardize the incident management process by facilitating coordination of an emergency among all responders (including all levels of government and public, private, and nongovernmental organizations) so that they work together seamlessly and manage incidents involving threats and hazards (regardless of cause, size, location, or complexity) to reduce loss of life, property damage, and harm to the environment. To achieve this objective, FEMA, an organization within DHS, developed a NIMS training program.187 All federal emergency responders, including firefighters, are required to receive NIMS training.188 Presidential Policy Directive 5, which established the NIMS training program, applies to all federal agencies, and non-federal entities, although not required to participate, are encouraged to do so.189 NFPA 1500 (Standard on Fire Department Occupational Safety and Health Program, 2013 Edition190) and NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition191) emphasize the need to use effective incident management systems at all emergency

183 Marlair, G., et al. Comments about the paper entitled “Lessons to be Learned from an analysis of ammonium nitrate disasters in the last 100 years,” by Pittman et al., Journal of Hazardous Materials 280 (2014). 184 Ibid. 185 See: https://www.fema.gov/national-incident-management-system (accessed on December 28, 2015). 186 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014. 187 The NIMS training program specifies National Integration Center and stakeholder responsibilities and activities for developing, maintaining, and sustaining NIMS training. The NIMS training program outlines responsibilities and activities that are consistent with the National Training Program, as mandated by the Post-Katrina Emergency Management Reform Act of 2006. This program integrates with FEMA training offered through the Emergency Management Institute (EMI) and USFA. See: http://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf (accessed on December 28, 2015). 188 See: https://www.fema.gov/national-incident-management-system/training (accessed on December 28, 2015). 189 To compel non-Federal entities seeking grants, FEMA does require its grant recipients to verify that they are “NIMS-compliant.” However, there is no requirement for fire services not receiving federal grants to participate in NIMS. See: https://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf (accessed on December 28, 2015). 190 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: NFPA, 2013. 191 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014.

West Fertilizer Company Final Report January 2016 110 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

scenes. In most cases, this process is known as the ICS, with the primary objective of managing the incident. NFPA 1561 defines an incident management system as “a system that defines the roles and responsibilities to be assumed by responders and the standard operating procedures to be used in the management and direction of emergency incidents and other functions.” CSB concluded that despite multiple personnel in the WVFD being trained and certified to initiate and manage the NIMS process, none of the certified firefighters who responded to incident was designated to assume or assumed the role of IC to initiate and coordinate the ICS and incident management plan as stipulated in the NIMS process. If the West firefighters had executed a planned, tested, and practiced ICS and incident management plan, the number of injuries and casualties sustained by both responders and neighboring residents could have been reduced. 7.2.3 Firefighter Training Firefighters must cope with extraordinary situations and circumstances that threaten their personal safety. To improve execution and reduce the threat of injury or loss of life, it is vital for both volunteer and career firefighters to receive thorough training and information supporting effective decision making. CSB’s investigation of the WFC incident revealed that no standardized training requirement applies to volunteer firefighters across the nation.192 The NFPA has found that, in general, career firefighters have more funding from their local municipalities and thus are often better trained and better equipped compared to volunteer or hybrid fire departments across the country.193 In some communities, volunteer firefighters receive training in formal or informal settings; however, this training hinges on the state and regulatory authority, and the level and type of this basic and specialty training are not standardized. Some VFDs provide training programs equal to those of paid departments, but most volunteer firefighters either pay out of pocket or raise funds to pay for any additional specialty training. Such specialty training can address wildland firefighting, technical rescue, swift water rescue, HAZMAT response, vehicle extrication, and firefighter assist and search teams. CSB found that since there is no federal agency regulating municipal fire departments, some volunteer firefighters in less populated areas or rural communities rarely receive any major type of course training, and most of their initial training is usually on-the-job experience.194 In addition, some volunteer

192 Career firefighters have a standardized basic minimum training requirement. 193 In its report A Third Needs Assessment of the U.S. Fire Service, the NFPA found that compared to their big city counterparts, fire departments in smaller communities were more likely to report that many firefighters had not had formal training in various activities and did not have sufficient PPE. See: http://www.nfpa.org/~/media/files/research/nfpa-reports/fire-service-statistics/2011needsassessment.pdf?la=en (accessed on December 28, 2015). 194 Many volunteer firefighters near special or large manufacturing and storage facilities do receive training from the facility staff. This observation is particularly true when the volunteers include employees of the facility.

West Fertilizer Company Final Report January 2016 111 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters receive EMT195 and fire academy training.196 After completing the EMT and fire academy training, most firefighters are required to earn state certification. To maintain additional professional competency, some volunteer firefighters become state certified, but they must meet the same levels of requirements as those that apply to career firefighters. For example, in Texas, the general requirements for volunteer fire protection personnel certification programs are the same as those for paid personnel. Certification for paid fire protection personnel in Texas is mandatory, but for volunteer fire protection personnel, participation in a certification program is voluntary and not enforced.197 Texas does not require volunteer firefighters to receive a minimum level of training on how to respond to fires involving hazardous materials. In some cases, volunteer firefighters receive first-level certification, which gives an overview of fire suppression and rescue techniques, including HAZMAT and jaws-of-life training. NFPA 1001 (Standard for Fire Fighter Professional Qualifications, 2013 Edition198) provides recommended basic and minimum training requirements that all firefighters are expected to complete to respond to fire emergency calls. Once the basic training requirement has been met, the subsequent level of training differs between paid career and volunteer firefighters. In Texas, paid career firefighters are required to complete about 500 hours of training certification over four levels—introduction, basic, immediate, and advanced—through an academy-type program. Training and certification for volunteer firefighters are provided through the State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA).199 The SFFMA sets up standards for training and certification, but local jurisdictions are left to decide how many firefighters should be sent for particular training and the level of certification needed to protect their respective localities. For example, VFDs in rural areas and sparsely populated communities might require their firefighters to be certified only at the introductory level because few

195 Some firefighters are mandated to receive certification as an EMT. The general EMT-Basic training requires about 100 hours of classroom or field instruction, usually involving some hours of practice in a hospital or ambulance. At the end of the training, EMT-Basic students must take and pass an examination. Firefighters seeking additional training may enroll in the EMT-Intermediate class or the Advanced EMT class, which includes an additional 1,000 hours of education in advanced medical emergency response and care. See: http://work.chron.com/certifications- need-become-firefighter-17338.html (accessed on December 28, 2015). 196 The fire academy training program prepares firefighters for state firefighter certification. The fire academy program involves the completion of classes in the fire science program. Other courses administered in the fire academy program for entry-level firefighters address building codes, emergency medical procedures, and prevention techniques. In addition, the programs train students to fight fires with standard equipment, such as fire extinguishers, ladders, axes, and chainsaws. See: http://work.chron.com/certifications-need-become-firefighter- 17338.html (accessed on December 28, 2015). 197 See: http://www.tcfp.texas.gov/certification/certification_overview.asp (accessed on December 28, 2015). 198 NFPA. NFPA 1001: Standard for Fire Fighter Professional Qualifications, 2013 Edition. Quincy, MA: NFPA, 2013. 199 According to its website, the SFFMA was established in 1876 to support fire and emergency service providers in Texas and beyond. The SFFMA offers support to more than 1,200 fire departments, 22,000 individual members, 80 industrial fire brigades, and EMS and international departments. See: http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9- 7ae03d5685dd (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 112 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

buildings are in the area. In contrast, other towns or communities (such as West) that are near a chemical plant might require their firefighters to receive HAZMAT training and certification. 7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training CSB determined that lack of knowledge and understanding of FGAN detonation hazards at the WFC facility contributed to the emergency responder fatalities. Interviews with surviving firefighters indicated that they did not have sufficient time and information to properly assess the WFC facility and evaluate the behavior of the FGAN-related fire. Because the firefighters did not have adequate knowledge of the FGAN hazard, they focused their emergency response efforts on the anhydrous ammonia tanks. The lack of adequate HAZMAT training and the lack of FGAN firefighting guidance contributed to the deaths of the emergency responders. A joint NFPA-USFA survey revealed that an estimated 36 percent of U.S. fire departments involved in HAZMAT responses have not provided formal training in those duties to all involved personnel.200 CSB reviewed the training and experience of the firefighters who were fatality injured in the WFC incident and found that all of the responding firefighters had minimum training and certifications for responding to fire emergencies, especially training through FEMA courses.201 In addition, very few of the volunteer firefighters involved in this explosion, including surviving officers, had received HAZMAT training. Only two of the deceased volunteer firefighters had taken the HAZMAT awareness course, which is the introductory basic level for HAZMAT training and includes recognition and use of the Emergency Response Guidebook (ERG) as well as notification protocols.202 Table 8 shows the age, rank, function at the scene, and training and experience levels of the victims. Table 8. Training and Experience Information of the Fatally Injured Firefighters203 Victim Rank Age Years of Experience Training Function on Scene 1 Firefighter 48 15 years with WVFD Landing zone safety, propane emergency response, fire and emergency management services emergency response, HAZMAT awareness, ladder practices, hose handling, live burns, basic self-contained breathing apparatus (SCBA), Introduction to Incident Dispatched to incident site by WVFD

200 NFPA, USFA. “Four Years Later: A Second Needs Assessment of the U.S. Fire Service.” See: www.usfa.fema.gov/downloads/pdf/publications/fa-303-508.pdf (accessed on December 28, 2015). 201 See: https://training.fema.gov/is/crslist.aspx?all=true (accessed on December 28, 2015). 202 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

203 Ibid.

West Fertilizer Company Final Report January 2016 113 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of Experience Training Function on Scene Command System (ICS-100),204 ICS for Single Resources and Initial Action Incidents (ICS-200),205 National Incident Management System (NIMS): An Introduction (IS-700),206 National Response Framework: An Introduction (IS-800b)207 2 Career Fire Captain (off duty) 52 31 years with career fire department 31 years as a career firefighter from Dallas (Training status unknown) Responded voluntarily to assist WVFD 3 Firefighter 26 2 years at mutual aid VFD ICS-100, ICS-200, IS-700a, NIMS Multiagency Coordination System (MACS) Course (IS-701a),208 NIMS Public Information Systems (IS-702a),209 NIMS Resource Management (IS- 703a)210 Dispatched for mutual aid 4 Firefighter 37 17 years at mutual aid VFDs211 Emergency vehicle operations, basic auto extrication, compressed air foam systems,212 basic firefighting, ICS-100, ICS-200, IS-700a, IS-800.b, HAZMAT I & II,213 Various training classes offered by TEEX and other departments since 1996.214 Responded in privately owned vehicle (POV); dispatched for mutual aid 5 Volunteer Captain 29 10 years at mutual aid VFD Training status unknown Attending EMT class nearby. Dispatched for mutual aid; responded in POV

204 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-100.b (accessed on December 28, 2015). 205 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-200.b (accessed on December 28, 2015). 206 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-700.a (accessed on December 28, 2015). 207 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-800.b (accessed on December 28, 2015). 208 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-701.a (accessed on December 28, 2015). 209 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-702.a (accessed on December 28, 2015). 210 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-703.a (accessed on December 28, 2015). 211 Training information provided to the CSB by victim’s family. 212 Ibid. 213 Ibid. 214 Ibid.

West Fertilizer Company Final Report January 2016 114 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of Experience Training Function on Scene 6 EMT, Firefighter 33 1 year at mutual aid VFD Training status unknown Attending EMT class nearby. Rode in city ambulance 7 On E-1 Firefighter 41 2 years with WVFD Basic auto extrication, emergency driving, landing zone safety, ICS-100, IS-700a Responded on Engine 1 8 Firefighter 50 13 years with city VFD Fire and EMS emergency vehicle response, landing zone safety, ground cover (basic and intermediate), EMS emergency vehicle response, vehicle extrication, propane ER, fire and EMS ER, Intro to IC, HAZMAT awareness, fire emergency vehicle response, ladder practices, hose handling, live burns, basic SCBA, ICS-100, ICS-700a, IS-800b Drove the brush truck 9 Volunteer Captain 50 18 years with WVFD Basic firefighting, propane emergency response, ICS-100, IS-700a Responded in POV 10

Firefighter 29 3 years with WVFD Firefighting phase 1, emergency driving, basic auto extrication, landing zone safety, SCBA and smokehouse training, ICS-100, ICS-200b, Intermediate ICS for Expanding Incidents (ICS-300),215 Advanced ICS (ICS-400),216 IS-700a, IS- 701a, IS-702a, IS-703a, NIMS Communication and Information Management (IS-704), NIMS Intrastate Mutual Aid: An Introduction (IS-706),217 IS-800b Drove in Engine 1 Texas provides voluntary certification for HAZMAT technicians and HAZMAT ICs through the Texas Commission on Fire Protection (TCFP).218 The TCFP was established under Texas Government Code, Chapter 419, to develop and enforce recognized professional standards for individuals and the fire service.219 In addition, the TCFP provides education and assistance to the fire service and enforces

215 Intermediate ICS for Expanding Incidents (ICS-300) provides training and resources for personnel who require advanced knowledge and application of the ICS. This course expands on information covered in the ICS-100 and ICS-200 courses. See: http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 28, 2015). 216 The Advanced ICS (ICS-400) course provides training and resources for personnel who require advanced application of ICS. This course expands on information covered in ICS-100 through ICS-300. See: http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 28, 2015). 217 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-706 (accessed on December 28, 2015). 218 See: http://www.tcfp.texas.gov/certification/certification_requirements.asp (accessed on December 28, 2015). 219 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 115 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

statewide fire service standards. The TCFP is responsible for certification, training approval, and testing and compliance.220 CSB evaluated the curriculum manual used for HAZMAT certification for firefighters in Texas and found that FGAN explosion hazards were not covered at all. In fact, the manual mentioned FGAN twice under United Nations (UN)/DOT hazard classes and divisions of hazardous materials and weapons of mass destruction (WMD)—as a Class 1, Division 1.5 insensitive explosive221 and as a Class 5, Division 5.1 oxidizing substance222—in the 349-page document.223 Nationally, CSB found that the curriculum used for HAZMAT training does not fully address the hazards and severity of FGAN-related fires and explosions. A review of the U.S. Fire Administration (USFA) National Fire Academy HAZMAT field course outlines confirmed that they place little emphasis on emergency response to storage sites containing dangerous reactive chemicals and oxidizers such as FGAN. Conversely, HAZMAT shipping and transportation are covered in detail in the courses. A review of one firefighter training reference manual, Fundamentals of Firefighter Skills, compiled by the International Association of Fire Chiefs (IAFC) and the NFPA, indicated that very little guidance is provided to firefighters regarding responses to HAZMAT incidents involving reactive chemicals. Chapter 29 (“Hazardous Materials: Recognizing and Identifying the Hazards”) of the second edition of the Fundamentals of Firefighter Skills reference manual includes in-depth information on various HAZMAT transportation methods and containers but does not consider storage and warehousing for these materials. FGAN is not mentioned in the entire chapter.224 CSB concludes that the current training resources at the local, state, and federal levels do not provide sufficient information for firefighters to understand the hazards of FGAN. It is therefore essential for firefighter and emergency response training institutions to collaborate with fire departments to develop and implement a realistic process for ensuring that hazard response knowledge, once attained, does not become unused and obsolete.225

220 TCFP. See: http://www.tcfp.texas.gov/about/mission_and_goals.asp (accessed on December 28, 2015). 221 AN is mentioned as FGAN fertilizer and fuel oil mixtures (ANFO), an example of a very insensitive explosive with a mass explosion hazard (blasting agent) under Division 1.5 (Explosives). Chapter 6, “Hazardous Materials Awareness.” United Nations/Department of Transportation (UN/DOT) Hazard Class and Division of Hazardous Materials and Weapons of Mass Destruction (WMD), Class 1. Section 601: 3. See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 222 AN is mentioned as an example of a Division 5.1 oxidizing substance under U.N./DOT Hazard Class 5. Chapter 6, “Hazardous Materials Awareness,” Section 601: 4. See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 223 TCFP. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, effective on June 1, 2010. Based on NFPA 472 (2008 Edition). See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 224 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 2008. 225 Hazard response knowledge must be retained, and an effective retraining process must be put in place to prevent the loss of its organizational value.

West Fertilizer Company Final Report January 2016 116 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.5 Lack of Situational Awareness and Risk Assessment Knowledge

Although many firefighter training courses provide overviews of initial fire scene size-up, assessment, incident planning, and execution, CSB found that none of the firefighter HAZMAT field training courses provide sufficient information on firefighter situational awareness and risk assessment that could help them make informed decisions while at the fire scene.226,227 The firefighters who initially responded to WFC did not have the tools to effectively perform the situational awareness and risk assessment that would have enabled them to make an informed decision to not fight the fire. Situational awareness in firefighting involves the capability to “read” the scene of a fire or emergency, including changes in the behavior of a fire. Effective situational awareness supports prompt decision making to either evacuate the scene of a fire or continue fighting the fire by taking a defensive or offensive stance. Chapter 4 of NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition) provides guidance on situational awareness competencies for responder-level personnel.228 In fires involving HAZMAT, it is not always possible for firefighters to obtain needed information before acting, but they might be able to characterize a HAZMAT incident based on initial information acquired from the emergency call center and dispatcher; emergency response manuals and guides; knowledge base on the response area; and visual, auditory, and olfactory (odorous) clues. In some cases, the fire department’s standard operating procedures (SOPs) and the level of training of the emergency response crew might be insufficient to respond at the incident scene to changing events and scenarios that were not planned for or anticipated—hence, the need for effective training on situational awareness and risk assessment. Clearly written SOPs would afford fire department trainees the opportunity to read and understand the operational procedures of their fire department. The NIOSH Alert, “Preventing Injuries and Deaths of Fire Fighters,” emphasizes the need for departments to establish and adhere to the firefighting policies and procedures stipulated in the SOPs.229 NFPA 1500 (Fire Department Occupational Safety and Health Program, 2013 Edition230) emphasizes the need for development of a risk management plan, including risk identification of actual and potential hazards. In addition, it states that “fire departments shall prepare and maintain policies and standard operating procedures that document the organizational structure, membership, roles and responsibilities, expected functions, and training requirements.” NFPA 1500 also

226 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 2008. 227 Texas Commission on Fire Protection. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, effective on June 1, 2010. Based on NFPA 472 (2008 Edition). See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 228 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013. 229 See: http://www.cdc.gov/niosh/docs/2005-132/pdfs/2005-132.pdf (accessed on December 28, 2015). 230 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 117 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

provides guidance on the procedures to initiate and manage operations at the scene of an emergency incident. Moreover, NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition) states that “SOPs shall include the requirements for implementation of the incident management system and shall describe the options available for application according to the needs of each particular situation.”231 Firefighting environments are inherently unpredictable, volatile, and fraught with risk.232 It is therefore important for decisions to be made in a context of changing priorities, uncertain information, and limited resources. Firefighters must be able to rapidly size up233 any situation and create scenarios (or what-ifs) to make quick and informed decisions and predict the nature and behavior of a fire. NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition) offers guidance on competencies for ICs. Scene size-up is essential in any emergency situation, especially for HAZMAT incidents.234 This approach includes a thorough overall assessment of the scene and the identification of all possible hazards to ensure the safety of the emergency response crew. CSB concluded that training references and guides on emergency response do not address how to effectively respond to AN-related fires. 7.2.6 Lack of Pre-Incident Planning at Facility The fire department did not have a formal pre-incident planning program for FGAN at WFC. Firefighters responding to the incident were aware of the risks associated with anhydrous ammonia leaking from the tanks and that it could form a toxic flammable cloud that could leave the facility, drift into nearby homes, and potentially explode. Although some responding firefighters knew that FGAN was onsite, they did not anticipate a possible FGAN explosion. Some of the West fire department officials reported that they were aware of the chemicals routinely stored at the WFC, but there was never any formal training to prepare for a fire or chemical emergency. Effective site-specific pre-incident planning for emergency responders is essential to guide initial and subsequent actions while responders are at an emergency. Onsite pre- incident planning might have identified the possible FGAN explosion hazard. CSB did not find evidence of regularly scheduled training exercises to ensure that the WVFD conducted incident pre-planning and facility tours to address fire safety and chemicals onsite. A pre-incident plan must provide clear information on the magnitude of hazards in a chemical plant or business. A competent incident commander (IC) or designated authority must be capable of executing the pre-incident plan, including analyzing the incident, planning the response, implementing the planned

231 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014. 232 Flin, R. Sitting in the Hot Seat: Leaders and Teams for Critical Incident Management. Chichester: Wiley, 1996. 233 Incident size-up uses ongoing processes of information gathering and analysis that will help the firefighters make quick and informed decisions concerning how better to respond to the incident. 234 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 118 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

response, evaluating progress, retreating from the incident, and terminating the response. The NFPA 235 provides guidance on developing an effective incident response plan methodology for emergency responders.236 NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition237) provides guidance on the competencies required for hazardous materials responders (including the IC) involved in pre-incident planning and execution of the plan. The pre-incident plan also must be effectively communicated to other external emergency units in the surrounding areas for times when these agencies are called on for mutual aid. In addition, a pre-incident plan must be systemic and must include a realistic exit and evacuation strategy, especially when a decision is made to not take offensive action at a hazardous materials incident. Pre-incident planning must include all of the HAZMAT onsite. Plans must be put in place to address how to effectively respond to an emergency. NFPA 1620 (Standard for Pre-Incident Planning, 2015 Edition) states that the pre-incident plan “shall identify and document any special hazards recognized by the authority having jurisdiction that present extraordinary life safety challenges, operations challenges, or other challenges to emergency responders.”238 NFPA 1620 further states that the “pre-incident plan should be the foundation for decision making during an emergency situation and provides important data that will assist the IC in developing appropriate strategies and tactics for managing the incident.” This standard also states that the “primary purpose of a pre-incident plan is to help responding personnel effectively manage emergencies with available resources.” Pre-incident planning involves evaluating the protection systems, building construction, building contents, and operating procedures that can affect emergency operations. NFPA 1620 outlines the steps involved in developing, maintaining, and using a pre-incident plan by isolating the incident into pre-incident, incident, and post-incident phases. In the pre-incident phase, for example, the guidance covers factors such as physical elements and site or occupant considerations, protection systems, water supplies, hydrant locations, and special hazard considerations. Building characteristics—including type of construction, materials used, occupancy, fuel load, roof and floor design, and unusual or distinguishing characteristics—should be recorded, shared with other departments that provide mutual aid, and entered into the dispatcher’s computer if possible so that the information is readily available if an incident is reported at the noted address.

235 The NFPA, a nonprofit standards organization, has been developing standards since 1896 that directly affect fire services at the department level. The NFPA produces more than 300 consensus codes and standards intended to minimize the possibility and effects of fire and other risks. The codes are voluntary standards that industry can adopt and that regulatory agencies can enforce once the codes are signed into law. Standards are an attempt by an industry or profession to self-regulate by establishing minimal operating, performance, or safety criteria. See: http://www.nfpa.org/about-nfpa (accessed on December 28, 2015). 236 CSB referred to the most current edition of the NFPA codes and standards throughout this report. 237 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013. 238 NFPA. NFPA 1620: Standard for Pre-Incident Planning, 2015 Edition. Quincy, MA: NFPA, 2015.

West Fertilizer Company Final Report January 2016 119 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An adequate pre-incident plan must include, at a minimum, specific tested and practiced procedures for responding to an emergency at a given facility; a list of potential HAZMAT such as FGAN, including the quantity of each chemical that may be onsite; details on HAZMAT handling and storage; chemical locations at a particular site; the likely behavior of chemicals in a fire, flood, or other emergency; worst case scenario regarding how these chemicals might behave or interact in an emergency; the Safety Data Sheet (SDS)239 for each of the HAZMAT; and specific recommendations on how to respond to a fire when these chemicals are involved. Before the incident, the WVFD did not conduct a pre-inspection for an FGAN-related fire emergency. In most cases, a site-specific pre-incident plan would be developed in partnership with each chemical plant or chemical business in the response jurisdiction. Although WFC reported the quantity and location of each of its hazardous chemicals, including FGAN, to the WVFD, no mechanism ensured that pre-incident drills or inspections were conducted. Although the firefighters in West conducted some onsite anhydrous ammonia drills, none of the drills or training focused on the potential of an FGAN-related fire emergency. A fire pre-plan would enable firefighters to determine various situations where conditions could dramatically change in a burning structure. This information would enable them to consider the hazards associated with each site. Also, the pre-incident plan could provide this advanced information, which might have aided the WVFD in developing a response strategy or might have facilitated a decision to stand down and allow the structure to burn to the ground if no lives were endangered by doing so. Whether a volunteer fire department (VFD) has pre-incident plans in place often depends on the individual fire department. Currently, no federal agency regulates municipal fire departments in the United States. Although the U.S. Congress funded the National Institute for Occupational Safety and Health (NIOSH) in 1998 to establish the Fire Fighter Fatality Investigation and Prevention Program, NIOSH only investigates on-the-job firefighter fatalities and makes recommendations for improvements to the profession. NIOSH lacks authority to enforce regulations or mandate firefighter training requirements.240 7.3 Limited and Conflicting Technical Guidance on FGAN Firefighters might not have at their fingertips all of the hazard information regarding the chemicals that can be found in their communities. Regardless of the instant availability of information on the hazards of a specific chemical, firefighters are required to respond immediately upon dispatch and are expected to

239 An SDS is a document developed by the manufacturer of a hazardous chemical product that communicates the hazards of the product. It is required under OSHA’s Hazard Communication Standard. Under this standard, all chemical manufacturers, distributors, or importers must provide to downstream users an SDS for each hazardous chemical. Previously, SDSs were known as Material Safety Data Sheets (MSDS); however, in 2012, the name underwent a change when OSHA decided to modify the Hazard Communication Standard to adopt the U.N. Globally Harmonized System. 240 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 120 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

make prompt decisions. To make effective decisions in fire emergencies, some fire prevention and emergency response stakeholders have developed technical manuals and guidebooks. These guidebooks help emergency responders and firefighters to better understand chemical hazards. References include the Emergency Response Guidebook (ERG), SDSs, and NFPA standards.241 Although firefighting manuals support the prevention of injuries and fatalities, CSB found conflicting information and inconsistencies in various emergency response guidelines. 7.3.1 Emergency Response Guidebook The ERG is a readily available and widely used guidebook among the emergency response community. Formerly known as the DOT ERG, this document is now jointly produced by DOT, Transport Canada, and the Secretariat of Communications and Transportation (Mexico). The current ERG is designed as a resource for first responders to consult during the initial phase of a dangerous goods or HAZMAT transportation incident. Emergency response personnel (such as firefighters, EMTs, and police officers) in the United States, Canada, Mexico, and other countries use the ERG when responding to transportation emergencies involving HAZMAT. In most cases, firefighters who complete HAZMAT courses, the most basic of which is Awareness Level training, are expected to be familiar with the ERG. Figure 63 shows the 2012 edition of the ERG.

241 Annex E of NFPA 400 (2013 Edition) also provides AN firefighting guidance. NFPA. NFPA 400: Hazardous Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 121 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA)242 Most firefighting apparatuses have a copy of the ERG.243 After the WFC incident, NIOSH investigators found copies of the 2012 ERG in the glove boxes of some of the damaged fire equipment and apparatuses.244 However, CSB does not have any evidence that indicates whether the West firefighters consulted the ERG on the night of the explosion. The ERG is especially useful in situations when the relevant SDS is not readily available to firefighters. The ERG gives direction (based on DOT Hazard Classification Criteria) on response to HAZMAT and dangerous goods emergencies during transportation. It does not provide any specific guidance on the

242 DOT Pipeline and Hazardous Materials Safety Administration (PHMSA). See: http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_7410989F4294AE44A2EBF6A80ADB640BCA8E4200/filename/ER G2012.pdf (accessed on December 28, 2015). 243 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition. See: http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 28, 2015). 244 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 122 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

handling of ammonium fertilizer.245 In fact, the ERG includes the following commentary under the heading of its 2012 Edition: This guidebook will assist responders in making initial decisions upon arriving at the scene of a dangerous goods incident. It should not be considered as a substitute for emergency response training, knowledge or sound judgment. ERG2012 does not address all possible circumstances that may be associated with a dangerous goods incident. It is primarily designed for use at a dangerous goods incident occurring on a highway or railroad. Be mindful that there may be limited value in its application at fixed facility locations.246 The current edition of the ERG lists 15 variations of FGAN. Next to each FGAN variant is a guide number that leads to information on the potential hazard and the appropriate emergency response, but the suggested measures are broad and subject to varying interpretations. On October 1, 2014, CSB provided comments on a DOT request for information (RFI), “Hazardous Materials: Revision of Emergency Response Guidebook” (FR Doc. 2014-20683), which was published on August 29, 2014.247 CSB commented as follows: The ERG is intended for incidents involving the transport of hazardous materials and is limited to the size of the transportation containers involved.248 However, the CSB has found in several investigations249 that the ERG manual was used by emergency responders for incidents involving chemical fires, explosions and releases of hazardous materials at fixed facilities. Incidents at fixed facilities may involve larger quantities of hazardous materials as well as additional hazards involving process conditions or other hazardous chemicals stored nearby, resulting in higher risk to emergency responders. The directions regarding response to a chemical release or fire incident intended for transportation may be different when applied to an incident at a fixed chemical or manufacturing facility. For this reason, the CSB suggests that the DOT consider additional language to clarify ERG’s use limitations at fixed facilities. CSB also urged DOT to highlight in bold text on the front cover page of the next edition of the ERG: “Only Intended for Use When Responding to Transportation Incidents.” Realizing that emergency

245 The ERG provides some information and guidance on handling Division 5.1 oxidizers. 246 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition: 356. See: http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 28, 2015). 247 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergency- response-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 248 See: http://www.csb.gov/assets/1/7/DOT_ERG__RFI10_1_14.pdf (accessed on December 28, 2015). 249 Technics, Inc., 2003. See: http://www.csb.gov/technic-inc-ventilation-system-explosion/ (accessed on December 28, 2015); DuPont Belle, 2010. See: http://www.csb.gov/dupont-corporation-toxic-chemical-releases/ (accessed on December 28, 2015); Millard Refrigerated Services, 2010. See: http://www.csb.gov/millard-refrigerated-services-ammonia-release/ (accessed on December 28, 2015); AL Solutions, 2010. See: http://www.csb.gov/al-solutions-fatal-dust-explosion/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 123 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

responders will continue to reference the ERG for incidents involving HAZMAT releases at fixed facilities, CSB suggested that DOT consider adding guidance such as the information that first responders should obtain and reference when responding to an incident at a fixed facility, such as the company SDSs and submitted Tier II information.250 CSB advised that such guidance also should be in the front section of the ERG (for example, on pages 1 and 2). In addition, CSB suggested that DOT move the user’s guide from page 356 to page 1 or 2 of the next ERG edition to provide users with earlier guidance. CSB also urged DOT to take the following actions: • Review and revise the ERG to remove generic and vague information in the emergency response section of Guide 140 and other ERG sections. • Include a statement that urges emergency responders to reference other sources in addition to the ERG to obtain more detailed instructions when responding to emergency incidents at fixed facilities. First responders should obtain and refer to the company SDSs or submitted Tier II information when responding to an incident at a fixed facility. This information should also be in the introduction of the ERG (for example, on pages 1 and 2). • Revise the ERG to address the unpredictable behavior of fires involving FGAN and the potential for detonation within a very short time frame. DOT should consider recommending a more conservative response to fires involving FGAN by emphasizing firefighter and resident evacuation when the threat is to human lives rather than property. • Revise Guide 140 to include a separate discussion of the properties and behaviors unique to FGAN (such as the potential for detonation within a very short time frame) that might differ from those of other oxidizers covered by Guide 140. On its website, DOT provided a preview of updates for the 2016 Edition of the ERG.251 The link to the ERG updates provided by DOT showed that the review working group on the ERG had made the following changes: • Replaced written instructions on page 1 with a flow chart to show how to use the new ERG (2016). • Expanded the Table of Placards and updated the title to Table of Markings, Labels, and Placards and Initial Response Guide to Use on Scene. • Expanded the Railcar Identification Chart and the Road Trailer Identification Chart to two pages each. • Updated Table 1 and Table 3 based on new toxic inhalation hazard (TIH)252 data and reactivity research.

250 Additional information on Tier II information is noted in Section 8.5 of this report. 251 DOT. “Preview of Updates for the ERG 2016.” See: http://www.phmsa.dot.gov/pv_obj_cache/pv_obj_id_CDF7F93A3E0C2F808D9EA09C262749DAEF400200/filena me/ERG2016_Preview.pdf (accessed on December 28, 2015). 252 TIH is the abbreviation for toxic inhalation hazard. Under the Hazardous Materials Regulations (HMR), 49 CFR Parts 171–180, TIH materials are gases or liquids that are known (or presumed on the basis of tests) to be so toxic to humans as to pose a hazard to health in the event of a release during transportation. See:

West Fertilizer Company Final Report January 2016 124 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Updated pipeline emergency response information. • Added information about Globally Harmonized System of Classification and Labeling of Chemicals (GHS) markings. • Added all new dangerous goods and HAZMAT listed in the U.N. Recommendations on the Transport of Dangerous Goods, 19th Revised Edition. • Added information on emergency response assistance plans applicable in Canada.

Also, DOT provided a snapshot of the cover page of the 2016 edition of the ERG (Figure 64) on its website.

Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA)253 CSB noticed (from the preview of the 2016 edition of the ERG), that DOT and other authors of the ERG moved the warning statement, “A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident” from the left side of the cover page of the 2012 edition to the top of the cover page, as recommended by CSB. However, DOT and other authors

https://www.federalregister.gov/articles/2004/08/16/04-18705/hazardous-materials-enhancing-rail-transportation- security-for-toxic-inhalation-hazard-materials (accessed on January 20, 2016). 253 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 125 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the ERG did not include the statement “Only Intended for Use When Responding to Transportation Incidents” in bold on the front cover page of the 2016 edition of the ERG, as suggested by CSB in its response to the DOT RFI for the ERG revision.254 Instead, DOT and other ERG authors modified the statement “A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident” to “A guidebook intended for use by first responders during the initial phase of a transportation incident involving dangerous goods/hazardous materials.”255 Note that “transportation incident involving dangerous goods/hazardous materials” is in bold on the cover page of the 2016 edition of the ERG. 7.3.2 Safety Data Sheets CSB did not find any record that the WVFD consulted the SDS for FGAN and other chemicals present at the WFC facility during the incident. After the incident, CSB reviewed the SDS (that was current at the time of the WFC incident) provided by CF Industries and EDC, the manufacturers of the FGAN used at the WFC. The CF Industries SDS for FGAN (SDS Number 004) provided guidance on FGAN hazards in the December 11, 2012, revision of the SDS.256 Under the Hazards Identification, Emergency Overview heading (item three, page 1), CF Industries described FGAN: Strong oxidizer. Contact with combustible material will increase fire hazard. May undergo detonation if heated under confinement causing pressure buildup or if subjected to strong shocks. Solid AN when sensitized or during decomposition may become unstable and/or explosive. When AN is heated to decomposition it may produce vapor which contains nitrogen oxides (NOX). AN is an oxidizer and as such may increase the flammability and/or explosiveness of other substances. Use water to control fires involving AN, if water is compatible with burning material. AN itself is non-flammable. AN can cause irritation to eyes and skin and may be an inhalation discomfort in confined locations.257 Under the Firefighting Measures heading (item five, page 3), CF Industries noted: Flood burning ammonium nitrate fertilizer with large volumes of low pressure water. Do not use salt water, carbon dioxide, dry chemicals or foam extinguishers. Never attempt to smother fire, such as by sealing off, closing a compartment or building doors when fire occurs. Do not add steam. Ammonium nitrate fertilizer does not have the property of spontaneous combustion. Fire fighters should wear approved self-contained breathing apparatus to protect themselves from the

254 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergency- response-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 255 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on December 28, 2015). 256 CF Industries has since removed its December 11, 2012, SDS for FGAN from its website. CF industries replaced the December 11, 2012, SDS for FGAN with a revised and updated SDS for FGAN (April 23, 2013). See: http://www.cfindustries.com/pdf/Ammonium-Nitrate-Amtrate-MSDS.pdf (accessed on January 20, 2016). On May 15, 2015, CF Industries published its current SDS for Amtrate FGAN fertilizer, which supersedes every other SDS. See: http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on December 28, 2015). 257 CF Industries LLC. “Safety Data Sheet, FGAN.” SDS Number 004, revised December 11, 2012.

West Fertilizer Company Final Report January 2016 126 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

toxic fumes of decomposing ammonium nitrate, and protective clothing to guard against molten nitrate splashes should also be worn.258 This SDS for FGAN referred to NFPA 400 (Hazardous Materials Code, 2013 Edition) under its section on handling and storage but not in its section on firefighting measures. Although Chapter 11 of NFPA 400 provided some recommendations for safe storage, handling, and use of AN, it did not include any specific guidelines on FGAN firefighting measures. Annex E of NFPA 400 outlined some general procedures and suggestions on firefighting for FGAN incidents. Section E.2.1 of Annex E of the 2013 edition of NFPA 400 states: [S]hould a fire break out in an area where FGAN is stored, it is important that the mass be kept cool and the burning be promptly extinguished. Apply large volumes of water as quickly as possible. If fires reach massive and uncontrollable proportions, fire-fighting personnel should evacuate the area and withdraw to a safe location.259 Also, Section E.2.2 of NFPA 400 suggested the provision of as much ventilation as possible to the fire area.260 Although the FGAN SDS provided by CF Industries contained some useful insights and guidance on how to respond to FGAN-related fires, it did not clearly define “a distance” from which a fire could be “flooded” (one of the special firefighting procedures) and did not specify what “volumes of low pressure water” would be needed. CSB compared the firefighting measures in the CF Industries and EDC SDS with those in the SDS provided by a similar large technical grade AN (TGAN) manufacturer (Orica)261 and with those in the current edition of the DOT ERG (Table 9). Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013 EDC SDS (FGAN) CF Industries SDS (FGAN) Orica AN SDS (TGAN) DOT ERG (2012 Edition) If confined when an ignition occurs, an explosion may occur. FGAN may undergo detonation if heated under confinement. FGAN may explode under confinement and high temperature. FGAN may explode from heat or contamination. Flood with water. Flood fire area from a distance. Fires should be fought from a protected location. Flood large fire with water from a distance.

258 Ibid. 259 NFPA. NFPA 400: Hazardous Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013. 260 Ibid. 261 According to its website, Orica is the largest provider of commercial explosives and blasting systems to the mining and infrastructure markets, a global leader in the provision of ground support in mining and tunneling, and a leading supplier of sodium cyanide for gold extraction. See: http://www.orica.com/About-Us#.VlXviHarSUk (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 127 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Firefighters should wear proper protective equipment and self- contained breathing apparatus. For massive fires, use unmanned fire nozzles; if this is impossible, withdraw from area, and let burn. A major fire may involve a risk of explosion. For massive fire, use unmanned hose holders or monitor nozzles; if this is impossible, withdraw from area and let fire burn.

These examples of guidance for fighting fires involving FGAN illustrate hazards that were broadly defined and were not clearly communicated to emergency responders. The use of vague and broad terminologies in some of the guidelines compared in Table 9 indicates that the behavior of FGAN under heat and confinement is not clearly understood because no standardized methods are used to communicate the hazards of FGAN and possible firefighting procedures to emergency responders. Also, terms such as “massive,” “major,” “large,” “protected location,” and “distance” were not clearly defined in the guidelines. The CF Industries SDS and the ERG suggested “flooding” a fire involving FGAN from a distance, and the Orica SDS suggested fighting such fires from a “protected location.” The EDC SDS instructed firefighting personnel to flood with water but did not address the need to extinguish fires from a distance or to evacuate under massive fire situations. In these guidelines, the safe distance or protected location is not clearly defined. Hence, a firefighter must make a judgment to determine which location or area is protected, which distance is safe enough to fight a fire involving FGAN, how much water is needed for flooding, and which fire is massive or major. Unfortunately, firefighters are often forced to make these decisions without adequate training, information, preparation, and pre-planning. The WFC incident highlighted the need for greater awareness of FGAN hazards. In response to the 2013 explosion, EDC updated its SDS to include more information about the explosive hazards of AN and information for firefighters. The revised EDC SDS now advises firefighters to fight AN fires remotely because of the risk of explosion. If an AN-containing structure is fully engulfed in flames, firefighters are instructed not to fight the fire and to evacuate the surrounding area to at least a one-half-mile radius.262 7.4 Lessons Not Learned and Lessons Learned 7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not Learned CSB found that lessons learned from previous firefighter fatalities and emergency responses to FGAN- related incidents were not effectively disseminated to firefighters and emergency responders in other communities where FGAN is stored or used. Had those lessons been applied to the very similar situation

262 See: www.eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No v_2014.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 128 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in West, the firefighters and emergency responders might have better understood the risks associated with FGAN-related fires. Although the firefighters in West knew of the hazards associated with the tanks of anhydrous ammonia as a result of previous releases, they were not alert to the explosion hazard from the FGAN inside the warehouse. Although FGAN itself does not burn, the conditions under which AN might detonate when exposed to fire are unpredictable and not clearly understood, and current guidance does not offer consistent advice on how to attempt to guarantee firefighter safety. The deaths of the volunteer firefighters and emergency responders in West was not the first time that firefighters have been killed when responding to FGAN-related explosion incidents. On April 16, 1947, a ship containing 7,000 tons of wax-coated FGAN263 exploded in the port of Texas City, Texas, killing 581 people, including all 26 Texas City firefighters who responded to the incident.264 The November 29, 1988, Kansas City, Missouri, ammonium nitrate/fuel oil (ANFO) incident, although not directly related to an FGAN fire, is worth mentioning because of its severity, the important lessons learned from the incident, and its implication for emergency response. Six firefighters from the Kansas City, Missouri, fire department were killed in an explosion while they were extinguishing a fire at a construction site.265 About 40 minutes later, a second explosion occurred, followed by several minor explosions. Investigators later learned that after the first explosion, the battalion chief immediately pulled back and prevented other firefighters from entering the area. A command post was set up at a safe distance, which ultimately prevented more firefighter casualties. The initial fire involved a trailer/magazine containing blasting mixtures of FGAN, fuel oil, and aluminum pellets. One end of the trailer contained approximately 3,500 pounds of ANFO mixture while the remainder of the load was approximately 17,000 pounds of ANFO mixed with 5 percent aluminum pellets. In addition, a second explosion rocked another trailer/magazine loaded with approximately 1,000 30-pound sacks of ANFO mixture with 5 percent aluminum pellets.266 Both explosions in Kansas City created large craters where the two trailers had been parked, similar to the impact of the explosion in West. The first trailer explosion produced a swimming-pool-like crater that

263 Although the Texas City incident involved a form of wax-coated FGAN that is no longer manufactured for fertilizer purposes and a form of strong confinement (the locked hull of a ship), the lessons of confinement were developed and incorporated into industry guidance after the Texas City incident. 264 See: https://www.txdps.state.tx.us/dem/temo/archives/2013/Vol60No4/Articles/article2.htm (accessed on December 28, 2015). 265 The Texas City incident is discussed in this section to indicate that firefighters have lost their lives in the past because of a lack of pre-incident planning, inadequate training and information, and erroneous knowledge of the hazards with which they were dealing. The same observation applied to Kansas City, even though it was an ANFO incident; firefighters were not equipped with the right information and had inadequate knowledge of the hazards of the explosive material (ANFO) that they dealt with that evening, and they lost their lives as a result. 266 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf (accessed on January 20, 2016).

West Fertilizer Company Final Report January 2016 129 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 80 feet in diameter with a depth of 8 feet, connected to a smaller crater that was 20 feet in diameter and 6 feet deep. The second trailer explosion gouged a crater approximately 100 feet in diameter and 8 feet deep, similar in dimensions to the crater resulting from the explosion in West, Texas. The Kansas City incident investigation determined that the firefighters were not told specifically about the contents of the trailer/magazine, although the dispatcher did caution them about explosives on the site. The firefighters did not report any indication of the presence of warning placards on the trailers because there was no requirement by firefighters to report the presence or absence of warning placards over the radio upon their arrival at a scene of a fire. Also, it was not clear whether the firefighters realized that the trailers housed an explosive magazine.267 No record of communication among the dispatch official, fire chief, and firefighters indicated that the firefighters knew the contents of the magazine, and the firefighters did not seem alarmed when they arrived at the site. In addition, the fire department was not aware of the presence of the trailers/magazines or their contents before the incident because of a lack of jurisdictional authority. The Kansas City Fire Prevention and Protection Code did not require the city engineer to notify the fire department that blasting permits had been issued, although this provision was changed immediately after the incident. The Kansas City Fire Department had no authority or responsibility to inspect the construction site because it was a state enclave.268 Shortly after the Kansas City explosions, the USFA produced a technical report (USFA-TR- 024/November 1988)269 with findings of its investigation and lessons learned. Although the fertilizer- related incidents in Texas City and West did not involve explosives per se, the Kansas City incident further illustrated that the lack of knowledge about the stored HAZMAT and the lack of pre-incident planning by firefighters before their response led to the fatalities. Most of the recommendations based on lessons learned emphasized the need to be properly prepared through pre-incident planning and through the provision of clear information to firefighters and emergency responders dealing with fires involving HAZMAT. CSB observed that within the last 6 years, three notable FGAN-related incidents in Texas involved emergency responders. Subsequently, CSB reviewed the emergency response activities associated with the FGAN-related fires that occurred in 2009 at the EDC facility in Bryan, Texas, and in 2014 at the East Texas Ag Supply facility in Athens, Texas. On Thursday, July 30, 2009, at about 11:40 am CDT, a fire broke out at the EDC facility in Bryan. The EDC facility stores FGAN and blends it with other materials to create fertilizer. The fire at the EDC fertilizer plant led to the evacuation of more than 80,000 residents in the Bryan and College Station area.

267 An explosive magazine is an enclosed storage structure for holding explosives. 268 A state enclave is any portion of a state that is completely surrounded by the territory of another state. 269 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf (accessed on January 20, 2016).

West Fertilizer Company Final Report January 2016 130 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Although the storage structure burned to the ground, unlike the incident at the WFC facility, no explosion, loss of life, or major injuries were recorded. At Bryan, the firefighters were informed that a welder had accidentally heated an FGAN bin and that the chemical was smoldering. The firefighters decided not to fight the fire, evacuated the area, and let the facility burn to the ground, without any explosion. Their knowledge of FGAN and the risks associated with a probable explosion most likely led the Bryan firefighters to decide to evacuate. Figure 65 shows the post-incident aerial view of the EDC facility wooden fertilizer warehouse.

Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: Bryan-College Station Eagle) After the incident, the Bryan Fire Department—in conjunction with the emergency management divisions for Brazos County, the city of Bryan, the city of College Station, and Texas A&M University—performed an emergency review and analysis and released an after-action report and improvement plan. These documents were shared with fire departments and emergency response agencies that were involved in the incident response and investigation, including local and regional emergency response agencies—mostly

West Fertilizer Company Final Report January 2016 131 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in the Brazos Valley area, where Brazos County, the cities of Bryan and College State, and Texas A&M University are located—and other state agencies that responded to the incident.270 The 2009 EDC fire after-action report for Brazos Valley highlighted the need for emergency response departments to reflect on protection, response, and recovery activities that occurred during the EDC incident, despite the fact that the community-wide response to the incident resulted in no loss of life or serious injuries. In addition, the after-action report identified potential strengths to be maintained and built on, noted potential areas for further improvement, and suggested recommendations for corrective and preventive actions based on the incident. The after-action report indicated: The Texas Division of Emergency Management provides the National Emergency Response and Rescue Training Center (NERRTC) funding to develop regional plans that will enable local emergency management to rapidly respond to disasters using the region’s resources before requesting assistance from State and Federal partners. Within that scope, NERRTC also develops after-action reports on behalf of local, regional and state governments that have been affected by major disasters. As in the case of the EDC fire, lessons learned help recognize needs for plans, policies and procedures revisions to enhance the effectiveness of response (personnel, teams and/or equipment).271 Unfortunately, CSB did not find any record that the WVFD requested or received a copy of the Brazos Valley after-action report and improvement plan. In addition, no record suggested that lessons learned from the EDC incident were discussed or shared with firefighters at West.272 Although circumstances in West might have differed from those in Bryan, if lessons learned had been effectively relayed among the firefighters at West, the volunteer firefighters who responded to the WFC incident possibly could have drawn on the experience of Bryan firefighters to inform response strategies, both in the pre-planning stages and in the response to the incident on the night of April 17, 2013. 7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned On May 29, 2014, at around 5:45 pm, a fire involving FGAN occurred at the East Texas Ag Supply facility in downtown Athens, Texas. Emergency dispatchers and the Athens Police Department promptly notified firefighters from the Athens Fire Department (AFD).273 Emergency response units from the AFD arrived on the scene of the fire at 5:50 pm and found fire and smoke coming from the northwest end of the 3,500-square-foot East Texas Ag Supply facility. This facility was built with masonry bricks and combustible wooden structures, similar to construction at the WFC facility.274 The AFD chief arrived

270 EDC. “2009 El Dorado Chemical Fire After-Action Report for Brazos Valley,” August 11, 2009. 271 Ibid. 272 CSB found that several surviving West firefighters interviewed after the WFC incident did not have adequate information about the EDC incident at Bryan (approximately 100 miles south of West, Texas). 273 The AFD was organized as a volunteer department in 1911. Currently, the AFD is a fully paid fire department with two stations and 27 firefighters. See: http://athenstexas.us/fire.cfm (accessed on December 28, 2015). 274 Shortly after the April 17, 2013, incident at the WFC facility in West, Texas, an investigative reporter from the Dallas news station (WFAA) entered the Athens facility with a camera crew and revealed that East Texas Ag Supply

West Fertilizer Company Final Report January 2016 132 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

about 2 minutes after the first responding units were dispatched to the site of the incident, and he found that the fire had self-ventilated at the northwest end. On the basis of his observation of the enormous scope of the fire and the possibility of detonation of FGAN in the engulfed building, the fire chief promptly decided to let the East Texas Ag Supply facility burn to the ground instead of attempting to fight the fire.275 He ordered his firefighters to retreat from the scene and began an extensive evacuation of the downtown Athens, Texas, area. The Athens Police Department coordinated the evacuation of the nearby residential areas, setting up an initial three-block evacuation perimeter, which was later expanded to five blocks.276 Fortunately, no injuries were associated with this incident. On June 2, 2014, the State Fire Marshal’s Office (SFMO) completed its investigation of the East Texas Ag Supply facility incident and released its findings, ruling and classifying the source of the fire as undetermined.277 The East Texas Ag Supply facility was a privately owned business with annual revenues estimated between $10 million to $20 million and a work force of approximately nine employees. The East Texas Ag Supply facility was an FGAN and potash fertilizer storage facility, and it was registered under Standard Industrial Classification Code 5191 (Farm Supplies) and North American Industry Classification System (NAICS) Code 424910 (Farm Supplies Merchant Wholesalers).278 On the day of this incident, the East Texas Ag Supply facility received approximately 70 tons of FGAN (total) and 100,000 pounds of potash, which were stored inside the building when the fire occurred. CSB gathered information concerning the East Texas Ag Supply incident from the emergency responders and the facility and also conducted an interview with the AFD fire chief. According to the incident statement provided to CSB, the Athens, Texas, fire chief stated: We allowed the fire to mitigate itself, with research showing that some such facilities had burned out with no explosions. We had learned a lot from West and had already removed other products that could cause contamination and had made the owner remove his diesel tractor from within the building and to keep it off site when not in use. We feel this was a major deterrent from having a detonation.279 Figure 66 and Figure 67 show photographs of the East Texas Ag Supply facility during the fire incident.

was receiving and storing the same substance thought to have been involved in the explosion in West. See: http://www.wfaa.com/story/news/local/investigates/2014/08/18/14029198/ (accessed on December 28, 2015). 275 According to the Athens, Texas, fire chief, the initial plan of action was to engage the fire at the incipient stage, but by the time he arrived on scene, the chief knew that the fire was well past the incipient stage and that the quantity of water needed to squelch the fire at that stage was beyond the capabilities of the equipment on hand. He gave the order for his men to cease firefighting based on his early observations and to begin evacuation activities. 276 The City of Athens police chief was in charge of the evacuation and the control of traffic. The police chief set the initial evacuation perimeter at three blocks from the facility based on the immediate resources available to the police chief at that time; the perimeter subsequently was expanded to five blocks. Police and fire personnel conducted the evacuation notification by using their public address systems and going door to door. 277 See: http://www.tdi.texas.gov/news/2014/news201443.html (accessed on December 28, 2015). 278 After the WFC incident in West, the city of Athens, Texas, received a lot of attention because of the presence of a fertilizer storage facility downtown that was similar to and older than the WFC facility. Wooden bins were used for storage of AN at the East Texas Ag Supply facility. 279 The fire incident statement was provided to CSB via email on October 3, 2014, by the Athens, Texas, fire chief.

West Fertilizer Company Final Report January 2016 133 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 66. Dark Grey Smoke280 Originating from East Texas Ag Supply Facility in Downtown Athens, Texas (Source: Athens Fire Department)

280 However, this smoke was not as black as the smoke from the WFC fire (see Section 4 of this report).

West Fertilizer Company Final Report January 2016 134 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas281 (Source: Athens Fire Department) In an interview, the fire chief reported that the AFD conducted extensive pre-planning, visited the East Texas Ag Supply fertilizer storage facility on multiple occasions, and instructed the owner of the facility to repair anything that seemed to be hazardous or noncompliant with the International Fire Code, which the city of Athens adopted in 2009. SFMO officials had also visited the facility previously on at least two occasions and compelled the owner of the East Texas Ag Supply facility to fix old broken machinery that was onsite.282 In addition to these visits from SFMO, AFD officials often toured the facility to randomly inspect loading and unloading operations and to take note of other fire safety issues, including the location and spacing of exits within the facility. Pre-incident assessment of the facility indicated that the fertilizer storage bins were old and constructed of double layer plywood, each about 10 feet from the ceiling of the 35- to 40-foot-tall building, with three of the bins used to store FGAN. Similar to the WFC facility in West, the East Texas Ag Supply facility had no sprinkler systems, and the building was

281 At the East Texas Ag Supply facility incident in Athens, Texas, the flame appeared to be the normal yellow color of many wood and other combustibles burning in normal air. Unlike the WFC incident, there was no detonation of FGAN; hence, no evidence of brighter (higher-temperature) white flame was observed before the detonation at West (see Section 4 of this report). 282 In addition to the actions taken by the city of Athens before the East Texas Ag Supply fire on May 29, 2014, the SFMO—as part of its endeavors to share the lessons learned from the West, Texas, AN explosion—went to all 66 counties with businesses that had 10,000 pounds or more of AN. The statewide tour started on December 12, 2013, and was completed on December 17, 2014. Local first responders, LEPC members, local officials, business staff, and citizens were invited to the public meetings organized by the SFMO. On April 3, 2014, the SFMO visited Athens, Texas (Henderson County) to enlighten the public on the hazards of FGAN. See: http://www.tdi.texas.gov/fire/fman.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 135 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

constructed with masonry brick walls on three sides, covered with an asphalt shingle roof. Figure 68 shows the East Texas Ag Supply facility, including its masonry brick walls completely burned to the ground.

Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke (Source: Athens Fire Department) The Athens community has two community alert systems, CodeRED and FIRST Alert. The CodeRED community alert system was developed to notify residents of any emergency. The FIRST Alert system is directed from the Henderson County 911 dispatch center.283 The protocol for use of the CodeRED system indicates that during any emergency situation or a fire incident, the fire chief or a designee (usually the police chief) would give the order for the CodeRED notification. Once a CodeRED order is given, the designee or authorized emergency staff member is expected to make a recorded speech, which is then broadcast over the Internet and to all landline telephones in the city. The process also notifies mobile phone subscribers. The CodeRED system was not deployed during the East Texas Ag Supply incident to notify Athens residents. 284 However, the CodeRED alert system was used the following day (May 30, 2014) to notify the community about the post-incident status of the East Texas Ag Supply facility and the conditions surrounding that facility. The Athens, Texas, fire chief compared the city’s situation to that in West and stated that the AFD conducted additional research and identified how best to respond to any emergency situation that could

283 Athens, Texas, is located in Henderson County, about 70 miles southeast of Dallas, Texas. 284 On the day of the incident, there was no clear communication on the designation of the appropriate party to make the outgoing emergency notification message. The fire chief maintained that because he was occupied with command firefighting operations, the task of making the announcement should have been transferred to the Athens Police Department (police chief); unfortunately, this was not the case. Moving forward with the post-incident critique, the fire chief indicated that standardizing the designation of who makes the announcement would be better defined for future community notifications.

West Fertilizer Company Final Report January 2016 136 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

arise because of the East Texas Ag Supply facility. In West, the WFC plant was primarily a fertilizer facility, with anhydrous ammonia tanks, carts, loaders, insecticides, and other potential contaminants for FGAN. On the basis of the aftermath of the WFC explosion in West, Henderson County reviewed its existing local emergency planning committee (LEPC) process. About a year before the Athens fire incident, the natural disaster planning LEPC was expanded, with the fire chief as its chair, to address emergencies arising from human activities or industrial facilities. Although the cause of the Athens fire incident has not been determined, the city of Athens initiated reforms aimed at protecting the city from another incident in the future. On May 29, 2015, a year after the fire at the East Texas Ag Supply facility, the city passed an ordinance that banned the bulk storage of FGAN in Athens. The ordinance included a mandatory reporting process for facilities with limited quantities of hazardous chemicals such as FGAN so that they would report the quantities of the hazardous chemicals in their facilities, thereby enabling VFDs to conduct inspections at such facilities.285 CSB investigators conducted a teleconference with the city of Athens fire chief on June 24, 2015. The fire chief stated that the East Texas Ag Supply facility had been torn down and will not be rebuilt within the Athens city limits. In addition, Athens is now considering efforts aimed at monitoring other hazardous chemicals (similar to FGAN) that are currently stored by facilities within the city limits.286 7.5 Other Post-Incident Investigation Reports Related to Firefighting After the fire and explosion at the WFC facility, several other agencies conducted investigations of the incident. EPA and OSHA conducted their investigations for violations of environmental and workplace safety and health laws, while the Texas SFMO and NIOSH conducted their investigations on the firefighters and the emergency response at the WFC facility. The ATF investigation of the WFC incident is ongoing. 7.5.1 Texas State Fire Marshal’s Office (SFMO) The SFMO 287 served as the lead Texas investigatory agency for the WFC incident, working in collaboration with ATF.288 On May 15, 2014, the SFMO released its line-of-duty deaths investigation of the West, Texas, incident, “Firefighter Fatality Investigation” (Investigation FFF FY 13-06).289 The SFMO report described the incident and issued recommendations focused on the emergency response to the WFC incident, including the conditions that led to the fire and explosion. The report indicated that the firefighters at West were not prepared for what they faced on the night of April 17, 2013. Also, the

285 Section 8.7.3 of this report discusses the Athens City ordinance in detail. 286 Section 8.7 of this report addresses state and local regulatory developments (post-West, Texas, and Athens, Texas, incidents). 287 See: http://www.tdi.texas.gov/fire/documents/fmohistory.pdf (accessed on December 28, 2015). 288 Section 1.2.1 of this report addresses the ATF investigation. 289 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 137 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SFMO highlighted that the emergency responders were victims of a “systemic deficiency in the training and preparation” of the WVFD, attempting to put out a fire that was beyond its incipient stage290 and could no longer be extinguished. The report also included findings related to training and operational best practices for firefighters. On page 47, the SFMO report identified training deficiency as a key finding: The State of Texas has not adopted minimum training standards for volunteer fire departments; however, all fire department members must be properly trained and qualified to perform their assigned duties. Members who are authorized to work in high-level assignments (rank) must be trained and evaluated in performing those duties. All members must be periodically re-evaluated to ensure that they are capable of performing their assigned duties safely and effectively.291 The SFMO firefighter fatality report on the WFC incident further proposed several recommendations based on training of firefighters, including establishment of “realistic training and educational requirements for all positions and ranks and a promotional process that ensures that ranking members demonstrate a progressive knowledge, skill, and ability to perform their assigned duties and responsibilities according to their position in the organization.” The SFMO report concludes by recommending that “fire departments should develop standard operating guidelines and appropriate training involving those critical findings specific to incident command, strategy and tactics, and firefighter safety.”292 The SFMO report findings and recommendations are similar to those of CSB in this report with regard to the emergency response in West. Section 7.2 of this report describes in detail pre-incident planning, fire scene risk assessment, and development of a clearly defined incident command structure for emergency situations.293 7.5.2 NIOSH Findings and Recommendations In 1998, the U.S. Congress funded NIOSH to establish the Fire Fighter Fatality Investigation and Prevention Program, which investigates on-the-job fatalities of firefighters and provides improvement recommendations to the profession.294 On November 12, 2014, NIOSH released its report on the emergency responder fatalities caused by the WFC explosion.295 The report, “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an FGAN Explosion at a Fertilizer Plant Fire–Texas,” identified contributing factors to the firefighter fatalities, specifically failure to recognize hazards associated with FGAN, limited pre-incident planning of the commercial facility, quick spread of the fire

290 The term “incipient” has been widely used in the firefighting community and in various fire codes, including NFPA codes. However, CSB believes that it could be easily misinterpreted and imposes on firefighters a responsibility to make a subjective determination regarding the seriousness of a fire. 291 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015). 292 Ibid. 293 Section 7.1 of this report considers the firefighter response and Section 7.2 discussed details of factors contributing to the firefighter and other emergency responder fatalities in West, Texas. 294 See: www.cdc.gov/niosh/fire (accessed on December 28, 2015). 295 See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 138 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to uncontrollable size, unexpected detonation of approximately 40 to 60 tons of solid FGAN, emergency responders working within the blast radius at the time of the explosion, and large non-sprinklered wood construction in the commercial structure.296 In addition, NIOSH issued recommendations to prevent a similar incident from recurring. Recommendations included pre-incident planning inspections of facilities within the jurisdiction of a fire department; development of a written risk management plan; fire department use of risk management principles at all structure fires, especially for incidents involving high-risk hazards; development, implementation, and enforcement of a written incident management system to be applied during all emergency incident operations; standards for firefighters to wear a full array of turnout clothing and personal protective equipment (PPE) appropriate for the assigned tasks; and firefighter training that meets or exceeds NFPA 1001 (Standard for Fire Fighter Professional Qualifications). CSB concluded that most of the key contributing factors and recommendations cited by NIOSH in its WFC incident investigation report are similar to those of CSB.297 7.6 Summary of Incident Emergency Response CSB found no evidence of pre-incident planning addressing the likelihood of a fire involving FGAN at the WFC facility. As a result, the firefighters who responded to the WFC fire did not take the time to critically assess the situation on the ground before the explosion occurred. Senior emergency response personnel from the WVFD arrived at the scene of the incident at different times, and firefighters who were ICS trained and certified in the NIMS process did not assume the role of IC to establish, implement, and coordinate an incident command structure and incident management system for the fire emergency. The firefighters did not fully understand the hazards of FGAN detonation and consequently shifted their firefighting tactics to strategies to ensure that the anhydrous ammonia tanks onsite did not rupture. Also, the emergency response personnel at West did not take the time to implement an incident management system plan, which would have facilitated the prompt and proper evacuation of the nearby residents. The volunteers who responded to the WFC facility fire did not have sufficient HAZMAT training to make an informed decision on how best to respond to the fire at the fertilizer facility. Furthermore, lessons learned from previous firefighter fatalities and emergency responses to FGAN-related incidents were not effectively disseminated to firefighters and emergency responders in other communities, such as West, where FGAN is stored or used. A review of firefighter training courses, information in emergency response guides, manufacturers’ manuals, and other information available to emergency responders concerning AN-related fires at incident sites confirms that such materials place little emphasis on how to effectively respond to fire

296 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

297 Ibid.

West Fertilizer Company Final Report January 2016 139 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incidents involving the handling and storage of FGAN and might altogether be insufficient to enable firefighters to recognize the potential magnitude of an FGAN explosion. The commonly used emergency response guides and manuals contain inconsistent information regarding the best response to FGAN- related fires. In a fire situation, an FGAN explosion could occur at any time, and without knowing how long an AN-related fire has been burning, firefighters might not be aware of how much time they have to make informed emergency response decisions before an explosion occurs. That is why in the DECIDE model widely used by HAZMAT responders, after it is determined that HAZMAT is present, the next step is to estimate likely harm, without intervention.298 Above all, the conditions under which FGAN might detonate when exposed to a fire are unpredictable and not clearly understood, and current guidance does not offer best practices to protect firefighters from FGAN fire and detonation hazards. 7.7 Firefighter Training Grants and Programs 7.7.1 Need for Training CSB found that currently no federal requirements compel municipal fire departments to develop site- specific pre-incident plans with businesses and chemical plants that process and store HAZMAT such as FGAN. To implement any reform in nationwide inspection of businesses and facilities storing hazardous chemicals, determining the number of fire departments and firefighters in the United States (especially in rural communities such as West, Texas) is important. In addition, it is important to understand how prepared fire departments and firefighters should respond to fires involving FGAN. Part of being prepared is being properly trained on the hazards surrounding a community. 7.7.1.1 U.S. Firefighter Statistics CSB conducted a review of firefighter statistics across the country at the time of the WFC fire and explosion. The review indicated that the majority of the nation’s firefighters are volunteers and that 85 percent of fire departments are composed of volunteer firefighters. In addition, the NFPA estimated the number of firefighters in the United States in 2013 at more than a million, including 345,600 career firefighters (31 percent of the total) and 786,150 volunteer firefighters (69 percent of the total).299 Approximately 95 percent of all volunteer firefighters serve in local fire departments that protect fewer than 25,000 people.300 More than half of these volunteer firefighters support small rural departments that protect fewer than 2,500 residents, such as the WVFD in West, Texas.301 At the end of 2012, an estimated 30,100 fire departments operated in the United States. Of these, 2,610 (9 percent of all departments) were composed of only career firefighters; 1,995 (7 percent) relied on mostly career

298 Ludwig Benner. “D.E.C.I.D.E in Hazardous Materials Emergencies.” See: http://www.henrycoema.org/EMA/HazMat_Training_Materials_files/DECIDE.pdf (accessed on January 8, 2016). 299 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 300 Ibid. 301 Ibid.

West Fertilizer Company Final Report January 2016 140 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters; 5,445 (18 percent) were supported by a mostly volunteer firefighting force; and 20,050 (67 percent) depended entirely on volunteer firefighters.302 Despite the fact that the majority of the nation’s firefighters are volunteers and that 85 percent of fire departments are composed of volunteers, no federal requirements mandate that VFDs work with businesses and chemical plants that process and store HAZMAT (such as FGAN) to develop site-specific pre-incident plans. 7.7.1.2 U.S. On-Duty Firefighter Fatalities Over the last few decades, the fire service industry has made notable advancements, including building code improvements, incorporation of sprinkler systems in commercial and industrial buildings, and development of improved personal protective gear and technologically advanced apparatus. In addition, several laws and programs have been implemented to improve firefighter health and safety in the United States.303,304,305 Despite these laws and improvements, many firefighters are injured or killed while on duty each year. The USFA has recorded the number of firefighter fatalities and conducted an annual analysis since 1977, noting almost 4,500 on-duty firefighter fatalities in the United States in the last 35 years.306 By the end of 2013, 101 firefighter fatalities were reported for the year nationally, including those in West, Texas; four Houston Fire Department firefighters who died while responding to a hotel fire on May 31, 2013; and 19 firefighters from the Prescott Fire Department who lost their lives while responding to a wildland fire in Arizona on June 30, 2013. The NFPA also publishes its own annual study detailing on-duty firefighter fatalities in the United States.307 The annual number of fatalities for volunteer firefighters is substantially higher than the annual number of fatalities for career firefighters (Figure 69).

302 NFPA, Fire Analysis and Research Division. “US Fire Department Profile 2012.” See: http://www.kolb.net/FireReports/2013/US_DeptProfile2012.pdf (accessed on December 28, 2015). 303 Fabio, A. et al. “Incident-level risk factors for firefighter injuries at structural fires.” Journal of Occupational and Environmental Medicine, 44(11) (2002): 1059–63. 304 NFPA. NFPA 1500: Standard on Fire Department Occupational Safety and Health Program. Quincy, MA: NFPA, 2013. 305 Moore-Merrell, L. et al. Contributing Factors to Firefighter Line-of-Duty Injury In Metropolitan Fire Departments in the United States. Emmitsburg, MD: USFA, 2008. 306 USFA. See: http://www.usfa.fema.gov (accessed on December 28, 2015). 307 NFPA. “U.S. Fire Service.” See: http://www.nfpa.org/research/fire-statistics/the-us-fire-service (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 141 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA)308 This discrepancy could be due to a number of factors, such as the larger population of volunteer firefighters (more than 67 percent of all firefighters nationwide) or the lack of standardized training requirements for volunteers. Of the 82 firefighter fatalities in 2012, 39 were volunteer firefighters (47.6 percent of the total), and 32 were career firefighters (39 percent of the total); in addition, four part-time wildland firefighters, three contract wildland firefighters, two paid on-call firefighters, one part-time (paid) firefighter, and one industrial firefighter lost their lives (1.2 percent of the total). CSB believes that adequate training is essential to reduce on-the-job firefighter fatalities, especially among volunteer firefighters who are not required to complete the same level of training as career firefighters. 7.8.1.3 U.S. Volunteer Firefighter Statistics A VFD is a fire department composed of volunteers, usually residents or nearby citizens, who perform fire suppression and other related emergency services for a local jurisdiction or community. The U.S. Department of Labor (DOL) classifies volunteer firefighters as firefighters who receive either no compensation or nominal fees (up to 20 percent of the compensation that a full-time firefighter would receive in the same capacity).309 DOL allows volunteer firefighters to receive benefits such as worker’s compensation, health insurance, life insurance, disability insurance, pension plans, length-of-service

308 See: http://nysfma.org/diyFiles/FirefighterFatalitiesinttheUS2013.pdf (accessed on December 28, 2015). 309 Dodge, G., and M. Mullarkey. Managing Volunteer Firefighters for FLSA Compliance: A Guide for Fire Chiefs and Community Leaders. Fairfax, VA: International Association of Fire Chiefs, 2006.

West Fertilizer Company Final Report January 2016 142 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

awards, and property tax relief. DOL also states that volunteer firefighters may be paid nominal fees on a per-call or per-shift basis or on the basis of various service requirements, but they may not be compensated based on productivity (such as receiving an hourly wage). Career firefighters are fully compensated for their services. Some volunteer firefighters might serve in a hybrid fire department that relies on both full-time and volunteer firefighters. In this approach, career firefighters can regularly staff a station for rapid response with needed apparatuses, and the volunteers can provide supplementary staffing and staff apparatuses before, during, and after an incident or while full- time career personnel are out of service for training. Moreover, volunteer firefighters can sometimes compose a group of part-time or on-call firefighters who have other occupations when not engaged in occasional firefighting. The West volunteer firefighters held other (full-time) jobs and were not financially compensated for their time. Some VFDs compensate their firefighters as employees during the time that they are responding to or attending to an emergency scene and possibly during training. An on-call firefighter can also volunteer time for other nonemergency duties, such as training, fundraising, and equipment maintenance. In addition to fundraising, fire departments and emergency response services often seek alternative sources to support and fund their daily operations and long-term plans. Federal and state funding is available through grants from DHS and FEMA to assist emergency responders and fire departments in addressing EMS and firefighter-related needs such as training and equipment procurement and maintenance. National programs that support the need for emergency preparedness, including firefighter training, are discussed in the next section of this report. 7.7.2 National Firefighter Training Funds and Programs 7.7.2.1 U.S. Department of Homeland Security (DHS) DHS was formed after the terrorist attacks of September 11, 2001, as part of a national effort to safeguard the United States against terrorism. The mission of DHS includes preventing terrorism and enhancing security, managing U.S. borders, administering immigration laws, securing cyberspace, and ensuring disaster resilience. DHS also provides the coordinated comprehensive federal response in the event of a terrorist attack, natural disaster, or other large-scale emergency while working with federal, state, local, and private sector partners to ensure a swift and effective recovery effort. DHS builds a ready and resilient nation through efforts to accomplish the following: • Bolstering information sharing and collaboration. • Providing grants, plans, and training to homeland security and law enforcement partners. • Facilitating rebuilding and recovery.310 Although the scope of DHS is expansive, it contains many components, including FEMA, where much of the federal funding flows to various FEMA programs that assist in elements of national resiliency, such as

310 See: http://www.dhs.gov/building-resilient-nation (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 143 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

rebuilding and recovering after a disaster (such as the West, Texas, incident) or encouraging emergency response preparedness training. Federal Emergency Management Agency (FEMA) FEMA was created in 1979 in an effort to coordinate the federal government’s role in preparing for, preventing, mitigating the effects of, responding to, and recovering from all domestic disasters, whether natural or man-made, including acts of terror.311 On March 1, 2003, FEMA became part of DHS, and FEMA’s Office of National Preparedness was given responsibility for helping to ensure that the nation’s first responders were trained and equipped to deal with WMD along with other types of disasters. FEMA supports preparedness by developing policies; ensuring that adequate plans are in place and are validated; defining the necessary capabilities required to address threats; providing resources and technical assistance to state, local, tribal, and territorial partners; and integrating and synchronizing preparedness efforts throughout the nation. DHS and FEMA achieve their mission of ensuring disaster resiliency partly by providing funding and support to various federal programs that are tasked with preparing the nation to respond to various hazards, such as community exposure to chemicals and hazardous materials. Fire departments use the programs to assist in developing a well-organized, equipped, and trained function for the communities they serve. CSB reviewed the nationwide funding mechanisms available to career and VFDs through DHS and FEMA. Volunteer firefighters similar to those who responded at West have access to these firefighting resource funds if they can demonstrate that they have a need for it. CSB examined whether federal and state funds could be allocated to fire departments to assist them in obtaining the training that firefighters need to address fires and explosions involving HAZMAT such as FGAN. Grants It is important to understand the process for allocating grants to emergency responders such as fire departments. First, this section discusses the application process for a DHS FEMA grant. Second, the FEMA Grant Programs Directorate (GPD), the program that administers these grants once they receive proposals from applicants for funding is discussed. Third, the DHS FEMA preparedness (non-disaster) grants are described. Fourth, the Assistance to Firefighter Grants (AFG) Program is discussed in detail and in relation to funding in Texas. Specifically, the AFG, Staffing for Adequate Fire and Emergency Response (SAFER) grants, and the Fire Prevention and Safety (FP&S) grants are examined. DHS FEMA Grants Application Process Often federal grant funding flows to the local level through the states. However, some states provide direct funding for emergency medical services (EMS), especially in rural areas. On the other hand, some states have no funding for local programs. Most SFMOs and EMS bureaus offer technical assistance to

311 See: http://www.fema.gov/about-agency (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 144 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

local agencies and subsidized training programs to first responders.312 A large portion of the federal grant budget is passed to the states through formula or block313 grants. The states then decide how to use the grant money. However, some direct federal grant programs are for fire departments and EMS agencies such as the AFG.314 Direct grants are given specifically to the applying agency, but pass-through grants315 require the state to apply to the federal government and then distribute grant money to agencies that request it. Project grants are the most common form of federal grant. Depending on the program requirements, EMS organizations gain access to the funds through a competitive bidding process. Application for a project grant does not guarantee an award, and the amount received by grantees is not predetermined by a formula.316 Although most DHS components possess some programs that support grants,317 FEMA has the majority of programs and funding.318 FEMA Grant Programs Directorate (GPD) The purpose of FEMA GPD is to strategically and effectively administer and manage FEMA grants to ensure critical and measurable results for customers and stakeholders. The mission is to manage federal assistance to measurably improve capability and reduce the risks that the nation faces in times of man- made and natural disasters. The focus of GPD is to provide customer service to all grantees as well as internal and external partners; establish and promote consistent outreach and communication with state, local, and tribal stakeholders; ensure transparency in the grant process; and enhance the nation’s level of preparedness and the public’s capability to prevent, protect, mitigate against, respond to, and recover from all hazards. GPD also holds program management responsibility for the suite of preparedness grants that included, and continue to include, the following goals and objectives: • Review, negotiate, award, and manage the FEMA preparedness grant portfolio. • Provide subject matter expertise in response to regional office and stakeholder inquiries. • Develop grant guidance. • Formulate risk methodology to support grant allocations. • Analyze investments. • Manage budget execution and formulation.

312 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012. 313 A block grant does not involve competition. The federal government distributes funds to the states based on an established formula. 314 The AFG Program is discussed in further detail in the Assistance to Firefighters Grant Program Section of this report. 315 Funds issued by a federal agency to a state agency or institution that are then transferred to other state agencies, units of local government, or other eligible groups, per the award eligibility terms. 316 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012. 317 DHS supports a wide variety of financial assistance, including post-disaster relief and resilience, preparedness, boating safety, cybersecurity, research, university centers of excellence, and assistance to firefighters. 318 See: http://www.dhs.gov/dhs-financial-assistance (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 145 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Provide the driving force for grant management initiatives through the strategic delivery of policy, training, systems, and data analysis.319 The GPD carries out its mission through three divisions, including the GPD Front Office, Grant Operations Division, and Preparedness Grant Division.320 The FEMA grants that pertain to firefighter training and emergency response are discussed in the Preparedness (Non-Disaster) Grants and Assistance to Firefighters Grant Program Sections of this report. Preparedness (Non-Disaster) Grants FEMA provides state and local governments with preparedness program funding in the form of Non- Disaster Grants to enhance the capacity of state and local emergency responders to prevent, respond to, and recover from a WMD terrorism incident involving chemical, biological, radiological, nuclear, and explosive (CBRNE) devices and cyber attacks.321 The Emergency Management Performance Grant (EMPG) Program is a preparedness grant that provides more than $350 million to assist local, tribal, territorial, and state governments in enhancing and sustaining all-hazards emergency management capabilities.322 Either the State Administrative Agency (SAA) or the state’s Emergency Management Agency (EMA) is eligible to apply directly to FEMA for EMPG Program funds on behalf of state and local EMAs.323 The fiscal year (FY 2015) EMPG Program will focus on planning, operations, equipment acquisitions, training, exercises, construction, and renovation to enhance and sustain the all-hazards core capabilities of state, local, tribal, and territorial governments.324 The period of performance for the EMPG Program is 24 months. In FY 2015, the EMPG Program allocated $20,163,325 to the state of Texas.325 Assistance to Firefighters Grant Program Within FEMA, the AFG Program consists of three types of grants326 that support improvements in training, staffing, and safety within fire departments. These grants include the AFG, FP&S grants, and SAFER grants:

319 See: https://www.fema.gov/grant-programs-directorate (accessed on October, 23, 2015). 320 The Preparedness Grant Division includes the Preparedness (Non-Disaster) Grants. 321 See: https://www.fema.gov/preparedness-non-disaster-grants (accessed on October, 22, 2015). 322 See: http://www.dhs.gov/news/2015/07/28/dhs-announces-grant-allocations-fiscal-year-fy-2015-preparedness- grants (accessed on October 22, 2015). 323 See: http://www.fema.gov/media-library-data/1427284579730- 8faafd19a62444a974429c3e12d803fa/FY2015EMPG_FAQ.pdf (accessed on December 28, 2015). 324 See: http://www.fema.gov/media-library-data/1438020444107- 4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on October 22, 2015). 325 See: http://www.fema.gov/media-library-data/1438020444107- 4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on November 25, 2015) 326 The AFG Program also includes Assistance to Firefighters Fire Station Construction Grants.

West Fertilizer Company Final Report January 2016 146 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• AFG. The primary goal of the AFG Program is to meet the firefighting and emergency response needs of fire departments and nonaffiliated EMS organizations. Since 2001, the AFG Program has helped firefighters and other first responders to obtain critically needed equipment, protective gear, emergency vehicles, training, and other resources needed to protect the public and emergency personnel from fire and related hazards.327 AFGs are awarded to fire departments, state fire training academies, and EMS organizations. • SAFER Grants. The SAFER Grants were created to provide funding directly to fire departments and volunteer firefighter interest organizations to help them increase the number of trained frontline firefighters available in their communities. The goal of SAFER is to enhance the local fire departments’ capabilities to comply with staffing, response, and operational standards established by the NFPA (NFPA 1710, NFPA 1720, or both).328 • FP&S Grants. The FP&S Grants are part of the AFG Program and support projects that enhance the safety of the public and firefighters from fire and related hazards.329 The primary goal is to reduce injury and prevent death among high-risk populations. In 2005, Congress reauthorized funding for FP&S Grants and expanded the eligible uses of funds to include firefighter safety research and development.330 In FY 2014, the AFG provided more than $300 million in grant money nationwide; of this $300 million, Texas received approximately $6.5 million. The AFG Program issued 2,243 individual grants nationwide, and of those, only 90 grants were to fire departments for the purpose of training firefighters.331 Moreover, in FY 2014, the AFG Program awarded grant money to 40 firefighting and EMS organizations in Texas to provide aid for much needed resources (Figure 70). Of those 40 Texas organizations, 20 career fire departments, but only 14 VFDs, were awarded funding through the AFG Program. The remaining six organizations include emergency service organizations and one state fire training academy. Notably, an interesting finding is that of the grants awarded in Texas, only one award was specific to training personnel while the majority of the awards were used to fund equipment, PPE, facility modifications, vehicle acquisitions, and wellness and fitness programs.

327 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 328 See: http://www.fema.gov/staffing-adequate-fire-emergency-response-grants (accessed on December 28, 2015). 329 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 330 See: http://www.fema.gov/fire-prevention-safety-grants (accessed on December 28, 2015). 331 See: http://www.fema.gov/assistance-firefighters-grants-award-year-2014 (accessed on October 21, 2015).

West Fertilizer Company Final Report January 2016 147 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Organization City State Program Award Amount Activity Breakdown Award Date Martindale Volunteer Fire Dept. Co. Martindale TX Operations and Safety $46,196.00 Personal Protective Equipment ($48,005) 4/24/2015 Northwest Rural Emergency Medical Services Association, Inc. Tomball TX Operations and Safety $160,572.00 EMS Equipment ($168,600) 4/24/2015 Sulphur Springs Fire Rescue Sulphur Springs TX Operations and Safety $57,143.00 Modify Facilities ($60,000) 4/24/2015 Devine Volunteer Fire and Rescue Department Devine TX Operations and Safety $23,982.00 Equipment ($24,056) 5/8/2015 Farmers Branch Fire Department Farmers Branch TX Operations and Safety $223,773.00 Personal Protective Equipment ($246,150) 5/22/2015 Frankston Volunteer Fire Department Frankston TX Operations and Safety $80,000.00

Equipment ($45,900) || Personal Protective Equipment ($38,100) 5/22/2015 City of Paris Fire Department Paris TX Operations and Safety $11,632.00 Equipment ($12,795) 5/29/2015 Commerce Fire Department Commerce TX Operations and Safety $153,048.00 Personal Protective Equipment ($160,075) 5/29/2015 Texas Engineering Extension Service (TEEX) College Station TX State Fire Training Academy $265,243.00 Equipment ($265,600) 6/19/2015 Hitchcock Volunteer Fire Department Hitchcock TX Operations and Safety $160,667.00 Personal Protective Equipment ($167,500) 7/3/2015 Leander Fire Department Leander TX Operations and Safety $22,719.00 Wellness and Fitness Programs ($6,540) 7/10/2015 San Marcos Fire Department San Marcos TX Regional Request $707,546.00 Equipment ($778,300) 7/10/2015 Troup Volunteer Fire Dept Troup TX Vehicle Acquisition $238,096.00 Vehicle Acquisition ($250,000) 7/10/2015 Bonham Fire Department Bonham TX Vehicle Acquisition $663,713.00 Vehicle Acquisition ($696,898) 7/24/2015 Glenn Heights Fire Department Glenn Heights TX Operations and Safety $78,858.00 Personal Protective Equipment ($82,800) 7/24/2015 Houston Fire Department Houston TX Operations and Safety $915,120.00 Training ($1,008,732) 7/24/2015 Itasca Fire Department Itasca TX Vehicle Acquisition $103,621.00 Vehicle Acquisition ($108,802) 7/24/2015 Burnet County Emergency Services District No. 9 Spicewood TX Operations and Safety $72,000.00 Personal Protective Equipment ($75,600) 7/31/2015 Apple Springs Volunteer Fire Dept Apple Springs TX Operations and Safety $53,143.00 Personal Protective Equipment ($55,800) 8/14/2015 Mic-County Volunteer Fire Department Lockhart TX Regional Request $399,637.00 Equipment ($423,600) 8/14/2015 Orange County Emergency Services District #1 Vidor TX Operations and Safety $173,993.00 Personal Protective Equipment ($191,392) 8/14/2015 Anna Fire Department Anna TX Operations and Safety $28,572.00 Modify Facilities ($30,000) 8/21/2015 Cash Fire Department Assoc. Inc. Greenville TX Operations and Safety $71,760.00 Equipment ($74,355) 8/21/2015 City of Palestine Fire Department Palestine TX Operations and Safety $170,667.00 Personal Protective Equipment ($179,200) 8/21/2015 City of Terrell Fire Department Terrell TX Operations and Safety $246,215.00

Modify Facilities ($65,700) || Personal

Protective Equipment ($139,500) || Wellness and Fitness Programs ($53,325) 8/21/2015 eastex freeway volunteer fire department humble TX Operations and Safety $73,119.00 Equipment ($80,430) 8/21/2015 Elm Mott Volunteer Fire and Rescue Elm Mott TX Operations and Safety $31,429.00 Equipment ($33,000) 8/21/2015 Kilgore Fire Department Kilgore TX Operations and Safety $158,364.00 Personal Protective Equipment ($174,200) 8/21/2015 Comanche Volunteer Fire Department Comanche TX Operations and Safety $116,071.00 Personal Protective Equipment ($121,374) 8/28/2015 Sanger Volunteer Fire Department Sanger TX Operations and Safety $36,364.00 Equipment ($40,000) 8/28/2015 Tarkington Volunteer Fire Department Cleveland TX Operations and Safety $62,858.00 Personal Protective Equipment ($66,000) 8/28/2015 Kingsville Fire Department Kingsville TX Vehicle Acquisition $362,728.00 Vehicle Acquisition ($399,000) 9/4/2015 Muenster Volunteer Fire Department Muenster TX Operations and Safety $78,572.00 Personal Protective Equipment ($82,500) 9/4/2015 Richland Hills Fire Rescue Richland Hills TX Operations and Safety $41,214.00 Equipment ($43,274) 9/4/2015 Stafford, City of Stafford TX Operations and Safety $152,728.00 Personal Protective Equipment ($168,000) 9/4/2015 Quitman Fire & Rescue Quitman TX Operations and Safety $111,429.00 Personal Protective Equipment ($117,000) 9/11/2015 CITY OF WEBSTER WEBSTER TX Operations and Safety $23,620.00 Equipment ($24,800) 9/18/2015 Garland Fire Department Garland TX Operations and Safety $18,730.00 Equipment ($20,400) 9/18/2015 Van Alstyne Fire Department Van Alstyne TX Operations and Safety $33,387.00

Modify Facilities ($23,500) || Equipment ($10,056) 9/18/2015 Centerville Volunteer Fire Dept., Inc Centerville TX Operations and Safety $97,381.00 Personal Protective Equipment ($102,250) 9/25/2015 $6,525,910.00 Assistance to Firefighters Grant Program (AFG) FY 2014 Award Recipients Last Updated: 9/25/2015 - www.fema.gov/firegrants/ TOTAL

Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA) In FY 2014, the awarded SAFER Grants totaled approximately $11.7 million to five fire departments in Texas to increase the number of trained firefighters; of these five departments, only one was a VFD (Figure 71). Similarly, the awarded FP&S Grants totaled approximately $1.5 million to two organizations in Texas, neither of which were fire departments, to support projects that enhance the safety of the public and firefighters from fire and related hazards (Figure 72).

West Fertilizer Company Final Report January 2016 148 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA)

Figure 72. FP&S Grant Recipients in Texas (Source: FEMA) On the basis of the analysis of the FEMA FY 2014 funding allocation to fire departments throughout the nation, it can be concluded that much of the grant monies went toward non training-related support. Given the constraints that many VFDs experience regarding funds to support training, fire departments should express a greater interest in also applying for federal grants for training purposes and not solely for supporting other firefighting-related needs such as equipment. For this reason, FEMA should develop a grant that specifically supports firefighter training needs and cannot be used toward funding other resource needs such as equipment or PPE. DHS FEMA Programs A general understanding of the intricate landscape of federal grant programs also enables a better understanding of many of the DHS and FEMA programs specific to training. This section describes the various components and programs that promote preparedness at a national level. First, the FEMA National Preparedness Directorate (NPD) serves as a mechanism for fostering programs and resources. Second, training programs reside within the National Training and Education Division (NTED). Third, the Homeland Security National Training Program (HSNTP) is positioned to create accessible training and specifically addresses national preparedness gaps. Fourth and fifth, the Center for Domestic Preparedness (CDP) and the Rural Domestic Preparedness Consortium (RDPC) are NTED training

West Fertilizer Company Final Report January 2016 149 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

partners. Sixth, the USFA role as a leader in firefighter training is reviewed. Each is discussed in detail in the rest of this section. National Preparedness Directorate (NPD) The NPD is an organizational component of FEMA that provides the doctrine, programs, and resources to prepare the nation to prevent, protect, mitigate, respond to, and recover from disasters while minimizing the loss of lives, infrastructure, and property.332 A variety of courses in all-hazards emergency planning and response constitutes a key aspect of building a culture of preparedness and involves training at many levels, including: • State, local, tribal, and territorial elected officials. • Emergency managers. • First responders. • Appropriate whole community members, such as volunteer organizations, Community Emergency Response Teams, Citizen Corps, and bystanders. • Other emergency responders. Through the NPD, FEMA has established and delivered effective training and professional education programs and developed a national certification system for overall emergency management competency and expertise. This work is accomplished by the National Emergency Training Center (NETC), CDP, and other training partners.333 National Training and Education Division (NTED) NTED serves the nation’s first responder community, offering more than 150 courses to help build critical skills that responders need to function effectively in mass consequence events. NTED primarily serves state, local, and tribal entities in 10 professional disciplines, but has expanded to serve the private sector and citizens as well. Instruction is offered at the awareness, performance, and management and planning levels. Emergency responders attend NTED courses to learn how to apply the basic skills of their profession in the context of preparing, preventing, deterring, responding to, and recovering from acts of terrorism and catastrophic events. Training partners or providers that develop and deliver NTED approved training courses include: • CDP. • Counterterrorism Operations Support. • Louisiana State University. • New Mexico Institute of Mining and Technology.

332 See: http://www.fema.gov/national-preparedness-directorate (accessed on December 28, 2015). 333 See: http://www.dhs.gov/topic/plan-and-prepare-disasters (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 150 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Texas Engineering Extension Service.334 • Transportation Technology Center, Inc. • University of Hawaii, National Disaster Preparedness Training Center. Other training partners, such as the following, have developed or are developing training courses for NTED: • BCFS Health and Human Services. • Frederick Community College. • International Association of Fire Fighters.335 • Naval Postgraduate School. • RDPC.336 NTED training partners deliver training at no cost to the individual or to the individual’s jurisdiction or agency. In some circumstances, with approval from the SAA state/territory training point of contact, Homeland Security Grant Program (HSGP) funds 337 may be used for overtime and backfill costs for those individuals attending NTED courses. Training providers have a limited supply of training for each state. Occasionally, a state exhausts the available free training. In these cases, NTED has an Excess Delivery Acquisition Program that allows NTED training partners to charge for course delivery when more sessions of a requested class are needed than the grant funds can accommodate. Select training partners potentially could support training firefighters on the hazards associated with FGAN fires, as discussed in further detail. NTED courses include multiple delivery methods, specifically instructor-led (direct), train-the-trainers (indirect), customized (conferences and seminars), and web-based deliveries. Instructor-led courses are offered in residence (i.e., at a training facility) or through mobile programs that deliver courses to state and local jurisdictions that request the training. While the GPD, Grant Operations Division manages, administers, and conducts application budget review, creates the award package, approves, amends and closes out awards, the NPD NTED holds programmatic responsibility for the HSNTP Continuing Training Grants (CTG) Program and also maintains the program management function and responsibilities throughout the life cycle of the awarded grant.338

334 TEEX currently has an 8-hour course delivered in any participating jurisdiction that focuses on training responders to meet the requirements established in NFPA 472, Chapter 4, “Competencies for Awareness Level Personnel,” and the OSHA 29 CFR 1910.120 (q)(6)(i) (a–f) First Responder Awareness Level competencies. This course takes an all-hazards approach to HAZMAT incidents. It provides participants with the knowledge to recognize the HAZMAT, protect themselves, notify others, and secure the scene. As part of a DHS FEMA funded HSNTP Cooperative Agreement, this course is available at no direct cost to state, county, and local government agencies. 335 Section 7.7.3.1 of this report provides additional information about the IAFF. 336 RDPC is discussed in further details in the Rural Domestic Preparedness Consortium Section of this report. 337 HSGP funds can be used to reimburse the state agency or local jurisdiction for delivery of, and attendance to, the course. 338 DHS, HSNTP, CTG Program. “Notice of Funding Opportunity.” DHS-15-NPD-005-000-01.

West Fertilizer Company Final Report January 2016 151 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Homeland Security National Training Program, Continuing Training Grants The FY 2015 HSNTP CTG program339 provides funding via cooperative agreements340 to training partners to develop and deliver training to prepare whole communities to prevent, protect against, mitigate, respond to, and recover from acts of terrorism and from natural, man-made, and technological hazards. An objective of the program is to create accessible training solutions to address specific national preparedness gaps across the country. For FY 2015, the total HSNTP funds available under the CTG Program is $11.521 million, to be used for training in the following focus areas: • Cybersecurity. • HAZMAT. • Countering violent extremism. • Rural training. The FY 2015 HSNTP CTG Program is an open and competitive funding opportunity, available to entities with existing programs or demonstrable expertise relevant to the focus areas in the funding opportunity announcement—including state, local, tribal, and territorial entities; nonprofit national associations and organizations; nonprofit higher education institutions; and nonprofits such as community and faith-based organizations. HAZMAT and rural training are two focus areas of interest to this investigation because fire departments with HAZMAT or FGAN facilities in their jurisdiction (or those in rural341 locations) can apply for this grant since they fall under these focus areas. Within the HAZMAT focus area, departments are required to identify current and emerging national gaps in HAZMAT incident planning, response, and recovery as well as the training solutions to address these gaps. The FY 2015 HSNTP CTG Program prescribed the following standards related to HAZMAT training: NFPA standards, including NFPA 472 (Standard for Competence of Responders to Hazardous Materials /Weapons of Mass Destruction Incidents), NFPA 473 (Standard for Competencies for EMS Personnel Responding to Hazardous Materials/Weapons of Mass Destruction Incidents), and 29 CFR 1910.120 (Hazardous Waste Operations and Emergency Response). In addition, Executive Order 13650, “Improving Chemical Facility Safety and Security,” and published reports from the Chemical Facility Safety and Security Working Group have been incorporated. The proposed training should address the following issues:

339 As appropriated by the Department of Homeland Security Appropriations Act, 2015 (Pub. L. 114-4) and authorized by the Implementing Recommendations of the 9/11 Commission Act of 2007 (Pub. L. 110-53) (hereafter the 9/11 Act), and the Homeland Security Act of 2002 (6 U.S.C. § 101 et seq.). 340 A legal instrument of financial assistance between a federal awarding agency or pass-through entity and a non- federal entity that is consistent with 31 U.S.C. 6302–6305. 341 The U.S. Census Bureau defines rural areas as all areas not meeting the following definition of a metropolitan area: Metropolitan statistical area (MSA) must include at least one city with 50,000 or more inhabitants or an urbanized area with at least 50,000 inhabitants and a total MSA population of at least 100,000.

West Fertilizer Company Final Report January 2016 152 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Planning, response and mitigation strategies, defensible critical decision making to save lives and property, and actions for fixed-facility spills and releases. • Increasing knowledge, skills, and abilities to achieve core capabilities of interdiction and disruption, on-scene security and protection, and operational communications and coordination to enhance a jurisdiction’s capability to mitigate and respond to HAZMAT incidents. • Responder health and safety to prepare for, respond to, and recover from HAZMAT incidents by including on-scene health risk assessments and hazard risk analysis, incident safety and health plans, air monitoring plans, PPE selection and use, and safe work practices. Many VFDs similar to the WVFD are situated in rural environments where the funding to support training is limited. The required training objectives for the rural training focus area include HAZMAT, mass fatality planning and response, crisis management for school-based incidents, development of emergency operations plans, railcar safety, agroterrorism and food and animal safety, and media engagement strategies for first responders.342 Center for Domestic Preparedness CDP opened in June 1998 as a training center for the nation’s emergency responders. The CDP mission is to train emergency response providers from state, local, and tribal governments as well as the Federal government, foreign governments, and private entities, as available. CDP training is also available for international, federal, and private sector responders who may participate if space is available on a fee-for- service basis. The scope of training includes preparedness, protection, and response. CDP provides onsite and mobile training at the performance, management, and planning levels while also facilitating the delivery of training by DHS training partners. DHS fully funds CDP training for state, local, and tribal responders. CDP has three distinct facilities that support training, specifically the Chemical, Ordnance, Biological, and Radiological Training Facility (COBRATF), Advanced Responder Training Complex (ARTC), and Noble Training Facility. The CDP COBRATF offers the only program in the nation featuring civilian training exercises in a toxic chemical agent environment, including biological materials. The advanced hands-on training enables responders to effectively respond to real-world incidents involving chemical, biological, explosive, or radiological materials or other HAZMAT. The ARTC provides responders with a realistic training environment to exercise the skills acquired during training. The CDP Noble Training Facility is the nation’s only hospital dedicated solely to preparing the health care, public health, and environmental health communities for mass casualty events related to terrorism or natural disasters. CDP’s federal training partners include agencies such as: • Emergency Management Institute (EMI). • National Fire Academy (NFA). • Federal Law Enforcement Training Centers.

342 DHS HSNTP CTP Program. “Notice of Funding Opportunity (NOFO),” DHS-15-NPD-005-000-01.

West Fertilizer Company Final Report January 2016 153 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Center for Disease Control and Prevention. • Veterans Administration. • DHS Office for Bombing Prevention. • Radiological Emergency Preparedness Program. • Department of Agriculture. • DHS Domestic Nuclear Detection Office. • Health and Human Services Division of Strategic National Stockpile. Rural Domestic Preparedness Consortium (RDPC) Rural emergency responders face unique challenges compared to their urban counterparts, such as limited access to funding for fundamental training. These challenges in providing consistent and high-quality training for first responders were recognized by Congress and DHS, which then established RDPC. Led by the Center for Rural Development, RDPC is a DHS-funded program providing training and resources to rural first responders. RDPC develops and delivers relevant all-hazards training specific to rural environments, and courses are offered both in person and online at no cost. To ensure that training directly reflects the needs of rural emergency responders, RDPC convenes a national rural preparedness summit and completes a biannual national survey of rural stakeholders. Data gathered from these activities are used to determine the type of training needs, level of need, and best delivery methods.343 U.S. Fire Administration (USFA) The USFA is currently an entity within FEMA. The USFA was established by the Federal Fire Prevention and Control Act of 1974. 344 The mission of the USFA is to provide leadership, coordination, and support for the nation’s fire prevention and control, fire training and education, and EMS activities and to prepare first responders and health care leaders to react to all-hazard and terrorism emergencies. One of USFA’s key objectives is to reduce the nation’s loss of life from fire while also reducing property loss and nonfatal injury due to fire.345 The USFA develops and delivers fire prevention and safety education programs in partnership with other federal agencies, the fire and emergency response community, media, and safety interest groups.346 The USFA collaborates with public and private groups to promote and improve fire prevention and life safety through research, testing, and evaluation. The USFA manages many of the federal programs related to firefighting, including the National Fire Incident Reporting System, a dataset and collection of statistical

343 See: https://www.ruraltraining.org/about/overview/ (accessed on October 21, 2015). 344 The U.S. Congress passed P.L. 93-498, the Federal Fire Prevention and Control Act, in 1974, which led to establishment of the USFA and the NFA. See: http://legcounsel.house.gov/Comps/FIREPREV.PDF (accessed on December 28, 2015). 345 See: https://www.fas.org/sgp/crs/homesec/RS20071.pdf (accessed on December 28, 2015). 346 See: http://www.usfa.fema.gov/about/index.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 154 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information relating to fire incidents, public fire education campaign materials, and information on grants and funding. The USFA oversees the NFA at the NETC in Emmitsburg, Maryland. The NFA works to enhance the capability of fire and emergency services and allied professionals to deal more effectively with fire- related emergencies. The NFA offers free training courses and programs on campus, online, and throughout the nation.347 The USFA offers federal funding and grants directly to local career fire departments and VFDs and unaffiliated EMS organizations to help address a variety of equipment, training, and other firefighter and EMS-related needs. The grants are provided through the Fire Act Grants under the FEMA AFG Program, FP&S Grants, and SAFER Grants, which provide grants for hiring, recruiting, and retaining firefighters.348 349 Firefighters often dedicate personal time for training, public education, fundraising, and other nonemergency department-related activities. In addition, they are often members of their local or national firefighter associations. 7.8.2 Texas Firefighting Training Organizations and Programs CSB reviewed the availability of national firefighter training grants and programs. The review revealed that career and volunteer firefighters and fire departments have access to many federally funded training grants and programs throughout the nation. Moreover, CSB reviewed state-level funding and programs available to Texas firefighters and fire departments in an effort to determine how access to HAZMAT and FGAN-specific training can be increased while also improving training standards for FGAN. Select state resources—such as the Texas Commission on Fire Protection (TCFP), Texas Rural Volunteer Fire Department Assistance Program, SFFMA, and Texas A&M Engineering & Extension Services (TEEX) are discussed further. As a result, CSB issues recommendations to some of these state resources, which are identified in Section 11. 7.7.2.2 Texas Commission on Fire Protection (TCFP) The TCFP, a state government agency, is one of many state and local agencies that compose the Texas fire protection community. The commission’s statutory authority and role within this community is to serve Texas fire departments as follows: • Provide training guidelines and assistance to the fire service. • Establish and enforce statewide fire service standards.350

347 See: http://www.usfa.fema.gov/training/nfa/ (accessed on December 28, 2015). 348 See: https://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 349 The AFG, FP&S Grants, and SAFER Grants are discussed in the Assistance to Firefighters Grant Program Section of this report. 350 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on November 13, 2015).

West Fertilizer Company Final Report January 2016 155 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An important TCFP characteristic is its service to regulated organizations, including paid fire departments and those volunteer departments that choose to be voluntarily regulated. The policymaking body of the TCFP is a 13-member board appointed by the governor and confirmed by the Texas Senate. The commissioners adopt policies in accordance with Chapter 419 of the Texas Government Code. Upon adoption by the TCFP, these policies become state administrative laws collected under Part 13 of Title 37 of the Texas Administrative Code (TAC). The TCFP may propose or adopt changes to the TAC. The firefighter advisory committee351 is responsible for reviewing and commenting on the administrative rules that govern the state’s fire service and also assists the TCFP in matters relating to fire protection personnel, volunteer firefighters, fire departments, and VFDs.352 The advisory committee may submit new curricula (or changes to curricula) for study and review before approval by the TCFP. The commission often creates ad hoc advisory committees to assist in creating and updating curricula, validating test questions, and addressing other related matters. Members of the Texas fire service serve voluntarily on these committees.353 The goal of the TCFP compliance program is to ensure the safety of the state’s fire protection personnel by inspecting fire departments and other regulated entities to confirm that they are in compliance with state laws and rules. The compliance inspectors also inspect training records to ensure that fire protection personnel are in compliance with the appropriate certification rules for their disciplines. The commission’s compliance officers travel to every regulated entity at least once every 2 years to inspect fire protection personnel certifications, training records, breathing air test records, protective clothing, and self-contained breathing apparatus. If a fire department is found to be in violation of a state law or TCFP rule, the Compliance Section compels the department to correct the violation immediately or works with it to develop a plan that will lead to compliance.354 The TCFP certification program certifies approximately 32,000 fire protection personnel in Texas. State law requires paid fire protection personnel to be certified by this commission; volunteers and individuals not affiliated with a paid or volunteer department can voluntarily choose to be certified by TCFP. The commission certifies fire protection personnel to multiple levels (basic, intermediate, advanced, and master) in several different disciplines.355 In addition, TCFP certifies training facilities. When fire departments have unmet training needs, TCFP may take a number of actions: • Authorize reimbursement for a local government agency for training program expenses. • Provide staff or educational materials on request to training programs or fire departments.

351 The firefighter advisory committee is created by the TCFP enabling statute, Chapter 419 of the Government Code. The TCFP appoints members. See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm#419.023 (accessed on December 28, 2015). 352 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 3, 2015). 353 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 13, 2015). 354 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on October 27, 2015). 355 Including structure fire protection, aircraft rescue fire protection, marine fire protection, fire inspector, fire and arson investigation, HAZMAT technician, pumper driver and operator, fire instructor, fire officer, and head of department.

West Fertilizer Company Final Report January 2016 156 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Establish minimum curriculum requirements for courses in schools operated by state or local governments. • Provide training assistance to fire departments through the following methods:  Purchase and provide training aids to fire departments, temporarily or permanently.  Finance training seminars for fire departments.  Pay instructor fees to teach specialized courses for fire departments that employ fully paid fire protection personnel.356 Although these four elements are cited in the TCFP statute (Section 419.028), the commission is no longer funded for the type of assistance provided by authorizing reimbursements or delivering training. The TCFP funding program that offers this type of training assistance to fire departments was transferred to the Texas A&M Forest Service in 2009.357 TCFP’s Certification Curriculum Manual supplies the curriculum for the training of structural fire suppression personnel, aircraft rescue fire protection personnel, and marine fire protection personnel as well as fire inspectors, fire investigators, HAZMAT technicians, pumper drivers and operators, fire instructors, fire officers, and wildland firefighters. 358 The Certification Curriculum Manual’s Hazardous Materials Awareness chapter was updated in June 2015. This chapter of the manual includes course material on Class 5 oxidizing substances and organic peroxides; this class includes AN.359 The curriculum sets the minimum standards for materials covered in the course; however, instructors decide whether to go into further detail within specific topic areas such as AN. The TCFP may consult and cooperate with a local governmental agency, other governmental agency, university, college, junior college, or other relevant institutions concerning the development of training schools and associated programs of courses of instruction for fire protection personnel, including the preparation or implementation of continuing education or training programs.360 The TCFP has entered into a memorandum of understanding (MOU) with TEEX361 to coordinate each organization’s training responsibilities. In addition, the TCFP has an MOU with the Texas A&M Forest Service to coordinate the provision of training assistance and other assistance to firefighting entities. The Texas A&M Forest Service consists of many programs directed to VFDs to enhance the ability of firefighters to protect themselves and the public from fire-related hazards. One such program within the Texas A&M Forest Service that supports volunteer firefighter training is discussed in more detail in the next section.

356 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on October 28, 2015), Section 419.028 through Section 419.031. 357 The Rural VFD Assistance Program in the Texas A&M Forest Service is discussed further in Section 7.7.4 of this report. 358 See: http://www.tcfp.texas.gov/manuals/curriculum_manual.asp (accessed on October 28, 2015). 359 See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on October 28, 2015). 360 Section 419.030. 361 Section 7.7.2.5 discusses TEEX in further detail.

West Fertilizer Company Final Report January 2016 157 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7.2.3 Texas Rural Volunteer Fire Department Assistance Program (HB 2604)

In a January 2015 interim report by the Texas Committee on Homeland Security and Public Safety, Chairman Joe Pickett (D-El Paso) submitted recommendations to, and drafted legislation for consideration by, the House of Representatives, 84th Texas Legislature.362 The committee’s report indicates that of the 40 fire departments that represent the authority with jurisdiction for the 43 FGAN facilities across the state, 27 are VFDs; 7 are a combination of paid and volunteer firefighters; and 6 consist only of paid firefighters. A recommendation that stemmed from this finding encouraged the legislature to approve a rider in the Appropriations Bill for Texas A&M Forest Service that addresses funding in the Rural Volunteer Fire Department (Rural VFD) Assistance Program. The purpose of this funding is to provide training for VFDs across the state that are in a jurisdiction with an FGAN facility.363 The 77th Texas Legislature passed House Bill 2604 in 2001, establishing the Rural VFD Assistance Program.364 The primary goal of the VFD Assistance Programs is to enhance the emergency response capabilities of volunteer and combination fire departments with 20 or fewer paid members.365 The Texas Rural VFD Assistance Program provides funding to rural VFDs for the acquisition of firefighting vehicles, fire and rescue equipment, protective clothing, dry hydrants, computer systems, and firefighter training. This cost-share program is funded by the Texas State Legislature. Beginning on September 1, 2015, the annual grant budget for the program increased to $24.3 million from the previous annual budget of $12.8 million. Cost share assistance for training tuition has increased after changes to the Rural VFD Assistance Program that also took effect on September 1, 2015. The new reimbursement rate is 100 percent of the actual cost of tuition, not to exceed $125 per day up to a maximum of $625 per trainee per school. The annual maximum for training tuition grant assistance per fire department is $12,500.366 The Texas A&M Forest Service conducted a funding meeting for FY 2015 on March 11, 2015, to determine how grants would be awarded. During this meeting, approximately $1.4 million in grants was awarded to Texas VFDs. Two VFDs in McLennan County, Texas, were approved for funding, and one is the WVFD, approved for $8,000 for a training library (Table 10).367 All VFDs that apply for state grants,

362 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-Homeland- Security-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015). 363 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-Homeland- Security-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015): 22–24. 364 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New_- _Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 13, 2015). 365 See: http://texasforestservice.tamu.edu/content/article.aspx?id=19857 (accessed on October 28, 2015). 366 See: http://texasforestservice.tamu.edu/uploadedFiles/TFSMain/Preparing_for_Wildfires/Fire_Department_Programs/Lo cal_Volunteer_Fire_Department_Programs/Rural_VFD_AssistanceProgram/Special%20Announcement%20-- %20Program%20Changes%20FY16(1).pdf (accessed on October 27, 2015) 367 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New- _Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 16, 2015).

West Fertilizer Company Final Report January 2016 158 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

including matching federal funds, must certify that they have adopted NIMS. Before the WFC incident in December 2012, the WVFD had requested funds through the Rural VFD Assistance Program for a large brush truck, but the request was not approved. The WVFD requested this funding every year thereafter, although it did not meet the NIMS certification requirement.368 Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program Date Approved Equipment/Training Category Approved Amount January 2003 Truck Chassis Large $40,000 May 2004 C/S Structural Gear $6,000 September 2008 Wildland Gear $5,700 March 2015 Training Library $8,000

The SFFMA of Texas was instrumental in the creation of House Bill 2604, which annually distributes grant funding through the Texas Forest Service to fire departments in need. Similar to the TCFP, the SFFMA assists many volunteer firefighters and fire departments in obtaining training. 7.7.2.4 State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA) Organized in 1876, the SFFMA is Texas’s oldest and largest fire association serving the fire and emergency service responders of Texas. The SFFMA has the support of more than 1,200 fire departments, 22,000 individual members, 80 industrial fire brigades, and EMS and international departments. The association is active in legislative efforts that affect the fire service in Texas.369 The SFFMA is a fee-based membership organization that offers individual and fire department memberships,370 and has partnered with the National Volunteer Fire Council (NVFC)371 to provide joint benefits to their members. The SFFMA consists of a volunteer firefighter certification program that encourages VFDs to initiate the program in an effort to upgrade training standards. A VFD must be a member of the SFFMA to participate in the certification programs. Through the program, the fire department’s selected

368 See: http://tfsweb.tamu.edu/HistoricalFunding/ (accessed on November 17, 2015). 369 See: http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9- 7ae03d5685dd (accessed on October 29, 2015). 370 The fire department membership dues are based on the Federal Census population of the cities and towns that they serve. 371 NVFC is discussed in further detail in Section 7.7.3 of this report.

West Fertilizer Company Final Report January 2016 159 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

certification coordinator is required to attend a free certification workshop at least once every 2 years. The certification workshop is a requirement to maintain the departments’ participation status. The certification coordinator validates that all training and certifications meet state criteria; it is the coordinator’s responsibility to document the training and ensure that a qualified instructor has conducted the training. To verify that a department holds continual training and correctly maintains its records, the coordinator must submit an annual training summary or progress report.372 The SFFMA Certification Board sets the criteria for the training curriculum; however, it does not develop topic- specific training modules for firefighters and departments. The SFFMA relies on firefighter training schools, approved training providers, or certified training instructors to administer the training. The SFFMA Program allows individual departments and their members to decide how far they will go in the process. The process levels include NFPA 1403, Introductory; NFPA 1001, Firefighter I; NFPA 1001, Firefighter II; and Master certifications.373 Currently, the SFFMA does not have an exclusive program that certifies firefighters on HAZMAT or AN; however, part of the certification for the Firefighter I program includes a section on HAZMAT.374 As part of the minimum standards for firefighter certification, the section designates that trainees recognize the hazard classes and divisions of HAZMAT and WMD375 and identify common examples of materials and primary hazards in each hazard class or division, such as Class 5 oxidizers.376 The SFFMA Texas Industrial Emergency Services Board (TIESB) provides guidance for the Texas Industrial Fire Protection Program. The TIESB works with the Texas Chemical Council and the National Petroleum Refiners Association in reviewing differences among various industries in training needs for all emergencies and loss prevention programs. The TIESB has many objectives, including promoting the development of fire training and loss prevention programs for industrial firefighters or members of the SFFMA and also recommending for each member industry-minimum criteria for maintaining effective fire training, loss prevention, and educational programs.377 Currently, the TIESB has a certification program for industrial HAZMAT teams and emergency response personnel378 that establishes minimum criteria for certification but also provides flexibility so that each facility can structure its training programs to address individual needs. The TIESB has formally adopted NIMS, designating it as the incident management system for all members seeking certification of their training programs.379

372 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Navigating_Cert_2015_Apr.pdf (accessed on November 2, 2015). 373 See: http://www.sffma.org/WEB/SFFMAPages/Certification/Resources/Certification_FAQ.pdf?WebsiteKey=65a2a6d5- cf92-4d26-8251-b69cdeecaa68&hkey=1509bff9-ad5b-411d-904d-9de79e384a6d (accessed on October 30, 2015). 374 Of the 22 sections in the program, Section 18 covers HAZMAT. 375 NFPA 472, Section 4.2.1: 2, 3. 376 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Full_Program_2015_02.pdf (accessed on October 29, 2015): 61. 377 See: http://www.sffma.org/web/SFFMA/Divisions/Industrial/SFFMA/TIESB.aspx?hkey=60a9d6ce-7f4f-4d91- b642-d41585bf3597 (accessed on October 30, 2015). 378 Training program certification is for HAZMAT Technician, Specialist, and Incident Command levels. 379 See: http://www.sffma.org/web/SFFMAPages/TIESB/Policy_Docs/TIESB010.pdf (accessed on October 30, 2015).

West Fertilizer Company Final Report January 2016 160 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Within Texas, multiple organizations support firefighter standards for training curricula and certification. These organizations work with training partners such as TEEX in the development of course curricula and the implementation of training programs that suit the diverse needs of fire departments. 7.7.2.5 Texas A&M Engineering Extension Services (TEEX) In 1929, the State Firemen’s and Fire Marshals' Association of Texas (SFFMA) selected Texas A&M College as the site for a permanent firefighter training school. In 1931, the Texas Legislature authorized the creation of a Firemen’s training school by passing House Bill No. 921. This bill authorized Texas A&M to create, conduct and maintain a Firemen’s training school. A member of The Texas A&M University System, the Texas A&M Engineering Extension Service (TEEX) has more than 80 years of experience in providing professional services with expertise in national and industrial security, emergency preparedness and response, public infrastructure, occupational safety, economic development, and technology assessment and validation. TEEX employees nearly 1,000 experts in various fields and is able to develop training solutions for emergency responders across the state and nationwide. Funding for Texas agencies and fire departments is available from several sources to support TEEX tuition, fees, and other related expenses. TEEX encourages fire departments to take advantage of federal funding programs such as those in DHS FEMA as well as no-cost training in Texas through the fire extension services, NFA, area schools, and other assistance programs and associations.380 TEEX tailors need-specific services and training at a number of its facilities and also at customer-specified locations worldwide. TEEX has the ability to offer a full-range of services and delivery methods, including: • Course design and development. • Online course delivery. • Hosting services for eLearning courses. • Classroom-based instruction. • Hands-on skills-based instruction. • National certification testing. • Technical assistance and technology validation. • Bilingual training and translation services. TEEX collaborates with resources within The Texas A&M University System to provide a unique blend of research and technical expertise. The TEEX Emergency Services Training Institute’s (ESTI) main training facility is the Brayton Firemen’s Training Field. Adjacent to this facility is Disaster City®, which is comprised of 296 acres in College Station, Texas, making it the world’s largest, most comprehensive campus for first responders. Each year thousands of students participate in ESTI’s hands-on training in firefighting, emergency medical services, hazardous materials, rescue, Incident Command, and

380 See: https://teex.org/Pages/about-us/funding-grants.aspx (accessed on November 6, 2015).

West Fertilizer Company Final Report January 2016 161 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

specialized programs. ESTI offers over 200 different courses in more than 130 specialty areas to students from across Texas, the United States and around the world.381 In FY15 TEEX/ESTI provided training for some 96,364 students in 3,670 separate classes which accounted for 1.625 million man contact hours. During the course of FY15 training, all 254 Texas Counties were served including 92% of all Texas Communities. TEEX/ESTI also trained students from 81 foreign countries during FY15. TEEX receives General Revenue from the State of Texas to provide outreach or extension training to the States Emergency Responders. In FY15, more than 20,000 responders of the State trained through this program at no cost to them or their department. Through its accreditation with the National Professional Qualification System (NPQS), or ProBoard, TEEX/ESTI is authorized to offer certification training in compliance with National Fire Protection Association (NFPA) standards.382ESTI is currently accredited to provide certifications in 46 individual disciplines. TEEX/ESTI currently leads the nation in the number of ProBoard certifications issued on an annual basis. The certification levels TEEX/ESTI offers include: • NFPA 1001 Fire fighter I & II. • NFPA 1002 Driver/Operator Pumper, Aerial, ARFF, Mobile Water Supply. • NFPA 1003 Airport Firefighter. • NFPA 1006 Rescue Technician - Rope Rescue I, II; Trench Rescue I, II; Confined Space Rescue I, II; Wilderness Rescue I, II; Vehicle & Machinery I, II; Structural Collapse I, II. • NFPA 1021 Fire Office I – IV. • NFPA 1031 Fire Inspector I & II, Plans Examiner I. • NFPA 1041 Fire Instructor I & II. • NFPA 1061 Public Safety Telecommunicator I & II. • NFPA 1081 Fire Brigade - Incipient, Advanced Exterior, Interior Structural, Leader. • NFPA 472 Hazardous Materials - Awareness; Operations Core; Operations Mission Specific: PPE, Product Control, Air Monitoring & Sampling, Response to Illicit Laboratory Incidents; Technician; Technician w/ Tank Car Specialty; Technician w/ Cargo Tank Specialty; Technician w/ Intermodal Tank Specialty; Technician with Flammable Liquids Bulk Storage Specialty; Incident Commander. ESTI supports FEMA’s HSNTP with the delivery of over twenty different courses across the nation with topics that range from tactical level, Wide Area Search and WMD Defensive Operations to simulation- driven incident management courses to executive-level workshops and seminars. In addition, ESTI provides technical assistance, exercise planning expertise and event review and After-Action Report support to organizations across the nation. Throughout the year, TEEX hosts full-scale operational readiness exercises (OREs) that test a team’s entire response capabilities.

381 See: https://teex.org/Pages/about-us/disaster-city.aspx (accessed on December 31, 2015). 382 See: https://teex.org/Pages/Program.aspx?catID=613&courseTitle=Pro%20Board (NPQS) (accessed on December 31, 2015).

West Fertilizer Company Final Report January 2016 162 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

TEEX/ESTI provides many DHS FEMA funded training programs that can be delivered online, face to face, or in a combination format. One such training program funded by DHS FEMA involves HAZMAT response; this training is geared toward emergency responders and focuses on the special challenges of dealing with WMDs or a terrorist incident, including knowledge of CBRNE events and responses to incidents involving CBRNE materials. The Standardized Awareness Training course focuses on training responders to meet competency requirements established in NFPA 472, Chapter 4, and in OSHA 29 CFR 1910.120. The course takes an all-hazards approach to HAZMAT incidents and gives participants the knowledge needed to recognize the hazardous material, protect themselves, notify others, and secure the scene. Another training program funded by DHS FEMA addresses incident management and response. These courses facilitate the implementation of the all-hazards multidisciplinary team-based approach outlined in the DHS National Response Framework, which is designed to respond to large-scale or expanding incidents, including those involving HAZMAT.383 In addition to the in-person training, ESTI offers a variety of web-based training, such as awareness-level courses and those within the innovative Online Recruit Academy. These interactive courses provide emergency responders with a convenient way to complete knowledge-based training at their own pace. There is an increasing need to provide training to responders who have the potential and will be expected to respond to Industrial Facilities/Industrial Emergencies in their area. There are multitudes of newly- introduced specialized hazards across the United States that First Responder communities have the potential to respond to. The increased potential for incidents to occur in these areas further highlights the need for all response and emergency management personnel be trained on how to properly preplan for, respond to, and mitigate these specialized incidents. Components of this training should address the preplanning, command, safety, operational, logistical, and local resource coordination and public information areas and should focus on assisting local responders in addressing key priorities and a safe outcome for their personnel. These hazards include emergencies that result from drilling and fracking operations, flammable liquid bulk storage facilities, transportation emergencies (pipelines, rail384, trucking, maritime, and air), and warehousing or storage of hazardous chemicals and materials such as FGAN. In light of these potential exposures to the response community, TEEX has developed a course entitled, “Industrial Emergencies for Municipal Based Responders” (IEMBR). This is a two-phased course with the awareness-level information contained in Phase I and the hands-on (firefighting and Hazardous Materials Response) contained in Phase II. TEEX is currently reaching out across the State of Texas and providing Phase I IEMBR training to first responders. Due to the complexity of the Phase II response scenarios and the

383 See: https://teex.org/Pages/Program.aspx?catID=469&courseTitle=Response- Hazardous%20Materials%20and%20Search%20and%20Rescue (accessed on November 6, 2015). 384 TEEX has also developed and is currently delivering a 24-hour Crude by Rail course. TEEX worked in corporation with rail service providers, owning companies and the response community to develop this course. It provides a detailed look at rail car construction, hazards associated with rail car emergencies, response plans, resource management and responder safety.

West Fertilizer Company Final Report January 2016 163 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

need for realistic training props, all Phase II training is conducted at the TEEX/ESTI Brayton Firemen’s Training Field. Phase II of the IEMBR course is more costly than Phase I due to the flammable liquid fuels, LPG and firefighting foams that are used as part of the training.385 There is a critical need to establish a funding mechanism for First Responders to attend IEMBR Phase II training. 7.7.3 National Membership Firefighter Associations Although several bodies represent the interests of firefighters and emergency responders, the three most prominent labor unions and associations for firefighters in the United States are the International Association of Fire Fighters (IAFF), NVFC, and IAFC. Combined, these three associations have more than a million members across the United States.386 An important aspect of the mission of each association entails providing training information and resources to members. 7.7.3.1 International Association of Fire Fighters (IAFF) The IAFF387 is a labor union that represents career firefighters in the United States and Canada. Established in 1918, the IAFF currently represents a membership of more than 300,000 professional firefighters in more than 3,200 fire departments. The IAFF acts to ensure that adequate resources and tools, including the development and implementation of new training and equipment, are provided to career firefighters and paramedics in all member fire departments. 7.7.3.2 National Volunteer Fire Council (NVFC) The NVFC is a nonprofit association that represents the interests of fire and emergency services at the national level by providing advocacy, information, resources, and programs to support volunteer first responders. The NVFC serves as the voice of the volunteer firefighter in the national arena and supplies tools, resources, programs, and advocacy for first responders nationwide. The NVFC also conducts national advocacy for first responders, including promoting legislation that benefits the fire and emergency medical services. The NVFC offers information, education, and training for volunteer fire and EMS organizations throughout their respective states.388 7.7.3.3 International Association of Fire Chiefs (IAFC) The IAFC represents the leadership of firefighters and emergency responders worldwide.389 With a network of more than 10,000 fire chiefs and emergency personnel, IAFC members include experts in firefighting, EMS, terrorism responses, HAZMAT spills, natural disasters, search and rescue operations, and public safety policy. The IAFC was established in 1873 to provide a forum for fire and emergency

385 See: https://teex.org/Documents/2014-04-firetalk.pdf (accessed December 31, 2015). 386 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 387 See: http://client.prod.iaff.org/#page=AboutUs (accessed on December 28, 2015). 388 NVFC. See: http://www.nvfc.org/ (accessed on December 28, 2015). 389 IAFC. See: http://www.iafc.org/About/?navItemNumber=537 (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 164 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

service leaders to exchange ideas, develop professionally, and identify the latest products and services available to first responders, including career and VFD chiefs.390 8.0 Regulatory Analysis Multiple federal, state, and local agencies regulate FGAN storage and handling, depending on statutory requirements, which can address worker safety, environmental protection, public safety, national security, and transportation. Requirements for reporting bulk quantities of FGAN also vary. CSB reviewed FGAN safety-related requirements in the United States and found differences in how FGAN facilities are identified and regulated. This section includes a discussion of the requirements for FGAN safety and security as well as voluntary efforts by industry, including: • President Obama’s Executive Order (EO) 13650 (Section 8.1). • OSHA Explosives and Blasting Agents standard (Section 8.2). • DHS Chemical Facility Anti-Terrorism Standards (CFATS) (Section 8.3). • OSHA Process Safety Management (PSM) standard (Section 8.4.1). • EPA Risk Management Program rule (Section 8.4.2). • EPA Emergency Planning and Community Right-to-Know Act (EPCRA) regulations (Section 8.5). • National fire protection standards and Texas fire codes (Section 8.6). • Post incident state and local regulatory developments (Section 8.7). • Voluntary industry initiatives (Section 8.8). Each of these sections includes background and analysis. The sections provide supporting information for the CSB recommendations in Section 11, which includes recommendations to regulatory agencies to revise existing standards so that they include FGAN-specific requirements. 8.1 President Obama’s Executive Order 13650 In the aftermath of the West Fertilizer Company (WFC) incident, President Barack Obama issued EO 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013.391 The EO states that “…measures can be taken by executive departments and agencies with the regulatory authority to further improve chemical facility safety and security in coordination with owners and operators.”392 The EO established the Chemical Facility Safety and Security Working Group, which is co-chaired by the

390 According to its website, the mission of the IAFC is to provide leadership to current and future career, volunteer, fire rescue, and EMS chiefs; chief fire officers; and company officers and managers of emergency service organizations throughout the international community, using vision, information, education, services, and representation to enhance their professionalism and capabilities. See: http://www.iafc.org/About/index.cfm?navItemNumber=537 (accessed on December 28, 2015). 391 Executive Order 13650. “Improving Chemical Facility Safety and Security.” August 1, 2013. 392 Ibid.

West Fertilizer Company Final Report January 2016 165 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Secretary of Homeland Security, the EPA Administrator, and the Secretary of Labor.393 Working with multiple governmental agencies, the EO Working Group was tasked with improving operational coordination with state, local, and tribal partners; enhancing federal coordination regarding chemical facility safety and security; improving information collection and sharing; modernizing key policies, regulations, and standards; and identifying best practices.394 One of the group’s first deliverables, issued in August 2013, was the document, “Chemical Advisory: Safe Storage, Handling, and Management of FGAN.”395 The advisory summarized best practices for AN storage, lessons learned from past AN incidents, hazard information, hazard reduction options, emergency planning activities, emergency response operations, and information resources.396 In June 2015, the advisory was reissued as “Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills.”397 This advisory includes a more detailed and reorganized regulatory information section.398 It has been distributed by government agencies such as EPA and OSHA and by the two U.S. manufacturers of FGAN, CF Industries and EDC. In addition, in June 2014, the EO Working Group published “Actions to Improve Chemical Facility Safety and Security—A Shared Commitment: Report for the President.”399 That report summarized the EO Working Group’s progress, focusing on actions to date, findings and lessons learned, challenges, and high-priority next steps.400 The report includes an aggressive action plan that details specifically how the EO Working Group has begun to, or will, tackle each of its aforementioned tasks.401 8.2 OSHA Explosives and Blasting Agents Standard The 1971 OSHA Explosives and Blasting Agents standard (29 CFR 1910.109) regulates, in part, the storage, use, and transportation of explosives and blasting agents and specifies safety requirements for various grades of AN. The standard was based on two national consensus standards—NFPA402 495 (Code for the Manufacture, Transportation, Storage, and Use of Explosives and Blasting Agents, 1970

393 Ibid. 394 Ibid. 395 See: http://www.ctif.org/sites/default/files/news/files/fed_an_advisory-083013.pdf (accessed on December 28, 2015). 396 Ibid. 397 See: http://www.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on December 28, 2015). 398 Ibid. 399 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 28, 2015). 400 Ibid. 401 See: https://www.osha.gov/chemicalexecutiveorder/ (accessed on December 28, 2015). 402 NFPA codes, standards, and guides are voluntary consensus products that are not enforceable unless adopted into law.

West Fertilizer Company Final Report January 2016 166 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Edition), and NFPA 490 (Code for the Storage of Ammonium Nitrate, 1970 Edition).403 The first nine sections of OSHA’s Explosives and Blasting Agents standard, (a) through (h), cover the storage and transportation of explosives and blasting agents. The last two sections, (j) and (k), address small arms ammunition and the manufacture of explosives and pyrotechnics. AN is covered in the middle of the standard, under section (g) when it is used as a blasting agent404 and under section (i) when it is stored in the form of crystals, flakes, grains, or prills, including fertilizer grade, dynamite grade, nitrous oxide grade, technical grade, and other mixtures containing 60 percent or more AN by weight.405 Included in 29 CFR 1910.109(i) are requirements for storage, building construction, ventilation, and fire protection associated with bulk and bagged AN. These requirements cover facilities that store more than 1,000 pounds of AN.406 At the time of the incident, the WFC facility stored FGAN well in excess of 1,000 pounds. The standard includes various requirements for the bulk storage of AN.407 For example, the standard mandates that warehouses have “adequate ventilation or be capable of adequate ventilation in case of fire.”408 Also, storage bins must “be clean and free of materials which may contaminate AN.”409 Bins storing bulk quantities of AN may not be constructed with galvanized iron, copper, lead, or zinc “unless suitably protected,” and wooden bins “protected against impregnation by AN” are permitted.410 The partitions dividing AN storage from other products that would contaminate the AN must be of “tight construction.”411 To avoid potentially dangerous contamination, AN must be in a separate building or must be separated by “approved type firewalls of not less than 1 hour fire-resistance rating from storage of organic chemicals, acids, or other corrosive materials, materials that may require blasting during processing or handling, compressed flammable gases, flammable and combustible materials or other contaminating substances.”412 While CSB found no evidence to suggest that any detonation of AN in the United States has occurred at a facility compliant with OSHA’s 1910.109(i) standard, CSB does find that these requirements do not offer sufficient safeguards concerning the bulk storage of FGAN. This conclusion is evidenced best by the

403 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=19509 (accessed on December 28, 2015). The NFPA 490 standard went through several updates. The most recent edition was issued in 2002. In 2010, NFPA incorporated NFPA 490 into a more recently developed standard, NFPA 400 (Hazardous Materials Code) (discussed in detail in Section 8.6.1). OSHA, however, has not updated its Explosives and Blasting Agents standard to incorporate the provisions of NFPA 400 because OSHA’s legal authority to adopt consensus standards expired in the mid-1970s. 404 Because it was not pertinent to this investigation, 29 CFR 1910.109(g) is not discussed. 405 29 CFR 1910.109(i)(1)(i)(a). 406 29 CFR 1910.109(i)(2)(i). 407 Because bulk storage of FGAN was primarily at issue at the WFC facility, bagged storage is discussed only briefly for the sake of comparison. 408 29 CFR 1910.109(i)(4)(i)(a). 409 29 CFR 1910.109(i)(4)(ii)(a). 410 Ibid. 411 Ibid. 412 29 CFR 1910.109(i)(5)(i)(a).

West Fertilizer Company Final Report January 2016 167 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC incident, in which the use of wooden bins (albeit not untreated wooden bins) to store FGAN was allowed under the 1910.109(i) standard. The CSB found that such construction likely facilitated the fire’s spread between storage bins.413 Moreover, the CSB found that even if the wooden bins had been treated (e.g., with coated or clad materials), the incident may have still occurred. This is because, as discussed previously, although coated or clad materials may protect wood against AN impregnation, they are not fire resistant and will still burn. Accordingly, CSB issued public comments on March 31, 2014 when OSHA released a Request for Information (RFI) to CSB and other stakeholders on its Explosives and Blasting Agents standard.414 The comments made by CSB pertained in part to the weakness of the provisions in 29 CFR 1910.109(i), particularly with respect to the bulk storage of FGAN.415 Specifically, CSB expressed concern that, because of certain gaps in 1910.109(i), users are left to decide appropriate safety measures without proper instruction.416 For example, 1910.109(i) permits the use of wooden bins “protected against impregnation of AN” without defining the word “impregnation.”417 Furthermore, even if the word had been defined, CSB noted that the use of wooden bins is not recommended in other countries, such as the United Kingdom (U.K.), which recommend the use of concrete for bulk AN storage.418 Moreover, CSB noted in its RFI comments that 1910.109(i) does not provide sufficient fire protection measures with respect to the storage of bulk quantities of FGAN because it requires sprinklers only for bagged AN in amounts exceeding 2,500 tons.419 CSB concluded that the requirement for sprinklers (or other fire suppression methods) as well as fire detection equipment likely would have helped minimize the severity of the impact of the WFC fire and explosion on the facility and on the surrounding community.420 In addition, CSB commented that the title of the standard, “Explosives and Blasting Agents,” should be revised so that it is clear that FGAN not used as a blasting agent or explosive is also covered under the standard.421 As currently titled, the name of the standard might mislead readers to believe that the standard applies only to the explosives industry. Accordingly, CSB recommended that the title be revised to clearly indicate that the standard also applies to the fertilizer industry. Similarly, CSB noted that no scope describing the purpose and application of the standard is listed at the beginning of the standard.422 Rather, the scope of 29 CFR 1910.109(i) that applies to FGAN appears in the middle of the standard.

413 It should be noted, however, that 29 CFR 1910.109(i) did prohibit the configuration and contents of the seed room adjacent to the AN bin. 414 On December 9, 2013, OSHA issued an RFI on 17 issues regarding revision to the agency’s regulatory standards. CSB commented on 15 of the 17 issues in a public comment dated March 31, 2014. The CSB comments are posted on the OSHA website; see: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 415 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 416 Ibid. 417 Ibid. 418 Ibid. 419 Ibid. See: 29 CFR 1910.109(i)(7)(i). 420 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 421 Ibid. 422 Ibid.

West Fertilizer Company Final Report January 2016 168 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB recommended changing this organization so that the scope is specified early in the document and is easy to locate. CSB concluded that the implementation of such recommendations regarding the standard’s title and scope would likely make the standard easier to understand. In addition to providing comments in response to the OSHA RFI, CSB reviewed guidance documents on FGAN from government and industry sources, finding that the only pre-WFC incident reference to the OSHA standard was in an EPA Chemical Safety Alert, “Explosion Hazard from AN,” from December 1997.423 In a letter to EPA, The Fertilizer Institute (TFI), a major trade association composed of fertilizer industry representatives, contended that the reference was inaccurate and that EPA therefore should remove it from its alert.424 Specifically, TFI said that the standard “was not applicable to facilities handling AN, unless the facility also handles an explosive or blasting agent.”425 This assertion, however, is incorrect; no part of the standard supports such a reading. As previously mentioned, 29 CFR 1910.109(i) clearly states that it applies to “. . . the storage of AN in the form of . . . prills including fertilizer grade . . .”426 Nonetheless, CSB finds that additional and well publicized guidance is needed to explain the applicability and provisions of the standard. Fertilizer industry representatives reported to the Government Accountability Office (GAO) that it was not well known that 1910.109(i) applies to FGAN.427 While conducting interviews with WFC management and employees, CSB found that WFC personnel knew little about the pertinent section. During these interviews, CSB learned that OSHA conducted its last inspection of the WFC plant428 in 1985, when the facility was cited for various violations concerning anhydrous ammonia, respiratory protection, and recordkeeping. CSB found no evidence that OSHA cited the WFC for violating any requirement of 1910.109(i) before the April 2013 fire and explosion. It is unknown whether OSHA inspected the facility against this section of the standard. CSB found that, in addition to WFC personnel, others who would reasonably be expected to know about 29 CFR 1910.109(i) might not have had such knowledge. After the current owners acquired the facility in 2004, third-party safety consultants who visited the facility never referenced 1910.109(i) in their final inspection reports. In fact, in reviewing documentation provided by the WFC, CSB identified only one mention of 1910.109(i)—in a Safety Data Sheet (SDS) provided by one of the WFC’s FGAN suppliers, CF Industries, which the WFC received in 2012. The GAO confirmed this observation, noting in its May

423 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on December 28, 2015). 424 The Fertilizer Institute. “Fertilizer Grade Ammonium Nitrate: Properties and Recommended Methods for Packaging, Handling, Transportation, Storage and Use.” 425 Leason, Chris S., counsel to TFI. Letter to Tawai-David Chung, EPA OSWER, CEPPO, June 27, 1997. At the request of CSB, EPA conducted a search to find its final signed response to TFI’s letter. Because of the age of the document, it would only exist in paper form; however, EPA no longer has paper files from that time frame. Thus, EPA’s response to this letter is unknown. 426 29 CFR 1910.109(i)(1)(i)(a). 427 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 428 Certain structures of the WFC plant had not yet been built at the time of the 1985 OSHA inspection.

West Fertilizer Company Final Report January 2016 169 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2014 report that it reviewed four SDSs from producers of solid FGAN fertilizer and only one mentioned the pertinent section of the OSHA standard.429 CSB notes as a concern the fact that the fertilizer industry, as recently as 2014, reported that personnel exhibited little recognition of the applicability of 1910.109(i) to FGAN.430 With respect to enforcement, CSB found very little history of OSHA using 29 CFR 1910.109(i) to cite fertilizer facilities. Table 11 shows OSHA’s record of 1910.109(i) citations and also the citation that OSHA issued against the WFC by Standard Industrial Classification (SIC)431 code. Table 11. OSHA 29 CFR 1910.109(i) Citation History No. Facility Inspection Year Standard Industrial Classification 1. Coshocton Farm Bureau (Coshocton, OH) 1974 5083: Farm and Garden Machinery 2. Smith-Douglass Chemical Div. Bo. (Clayton, DE) 1975 5191: Farm Supplies 3. Jr. Simplot Co. (Bartley, NE) 1975 2875: Fertilizers, Mixing Only 4. Farmers Union Cooperative Oil (Flandreau, SD) 1975 5541: Gasoline Service Stations 5. Old Fox Chemical Co, Inc. (East Providence, RI) 1976 2875: Fertilizers, Mixing Only 6. Drake Chemical Inc. (Lock Haven, PA) 1976 2865: Cyclic Crudes and Intermediates 7. IMC Chemical Group Inc. Trojan (New Tripoli, PA) 1976 2892: Explosives 8. Atlas Powder Co. Kinepak (Alvarado, TX) 1977 2892: Explosives 9. Jacklin-Plant Food Center (Post Falls, ID) 1977 5191: Farm Supplies

1. Genstar Chemical Inc.

(Presque Isle, ME) 1978 2873: Nitrogenous Fertilizers

1. Nipak Energy Corp.

(Krum, TX) 1979 2892: Explosives

1. Iuka Coop Exchange

(Iuka, KS) 1979 5153: Grain and Field Beans

1. Beaver Explosives Inc.

(New Castle, PA) 1980 2892: Explosives

1. Independent Explosives Co. of

Pennsylvania (Pittston Township, PA) 1987 2892: Explosives

429 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 430 Ibid. 431 SIC is a system for classifying industries according to industry-specific four-digit codes.

West Fertilizer Company Final Report January 2016 170 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Thermex Energy Corp.

(Parrish, AL) 1990 2892: Explosives

• Kesco, Inc.

(Kittanning, PA) 1994 2892: Explosives

• Howard Fertilizer Company, Inc.

(Orlando, FL) 1997 2875: Fertilizers, Mixing Only

• Hall Explosives Inc.

(Good Springs-Tremont, PA) 1998 1629: Heavy Construction, Nec.

• American East Explosives

(Mount Carmel, PA) 1999 2892: Explosives

• West Fertilizer Co.

(West, TX) 2013 5191: Farm Supplies As shown in Table 11, 19 inspections resulted in citations, excluding the citation against the WFC. The SIC code for 10 of these citations are clearly nonfarm, addressing mostly explosives; the nine remaining citations are related to farm supplies. It is important to note, however, that these data reflect citations only, not inspections. That is, although the facilities in Table 11 were inspected against, and cited for violations of, 1910.109(i), they do not represent all inspections conducted by OSHA against that section of the standard. It is impossible to determine whether OSHA inspected any other facilities for compliance, but did not cite them. CSB found no evidence of citations from 1999 to 2013. The OSHA 29 CFR 1910.109(i) citation history in Table 11 is also similar to that of more recent OSHA enforcement data from 2005 to 2013. These data show that no other facility with the same North American Industry Classification System (NAICS)432 code as the WFC (NAICS Code 424910) received a citation for violating 1910.109(i). The GAO May 2014 report similarly concluded that OSHA rarely issued citations for violations of the standard’s requirements for FGAN storage at fertilizer facilities.433 GAO found that “a citation for a violation of [OSHA’s] AN storage regulations was issued as a result of an inspection of a fertilizer facility only once before the explosion in West, Texas.”434 After the WFC explosion, OSHA issued 24 citations to the WFC on October 9, 2013, including nine citations for serious violations of 29 CFR 1910.109(i).435 These violations included lack of adequate ventilation, absence of fire-resistive construction, and improper storage and bin pile heights.436 The agency also cited the WFC for not ensuring that the wooden bins it used to store FGAN were treated to prevent FGAN impregnation.437 OSHA and the WFC ultimately settled, with the WFC agreeing to pay

432 NAICS is the standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy. 433 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 434 Ibid. 435 OSHA. “Citation and Notification of Penalty to Adair Grain,” October 9, 2013. 436 Ibid. 437 Ibid.

West Fertilizer Company Final Report January 2016 171 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

penalties without admitting guilt about violating the standards under which it was cited, including 1910.109(i). There is evidence that the WFC owners made efforts to comply with regulations when notified of noncompliance. When the WFC owners acquired the facility in 2004, state and federal regulators found them to be noncompliant with environmental, product quality, and transportation regulations—issues that the owners promptly corrected. For example, Federal EPA inspectors cited the WFC for not refiling its Risk Management Plan (RMP) registration in 2004.438 This citation prompted the WFC to hire an insurance company to develop a comprehensive RMP for the safe storage of its anhydrous ammonia.439 Also, Texas Commission on Environmental Quality (TCEQ) inspectors issued a citation to the facility in 2006 for not having an air permit for anhydrous ammonia.440 The WFC subsequently developed maintenance and inspection programs to prevent anhydrous ammonia releases. As a result of these inspections and citations, the WFC took appropriate corrective actions. The importance of regulatory awareness and notification, therefore, cannot be overemphasized. 8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard In December 2014, the OSHA Directorate of Enforcement Programs issued investigatory and citation guidance to OSHA enforcement personnel on elements of 29 CFR 1910.109. The nine-page guidance document provides additional clarification of the scope of 1910.109(i) and its application to facilities that store FGAN. This document includes specific compliance guidance for the majority of standard provisions and describes conditions that would be considered in or out of compliance. This guidance further clarifies the application of the standard to facilities storing FGAN and provides a list of NAICS industry codes for facilities most likely to manufacture, use, store, handle, or possess FGAN. The list of NAICS codes includes facilities such as the WFC plant and states that particular attention to AN hazards is needed when inspecting these facilities. The guidance also clarifies the standard’s definition of “adequate ventilation” and includes the types of ventilation likely to be unacceptable under the regulations as well as a ventilation rate calculation to assess compliance. Furthermore, the guidance document provides additional clarification on the subject of wood protection against FGAN impregnation. As discussed previously, 1910.109(i) does not specifically define compliant approaches for the treatment of wood to protect against FGAN impregnation. The standard prohibits untreated wood bin construction for FGAN storage. Although OSHA does not recommend the use of treated wood bins, wood with impermeable coating and claddings (such as two-part epoxy coatings, steel sheet cladding, or sodium silicate) are considered acceptable means for protecting wood against FGAN impregnation. OSHA provides additional guidance for varying types of wood construction that might be encountered during field inspections, including citable conditions such as improperly treated wood and

438 EPA. “Enforcement Case Report to West Chemical & Fertilizer Company,” August 14, 2006. 439 Triangle Insurance Company. Anhydrous Ammonia Supplement for WFC, 2006. 440 TCEQ. “TCEQ Enforcement Referral to West Chemical & Fertilizer,” June 21, 2006.

West Fertilizer Company Final Report January 2016 172 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

treated wood that has not been maintained to protect the coating integrity. The guidance also addresses pile heights for clumping and caking conditions and fire prevention. The 2014 guidance document for 1910.109(i) addressed some of the issues with vague wording that CSB raised in the RFI comments. Some of the requirements listed under the standard, however, do not provide sufficient safeguards to a facility owner storing bulk quantities of FGAN. In the case of the WFC incident, the wood-constructed bins were made of combustible materials and likely facilitated the spread of a fire between storage bins. According to OSHA, AN impregnation of porous combustible materials, such as wood, can accelerate combustion in the event of a structural fire and increase the explosion risk.441 OSHA permits the use of wood bins and wood construction only if the wood is protected against impregnation. Although coated or clad materials can protect against AN impregnation, they are not fire resistant and will still burn, contributing to the generation of heat during a fire. CSB determined that the wood-constructed bins likely contaminated the AN, ultimately leading to the detonation by increasing AN energy and sensitivity (discussed in Section 4.2.1). Completely eliminating wood and other combustibles as materials for constructing FGAN bins and storage facilities greatly reduces the possibility of contaminating FGAN during a fire or smoldering event. Although OSHA enforcement guidance and other efforts have provided greater clarity on how 1910.109(i) applies to FGAN facilities, OSHA still needs to revise and update the standard to incorporate the most recent provisions in NFPA 400 (2016 Edition) that address the safe storage of FGAN. OSHA cannot enforce some of the regulations in the current 1910.109(i) because they contain requirements reserved for the authority having jurisdiction, such as the municipal or state code official for occupancy permits. Moreover, OSHA cannot cite the following requirements in the standard: • 29 CFR 1910.109(i)(2)(ii): Approval of large quantity storage shall be subject to due consideration of the fire and explosion hazards, including exposure to toxic vapors from burning or decomposing ammonium nitrate. • 29 CFR 1910.109(i)(2)(iii)(e): The continued use of an existing storage building or structure not in strict conformity with this paragraph may be approved in cases where such continued use will not constitute a hazard to life. Because the current version of 1910.109(i) has limited enforcement in some areas—and because NFPA 400 (2016 Edition) (discussed in Section 8.6.1.1) includes updated provisions, some in response to the WFC incident, for increasing the safety of AN storage facilities—OSHA should update 1910.109(i) to include requirements similar to the provisions in NFPA 400 (2016 Edition). It also should revise the rules that currently are enforceable only by municipal or state officials.

441 OSHA enforcement directive on 1910.109(i).

West Fertilizer Company Final Report January 2016 173 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.2 Need for an Emphasis Program

Unfortunately, only after the WFC incident was more attention focused on the hazards of FGAN and the role of applicable regulations. Since the explosion and issuance of the EO, OSHA has worked to increase awareness of FGAN and the scope of 29 CFR 1910.109(i) through the joint agency advisory on safe storage of FGAN, the letter to the fertilizer industry, and the guidance document for compliance officers to assist in enforcing the 1910.109 standard for FGAN facilities. However, enforcement guidance does not provide the resources needed by OSHA to increase the frequency of inspections, although such guidance may help ensure that 1910.109(i) is applied appropriately when OSHA compliance officers happen to inspect facilities that fall under the rule. A more realistic and immediate approach to confirm that FGAN facilities are complying with the standard would be for OSHA to launch a regional emphasis program (e.g., in Regions IV, VI, and VII442) where these types of facilities are more common. A regional emphasis program would include a certain number of annual inspections per year, which would facilitate bringing FGAN facility operators into compliance with both regulatory and industry standards and would reduce the potential for a future event similar to the WFC incident. Imposing stricter requirements on AN storage and handling could take several years before enactment into federal regulations. OSHA has initiated several national, regional, and local emphasis programs targeted at specific industries or located in specific geographical areas to help prevent hazards. Such emphasis programs have successfully focused inspection and enforcement efforts on specific industries. A 1910.109(i) emphasis program can include NFPA 400 (2016 Edition) as a guidance document for compliance officers to support recognition of hazardous conditions or issuance of violations when found. It would also prompt improvement of safe FGAN storage and handling practices through increased awareness and would allow OSHA to collect information and data that could support future revisions to current regulations on FGAN. 8.3 Chemical Facility Anti-Terrorism Standards (CFATS) DHS promulgated the CFATS in 2007 to address security issues at high-risk chemical facilities, including those that store certain quantities of FGAN. The rule establishes risk-based performance standards for chemical facility security and requires facilities to prepare vulnerability assessments and security plans to protect the public from a breach of security or an intentional release. Under CFATS, DHS collects information from facilities that possess designated quantities of chemicals of interest (COIs).443 In creating the COI list, DHS referenced other established lists that regulate

442 These regions include the following states: Alabama, Florida, Georgia, North Carolina, South Carolina, Tennessee, Mississippi, Kentucky, Nebraska, Kansas, Missouri, Iowa, Texas, Oklahoma, Arkansas, Louisiana, and New Mexico. 443 CFATS § 27.210(a)(1)(i).

West Fertilizer Company Final Report January 2016 174 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

chemicals—including the list of chemicals covered under the EPA Risk Management Program, the Chemical Weapons Convention, and DOT—and a list of chemicals with known inhalation hazards. The COI list includes 322 chemicals and also screening threshold quantities for each chemical as it relates to each of the three defined security hazards (release, theft, and sabotage). Chemical facilities that meet the COI criteria listed in Appendix A of the CFATS rule must complete and electronically submit a Chemical Security Assessment Tool (CSAT) Top-Screen form to DHS. Using the information collected from facility Top-Screen information, DHS assigns a preliminary risk-based tier— from the highest (tier 1) to the lowest “high-risk” level (tier 4) and the “not high-risk” level (tiered out)— based on a basic assessment of the potential consequences in association with the chemical holdings at each facility.444 Once a preliminary tier is assigned, each facility in tiers 1 through 4 must submit a CSAT Security Vulnerability Assessment to DHS, and DHS uses that assessment to make a final determination of the facility’s assessed level of risk. If DHS retains the facility in one of the four high-risk tiers, the facility must submit a site security plan. DHS reviews the plan, conducts an onsite inspection of the facility, and approves the plan if it is deemed adequate relative to the risks inherent in the facility, its chemical holdings, and potential consequences of a security breach. Since publication of the CFATS rule, DHS has received more than 50,000 Top-Screen forms submitted by chemical facilities. As of September 2015, DHS covers 3,182 high-risk facilities nationwide, and 2,607 of those sites have undergone onsite authorization inspections. 8.3.1 AN Screening Thresholds FGAN is listed in CFATS Appendix A as a DHS COI. A facility reports to DHS based on possession of AN under three conditions:

1. If a facility possesses 5,000 pounds or more of FGAN with more than 0.2 percent combustible

substances, including any organic substance calculated as carbon, to the exclusion of any other added substance in bulk storage, the facility must report. Facilities meeting this threshold must also submit information to DHS on quantity and on method of storage or packaging.

1. If a facility possesses 400 pounds or more of FGAN with more than 0.2 percent combustible

substances, including any organic substance calculated as carbon, to the exclusion of any other added substance in transportation packaging, the facility must report.

1. If a facility possesses 2,000 pounds or more of solid FGAN with a nitrogen concentration of 23

percent or higher in transportation packaging, the facility must report.

CSB requested and reviewed CFATS data from all facilities in the United States that submitted information to DHS for storage of FGAN as of March 2014. According to the DHS data, 1,351 facilities in the United States store AN in quantities that exceed the screening thresholds. The majority of those

444 When determining whether a facility is high risk, DHS primarily focuses on the potential consequences associated with a successful terrorist attack on the facility (including the use of stolen or diverted materials in a separate attack offsite). A threat factor also is incorporated into the risk assessment for facilities with release hazards.

West Fertilizer Company Final Report January 2016 175 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facilities store FGAN for agricultural uses (Figure 73). Based on the NAICS codes submitted with Top- Screen information, 46 percent of the facilities that report to DHS stock FGAN for agricultural purposes such as farm merchandising and wholesale or crop preparation. An additional 6 percent store FGAN for fertilizer mixing.

Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS) In 2008, DHS filed a reporting extension to agricultural facilities meeting screening thresholds of FGAN for farmers and agricultural end users of FGAN, such as the preparation and application of crops, feed, land, or livestock.445 However, this extension does not apply to chemical distribution facilities or to commercial chemical application services, such as the WFC. At the time of the April 2013 explosion, the WFC possessed an estimated maximum of 120,000 pounds of FGAN, about 60 times the screening threshold of 2,000 pounds, but did not submit Top-Screen information to DHS as required under the CFATS. Consequently, DHS was unaware that the WFC possessed FGAN until the 2013 explosion. After the incident, the WFC retroactively submitted a Top Screen to DHS upon notification that it was not compliant with the rule, and DHS did not issue a citation to the WFC for originally failing to submit the form. If the WFC had complied with the CFATS, a CFATS inspection or assistance visit might have noted the storage conditions at the WFC facility and prompted change. In addition, DHS engagement

445 73 Federal Register 1640.

West Fertilizer Company Final Report January 2016 176 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with facility management might have prompted greater engagement by local law enforcement, which in turn might have supported greater involvement by other community emergency services. 8.4 Safety Management Programs Following a number of major chemical accidents in the United States and abroad in the 1970s and 1980s, Congress amended the Clean Air Act (CAA) in 1990 to require both OSHA and EPA to publish new regulations to help prevent similar accidents. Through Section 304 of the CAA Amendments, Congress directed the Secretary of Labor, in coordination with the EPA Administrator, to promulgate, pursuant to the Occupational Safety and Health Act of 1970, a chemical process safety standard to prevent accidental releases of chemicals that could pose a threat to employees.446 Also, through CAA Amendments Section 112(r), Congress required EPA to publish regulations and guidance for chemical accident prevention at facilities using substances that posed the greatest risk of harm from accidental releases.447 The following sections focus on the intertwined regulations that OSHA and EPA developed – the OSHA Process Safety Management of Highly Hazardous Chemicals standard and the EPA Risk Management Program rule. 8.4.1 OSHA Process Safety Management Standard OSHA’s Process Safety Management of Highly Hazardous Chemicals standard (29 CFR 1910.119) (known as the PSM standard) became effective in May 1992.448 The standard contains requirements for preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals.449 It includes the following 14 elements: 1. Employee participation. 2. Process safety information. 3. Process hazard analysis. 4. Operating procedures. 5. Training. 6. Contractors. 7. Pre-startup safety review. 8. Mechanical integrity. 9. Hot work permits. 10. Management of change. 11. Incident investigation. 12. Emergency planning and response. 13. Compliance audits.

446 See: https://www.osha.gov/Publications/osha3132.html (accessed December 28, 2013). 447 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed December 28, 2015). 448 OSHA. “Process Safety Management.” OSHA 3132, 2000. 449 29 CFR 1910.119.

West Fertilizer Company Final Report January 2016 177 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Trade secrets.450 The PSM standard states that it applies, in part, to “a process which involves a chemical at or above the specified threshold quantities listed in Appendix A [List of Highly Hazardous Chemicals, Toxics and Reactives] to this section.”451 Notably, FGAN is not on this list. In deciding which chemicals to regulate under the PSM standard, OSHA reviewed potential “highly reactive and explosive substances,” as required by Section 304(b) of the CAA Amendments.452 OSHA considered information drawn from multiple sources, including EPA, DOT, World Bank, NFPA, the Health and Safety Commission of the U.K., and the states of Delaware and New Jersey.453 With respect to reactives, OSHA chose to include only those chemicals with the two highest (i.e., most dangerous) reactivity ratings under NFPA 490 because of the significant risk that they posed to workers.454 These chemicals had reactivity ratings of 3 or 4.455 FGAN, however, was left off the PSM list, despite having a reactivity rating of 3.456 Although the agency did consider adding FGAN to the PSM list in the late 1990s, this effort failed due to “resource constraints and other priorities.”457 Thus, FGAN has yet to be regulated under the PSM standard. Anhydrous ammonia, on the other hand, is on the List of Highly Hazardous Chemicals, Toxics and Reactives, with a threshold quantity of 10,000 pounds. CSB found that, at the time of the incident, the WFC was storing the equivalent of 34,000 pounds of anhydrous ammonia, more than three times the threshold quantity that triggers PSM coverage. CSB also discovered that the WFC had previously stored 54,000 pounds of anhydrous ammonia in 2006 and 2011. Given these facts, the WFC should have complied with the PSM standard because the company stored anhydrous ammonia, at least in 2006, 2011, and 2013, in quantities that exceeded its threshold quantity. However, CSB learned that the PSM standard did not apply to the WFC at the time of the incident because the facility qualified under OSHA’s interpretation of the standard’s retail facilities exemption. At the time of the incident, a facility qualified under the retail facilities exemption if the following conditions were met: (1) the facility contained a highly hazardous chemical in a quantity that met or exceeded the threshold quantity for the chemical; (2) the facility used a process458 covered by the PSM

450 Ibid. 451 29 CFR 1910.119(a)(1)(i). 452 CONSAD OSHA Report, 1988. 453 55 Federal Register 29150. 454 CONSAD OSHA Report, 1988. 455 Ibid. 456 Federal OSHA in discussion with CSB, May 14, 2015. 457 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed December 28, 2015). 458 The PSM standard defines “process” as any activity involving a highly hazardous chemical, including any use, storage, manufacturing, handling, or onsite movement of such chemicals (or any combination of these activities). It also states that, for purposes of this definition, any group of vessels that are interconnected—and separate vessels

West Fertilizer Company Final Report January 2016 178 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard; and (3) more than 50 percent of the facility’s income was derived from direct end users.459 The WFC facility met all three conditions for its storage of anhydrous ammonia. It stored anhydrous ammonia, a highly hazardous chemical, in quantities that exceeded its threshold quantity. Also, the facility used a process because it stored the anhydrous ammonia, and storage meets the PSM standard definition of a “process.” Because the WFC primarily sold its products, including anhydrous ammonia, to farmers (i.e., direct end users), the company met the third condition as well. Thus, the WFC qualified under the PSM standard’s retail facilities exemption and was not required to comply with the standard. If the PSM standard had applied to the WFC for its storage of anhydrous ammonia however, the WFC would have been required to conduct a process hazard analysis (PHA). A PHA must address the following: • Hazards of the process. • Identification of any previous incident that had a potential for catastrophic consequences in the workplace. • Engineering and administrative controls applicable to the hazards and their interrelationships, such as appropriate application of detection methodologies to provide early warning of releases, with acceptable detection methods that might include process monitoring and control instrumentation with alarms and also detection hardware such as hydrocarbon sensors. • Consequences of a failure of engineering and administrative controls. • Facility siting. • Human factors. • Qualitative evaluation of a range of the possible safety and health effects on employees in the workplace if a failure of controls occurs.460 The WFC would have had to address facility siting as part of its PHA. Facility siting refers to the location of the covered process and its proximity to various other components within the facility’s property.461 It does not refer to the site of the facility in relation to the surrounding community.462 A facility siting analysis at the WFC likely would have identified the close proximity of the facility’s FGAN storage warehouse and its anhydrous ammonia storage tanks, thus triggering implementation of necessary safeguards to mitigate the possibility of potentially catastrophic successive incidents involving the two hazardous chemicals. This observation was a critical element of CSB’s investigation because evidence indicated that the FGAN explosion damaged the facility’s anhydrous ammonia tanks. If more force had been applied to the tanks, their contents could have been released into the neighboring community and

that are located so that a highly hazardous chemical could be involved in a potential release— must be considered a single process. 459 OSHA interpretation letter. See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=23885 (accessed December 28, 2015). 460 See: https://www.osha.gov/Publications/osha3132.html (accessed on December 28, 2015). 461 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=1558 (accessed on December 28, 2015). 462 Ibid.

West Fertilizer Company Final Report January 2016 179 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caused even more fatalities and injuries. However, the WFC was not required to conduct facility siting because it qualified for the PSM standard’s retail facilities exemption. CSB communicated its concern about the retail facilities exemption in its March 31, 2014, comments to OSHA’s December 9, 2013 RFI.463 CSB asked OSHA to consider whether the retail facilities exemption should be revised in order to cover facilities such as WFC, which stored bulk quantities of chemicals covered by the PSM standard.464 8.4.1.1 Revised Interpretation of the PSM Retail Facilities Exemption On July 22, 2015, OSHA issued a memorandum, “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption” (Retail Exemption Memorandum).465 OSHA noted in the memorandum that the PSM exemption for retail facilities does not define the term “retail facility.”466 However, the agency also said that the preamble to the PSM standard does explain that chemicals in retail facilities are generally sold in “small volume packages, containers, and allotments.”467 OSHA pointed out that the preamble gives an example of a gasoline station as a type of facility that would fit within the definition of a retail facility and thus qualify for the exemption.468 OSHA also mentioned in the Retail Exemption Memorandum that other federal agencies define the term similarly.469 In particular, it states that the U.S. Department of Commerce, which develops NAICS codes, characterizes retail trade as follows (emphasis added): The Retail Trade sector comprises establishments engaged in retailing merchandise, generally without transformation, and rendering services incidental to the sale of merchandise. The retailing process is the final step in the distribution of merchandise; retailers are, therefore, organized to sell merchandise in small quantities to the general public. 470 However, this is not how OSHA had always interpreted its PSM retail exemption. After promulgation of the PSM standard, OSHA issued a series of letters of interpretation471 and a PSM compliance directive472 that interpreted the retail exemption more broadly than originally intended.473 Under these interpretations, a facility was considered exempt from the PSM standard if it derived “more

463 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 464 Ibid. 465 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 466 Ibid. 467 57 Federal Register 6356, 6369. 468 Ibid. 469 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 470 U.S. Department of Commerce. NAICS Manual, Sector 44–45: Retail Trade. 471 OSHA letters of interpretation explain OSHA requirements, which are set by statute, standards, and regulations. 472 OSHA. Compliance Directive (CPL) 02-03-045. 473 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015.

West Fertilizer Company Final Report January 2016 180 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

than 50 percent of its income from direct sales of highly hazardous chemicals to the end user” (the 50 percent test).474 This rationale is how the WFC claimed the retail exemption for its storage of anhydrous ammonia. If FGAN had been covered under the PSM standard before the WFC incident, the retail exemption, as it had been interpreted, would have precluded PSM coverage at the WFC and similar facilities. In addition, this 50 percent test allowed employers that sold or distributed large bulk quantities of highly hazardous chemicals directly to end users to claim the exemption, even if the end users were themselves commercial establishments.475 This reasoning led to confusion about the definition of the term “end user.” In its Retail Exemption Memorandum, OSHA said that it did not intend either of these outcomes. OSHA’s Retail Exemption Memorandum rescinded all previous documents, letters of interpretation, and memoranda related to the retail exemption and the 50 percent test.476 OSHA states that its interpretation of the exemption is now more consistent with the standard’s original intent.477 In reference to the NAICS Manual, OSHA states that: Only facilities, or the portions of facilities, engaged in retail trade as defined by the current and any future updates to sectors 44 and 45 of the NAICS Manual may be afforded the retail exemption at 29 CFR 1910.119(a)(2)(i).478 Facilities that fall within Sectors 44–45: Retail Trade, consist of a number of subsectors. These facilities are now (or are still) considered retail facilities eligible for the retail exemption. Notably, NAICS codes typically used for FGAN bulk storage and sales do not fit into one of these classifications. As such, facilities that store or sell bulk FGAN do not qualify for the retail exemption. If OSHA’s new interpretation were in effect before the incident, the WFC could not have claimed the retail exemption for its storage of anhydrous ammonia. Furthermore, it could not have claimed the exemption for its storage of FGAN had FGAN been included on the PSM list pre-incident. If this new interpretation had been in effect before the incident, the WFC might have recognized that its storage of anhydrous ammonia was covered by the PSM standard. Although compliance efforts would have focused on this potential hazard, the WFC might have learned about FGAN-related hazards as well. As previously discussed, if the WFC had conducted a facility siting analysis, it could have identified the close proximity of its FGAN storage warehouse to its anhydrous ammonia pressure tanks. This may have

474 Ibid. 475 Ibid. 476 Ibid. 477 Ibid. According to a December 23, 2015, OSHA memorandum, through September 30, 2016, OSHA will not cite employers for violations of the PSM standard at facilities that it would not have cited applying the interpretation of the term “retail” that was in place prior to July 22, 2015. 478 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. Facilities that fall under Sectors 44–45: Retail Trade consist of a number of subsectors, including Motor Vehicle and Parts Dealers (NAICS 441), Building Material and Garden Equipment and Supplies Dealers (NAICS 444), Gasoline Stations (NAICS 447), and General Merchandise Store (NAICS 452).

West Fertilizer Company Final Report January 2016 181 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

led the WFC to explore the potential for FGAN to catch fire and detonate under certain conditions. It also may have caused the WFC to implement safeguards to prevent hazards associated with the two different chemicals. OSHA’s revised interpretation of the retail exemption would mean that facilities such as the WFC would be covered for their use of anhydrous ammonia. According to the fertilizer industry, more than 3,800 U.S. retail facilities previously exempted by the older interpretation of the retail exemption would be covered under the requirements of the PSM standard because of anhydrous ammonia storage. 479 WFC use of FGAN could also be regulated directly in the future, but only if FGAN were added to PSM’s List of Highly Hazardous Chemicals, Toxics and Reactives. CSB recommends that OSHA consider including FGAN for coverage under the PSM standard.480 CSB supports OSHA’s revised interpretation of the retail exemption to guarantee that potential changes to the PSM standard will apply to facilities like the WFC that store anhydrous ammonia as well as FGAN, which would provide the basis for the CSB’s proposed recommendation to add FGAN to the PSM list. 8.4.1.2 Guidance on Recognized and Generally Accepted Good Engineering Practices Under the PSM Standard OSHA also recently addressed its reference to the common industry term, “recognized and generally accepted good engineering practices” (RAGAGEP), under its PSM standard. This term is often used in performance-based standards like PSM. Generally, standards can be either prescriptive or performance based. As its name suggests, a prescriptive standard sets rigid compliance specifications. A performance- based standard, on the other hand, simply delineates the expected performance outcome or end result, without specifying how the outcome or result is to be achieved. In other words, a prescriptive standard describes how something is to be achieved, but a performance-based standard only specifies what is to be accomplished. For example, OSHA’s Explosives and Blasting Agents standard (Section 8.2) is a prescriptive standard that contains FGAN-specific provisions. That part of the standard is prescriptive because its provisions set out how to handle FGAN; the provisions are inflexible. In contrast, OSHA’s PSM standard is performance-based. It employs a broad approach to materials and applications and enables incorporation of current industry practices. As a performance-based standard, it allows employers to select the RAGAGEP that they choose to apply to their facilities.481 These chosen RAGAGEP are the ones that employers must follow at their facilities so that they are deemed compliant. Although the PSM standard does not define RAGAGEP, OSHA’s Petroleum Refinery PSM National

479 TFI/ARA Hearing Statement: “Examining the Use of Agency Regulatory Guidance.” See: http://www.mo- ag.com/uploaded/Senate%20HSGAC%20RFAM%20Hearing%209-23-15.pdf (accessed December 1, 2015). 480 OSHA has initiated a Small Business Regulatory Enforcement Fairness Act panel on its PSM standard, after issuing an RFI in November 2013 seeking public comment on ways to improve the standard. ATF/OSHA/EPA. “Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 2015. 481 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015.

West Fertilizer Company Final Report January 2016 182 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emphasis Program references the definition established in the Center for Chemical Process Safety’s Guidelines for Mechanical Integrity Systems: Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) are engineering, operation, or maintenance activities based on established codes, standards, published technical reports or recommended practices or a similar document. RAGAGEP detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a vessel, inspecting a storage tank, or servicing a relief valve.482 This is the definition OSHA references in addressing its use of the term under the PSM standard. Following the WFC incident, OSHA provided guidance on its use of the term RAGAGEP under its PSM standard in a June 8, 2015, memorandum, “RAGAGEP in Process Safety Management Enforcement” (PSM RAGAGEP Memorandum). As noted by OSHA in its PSM RAGAGEP Memorandum, the PSM standard directly references or implies the use of RAGAGEP in three provisions:

1. 29 CFR 1910.119(d)(3)(ii): Employers must document that all equipment in PSM-covered

processes complies with RAGAGEP.

1. 29 CFR 1910.119(j)(4)(ii): Inspections and tests are performed on process equipment subject to

the standard’s mechanical integrity requirements in accordance with RAGAGEP.

1. 29 CFR 1910.119(j)(4)(iii): Inspection and test frequency follows manufacturer’s

recommendations and good engineering practice, and more frequently if indicated by operating experience.483 Accordingly, RAGAGEP under the PSM standard apply to process equipment design, installation, operation, and maintenance; inspection and test practices; and inspection and test frequencies.484 The PSM RAGAGEP Memorandum notes the following primary sources of RAGAGEP: (1) published and widely adopted codes, (2) published consensus documents, and (3) published nonconsensus documents.485 Published and widely adopted codes are those consensus standards that have been widely adopted by federal, state, or municipal jurisdictions.486 Published consensus documents are identified as those published by certain organizations which must follow the American National Standards Institute (ANSI) “Essential Requirements: Due process requirements for American National Standards” (ANSI Essential Requirements).487 Published nonconsensus documents include publications that do not conform to the ANSI Essential Requirements and peer-reviewed technical articles.488 It is important to note that

482 OSHA. Compliance Directive (CPL) 03-00-010. 483 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015. 484 Ibid. 485 Ibid. 486 Ibid. Examples of published and widely adopted codes include NFPA 101 (Life Safety Code) and NFPA 70 (National Electric Code). 487 Ibid. Examples of published consensus documents include the ASME B31.3, “Process Piping Code,” and the International Institute of Ammonia Refrigeration (IIAR) ANSI/IIAR 2-2008, “Equipment, Design, and Installation of Closed-Circuit Ammonia Mechanical Refrigerating Systems.” 488 Ibid. Examples of published nonconsensus documents include the Chlorine Institute “pamphlets” focusing on chlorine and sodium hypochlorite safety and the Design Institute for Emergency Relief Systems guideline book addressing technology for reactive and multiphase relief systems design.

West Fertilizer Company Final Report January 2016 183 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

while OSHA generally accepts published and widely adopted codes and published consensus documents as RAGAGEP, published nonconsensus documents are not necessarily generally accepted. However, OSHA may choose to accept them if they are applicable and appropriate.489 The PSM RAGAGEP Memorandum also explains the difference between “shall” and “should” language. In particular, OSHA notes that positive and negative uses of “shall,” “must,” or similar language in published RAGAGEP reflect the developer’s view that the practice is a mandatory minimum to control a hazard.490 Thus, if an employer deviates from such RAGAGEP, OSHA will presume a violation.491 Where “should” language applies in RAGAGEP, OSHA presumes that employer compliance with the recommended approach is acceptable.492 If an employer chooses to deviate from the recommended approach, however, OSHA will evaluate whether the employer has determined and documented that its alternative approach is at least as protective as the recommended approach or whether the recommended approach does not apply to the employer’s operation.493 OSHA presumes a violation if employers act in a way that RAGAGEP deem they “should not.”494 These enforcement considerations emphasize that RAGAGEP are more than optional recommendations. Many RAGAGEP are mandatory standards based on scientific data and previous incidents and it is crucial that employers comply with them. If FGAN is added to the PSM list, the use of RAGAGEP will allow facilities to select and comply with FGAN-specific standards, such as NFPA 400, that have been recently updated to address and help prevent the conditions that led to the WFC explosion. 8.4.2 EPA Risk Management Program Rule The EPA Risk Management Program rule (40 CFR Part 68, Subparts A through H) is intended to prevent and minimize the consequences of accidental releases of toxic or flammable substances.495 Enacted in 1996, the regulation required facilities to be compliant by 1999.496 In general, covered facilities are those with a substance on one of the Risk Management Program rule’s two lists, one for toxic substances and one for flammable substances, in a quantity that meets or exceeds the threshold quantity for the substance.497 These facilities must perform a hazard assessment, consisting of worst case and alternative release scenarios as well as a five-year accident history; implement an accident prevention program (which is required for most facilities); establish an emergency response program; and develop an RMP

489 Ibid. 490 Ibid. 491 Ibid. 492 Ibid. 493 Ibid. 494 Ibid. 495 EPA. “Accidental Release Prevention Requirements: Risk Management Program Under the Clean Air Act.” RFI, July 31, 2014. 496 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/100038BD.PDF?Dockey=100038BD.PDF (accessed on December 28, 2015). 497 See: http://www.epa.gov/rmp/risk-management-plan-rmp-rule-overview (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 184 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

and submit it to EPA.498 Facility management must revise and resubmit its RMP to EPA at least every five years.499 EPA has developed three program levels for process classification to ensure that individual processes are subject to requirements that appropriately match their size and risks they pose.500 Program Level 1 applies to processes with lower risks that would not significantly affect the public in a worst case release scenario and that have had no accidents with specific offsite consequences in the last five years.501 These facilities have limited and/or minimal accident prevention requirements.502 Program Levels 2 and 3 cover higher-risk facilities that must meet more stringent accident prevention requirements.503 A Program Level 3 facility is not eligible for classification under Program Level 1 and is either (1) subject to OSHA’s PSM standard or (2) classified in one of 10 specified NAICS codes.504 Program Level 3 requires implementation of an accident prevention program that is virtually equivalent to the one required under the PSM standard.505 Program Level 2 applies to facilities that are not eligible for classification in Program Level 1 or Program Level 3.506 Program Level 2 requires implementation of a streamlined accident prevention program.507 The WFC was a Program Level 2 facility under the Risk Management Program rule for its storage of anhydrous ammonia, a regulated substance, which the WFC kept in amounts that exceeded the substance’s threshold quantity. Program Level 2 facilities must conduct hazard reviews.508 For this requirement to be satisfied, facilities must conduct a review and identify the following: • Hazards associated with the Program 2 process and regulated substances. • Opportunities for equipment malfunction or human error that could cause a release. • Safeguards that will control the hazards or prevent the malfunction or error. • Steps to detect or monitor releases.509

498 Ibid. 499 Ibid. 500 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on December 28, 2015). 501 Ibid. 502 Ibid. 503 Ibid. 504 Ibid. These 10 manufacturing NAICS codes are (1) 32211 pulp mills; (2) 32411 petroleum refineries; (3) 32511 petrochemical manufacturing; (4) 325181 alkalis and chlorine manufacturing; (5) 325188 all other basic inorganic chemical manufacturing; (6) 325192 cyclic crude and intermediate manufacturing; (7) all other basic organic chemical manufacturing; (8) plastics material and resin manufacturing; (9) nitrogenous fertilizer manufacturing; and (10) pesticide and other agricultural chemical manufacturing. See: http://www2.epa.gov/sites/production/files/2013- 11/documents/cd-chap-02.pdf (accessed on December 28, 2015). 505 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on December 28, 2015). 506 Ibid. 507 Ibid. 508 See: http://www.epa.gov/sites/production/files/2013-11/documents/chap-06-final.pdf (accessed on December 28, 2015). 509 Ibid.

West Fertilizer Company Final Report January 2016 185 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB discovered that the WFC implemented a prevention program that included a hazard review. In its most recent RMP from 2011, the WFC identified major hazards, which included toxic releases, equipment failure, and earthquakes, but did not include fire or explosion.510 The facility also indicated that it did not use mitigation systems, such as sprinklers, for its storage of anhydrous ammonia.511 Clearly, this hazard review did not provide the type of protection needed to address the fire and explosion that occurred on the day of the WFC incident. Because FGAN is not a regulated substance, the WFC was not required to conduct such a hazard review for its storage of FGAN. Accordingly, CSB recommends that FGAN be added to the Risk Management Program list.512 CSB contends that EPA should consider adding FGAN to the list of regulated substances, taking into account the more recent recognition of the unpredictable explosive hazards of FGAN, better awareness of the location of FGAN facilities across the United States, greater knowledge of the quantity of FGAN normally stored at these facilities, and continuance of FGAN-related incidents since the issuance of the final Risk Management Program list. As demonstrated in Appendix B, FGAN-related incidents continue to occur, domestically and abroad. Despite tremendous property damage and economic cost, the most devastating result of these incidents is the immeasurable loss of human life. CSB found that a likely cause of such loss of life is the alarming number of FGAN facilities located in communities—next to schools, hospitals, residences, and businesses (discussed in Section 9). Another cause, as determined by CSB, is the tendency of these facilities to store FGAN in large quantities. Coupling these factors with the more recent recognition that FGAN is susceptible to unstable detonation under certain conditions, CSB recommends that FGAN be listed under the Risk Management Program rule. Moreover, CSB reviewed original listing criteria and found that inclusion of FGAN on the Risk Management Program list is warranted. 8.4.2.1 Risk Management Program Rule Listing Criteria Background Under CAA Section 112(r)(4), the factors to be considered in listing substances for Risk Management Program rule coverage are (1) the severity of acute adverse health effects associated with accidental releases of the substance, (2) the likelihood of accidental releases of the substance, and (3) the potential magnitude of human exposure to accidental releases of the substance.513 When EPA first promulgated its Risk Management Program list of chemicals and threshold quantities in 1994, it reviewed 11 different lists, including three EPA lists.514 The criteria used for development of these lists were reviewed to determine whether the criteria were related to the factors mandated by Congress for list development

510 WFC 2011 RMP submission to EPA. 511 Ibid. 512 EPA has issued a RFI and worked on a Notice of Proposed Rulemaking for its Risk Management Program rule. ATF/OSHA/EPA. “Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 2015. 513 58 Federal Register 5102 (January 19, 1993). 514 Ibid.

West Fertilizer Company Final Report January 2016 186 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

under CAA Section 112(r).515 Acute toxicity was generally considered in developing these lists of chemicals, but some also used flammability and explosivity as criteria for regulating chemicals.516 As part of its review of the first factor to be considered for listing substances under the Risk Management Program rule, EPA reviewed chemicals that could cause severe acute adverse health effects. EPA found that the severity of acute adverse health effects can be related to the inherent hazards (i.e., hazardous material properties that cannot be changed) of the substances of interest, such as the toxicity of a substance resulting in lethal effects.517 EPA noted that acute adverse health effects also could result from other inherent hazards, such as the flammability or high reactivity of the substance.518 Importantly, it stated that the phenomena associated with these hazards could be, for example, radiant heat from a chemical fire or blast waves from an explosion of a chemical.519 In reviewing the second Risk Management Program listing criteria factor, EPA stated that the likelihood of an accidental release of a chemical can be related to typical usage and handling scenarios, such as equipment commonly used in typical facility operations.520 EPA stated that ubiquitous substances, because of greater handling and use, might have a greater potential for an accidental release.521 The agency observed that a history of a large number of accidents in the past, for example, might be an indicator of an existing hazard related to a particular substance and its potential to be involved in accidental releases in the future.522 Notably, EPA stated that chemicals that are found in large volumes at many locations and chemicals that are particularly prevalent (e.g., commodity chemicals, like chlorine and ammonia) might be more likely to be involved in accidental releases than small-volume, less commonly used chemicals.523 With respect to the last factor to be considered for Risk Management Program listing, EPA found the magnitude of human exposure associated with accidental releases to be related to the severity of the health effects (hazards) and the likelihood of a release (the chance that a release will have an effect on the population of environment beyond the facility fenceline).524 The agency noted that this definition was somewhat different from the traditional risk assessment definition of human exposure, which relates magnitude of exposure to the population and sensitive environments that might be affected by a release from a specific site.525 It recognized that factors that might affect the magnitude of human exposure could be site specific or accident specific and could vary widely by location and incident.526 Significantly, EPA

515 Ibid. 516 Ibid. 517 Ibid. 518 Ibid. 519 Ibid. 520 Ibid. 521 Ibid. 522 Ibid. 523 Ibid. 524 Ibid. 525 Ibid. 526 Ibid.

West Fertilizer Company Final Report January 2016 187 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

also contended that proximity to population centers, for example, might play a role in the magnitude of accidental releases.527 8.4.2.2 Risk Management Program Rule Listing Criteria and Coverage for FGAN CSB reviewed the original listing criteria to determine their application to FGAN and found support for inclusion of FGAN on the Risk Management Program list. First, CSB found a high severity of acute adverse health effects related to accidental releases of FGAN because one of the phenomena associated with the hazards of FGAN as a reactive and as an explosive is blast waves from an FGAN explosion. Acute adverse health effects from blast waves can include not only major injuries (such as fractures and injuries to the head, ears, and eyes), but also death. All of these were reported after the WFC incident. As stated previously, EPA specifically deemed blast waves to be considered in assessing the severity of acute adverse health effects related to accidental releases of the substance. CSB concluded that FGAN meets the second criteria for listing under the Risk Management Program rule because the likelihood of accidental releases of FGAN is high. Before assessing the merits of this listing factor, CSB sought to define such accidental releases and ultimately found that they can be described as emissions of blast waves and thermal energy from FGAN explosions. An accidental release is defined by the CAA Amendments of 1990 as “an unanticipated emission of a regulated substance or other extremely hazardous substance into the ambient air from a stationary source.”528 In general, this definition has been interpreted to apply only to gases and liquids, not to solids such as FGAN.529 However, in its original Risk Management Program rule listing notice, EPA determined the proposed threshold quantity for high explosives530 based on the quantity that could produce potentially lethal blast waves from an explosion at a distance of 100 meters.531 This determination is significant because it supports the conclusion that EPA envisioned blast waves as qualifying as unanticipated emissions when it considered explosives for addition to the Risk Management Program list. CSB also conducted its own research on explosions and emissions. An explosion involves a sudden release of large amounts of energy. This energy release can be dissipated as blast waves, propulsion of

527 Ibid. 528 40 CFR 68.3 529 ARA. “Re: Accidental Release Prevention Requirements: Risk Management Programs under the Clean Air Act, Section 112(r)(7); Request for Information; Docket # EPA-HQ-OEM-2014-0328; FRL-9911-61-OSWER.” October 29, 2014. 530 High explosives represent the category of explosives that might most easily detonate. 59 Federal Register 4487 (January 31, 1994). They are likely to cause severe impacts in detonation scenarios. These explosives were subsequently deleted from coverage in 1998 due to settlement of litigation with the Institute for Manufacturers of Explosives. 63 Federal Register 640 (January 6, 1998). It is important to note, however, that this was not due to any potential misinterpretation of the term “accidental release” (as discussed in the Explosive Substances Section). 531 58 Federal Register 5102 (January 19, 1993).

West Fertilizer Company Final Report January 2016 188 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

debris, or the emission of thermal and ionizing radiation.532 Furthermore, the term “emissions” is not strictly limited to the release of toxic or flammable liquids and vapors. It can refer to the generation of hot gases and overpressures that result from explosions. This interpretation aligns with EPA’s reasoning that explosives can produce accidental releases, as demonstrated by EPA’s original inclusion of high explosives on the Risk Management Program list and by its associated determination of the appropriate threshold quantity for such explosives. CSB supports EPA’s original reasoning that blast waves are emissions for purposes of listing substances under the Risk Management Program rule. In particular, CSB supports that this reasoning should apply to FGAN. CSB concluded that there is a reasonable likelihood of an accidental release of FGAN because FGAN is a ubiquitous commodity chemical that is stored in large volumes at many locations. CSB found that this was true not only at the WFC facility (where the WFC stored 80,000 to 120,000 pounds of FGAN), but also at domestic fertilizer facilities throughout the South and the Midwest where Alabama, Missouri, Tennessee and Texas make up more than 50 percent of FGAN consumption in the United States.533 FGAN also has been involved in a large number of accidents in the past (described in Appendix B). It has been at the center of major disasters such as the Oppau, Germany, incident in 1921 and the Texas City, Texas, incident in 1947; each caused more than 500 fatalities. EPA considered these exact factors (i.e., ubiquity, commodity, volume, and past accident history) to be indicative of whether an accidental release of a substance is likely. Finally, CSB determined the magnitude of human exposure associated with accidental FGAN releases is significant because FGAN storage is commonly located close to many population centers. This was clearly the case in West, Texas, where a playground, four public school buildings, a nursing home, and an apartment complex all surrounded the WFC facility. It is also the case throughout Texas, where many fertilizer facilities are in communities and downtown neighborhoods (noted in Section 5.4). Because of the WFC investigation and other CSB investigations that identified offsite consequences from chemical releases, land use planning and siting of chemical facilities remain important issues for CSB. As discussed previously, EPA considered the proximity of facilities to population centers as a significant determinant of potential impact. The WFC incident demonstrates the validity of this conclusion. After finding that all three listing criteria were satisfied, CSB concludes that FGAN warrants listing under the Risk Management Program rule.

532 Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on November 14, 2015). 533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 2015). Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on November 14, 2015). 533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 2015).

West Fertilizer Company Final Report January 2016 189 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.2.3 Additional Support for Risk Management Program Rule Coverage for FGAN

Besides considering the three listing criteria factors mandated under the CAA, EPA identified other substances based on similarities with the mandated substances and selection criteria.534 EPA considered options that accounted for the inherent hazards of the substances to be listed and for the potential of these hazards to affect the community if an accidental release occurred.535 In particular, EPA analyzed hazards such as toxicity, flammability, reactivity, explosivity, and radioactivity, stating that all of them can result in acute effects after short-term exposure.536 EPA identified substances associated with each of these hazards, but also considered the potential impact that the identified substances would have on the community if a release took place.537 It evaluated each hazard independently, as well as each hazard’s potential to pose a threat to the community.538 Ultimately, a group of toxic substances, a group of flammable substances, and a group of explosive substances were proposed in the January 19, 1993, rule for addition to the 16 mandated substances in the CAA.539 Because they pertain to FGAN, CSB conducted further research on explosives and on reactive substances. Explosive Substances With respect to the group of explosive substances, EPA proposed to focus on physical hazards because of their ability to impact communities beyond the fenceline in the event of an accidental release.540 EPA viewed commercial high explosives, which have the potential to detonate, as the explosive substances with the greatest potential to affect such communities and therefore proposed commercial high explosives as a category for listing.541 In determining the threshold methodology, EPA indicated that a blast wave overpressure of 3.0 psi from a detonation could have potentially lethal effects in communities beyond the fenceline.542 The agency noted that this overpressure level could cause serious structural damage to buildings, lead to serious wounds from flying glass, and potentially cause eardrum rupture.543 The agency also considered reactive substances that have explosive properties, including oxidizers (e.g., pure AN), for listing.544 In its final decision however, EPA deferred listing these types of substances for lack of an adequate technical basis upon which to evaluate offsite consequences from unstable and reactive substances.545 Nonetheless, EPA concluded in its response that “this decision does not preclude the

534 58 Federal Register 5102 (January 19, 1993). 535 Ibid. 536 Ibid. 537 Ibid. 538 Ibid. 539 Ibid. 540 Ibid. 541 Ibid. 542 Ibid. 543 Ibid. 544 Ibid. 545 EPA. “Proposed List of Substances and Thresholds for Accidental Release Prevention: Summary and Response to Comments,” January 14, 1994: 146.

West Fertilizer Company Final Report January 2016 190 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Agency from revisiting this issue in the future, in response to a petition to list, or when the list is reviewed and the listing criteria modified.”546 For several decades, a number of agencies and organizations have regulated materials with explosive potential. ATF regulates the manufacture, processing, use, distribution, and storage of explosive materials; ATF regulations include requirements for licensing, permitting, and recordkeeping and for storage of explosives.547 DOT regulates the transportation of explosives, and other agencies, such as OSHA, Mine Safety and Health Administration (MSHA), Department of Defense (DOD), and International Maritime Organization, regulate certain aspects of the explosive industry.548 In its 1993 Federal Register notice, however, EPA stated that although explosives are regulated by federal, state, and local governments, these regulations do not uniformly address the issue of using appropriate hazard assessment techniques to identify hazards, designing and maintaining a safe facility, and minimizing the consequences of accidental releases when they do occur.549 EPA noted that all of these elements were to be addressed in the Risk Management Program regulations, which it described as “intended to help focus on accident prevention.”550 The agency therefore asserted that these substances should be considered for purposes of list development and accidental release prevention regulations, and for some time, high explosives (classified as Class 1, Division 1.1 on DOT’s Hazardous Materials Table) were included on the final 1994 Risk Management Program list.551 However, DOT Division 1.1 explosives were delisted four years later.552 After promulgation of the Risk Management Program list, the Institute of Makers of Explosives (IME) petitioned against EPA for judicial review, challenging the listing of high explosives.553 IME objections included the contention that existing ATF, DOT, MSHA, and OSHA regulations already adequately controlled DOT Division 1.1 explosives.554 EPA and IME ultimately settled, with EPA agreeing to delist the explosives in exchange for IME’s promise to undertake specific measures to enhance local emergency response.555 CSB found this information important with respect to its investigation because FGAN has explosive properties under certain conditions. Accordingly, CSB conducted research to determine whether FGAN was listed and then delisted along with these DOT Division 1.1 explosives. CSB found that DOT Division 1.1 explosives include one less common form of AN (classified by the United Nations as UN0222) containing more than 0.2 percent carbonaceous material. However, this form of AN is not commercially used or manufactured. Importantly, CSB discovered that FGAN has never

546 Ibid. 547 58 Federal Register 5201 (January 19, 1993). 548 Ibid. 549 Ibid. 550 Ibid. 551 Ibid. 552 79 Federal Register 44607 (July 31, 2014). 553 61 Federal Register 16598 (April 15, 1996). 554 Ibid. 555 Ibid. See also: 63 Federal Register 640 (January 6, 1998).

West Fertilizer Company Final Report January 2016 191 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

been explicitly regulated under the Risk Management Program rule because it is not a DOT Division 1.1 explosive. Furthermore, even if FGAN were a DOT Division 1.1 explosive, the DOT Division 1.1 explosives were never specifically identified by name on the Risk Management Program list. Therefore, AN has never explicitly been listed under the Risk Management Program rule. Nonetheless, CSB found it significant that EPA evaluated explosives, and the effects they can have upon communities in detonation scenarios, when determining the substances to include on the Risk Management Program list.556 Because FGAN can detonate under certain conditions, CSB recommends that FGAN be included for coverage under the Risk Management Program rule. Further support for including FGAN on the Risk Management Program list can be found in EPA’s original inquiry into reactive substances and in CSB’s past work on reactives. Reactive Substances At the time of its 1993 Federal Register notice, EPA was attempting to evaluate the hazards of reactive and unstable chemicals and to develop an adequate technical basis for determining the potential effects on the community.557 For example, EPA investigated computer models that estimate heats of reaction and also the possible use of heats of reaction to compare the effects of an explosion of an unstable substance to the effects of an explosion of TNT.558 EPA stated that this method would only be appropriate for substances that detonate, an outcome that appeared to be unlikely for many unstable substances.559 Ultimately, EPA contended that unstable and reactive substances would be considered for listing for accidental release prevention if the evaluation indicated potential community consequences.560 On the basis of the WFC investigation and on the CSB’s “Improving Reactive Hazard Management” study, CSB recommends that FGAN be added to the Risk Management Program list. In the early 1990s, EPA considered listing reactive substances, such as AN, on the Risk Management Program list.561 Specifically, EPA assessed whether to include chemicals whose reactive properties could cause impacts on nearby communities in the event of an accident.562 In December 2002, CSB issued the study, “Improving Reactive Hazard Management,” which examined reactive hazard management across the United States.563 The study found regulatory coverage of reactive hazards to be a key issue.564 As a result of the study, CSB issued several regulatory recommendations, including the following recommendation to EPA: Revise the Accidental Release Prevention Requirements, 40 CFR 68, to explicitly cover catastrophic reactive hazards that have the potential to seriously impact the public, including

556 58 Federal Register 5102 (January 19, 1993). 557 Ibid. 558 Ibid. 559 Ibid. 560 Ibid. 561 Ibid. 562 Ibid. 563 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001. 564 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 3.

West Fertilizer Company Final Report January 2016 192 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

those resulting from self-reactive chemicals and combinations of chemicals and process-specific conditions. Take into account the recommendations of this report to OSHA on reactive hazard coverage. Seek congressional authority if necessary to amend the regulation.565 Unfortunately, EPA has not initiated rulemaking consistent with CSB’s recommendation more than 10 years since its issuance.566 Therefore, CSB has categorized the status of this recommendation as “Open— Unacceptable Response.”567 Since issuing its reactive hazard investigation study in 2002, CSB has investigated several industrial accidents involving reactive chemicals.568 These are summarized in Table 12. Table 12. CSB Investigations Involving Reactive Chemicals Since 2002 Incident Date Location Severity First Chemical Corp.: Reactive Chemical Explosion October 13, 2002 Pascagoula, MS • 3 injured MFG Chemical Inc.: Toxic Gas Release April 12, 2004 Dalton, GA • 154 hospitalized Synthron Chemical: Explosion July 31, 2007 Morganton, NC • 1 fatality • 12 injured T2 Laboratories Inc.: Reactive Chemical Explosion December 19, 2007 Jacksonville, FL • 4 fatalities • 13 hospitalized Bayer CropScience: Pesticide Waste Tank Explosion August 28, 2008 Institute, WV • 2 fatalities West Fertilizer Company: Explosion and Fire April 17, 2013 West, TX • 15 fatalities • More than 260 injured

It is important to note, however, that Table 12 depicts only those incidents involving reactive chemicals that CSB investigated since 2002. That is, these incidents do not represent the universe of reactive chemical accidents, which is much larger.

565 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 102. 566 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014. 567 See: http://www.csb.gov/recommendations/?F_RecipientId=8 (accessed on December 17, 2015). OSHA’s associated recommendations are also categorized as “Open—Unacceptable Response.” See: http://www.csb.gov/UserFiles/file/CSB-OSHACorrespondence.pdf (accessed on January 15, 2016). 568 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014.

West Fertilizer Company Final Report January 2016 193 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.2.3.1.1 General Duty Clause

After the incident, CSB referenced its reactives study in “Preliminary Findings of the CSB from its Investigation of the West Fertilizer Explosion and Fire.”569 With respect to the EPA Risk Management Program rule, CSB specifically stated: In developing the RMP regulation, the EPA did not explicitly include explosives or reactive chemicals in the list of covered chemicals. In 2002, the CSB issued a study on reactive hazards, identifying 167 prior reactive incidents (including a 1994 explosion at an AN manufacturer). The Board recommended that . . . EPA expand [its] standard[] to include reactive chemicals and hazards. However, [EPA has not] yet acted upon the recommendation[].570 On June 6, 2014, after learning the Open—Unacceptable Response status of its recommendation, EPA raised, in a letter to CSB, its concern that CSB had mischaracterized in its reactives study the scope and history of EPA’s use of the CAA Section 112(r)(1), General Duty Clause (GDC).571 Because the GDC is a provision which CSB believes likely could have been used to cite the WFC facility, but was not, CSB conducted further research into the requirement. The GDC is a statutory obligation that makes owners and operators of facilities that possess regulated and other extremely hazardous substances responsible for ensuring that their chemicals are managed safely.572 In CAA Section 112(r)(1), the GDC states: The owners and operators of stationary sources producing, processing, handling or storing such substances [i.e., a chemical in 40 CFR Part 68 or any other extremely hazardous substance] have a general duty [in the same manner and to the same extent as the general duty clause in the Occupational Safety and Health Act] to identify hazards which may result from (such) releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.573 Accordingly, EPA has the authority to apply the GDC to facilities not only after incidents, but also before incidents to prevent them. The GDC is a broad provision with great potential to enhance safety measures at facilities that contain certain hazardous substances. In addressing the hazards associated with reactive substances and application of the GDC, CSB has stated that “many substances are unlikely to be considered ‘extremely hazardous’ since they do not present an inherent catastrophic reactive hazard until combined with other chemicals or under process-specific conditions.”574 This circumstance should not preclude, and EPA affirms has not precluded, such

569 CSB. “Preliminary Findings of the U.S. Chemical Safety Board from its Investigation of the West Fertilizer Explosion and Fire,” June 27, 2013. 570 Ibid. 571 EPA letter to CSB, June 6, 2014. 572 See: http://www2.epa.gov/sites/production/files/2013-10/documents/gdc-fact.pdf (accessed on December 29, 2015). 573 42 U.S.C. § 7412(r)(1). 574 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014.

West Fertilizer Company Final Report January 2016 194 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

substances from enforcement under the GDC. EPA referenced a 1989 Report of the Senate Environment and Public Works Committee, which stated that the presumption should be that a substance is extremely hazardous if it causes significant adverse impacts by acute toxic effect or “by blast, fire, corrosion or other reaction.”575 The report also states that “extremely hazardous substances” would “include other agents which may or may not be listed” that “as the result of short-term exposures associated with [accidental] releases to the air cause death, injury or property damage due to their toxicity, reactivity, flammability, volatility, or corrosivity.”576 According to this report, therefore, EPA could apply the GDC to reactive substances. However, EPA did not use the GDC to cite the WFC after the incident for its unsafe storage of FGAN. Considering the totality of the EPA regulatory landscape, CSB determined that requirements for facilities to safely store and handle FGAN are insufficient. As discussed, the Risk Management Program rule does not regulate FGAN because FGAN is not on the list of regulated substances. Furthermore, while EPA could use the GDC to impose requirements on facilities to ensure the safe management of FGAN as a reactive substance, EPA does not contend that the GDC is as easy to apply as a regulation. EPA may have been able to apply the GDC against the WFC after the incident, but it did not. Therefore, without more from the GDC, it is the recommendation of CSB that FGAN be included on the Risk Management Program list, especially in light of the fatal incident in West, Texas. 8.4.2.4 Risk Management Program Rule and Coverage of Anhydrous Ammonia As previously discussed, although the WFC was not covered under the Risk Management Program rule for its storage of FGAN, it was covered under Program Level 2577 of the rule for its storage of more than 10,000 pounds, the threshold limit, of anhydrous ammonia. The facility submitted its RMP registration in 1999, 2006,578 and 2011.579 The WFC’s 2006 RMP for anhydrous ammonia included important safety elements to prevent, control, and respond to an anhydrous ammonia release.580 For example, the insurance company conducted a hazard review to identify major release scenarios and address actions that would prevent or mitigate a release.581 Another important feature of the RMP was development of an emergency action plan with step-by-step procedures, detailing how employees should respond to an anhydrous ammonia release.582 Other program elements included operating procedures, maintenance and

575 EPA letter to CSB, June 6, 2014. 576 Senate Committee on Environment and Public Works, CAA Amendments of 1989, Senate Report No. 228, 101st Congress, 1st Session 211 (1989). 577 The WFC fell under Program 2 requirements for its storage of anhydrous ammonia because it did not meet the requirements for Program Level 3 and was not eligible for Program Level 1 coverage. 578 The WFC did not resubmit its RMP registration as it was supposed to in 2004 because of a change in ownership. EPA cited the company in 2006 for failing to refile its RMP in a timely manner. The WFC refiled it in 2006. 579 WFC RMP submissions to EPA. 580 Ibid. 581 Ibid. 582 Ibid.

West Fertilizer Company Final Report January 2016 195 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

inspection programs, training programs, incident investigations, offsite consequence analyses, and compliance audits.583 The Risk Management Program rule also required the WFC to comply with RAGAGEP for anhydrous ammonia, such as ANSI K61.1, “Safety Requirements for the Storage and Handling of Anhydrous Ammonia,” and OSHA’s Storage and Handling of Anhydrous Ammonia regulation (29 CFR 1910.111).584 As previously mentioned, the Risk Management Program list does not include FGAN, so the WFC was not required to take related Risk Management Program safety measures for FGAN. Of course, FGAN coverage under the Risk Management Program rule likely would have increased awareness of the explosion hazards of FGAN, leading to better management of the substance through compliance with federal safety regulations and best industry practices. If EPA had included FGAN under the Risk Management Program rule, the WFC would have been required to apply it for its storage of FGAN and perhaps could have reduced the risk of catastrophic accidents like the one that occurred at the WFC. 8.5 Emergency Planning The CSB investigation of the WFC incident identified the explosive potential of FGAN. CSB further found that no immediate evacuation at the first sign of fire occurred, in part because no in-place emergency plan addressed response specifically to an incident at the WFC warehouse. This situation left emergency responders and the West community unaware of the urgent need to evacuate. For FGAN facilities, there must be a well-exercised local emergency plan that emphasizes immediate notification to emergency responders and the community at the first sign of fire, as well as evacuation protocols. If there was an immediate evacuation once the fire was detected at the WFC, the number of fatalities and injuries likely would have been lower. Emergency planning is part of emergency management, which includes four different stages: (1) mitigation, (2) planning, (3) response, and (4) recovery. The nation’s emergency management system is intended to prepare communities for all types of hazards, including natural disasters, terrorism, and hazardous materials (HAZMAT) incidents. The responsibilities of emergency management personnel are shared among federal agencies that provide assistance through funding and training. For example, DHS primarily focuses its efforts on terrorism and natural hazards and also serves as the umbrella organization for other agencies that supply assistance to state and local authorities. Other federal agencies such as EPA and OSHA have emergency planning regulations for environmental and occupational accidents involving HAZMAT. The next sections discuss these regulations at the federal, state, and city levels and discuss their relevance to the WFC incident.

583 Ibid. 584 40 CFR 68.48(b).

West Fertilizer Company Final Report January 2016 196 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5.1 Federal Emergency Planning

In response to growing concerns about the safety and health of people and the environment after releases of hazardous substances in the U.S. in the 1970s and 1980s and the disaster in Bhopal, India, Congress passed new laws authorizing EPA and OSHA to regulate these risks. One was the Emergency Planning and Community Right-to-Know Act (EPCRA) of 1986, which was intended to address concerns about local preparedness for chemical emergencies and to ensure public access to information. EPCRA established a framework for states to organize resources to pre-plan for chemical accidents. EPCRA requirements include: (1) emergency planning (SARA Title III, Sections 301–303); and (2) emergency and hazardous chemical inventory reporting (SARA Title III, Sections 311 and 312).585 Each section of EPCRA covers a subset of chemicals and the statute and EPA regulations specify quantities that trigger reporting requirements (Table 13).586 Because they are pertinent to the WFC incident, requirements for emergency planning and hazardous chemical inventory reporting are discussed in greater detail. Table 13. EPCRA Chemicals and Reporting Thresholds

Section 302 Sections 311 and 312 Chemicals Covered 355 extremely hazardous substances (EHSs) Approximately 500,000 hazardous chemicals Thresholds Threshold planning quantity (TPQ): 1 to 10,000 lbs. onsite at any one time 500 lbs. or TPQ, whichever is lower, for EHSs; 75,000 gallons for gasoline; 100,000 gallons for diesel; and 10,000 lbs. for all other hazardous chemicals

EPCRA emergency planning establishes, in part, requirements for sharing information among industry and state, tribal, and local governments. As shown in Table 13, under Section 302, a facility that has an extremely hazardous substance (EHS) at or above its specific threshold planning quantity (TPQ) must report the substance. Reporting of EHSs, as well as other hazardous chemicals under Sections 311 and 312, must be made to the State Emergency Response Commission (SERC), Local Emergency Planning Committee (LEPC), and local fire department.587 State governors designated the SERCs which then designated roughly 3,500 local emergency planning districts and LEPCs for each district.588 At minimum, LEPCs must be composed of elected state and local officials; police, fire, civil defense, public health, transportation, and environmental professionals; representatives of facilities subject to EPCRA emergency planning requirements; community groups; and

585 Regulations implementing EPCRA are codified at 40 CFR Parts 350–372. 586 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 587 The local fire department receives only inventory information under Sections 311 and 312. 588 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 197 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the media.589 SERCs are supposed to supervise and coordinate the activities of LEPCs, establish procedures for receiving and processing public requests for information, and review local emergency response plans.590 LEPCs are supposed to develop emergency response plans, review the plans annually, and provide information to the public.591 EPCRA emergency planning also requires LEPCs to develop and update emergency response plans. LEPCs are supposed to use information reported by facilities to develop these plans, which cover procedures that describe how emergency responders should respond to chemical releases.592 The plans must (1) identify EHS facilities and transportation routes; (2) describe emergency response procedures, onsite and offsite; (3) designate a community coordinator and facility coordinators to implement the plan; (4) outline emergency notification procedures; (5) explain the means to determine the probable area and population affected by chemical releases; (6) describe local emergency equipment and facilities and the people responsible for them; (7) outline evacuation plans; (8) provide a training program for emergency responders (including schedules); and (9) detail methods and schedules for exercising emergency response plans.593 Importantly, EPCRA emergency planning requirements mandate the identification of facilities with EHSs only; identification of facilities without EHSs is not required. Thus, although facilities must report EHSs and certain non-EHSs (i.e., other hazardous chemicals under Sections 311 and 312), only facilities with EHSs trigger EPCRA emergency response plan requirements.594 For purposes of the WFC investigation, CSB determined that while anhydrous ammonia is on the EHS list, FGAN is not. CSB found, however, that AN is on the list of hazardous chemicals under Sections 311 and 312 that triggers emergency and hazardous chemical inventory reporting requirements. EPCRA emergency and hazardous chemical inventory reporting requires reporting of certain quantities of EHSs and hazardous chemicals. As shown in Table 13, under Sections 311 and 312, an EHS must be reported if it is held at the lower of 500 pounds or the substance’s TPQ, gasoline must be reported at 75,000 gallons, diesel must be reported at 100,000 gallons, and all other hazardous chemicals must be reported at 10,000 pounds.595 These reporting requirements are tied to OSHA’s Hazard Communication Standard (29 CFR 1910.1200). This standard requires employers to maintain SDSs for all hazardous chemicals in the workplace.596 SDSs contain crucial information, including chemical and hazard

589 Ibid. See also: 42 U.S.C. §11001(c). 590 Ibid. See also: 42 U.S.C. §11001(a). 591 Ibid. See also: 42 U.S.C. §11001(c). 592 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 593 Ibid. See also: 42 U.S.C. §11003(c). 594 It should be noted that EPA has suggested, through guidance to SERCs and LEPCs (including the most recent fact sheet to these entities), that they include Sections 311 and 312 facilities in their planning process. 595 See: http://www.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 596 Ibid.

West Fertilizer Company Final Report January 2016 198 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

identification; ingredient composition; first aid measures; firefighting measures; accidental release measures; handling and storage precautions; exposure controls and personal protection; physical and chemical properties; stability and reactivity properties; toxicological information; ecological concerns; disposal considerations; transport information; regulatory requirements; and other information.597 Facilities must maintain SDSs onsite and submit copies of them (or a list of SDS-covered chemicals) to their SERCs, LEPCs, and local fire departments.598 Facilities covered by Section 311 must also submit Emergency and Hazardous Chemical Inventory forms to their SERCs, LEPCs, and local fire departments annually.599 Facilities provide either a Tier I or Tier II inventory form.600 Tier I inventory form include the following aggregate information for each applicable hazard category: • An estimate (in ranges) of the maximum amount of hazardous chemicals for each category present at the facility at any time during the preceding calendar year. • An estimate (in ranges) of the average daily amount of hazardous chemicals in each category. • The general location of hazardous chemicals in each category.601 The Tier II inventory form contains basically the same information as the Tier I, but it must list the specific chemicals. Tier II inventory form provide the following for each chemical: • The chemical name or the common name as indicated on the SDS. • An estimate (in ranges) of the maximum amount of the chemical present at any time during the preceding calendar year and the average daily amount. • A brief description of the manner of storage of the chemical. • The location of the chemical at the facility. • An indication of whether the owner elects to withhold location information from disclosure to the public.602 Information submitted under Sections 311 and 312 is available to the public from SERCs and LEPCs.603

597 See: https://www.osha.gov/Publications/HazComm_QuickCard_SafetyData.html (accessed on December 29, 2015). OSHA does not enforce the ecological information, disposal considerations, transport information, and regulatory information sections of SDSs because other agencies regulate this information. 598 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 599 Ibid. 600 Ibid. 601 Ibid. 602 Ibid. It is important to note that under Section 312(f), upon request by the fire department with jurisdiction over the facility, owners/operators must provide fire departments with location information. They must also allow fire departments to conduct onsite inspections. 603 Ibid.

West Fertilizer Company Final Report January 2016 199 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5.2 State Emergency Planning in the State of Texas

Texas has suffered some of the worst disasters in U.S. history, both in kind and magnitude. One of the first was the devastating hurricane in Galveston in 1900, which almost destroyed the city and killed thousands. In 1937, in New London, a gas leak explosion destroyed a school and killed approximately 300 students and teachers. Ten years later, the FGAN explosion in Texas City inflicted an enormous loss of life and property that remains unknown to this day; it is ranked as one of the worst industrial accidents in U.S. history.604 As a result of these disasters, Texas enacted statutes to address all-hazard emergency management.605 The Texas Disaster Act of 1975 requires local jurisdictions to designate an emergency management coordinator to develop an emergency operations plan composed of a basic plan with 22 annexes.606 The basic plan and its annexes outline guidance for emergency management activities and assign roles and responsibilities to local agencies.607 Although the basic plan offers general guidance, the annexes provide more detail.608 For example, Annex Q, “Hazardous Materials and Oil Spill Response,” identifies the HAZMAT incidents that could occur in a specific community and how such an incident would likely affect nearby populations.609 Once a hazard is identified, appropriate response actions must be planned, including timely notification, identification of evacuation routes, and assignment of roles and responsibilities.610 Training exercises and drills must also test response effectiveness.611 When Congress enacted EPCRA in 1986, its provisions were incorporated into Texas’s existing emergency planning framework and into state codes.612 The SERC is the Emergency Management Council of Texas and includes participation from multiple state agencies.613 Within that group of agencies, 10 are considered to be SERC members with specific roles in emergency response and planning. For example, the TCEQ is responsible for receiving reports about accidental spills and releases;614 the Texas Department of State Health Services is designated to receive the Tier I or Tier II Emergency and Hazardous Chemical Inventory forms submitted electronically by facilities;615 and the Texas Department of Public Safety, Division of Emergency Management, is tasked with overseeing the

604 Texas Emergency Management Executive Guide (FY 2014 Edition). 605 Ibid. 606 Texas Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 607 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 608 Ibid. 609 See: McLennan County. Annex Q: Hazardous Materials & Oil Spill Response. Version 2.4, July 2009. 610 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 611 Ibid. 612 Texas Health and Safety Code, Title 6, Subtitle D, “Hazardous Substances,” Chapters 505 through 507. Texas Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 613 Texas Department of Public Safety. See: https://www.txdps.state.tx.us/dem/stateLocalOrganizations.htm#EMC (accessed on December 29, 2015). 614 See: https://www.tceq.texas.gov/response/spills (accessed on December 29, 2015). 615 This designation has changed since the date of the WFC incident. The Tier II Chemical Reporting Program has moved to the TCEQ. See: https://www.dshs.state.tx.us/tiertwo/ (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 200 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

all-hazard emergency management program and providing guidance and funding for cities, counties, and state agencies so that they can develop their own programs.616 8.5.3 City Emergency Planning in the City of West To fully understand the WFC incident, this section reviews emergency planning and management in West and at the WFC facility. West is located in McLennan County, which is West’s local emergency management district and which formed an LEPC in 1992. The McLennan County LEPC meets four times per year.617 Its members are nominated by the county judge and approved by the SERC.618 The LEPC membership consists of city, industry, hospital, and emergency response officials.619 CSB found that the WFC, however, was not listed on the attendance roster for any LEPC meeting for more than 21 years. As required by both state and federal regulations, the McLennan County LEPC prepared an emergency response plan (ERP) in accordance with guidance from the Texas Department of Public Safety, Division of Emergency Management.620 As discussed previously, this consisted of a basic plan with 22 annexes. It described in part McLennan County’s approach toward emergency planning, response, and notification. McLennan County officials review the plan annually and officially revise or update it every 5 years, as required by Texas law.621 Prior to the WFC incident, McLennan County last formally reviewed its ERP in 2010.622 The McLennan County ERP includes procedures on how to alert the public when natural or human- initiated disasters occur. ERP annexes describe actions to take in various scenarios, such as how to disseminate information quickly,623 how to warn special facilities (e.g., hospitals and schools) and populations of a hazard,624 and how to use alert systems to activate immediate evacuation.625 A vital component of ERPs and ERP annexes is LEPC engagement and communication. Without these, community members might not have the necessary information to respond appropriately to a specific type of incident. For example, on February 12, 2013, WIS was temporarily evacuated because of a controlled burn at the WFC facility. Before the evacuation, the school principal alerted 911 of the fire, but the 911 dispatcher did not acknowledge a coordinated burn. Students and staff were evacuated for approximately 30 minutes to WMS, using coordinated transportation. The WFC did not notify the WISD or WIS in advance that the

616 See: https://www.txdps.state.tx.us/internetforms/Forms/TDEM-10.pdf (accessed on December 29, 2015). 617 McLennan County LEPC Bylaws, Article II, Section 5, “Meetings.” 618 McLennan County LEPC Bylaws, Article II, Section 1, “Membership.” 619 Ibid. 620 State of Texas. Local Emergency Planning Committee (LEPC): A Primer for Local Planning for Hazardous Materials, July 2006. 621 Texas Administrative Code, Title 37, Part 1, Chapter 7, Subchapter B, Rule 7.12. 622 CSB reviewed the 2010 McLennan County ERP for this investigation report. 623 McLennan County Basic Plan, Annex I. 624 McLennan County Basic Plan, Annex E. 625 Ibid.

West Fertilizer Company Final Report January 2016 201 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facility was conducting a controlled burn of pallets and brush. After this incident, the WISD asked the emergency service providers and the WFC to provide advance notice of future burning activities. The WFC could have communicated its plans to the WISD or WIS through LEPC activities. The McLennan County ERP specifically includes Annex Q, “Hazardous Material and Oil Spill Response,” which requires identification of all regulated facilities within the county.626 Such facilities are those that are regulated by EPCRA. In particular, a regulated facility is: A plant site where handling/transfer, processing, and/or storage of chemicals is performed. For the purposes of [Annex Q], regulated facilities (1) produce, use, or store EHSs in quantities which exceed threshold planning quantities or (2) hold one or more hazardous chemicals in a quantity greater than 10,000 pounds at any time.627 Because the WFC was regulated by EPCRA, it would follow that Annex Q might list the WFC. However, the WFC was not listed. EPCRA covered the WFC for at least two reasons. First, the WFC stored anhydrous ammonia in quantities that exceeded the anhydrous ammonia TPQ of 500 pounds. Specifically, CSB found that the WFC reported holding 34,000 pounds of anhydrous ammonia at the time of the incident. Clearly, the WFC had onsite sufficient amounts of an EPCRA Section 302 EHS. This triggered not only reporting requirements, but also emergency response planning requirements.628 Thus, the WFC should have been listed in Annex Q for its EPCRA-regulated storage of anhydrous ammonia. Second, the WFC stored FGAN, a hazardous chemical under EPCRA Sections 311 and 312, in quantities that exceeded the AN threshold quantity of 10,000 pounds. In particular, CSB found that the WFC reported 80,000 to 120,000 pounds of FGAN onsite at the time of the incident. As such, the WFC was required to report its quantities of FGAN under EPCRA. CSB obtained WFC Tier II form documents, dated from 2000 to 2012, and found that the WFC annually reported its quantities of anhydrous ammonia to the WVFD, McLennan County LEPC, and Texas Department of State Health Services, but reported its FGAN only in its 2012 Tier II report. Ideally, under the best set of circumstances, the WFC should have been listed in Annex Q for its storage of FGAN. The WFC was not listed in Annex Q, however, due to a misunderstanding of EPCRA’s agricultural use exemption. EPCRA’s agricultural use exemption is a statutory exemption to the definition of “hazardous chemical.” It reads: Hazardous Chemical Defined. For purposes of this section, the term “hazardous chemical” has the meaning given such term by section 1910.1200(c) of title 29 of the Code of Federal

626 McLennan County Basic Plan, Annex Q. 627 Ibid. 628 The WFC was also expected to develop an emergency response plan for its storage of anhydrous ammonia, as required by the Risk Management Program rule. According to EPA, the EPCRA plan and the RMP must be coordinated. See: http://www2.epa.gov/sites/production/files/2013-11/documents/chap-08-final.pdf (accessed on December 29, 2015). However, no evidence indicated that the WFC RMP was shared with the LEPC or the WVFD.

West Fertilizer Company Final Report January 2016 202 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Regulations, except that such term does not include the following: . . . Any substance to the extent it is used in routine agricultural operations or is a fertilizer held for sale by a retailer to the ultimate customer.629 It is important to note that this exemption may apply only to Sections 311 and 312 reporting requirements; it does not apply to emergency planning requirements under Section 302. Furthermore, the agricultural use exemption applies directly to the hazardous chemical itself, not the specific individual or entity holding the chemical. That is, the exemption does not relieve an individual or entity of its responsibilities; rather, the individual or entity is exempt from EPCRA reporting requirements if the chemical in question is exempt. Where individuals or entities hold multiple chemicals, each chemical must be assessed individually to determine exemption status. The agricultural use exemption impacts those who use substances in “routine agricultural operations” and retailers who hold substances as fertilizer for sale to the ultimate customer. With respect to those who use substances in routine agricultural operations, CSB referred to guidance on EPA’s website that, in response to a question asking which hazardous chemicals are reportable for farmers under Sections 311 and 312, states: Under Section 311(e)(5), any substance when used in routine agricultural operations is exempt from reporting under Section 311 and 312. This exemption is designed to eliminate the reporting of fertilizers, pesticides, and other chemicals when stored, applied, or otherwise used at the farm facility as part of routine agricultural activities. . . . Thus, the storage and use of a pesticide or fertilizer on a farm would be considered the use of a chemical in routine agricultural operations and is, therefore, exempt under Sections 311 and 312.630 The belief is that minimal risk is involved when farmers use a substance in routine agricultural operations because farmers promptly apply those substances to their crops. Therefore, the exemption eliminates EPCRA reporting requirements under Sections 311 and 312 for at least certain farmers. However, for retailers who hold a substance as fertilizer for sale to the ultimate customer, CSB found that although EPA has published several hypothetical-based questions and answers on its website, it offers little general guidance. CSB discovered that the McLennan County LEPC reported that the WFC’s storage of anhydrous ammonia and FGAN appeared to qualify under EPCRA’s agricultural use exemption, a conclusion which the county stated was also confirmed by the SERC. The WFC’s anhydrous ammonia and FGAN were erroneously considered exempt from both emergency planning and hazardous chemical inventory reporting requirements because of the phrase “fertilizer held for sale by a retailer631 to the ultimate customer” and because the main WFC customers who bought fertilizer were nearby farmers (ultimate

629 EPCRA, Section 311(e)(5). 40 CFR 370.66. 630 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/211416278-What-hazardous-chemicals-are- reportable-for-farmers-under-311-and-312- (accessed on December 29, 2015). It should be noted, however, that although farmers may be exempt under Section 311(e)(5) from reporting these fertilizers in their Sections 311 and 312 reports, they are still required to notify the SERC (or TERC), LEPC (or TEPC), and local fire department under Section 302 if they have an EHS at or above its TPQ. 631 There is no definition of “retailer” under EPCRA.

West Fertilizer Company Final Report January 2016 203 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

customers / end users). This reason likely explains why the McLennan County LEPC ERP did not include the WFC for its storage of anhydrous ammonia, despite the fact that the exemption does not relieve reporting requirements for EHSs under Section 302. Because the WFC facility not only sold pure fertilizer but also blended chemicals to make fertilizer (e.g., for custom orders), CSB also examined how the agricultural use exemption applies to blends. EPA states that chemicals “held for the purpose of producing fertilizer” are “starting materials used to make a fertilizer,” not the fertilizer itself, so the retailer therefore should report them.632 EPA recognizes, however, that if those chemicals are not blended but rather sold individually to the end customer, then those chemicals are exempt.633 EPA confirmed this position in a September 3, 2010, letter to TFI, stating that the “mixing of fertilizers” must be reported and reiterating that “fertilizer held for sale by a retailer to the ultimate customer . . . is one that is merely held for sale, not one that is mixed or formulated.”634 To bolster its reasoning, EPA further explained: Congress’ intent was to focus Section 311/312 reporting on manufacturers and wholesalers— those are facilities that typically have large quantities of fertilizer, and that use and manufacture a wide range of chemical compounds. Congress appreciated that such manufacturers and wholesalers presented significant risks that needed to be addressed by emergency response authorities, but that mere retailers did not. Assuming arguendo that Congress’ intent is ambiguous, the above interpretation is one that EPA adopts as being the most reasonable interpretation of the statute. Therefore, consistent with the Agency’s prior Q&A guidance, the amount of chemicals intended for blending and the new product should be reported under Section 311 and 312 if the reporting thresholds are exceeded.635 On this basis, facilities that blend chemicals to make fertilizer such as the WFC should not apply the agricultural use exemption to those chemicals meant for blending. However, there is confusion about both who specifically qualifies for the exemption as well as the issue of blending because, although hypothetical-based Q&As are available, limited general EPA guidance exists. Therefore, EPA should develop a general guidance document pertaining to EPCRA’s agricultural use exemption and make a widespread effort to communicate its contents to the fertilizer industry. Since the incident, the Agricultural Retailers Association (ARA), a nonprofit trade association that represents the interests of agricultural retailers and distributors on legislative and regulatory issues, issued an alert to its members on May 14, 2013, warning agricultural retailers that blend (i.e., use nonchemical reactions to mix) dry fertilizers to report those fertilizers on their annual Tier I or Tier II inventory reports submitted to SERCs, LEPCs, and local fire departments. The alert also warned members that EPA has

632 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/212089537-Are-hazardous-chemicals-blended- for-fertilizer-exempted-under-agricultural-use-exemption- (accessed on December 29, 2015). 633 Ibid. 634 Dana S. Tulis, EPA Acting Director Office of Emergency Management. Letter to Chris S. Leason, counsel to TFI, September 3, 2010. 635 Ibid.

West Fertilizer Company Final Report January 2016 204 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cited agricultural retailers for incomplete inventory forms.636 TFI further noted in a verbal statement on November 15, 2013, at the Washington, DC, “Listening Session Regarding President Obama’s Executive Order Improving Chemical Facility Safety and Security”: As most of you know, there is a fertilizer retail exclusion for reporting under EPCRA. TFI supports removal of this exclusion. We feel everyone should report hazardous chemicals stored on site to the LEPC and SERC and work with local fire departments without exception.637 Despite these post-incident efforts, the ARA and TFI cover only some of the thousands of FGAN facilities in the United States. Consequently, EPA should take steps to ensure that fertilizer facilities fully comply with EPCRA and do not mistakenly apply the agricultural use exemption. In fact, EPA already hosted, from May to September 2014, 32 workshops for members of Local Emergency Planning Committees, which were held in Texas, Arkansas, Louisiana, Oklahoma, and New Mexico and attended by 1,340 representatives from local, state, and federal government as well as industry.638 It also recently released an online training module of key requirements for SERCs and LEPCs and a factsheet, “How to Better Prepare Your Community for a Chemical Emergency: A Guide for State, Tribal, and Local Agencies.”639 While these efforts demonstrate progress, CSB believes the development of more general EPCRA guidance, as well as a guidance document on the agricultural use exemption, could help significantly improve emergency planning at all levels. 8.5.4 Other Emergency Planning Requirements During the course of its investigation, CSB also found issues in emergency planning related to FGAN training and compliance with OSHA’s Hazardous Waste Operations and Emergency Response (HAZWOPER) standard (29 CFR 1910.120). CSB determined that employees at the WFC had limited training on FGAN hazards. The agency learned through interviews that some WFC employees were unaware that the FGAN fertilizer stored onsite could explode. Many said the April 1995 Oklahoma City bombing was the only basis of their knowledge of this. Nonetheless, WFC employees generally understood FGAN security regulations so as to verify that customers buying FGAN were registered and were using it only for agricultural purposes. CSB found that the lack of formal training at the WFC was a central reason why employees were largely unaware of FGAN hazards. Some WFC employees recalled having discussions about avoiding FGAN contact with heat, fire, and moisture. However, CSB concluded that FGAN safety training was inconsistent and that no formal training addressed FGAN hazards or required discussion of the FGAN SDS. WFC employees also lacked formal training on the facility’s ERP for anhydrous ammonia. Employees informally shared information

636 Unfortunately, the alert, even if made before the date of the incident, would have had little impact on the WFC because the facility was not a member of the ARA. 637 See: http://www.tfi.org/media-center/news-releases/tfis-verbal-statement-presented-nov-15-washington-dc- listening-session-re (accessed on December 29, 2015). 638 See: https://www.osha.gov/chemicalexecutiveorder/EO13650FS-ImprovingChemicalFacilitySafety.pdf (accessed on December 29, 2015). 639 Ibid.

West Fertilizer Company Final Report January 2016 205 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

so that they knew to evacuate as far as possible if such a release occurred. They also knew which emergency numbers to call. However, much of the WFC employee training was hands on and job specific. Thus, a lack of comprehensive emergency planning and response training played a role in how the incident unfolded. In addition, CSB discovered issues with OSHA’s HAZWOPER standard, which too is an integral element of emergency planning. Under the HAZWOPER standard, the WFC was required to develop an ERP for all “hazardous substances.” As defined by the standard, hazardous substances include those covered by EPA or DOT.640 FGAN meets this definition because it is listed in DOT’s Hazardous Materials Table.641 The WFC was therefore required to develop a HAZWOPER ERP, or would be considered exempt if it met another OSHA standard, Emergency Actions Plans (29 CFR 1910.38).642 The HAZWOPER ERP should have addressed pre-emergency planning and coordination with outside parties, personnel roles, lines of authority, training and communication, emergency recognition and prevention, safe distances and places of refuge, site security and control, evacuation routes and procedures, decontamination, and emergency medical treatment and first aid.643 However, no evidence indicated that the WFC developed the HAZWOPER ERP or was considered exempt under the Emergency Action Plans standard for FGAN. Consequently, OSHA cited the WFC after the incident for not providing an FGAN-related HAZWOPER ERP. 8.6 Fire Protection Codes and Standards Fire protection codes and standards generally refer to the most recently developed practices to protect people and property from fire and natural disasters. When adopted by states or local jurisdictions, codes (including building, electrical, plumbing, mechanical, and other codes) represent mandatory regulations. Standards, on the other hand, provide methods to achieve compliance with codes. Both codes and standards must be adopted through some process, usually state-level fire or building codes. The legislature must enact that adoption before a fire protection (or prevention) code or standard applies. Because fire and building codes may also include references to many standards, such standards are generally not adopted separately but instead are included once the fire or building code is adopted. Fire codes specify practices that must be followed; that is, codes are mandatory only if adopted. In contrast, fire protection standards typically refer to practices that, despite their mandatory language, are voluntary unless adopted into law (e.g., as a state fire code). The nation’s leading fire protection codes and standards are issued by the NFPA and the International Code Council (ICC). Both employ a public consensus process to produce model codes and standards that jurisdictions can adopt into law. The NFPA updated its current code for FGAN, NFPA 400 (Hazardous Materials Code) Chapter 11, after the WFC

640 29 CFR 1910(a)(3). 641 49 CFR 172.101. 642 29 CFR 1910.120(q)(1). 643 29 CFR 1910.120(q)(2).

West Fertilizer Company Final Report January 2016 206 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incident to address the conditions that likely led to the FGAN detonation. The ICC’s International Fire Code (IFC) also addresses storage and handling of oxidizing materials. Texas does not have a state-wide fire code and as a result, most fire departments in the state have no authority to inspect facilities against, or compel them to follow the safe practices outline in these codes, unless a fire code is adopted at the county or city level. In July 2015, the Texas Department of Insurance did adopt NFPA 1 (Fire Code) for inspections by the Texas State Fire Marshal’s office on the complaint of any person. However, even if fire protection standards are incorporated into state and local fire codes, catastrophic incidents can occur when such standards are deficient. CSB reviewed the ICC IFC and NFPA 1 (Fire Code). The IFC is in use or adopted in 42 states,644 and NFPA 1 is adopted statewide in 19 states. CSB also researched fire protection codes on the state, county, and city levels—specifically, in the state of Texas, in McLennan County, and in the city of West. The first part of this section describes the NFPA, with details on the NFPA standard for FGAN. The second part of this section describes the ICC, with details on how it addresses HAZMAT. The third and last part of this section describes fire code regimes on a more local level and analyzes codes in Texas, which can be improved to better protect emergency responders and the public from fire events. 8.6.1 National Fire Protection Association The NFPA is an international nonprofit organization that develops and publishes industry consensus codes and standards, guides, and recommended practices associated with fire prevention and related hazards. Companies can voluntarily comply with NFPA codes and standards or can be required to follow a standard if it is adopted by reference in local, state, or federal laws (e.g., in a local or state fire code). Many of the NFPA codes and standards are also incorporated in OSHA regulations. The EPA Risk Management Program rule and OSHA PSM standard regulations require owners and operators of covered facilities to ensure that facility processes are designed to comply with RAGAGEP, which can include NFPA codes and standards. However, if these consensus codes and standards are deficient, they can lead to insufficient protections. 8.6.1.1 NFPA Code for FGAN AN requirements were first covered by NFPA 490 (Storage of Ammonium Nitrate), which was adopted in

1. In 2010, NFPA withdrew NFPA 490 when it was incorporated into NFPA 400 (Hazardous

Materials Code). NFPA 400 establishes provisions for the storage, use, and handling of a number of hazardous substances, using four broad categories addressing building construction, storage requirements, fire protection systems, and general protections against fire. The 2013 edition had been published and was in effect at the time of the incident. The code has a specific chapter on AN (Chapter 11, “Ammonium Nitrate Solids and Liquids”). This distinguishes AN from other chapters because other chapters of the code are organized by chemical

644 The IFC is also adopted in the District of Columbia, NYC, Guam and Puerto Rico.

West Fertilizer Company Final Report January 2016 207 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

properties (such as “oxidizers” or “unstable or water reactive materials”) that can each apply to several chemicals. The scope of Chapter 11 covers “the storage, use, and handling of solid or liquid AN” in quantities exceeding 1,000 pounds. The chapter does not include FGAN manufacturing operations or the composition of FGAN designated as DOT hazard Class 1 explosives. The NFPA 400 code includes provisions for indoor and outdoor storage, fire protection systems, and general use; annexes offer additional guidance. In addition, the maximum allowable quantity (MAQ) designation is used in building and fire codes when addressing the storage, handling, and use of HAZMAT. The MAQ is integral to the NFPA 400 approach. It includes provisions for classifying materials, determining their MAQs, and adding other protective features if the intention is to use greater quantities of material. When evaluating the provisions in NFPA 400 (2013 Edition) against the factors that likely contributed to the WFC incident, CSB found code deficiencies concerning scope, building design, storage practices, and fire prevention and firefighting response for facilities that store bulk FGAN. However, it is important to note that the WFC would not have been required to comply with the code at the time of the incident unless the authority having jurisdiction enforced it retroactively. The WFC facility was constructed in 1962, so the requirements of NFPA 400 did not apply. Nonetheless, in response to some of the lessons learned from the WFC incident, CSB and other agencies and organizations participated in meetings with the NFPA Technical Committee on Hazardous Chemicals to provide input on the next revision of NFPA 400 (2016 Edition). A significant effort of the NFPA Technical Committee focused on addressing the requirements for existing FGAN storage facilities covered under NFPA 400 because the previous editions had primarily covered requirements for new facilities.645 As discussed, the wood construction of the WFC warehouse and bins that stored FGAN not only assisted in the rapid spread of the fire but also increased the sensitivity of the material that led to the detonation. In addition, the WFC warehouse had no installed fire detection or suppression systems, allowing the fire to spread through the building. If a building fire detection system had been operational, the early stages of the fire possibly could have been extinguished. Furthermore, sprinklers could have extinguished the fire before it could heat the FGAN pile sufficiently to produce a detonation. Similar to the OSHA Explosives and Blasting Agents standard, NFPA 400 (2013 Edition) allowed wood and combustible construction materials for bulk storage bins for FGAN as long as the bins were “protected against impregnation by FGAN.” The code noted in an annex that sodium silicate, epoxy coatings, or polyvinyl chloride (PVC) coatings were acceptable means to achieve this protection. However, the method used to coat the wood to resist FGAN impregnation does not prevent a fire. The presence of combustibles during a fire can create explosive conditions within a building that stores bulk FGAN. NFPA 400 (2016 Edition) now prohibits the use of combustible materials for all construction and bins at new facilities, even when coatings are applied to protect against FGAN impregnation.

645 Pearce, Nancy. “Safer Storage.” NFPA Journal, May 1, 2015.

West Fertilizer Company Final Report January 2016 208 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

However, the 2016 revisions to NFPA 400 do not apply the same requirements to prohibit combustible construction at existing facilities. The NFPA was challenged to reasonably specify construction requirements for facilities with combustible construction, which comprise the majority of FGAN storage facilities.646 To address existing facilities, NFPA 400 (2016 Edition) contains the new Section 11.1.5, “Protection of Existing Buildings.” This includes requirements that apply retroactively, where adopted, for existing buildings with combustible content. Facilities are required to install automatic fire sprinkler and detection systems. Activation of the fire detection system must automatically initiate an audible and visual alarm at the facility as well as a public notification or alert system to warn individuals located within one mile of the facility that they need to evacuate. Another shortcoming of NFPA 400 (2013 Edition) lies in Annex E, “Properties and Uses of Ammonium Nitrate and Fire-Fighting Procedures,” which called for large volumes of water to be applied as quickly as possible unless the fire reached “massive and uncontrollable proportions,” when responders were advised to evacuate and withdraw to a safe location. CSB found this guidance to be vague because the user had to determine when to categorize a fire as “massive and uncontrollable” and when to make the decision to evacuate rather than attempt to extinguish the fire. Because of FGAN’s unpredictable nature, immediate evacuation should be the first action for responders, using a minimum evacuation distance calculated in advance based on the quantity of FGAN stored. The 2013 edition of NFPA 400 did not require pre- planning, but given the events that unfolded during the WFC response, firefighters should also have a pre- incident plan to facilitate quick and effective decision making when responding to an FGAN fire. NFPA 400 (2016 Edition) now requires new and existing facilities to have emergency action plans that clearly state that “fire potentially affecting FGAN storage beyond the initial (incipient) stage shall not be approached by facility personnel.”647 The emergency plan must also specify whether the FGAN storage facility has a sprinkler system and whether it is constructed of combustible materials. For new facilities, the plan must establish a safe evacuation distance based on an approved648 analysis of potential offsite consequences. If no analysis has been performed, a distance of one mile should be used. The revised Annex E of NFPA 400 (2016 Edition) offers additional guidance to firefighters, including information on the conditions that cause FGAN explosions. The guidance states that only incipient fires in FGAN storage areas (or in vehicles transporting FGAN) should be attacked by using manual fire extinguishing methods that require a human operator.649 Firefighters should withdraw to a safe distance and allow the structural fire to burn to completion once it progresses beyond the incipient stage.650

646 Ibid. 647 NFPA. NFPA 400: Hazardous Materials Code, 2016 Edition. Quincy, MA: NFPA, 2016. 648 Plan approvals are performed by the authority having jurisdiction, such as the fire department or fire marshal. 649 NFPA. NFPA 400: Hazardous Materials Code, Annex E, 2016 Edition. Quincy, MA: NFPA, 2016. 650 NFPA 400 (2016 Edition) states that “responses to incipient releases of hazardous materials where the material can be absorbed, neutralized, or otherwise controlled at the time of release by employees in the immediate release area, or by maintenance personnel, shall not be considered emergency responses as defined within the scope of this code.”

West Fertilizer Company Final Report January 2016 209 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Following the WFC incident, the NFPA-sponsored Fire Protection Research Foundation651 (the Foundation) conducted a study652 to determine the adequacy of the separation distances prescribed for hazardous materials in NFPA 400, with a greater focus on FGAN. NFPA 400 specifies separation and clearance distances for newly constructed hazardous chemical storage from other on-site equipment and occupied buildings. The Foundation’s technical committee was made up of industry representatives, and research and engineering organizations that conducted literature reviews of existing methodologies to determine safe separation distances and testing to characterize the effect of AN detonations on personnel and processes near an explosive event. The study included reviews of various sources for risk-based and consequence- based methodologies for determining the safe distances as well as established distance tables. To study the adequacy of the existing separation distances in NFPA 400, the Foundation commissioned explosive testing to characterize the effects of nearby processes and personnel using a 3,000 pound ANFO donor charge to simulate an explosion. As part of the analysis, blast consultants compared the blast pressures and data recorded at various distances from the donor charge and compared the effects to the recommended distances for Class 3 Oxidizers in detached unsprinklered storage prescribed in NFPA 400 Chapter 15 (Oxidizer Solids and Liquids). The study concluded that the process-to-process separation distances for solid AN may be inadequate to provide protection against blast effects, but the process-to-personnel separation distances may be acceptable if personnel are inside buildings located at prescribed distances. However, the study concluded that additional testing and analysis is necessary to validate the absolute safety of personnel based on variations in processes, design, and potential reactants. The purpose of the project was to provide guidance to the NFPA technical committee for the development of technically-based separation distances for storage. Thus, the Foundation recommends a technical- based approach to establish safe separation distances that takes into account the risks associated with a known material and process, as well as the potential consequences of a catastrophic event involving that material. 8.6.2 International Code Council Like the NFPA, the ICC is an international nonprofit organization that develops and publishes consensus codes and standards. In addition to publishing the IFC, the ICC also produces the International Building Code (IBC), which is in use or adopted in 50 states. Jurisdictions can adopt the model codes by reference. The ICC views its codes as “companion” documents that work across disciplines (e.g., building construction, fire protection, mechanical systems, plumbing, zoning). Thus, a regulation for HAZMAT storage will affect building code requirements for construction, mechanical code requirements for

651 The Fire Protection Research Foundation is an affiliate of NFPA and plans, manages, and communicates research on fire safety issues in collaboration with academics, laboratories, and industry. 652 See: http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 210 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ventilation, plumbing code requirements for drainage, and fire code requirements for operations and handling. The codes are cross-referenced for ease of use. The ICC requirements for protecting AN from fire exposure and explosion are based on material properties, quantities stored, and storage and handling conditions. The ICC defines storage as “the keeping, retention or leaving of hazardous materials in closed containers, tanks, cylinders, or similar vessels; or vessels supplying operations through closed connections to the vessel.”653 Therefore, despite common references to the WFC FGAN as “in storage,” the IFC would interpret this application as “handling,” which it defines as “the deliberate transport by any means to a point of storage or use,” or as “use,” which it defines as “placing a material into action, including solids, liquids and gases.”654 The IFC does not have a separate chapter for AN. The IFC refers to NFPA 400 when AN intended for explosive materials is stored, handled, or used. Otherwise, AN is treated as an oxidizing agent, subject to the general requirements for each oxidizer class in IFC Chapter 63 (Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids) and Chapter 50 (Hazardous Materials). 8.6.3 State Fire Codes Without a comprehensive federal standard, states must rely on their own regulations to oversee HAZMAT storage. Most states have enacted fire codes or have adopted model fire codes. These codes typically include HAZMAT storage and emergency planning provisions. However, at the time of the incident, Texas had no state fire code, and the state still has no such code as of publication of this report. The majority of states have adopted model fire codes through referencing them into law.655 Two recognized model fire codes are the IFC and NFPA 1. Both establish minimum requirements for fire prevention and protection systems. Some states and municipalities have developed their own fire codes, using model codes as a guide. New York City updated its fire code in December 2007, marking its first major revision since 1913.656 After investigating an industrial waste explosion and fire in 2001 in the Chelsea district of Manhattan, CSB issued a recommendation to the Mayor and City Council to better address HAZMAT.657 The city developed its own code, borrowing heavily from the IFC (2003 Edition) but requiring some more stringent provisions. States could potentially apply other IFC chapters for storing bulk FGAN. For example, IFC Chapter 63 (Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids) includes provisions for storage and use of oxidizing materials, such as FGAN. This chapter says that indoor storage of oxidizers should be located in a detached building with an automatic sprinkler system and smoke detection systems. Additional

653 ICC. Chapter 50, Section 5002.1. International Fire Code, 2015 Edition. Washington, DC: ICC, 2015. 654 Ibid. 655 ICC. “International Code Adoption.” International Fire Code. Washington, DC: ICC, 2014. See: http://www.iccsafe.org/gr/Pages/adoptions.aspx (accessed on November 6, 2014). 656 Cassono, Salvatore. “A New Fire Code for New York City.” Building Safety Journal (July–August 2008). 657 CSB. “Chemical Waste-Mixing Incident: Kaltech Industries Group, Inc.” CSB Investigation Report, April 25, 2002.

West Fertilizer Company Final Report January 2016 211 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

requirements for storage configuration, separation barriers, and explosion control depend on the class of oxidizer, of which the IFC names four. NFPA 1 includes similar requirements for oxidizers in Chapter 70 (Oxidizer Solids and Liquids). This chapter directs users to follow NFPA 400, which also incorporates similar building and fire protection requirements for indoor storage of oxidizers. The WFC did not voluntarily implement any of the provisions from the oxidizer chapters of the IFC or NFPA 1, nor were they required to do so by the authority having jurisdiction. The WFC did not install an automatic sprinkler or smoke detection system in the fertilizer warehouse, nor did it store its FGAN in a separate building, away from combustibles. The location where the fire originated was adjacent to the FGAN bin, and no fire-rated wall separated the rooms. The WFC was not subject to code provisions because none of the relevant jurisdictions—not the state of Texas, McLennan County, or the city of West—had adopted a fire code. Texas affords counties and municipalities the discretion to adopt or develop fire codes. However, state law limits which counties can adopt such codes. Only a county with a population of more than 250,000 (and counties adjacent to a county with a population of more than 250,000) may adopt a fire code. Moreover, even if such a county does adopt a fire code, that code applies only to the unincorporated areas of the county. Cities within the county can adopt the county fire code, not adopt a fire code, or develop their own fire codes. Adoption of a city fire code does not affect any unincorporated areas outside the city. Although many major Texas cities have adopted fire codes, the pattern is inconsistent. As of September 2014, 43 facilities stored FGAN in 36 Texas counties. Only one of those 36 counties has a population of more than 250,000 people,658 and only six of those counties are adjacent to counties with populations that equal or exceed 250,000. Consequently, 79 percent of the 43 FGAN storage facilities are located in Texas jurisdictions that, under state law, cannot adopt a fire code. According to the 2010 census, the population of McLennan County was 241,281. Thus, the county fell below the population threshold. However, one of the seven adjacent counties had a population of more than 250,000. Accordingly, McLennan County had the authority to adopt a fire code, but this was not required. It is also important to note that the WFC facility was only partially within city limits. The fertilizer warehouse was located in an unincorporated area of West. If McLennan County had adopted a fire code, it would have applied to the WFC fertilizer warehouse only. Furthermore, if West had decided to adopt its own fire code, it would have applied to the entire WFC facility except for the warehouse. Although efforts have been made to make a state fire code in Texas mandatory, such endeavors have not been successful. The Texas Legislature debated the issue of adopting a state fire code at least as far back as 1978. Legislative committee reports between 1978 and 1984 from the Texas House of Representatives and the Texas State Senate identified the severe fire problem, and one report contended that the losses from fires exceeded “loss of life and property” from “all natural disasters combined” in the state.659 After

658 U.S. Census Bureau. 2010 U.S. Census. Washington, DC: U.S. Census Bureau, 2011. 659 Texas House of Representatives Committee on Business and Industry. “Interim Report,” October 13, 1978.

West Fertilizer Company Final Report January 2016 212 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

hearing multiple testimonies in public hearings across the state, a committee report concluded that Texas was “one of the leading states in property loss and lives lost because of fire.”660 This same committee report also found that such major losses occurred not in the most populated municipalities that had adopted fire and building codes, but in the unincorporated areas where fire codes did not apply.661 It stated that unincorporated areas were particularly problematic when annexed into a municipality because the city assumed responsibility for fire-prone buildings that were not built to code specifications.662 Because growth areas in counties are inevitable targets for municipal annexation, if counties are not granted proper regulatory authority, cities inevitably inherit the problems thus created. The Texas legislative committee reports also identified that without a state fire code, the State Fire Marshal cannot fulfill the duty of minimizing fire risks. One report noted that the State Fire Marshal has no authority to adopt a fire code, despite holding responsibility for the inspection of state-owned and state-leased buildings. Without a code, the State Fire Marshal is unable to set criteria to assess a fire hazard and enforce corrective actions. Moreover, although the local fire marshals hold authority to inspect facilities in their jurisdictions, without a fire code, they cannot enforce safety measures that are not legally required. The Texas Fire Protection Standard Committee, a special interim legislative committee, studied the fire problem and issued an interim report to the 69th session of the Texas Legislature in December 1984.663 This committee confirmed many of the findings above.664 In addition, the committee analyzed NFPA national fire data from 1978 to 1982.665 These data indicated that the per capita number of fires, deaths, and injuries and the dollar loss resulting from fire were all lower in states with fire codes than in those without them.666 The data also suggested that education alone to minimize human errors was insufficient to reduce fire loss because fire causation was mostly attributable to improper structural design and equipment malfunction.667 This committee also received extensive testimony from around the state indicating that the loss of life in the volunteer firefighter service was primarily “because there were no codes.”668 Over the years, proposed bills in the Texas Legislature for adoption of a fire code failed to gain support. In 1977, the Texas House of Representatives addressed a proposed bill to enforce a “fire prevention code” that would apply only to unincorporated areas and would be enforced by the state and county fire

660 Texas Senate Subcommittee on Consumer Affairs. “Final Staff Recommendations,” December 1980. 661 Ibid. 662 Ibid. 663 Texas Fire Protection Standards Committee. “Interim Report to the 69th Texas Legislature.” December 1984. 664 Ibid. 665 Ibid. 666 Ibid. It was noted in the report that the fire loss data had limitations because mandatory reporting requirements were not consistent throughout the nation. This limited statistical analysis nonetheless pointed out principal causes of fires. 667 Ibid. 668 Ibid.

West Fertilizer Company Final Report January 2016 213 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

marshals.669 In 1997, 20 years later, another proposed Texas House bill sought adoption of a code that would apply to (1) buildings located in unincorporated areas that have not adopted a fire code, (2) municipalities that did not adopt a fire code, (3) public assembly buildings in municipalities that have not adopted either model code, and (4) state-owned buildings.670 Neither bill progressed out of committee. In 1989, the Texas Legislature granted limited authority to counties with a population of 250,000 or more to adopt and enforce a fire code.671 This authority was later amended in 1997 to address growing populations and include counties adjacent to those with a population of at least 250,000.672 The failure to mandate a statewide fire code left some counties such as McLennan County without minimum fire protection measures. The absence of a state-wide fire code and the local population restrictions for code adoption remain an important issue for CSB. However, since the WFC incident, Texas has amended the administrative code to provide the State Fire Marshal with greater authority to enforce some NFPA codes at FGAN storage facilities, as well as to enter, upon complaint, and inspect facilities against the provisions of NFPA 1. Though the adoption did not create a state-wide fire code, it allows for the State Fire Marshal to inspect against a more comprehensive standard than NFPA 101 (Life Safety Code) that Texas previously adopted.673 Additional changes to the Texas State Fire Marshal’s authority to inspect FGAN facilities were enacted as part of House Bill 942 (described in Section 8.7.2). In addition, the Texas Agriculture Code was amended to impose additional requirements on FGAN retailers (described in Section 8.7.1). 8.7 Post-Incident State and Local Regulatory Developments Since the 2013 WFC incident, state and local legislators in Texas have attempted to improve FGAN safety through regulatory change. These efforts represent important first steps in recognizing the potential catastrophic hazards of FGAN under certain conditions. However, they are not entirely adequate. For example, when Texas House Bill (HB) 942 became law, it simply codified existing state hazardous chemical reporting requirements. Also, although the revised Texas Commercial Fertilizer Rules establish requirements for FGAN to be separated by at least 30 feet from combustible and flammable materials,674 this requirement is much less restrictive than the newly revised NFPA 400

669 65th Texas Legislative Session. House Bill (HB) 325, “An act relating to the promulgation and enforcement of a state fire prevention code for unincorporated areas of the state by the State Board of Insurance.” 670 75th Texas Legislative Session. HB 2922, “An act relating to a statewide building and fire code.” 671 71st Texas Legislative Session. HB 2252, “An act relating to the authority of the commissioners courts of certain counties to adopt a fire code for certain buildings in unincorporated areas.” 672 75th Texas Legislative Session. State Bill (SB) 10, “An act relating to the authority of certain counties to adopt and enforce a fire code.” 673 See: https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1 &p_tac=&ti=28&pt=1&ch=34&rl=303 (accessed on December 30, 2015). 674 Texas Administrative Code, Title 4, Chapter 65, Section 65.6(d)(3). See: http://otscweb.tamu.edu/Laws/PDF/CommercialFertilizerRules.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 214 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard and might not fully eliminate the risk of molten FGAN contamination during a fire. This section includes a discussion of the Texas Commercial Fertilizer Rules, a general analysis of HB 942 as well as a comparison of HB 942 to other legislation pending in committee as of this report’s publication date, and a review of an Athens, Texas, ordinance that mandates a ban on the bulk storage of FGAN. 8.7.1 Texas Commercial Fertilizer Rules The Office of the Texas State Chemist (OTSC) regulates the sale of FGAN and FGAN-containing materials. Enacted by 2007 amendments to the Texas Agricultural Code Section 65.6, the law places limits on FGAN sales. It establishes requirements for registration certificates issued by the Texas Feed and Fertilizer Control Service as a condition of selling (or offering to sell) FGAN.675 To reduce theft or terrorism, the requirements focus on security measures for FGAN storage and on recordkeeping to identify people who purchase FGAN. In June 2014, Texas revised the provisions of its Commercial Fertilizer Rules.676 The revised rules require FGAN facilities to file Top-Screen information under the federal CFATS rule as well as EPCRA Tier II information with the Texas Department of State Health Services as a condition for receiving an annual certificate of registration to sell FGAN. The 2014 revisions also require OTSC to inspect FGAN storage areas. Such inspections are to confirm that combustible and flammable materials, such as potential sources of ignition—fuels, oils, hay, or other organic materials—are separated from FGAN by at least 30 feet. If facilities do not comply with these requirements, OTSC can deny, suspend, or revoke annual certificates to sell (or offer to sell) FGAN. 8.7.2 Texas House Bill 942 The summary of Texas HB 942 says that it is an “act relating to the storage of certain hazardous chemicals; transferring enforcement of certain reporting requirements, including the imposition of criminal, civil, and administrative penalties, from the Department of State Health Services to the Texas Commission on Environmental Quality.” It became law on June16, 2015.677 The law bars facilities from storing FGAN with any nonfertilizer materials, requires that FGAN be stored at least 30 feet away from combustible materials, moves FGAN regulation from the Department of State Health Services to the TCEQ, allows the State Fire Marshal to inspect FGAN facilities, gives fire departments access for pre-fire planning assessments, and requires correction of hazardous conditions within 10 days.678 Although this law is an effort by state legislators to better regulate FGAN, it is not entirely adequate. For example, the requirement that FGAN storage be at least 30 feet from combustible materials was already required by the Texas Commercial Fertilizer Rules, as amended in June 2014 (and discussed in Section

675 See: http://www.tlc.state.tx.us/pubssoe/80soe/80soe.pdf (accessed on December 29, 2015). 676 See: http://otscweb.tamu.edu/Risk/AmNitrate/PDF/AN-Compliance-Guide.pdf (accessed on December 29, 2015). 677 Ibid. 678 See: http://kwbu.org/post/abbott-signs-bill-tackles-ammonium-nitrate-storage (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 215 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7.1), a year before HB 942 became law. During a May 2015 meeting of the Texas Senate Committee

on Natural Resources and Economic Development, Senator Brian Birdwell, who sponsored the bill, affirmed this fact. He said, “To be clear this is not a new regulatory scheme. HB 942 simply codifies existing regulations regarding reporting of hazardous chemicals. These are existing regulations which 100 percent of FGAN storage facilities in this state [must currently comply with].”679 A related bill, HB 417, would impose penalties for improper FGAN storage and would create rulemaking authority over FGAN facilities.680 The bill states, “The commissioner of insurance, after consultation with the state fire marshal, by rule shall adopt fire protection standards for FGAN storage facilities, including standards for the storage of FGAN at those facilities.”681 State Representative Joe Pickett, the author of HB 417, told the Texas House Committee on Environmental Regulation in April 2015 that “the rulemaking authority is a way to make changes without the Legislature being in session,” explaining that the Commissioner of Insurance would work with state agencies.682 This regulatory authority distinguishes HB 417 from HB 942. Although HB 417 does not necessarily establish new regulations, it gives the Commissioner of Insurance an opportunity to do so. As of December 2015, however, this bill remains pending in committee.683 8.7.3 Athens City Ordinance After the May 29, 2014, FGAN-related fire at the East Texas Ag Supply facility in Athens, Texas (discussed in Section 7.4), the city of Athens initiated efforts to prevent similar events. On May 29, 2015, Athens passed an ordinance that banned bulk storage of FGAN and anhydrous ammonia.684 The ordinance (No. O-24-14) states in simple terms, “Commercial Fertilizer Storage or Manufacturing Facilities used to produce, transfer, store, or offer for sale Bulk FGAN, Bulk FGAN Material and/or Anhydrous Ammonia shall not be allowed in any zoning district in the City.” A “commercial fertilizer storage or manufacturing facility” is defined as one that “stores, mixes, or manufactures 10,000 or more pounds of FGAN and/or anhydrous ammonia and/or is required to register with the Texas Feed and Fertilizer Control Service.” The ordinance also streamlines chemical reporting and allows volunteer fire departments to inspect facilities.685 However, this ordinance does not apply retroactively to the facilities that existed when the ordinance was enacted.

679 Ibid. 680 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on December 29, 2015). 681 Texas HB 417, “An act relating to information regarding the storage of certain hazardous chemicals; providing penalties.” 682 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on December 29, 2015). 683 See: http://txlege.texastribune.org/84/bills/HB417/ (accessed on December 29, 2015). 684 See: http://www.kltv.com/story/29192400/one-year-after-fire-city-of-athens-state-make-changes-in-ammonium- nitrate-storage (accessed on December 29, 2015). 685 Ibid.

West Fertilizer Company Final Report January 2016 216 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 8 Industry Standards

Since the WFC incident, the fertilizer industry has implemented initiatives to prevent such an incident from reoccurring. In February 2014, TFI and the ARA, two primary agricultural trade associations, developed and issued Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Fertilizer Retail Facilities (or Safety and Security Guidelines).686 This public document explains the OSHA Explosives and Blasting Agents standard, but also provides more specific guidance. In March 2014, TFI and the ARA initiated an FGAN stewardship program. Participation involves a voluntary assessment every three years of facility safety and security, focusing on FGAN and anhydrous ammonia. 8.8.1 The Fertilizer Institute (TFI) TFI is a major trade association for the fertilizer industry.687 TFI members include BP Energy Company, Dow AgroSciences, DuPont Sulfur Products, JP Morgan, Mitsubishi International Corporation, Shell Sulphur Solutions, and Union Pacific Railroad.688 TFI lists security, energy, the environment, and worker health and safety as concerns to its members.689 It also lists product safety stewardship as one of its key issues.690 TFI offers tools to enhance the safety and security of products and equipment (discussed in Appendix E) across the supply chain.691 Post-WFC incident tools include the Compliance Assessment Tool, the Safety and Security Guidelines, and the ResponsibleAg program. Each of these is discussed in the next sections. 8.8.1.1 Compliance Assessment Tool The Asmark Institute, a private not-for-profit educational organization that is a resource center for the agricultural retail industry, developed the web-based Compliance Assessment Tool.692 With regulatory compliance consistently cited during the last 18 years as one of the top 10 threats to the long-term viability of agricultural retail facilities, the Compliance Assessment Tool is meant to assist the agricultural retail industry.693 This tool helps personnel at facilities, terminals, warehouses, and farm equipment dealers in identifying the regulations that apply to their specific sites. 694 The Compliance Assessment Tool evaluates onsite compliance efforts.695 Through accessing the website, entering facility

686 ARA, TFI. “Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Fertilizer Retail Facilities,” February 2014. 687 See: http://www.tfi.org/about (accessed on December 29, 2015). 688 See: http://www.tfi.org/about/membership-list (accessed on December 29, 2015). 689 See: http://www.tfi.org/about (accessed on December 29, 2015). 690 See: https://www.tfi.org/advocacy/stewardship (accessed on December 29, 2015). 691 See: http://www.tfi.org/safety-and-security-tools (accessed on December 29, 2015). 692 See: http://www.tfi.org/compliance-assessment-tool (accessed on December 29, 2015). 693 See: https://www.asmark.org/Compass/ComplianceAssessmentTool/ (accessed on December 29, 2015). 694 Ibid. 695 Ibid.

West Fertilizer Company Final Report January 2016 217 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information, and describing scope of operations, the user can download a specific compliance assessment document and then complete a worksheet.696 Periodic use of the tool is encouraged to help control risk and to support compliance efforts.697 8.8.1.2 Safety and Security Guidelines for the Storage and Transportation of FGAN at Fertilizer Retail Facilities TFI and the ARA created the Safety and Security Guidelines.698 TFI’s website notes that “the document was created to fill the void in emergency response guidelines specific to FGAN fertilizer at retail fertilizer facilities.”699 The guidelines outline best practices for safe and secure storage and transport of FGAN.700 They also summarize storage and handling regulations for FGAN facilities as well as recommendations for first responders.701 Moreover, they provide rules for transporting FGAN via truck, highway, rail, and barge.702 8.8.1.3 ResponsibleAg Created by TFI and the ARA in 2014, ResponsibleAg is a third-party auditing program for fertilizer retailers.703 Although any business that stores or handles fertilizer product is eligible to participate in the ResponsibleAg Certification Program, the first three years of the program focus on companies that store and handle AN and/or anhydrous ammonia fertilizer.704 Using federal requirements for the storage and handling of fertilizer products, ResponsibleAg has compiled a checklist of more than 320 questions for auditing each participating facility.705 The participating facility determines the audit scope; however, all participants must have a “base audit.”706 A participating facility may become ResponsibleAg certified only if it passes the initial audit or if it takes all necessary steps to correct the issues identified during the audit and documented in the facility’s corrective action plan.707 ResponsibleAg also allows its participating suppliers to access the list of participating facilities that have successfully completed the assessment and earned certification.708 This is important because it allows suppliers to determine whether prospective buyers have successfully completed the ResponsibleAg assessment, which thereby promoted federal regulatory compliance. This approach enables

696 Ibid. 697 Ibid. 698 See: http://www.tfi.org/ammonium_nitrate_guidelines (accessed on December 29, 2015). 699 Ibid. 700 Ibid. 701 Ibid. 702 Ibid. 703 Ibid. 704 See: http://www.responsibleag.org/About.cgi (accessed on December 29, 2015). 705 Ibid. 706 Ibid. 707 These corrective actions must be certified by ResponsibleAg, usually during a verification audit. 708 See: https://www.responsibleag.org/FAQ.cgi#Link02 (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 218 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ResponsibleAg members to engage in some elements of product stewardship (as discussed in Section 8.8.3). Notably, CF Industries and EDC, the only AN fertilizer manufacturers in the United States, are listed as ResponsibleAg participants.709 Appendix F includes additional information on the ResponsibleAg program process. 8.8.2 Agricultural Retailers Association (ARA) The ARA is also a major trade association for the fertilizer industry.710 It represents agricultural retailers and distributors across the United States on legislative and regulatory issues.711 ARA members represent the majority of agribusinesses in the United States.712 The ARA works with Congress to create legislation, and updates federal agencies and legislators on important issues affecting the industry.713 The ARA offers programs and services to keep its members informed of important industry issues.714 8.8.3 Product Stewardship As of this report’s publication, only two companies in the United States, CF Industries and EDC, manufacture FGAN.715 Fertilizer manufacturers can promote the safe storage and handling of FGAN by distributors and retailers by implementing product stewardship programs. According to the Center for Chemical Process Safety, product stewardship encourages safety and health in the design, manufacture, marketing, distribution, handling, use, and disposal of chemical products.716 Responsibility for safely managing the product is shared throughout the supply chain and the product life cycle. Because it is a self-regulated program, product stewardship can only be as effective as industry intends and allows. CSB determined that components of an effective product stewardship program should generally include the following elements for each product: • Identifying and communicating all product hazards among manufacturers, distributors, and retailers. • Providing supplemental technical information on safe handling practices for the product (furnished by manufacturers and/or distributors) to other distributors and/or retailers. • Establishing accountability for distributors and retailers to promote safe handling of a product throughout the chain of customers. • Performing monitoring and auditing, such as onsite visits to the locations where the product will be stored or used.

709 See: https://www.responsibleag.org/ParticipantList.cgi (accessed on December 29, 2015). 710 See: http://www.aradc.org/ARADC/About/About/ (accessed on December 29, 2015). 711 See: http://www.aradc.org/becomeamember/ (accessed on December 29, 2015). 712 Ibid. 713 Ibid. 714 See: http://www.aradc.org/about/about (accessed on December 29, 2015). 715 The WFC also reported receiving imported AN from foreign manufacturers between 2006 and 2013. 716 Center for Chemical Process Safety. Guidelines for Safe Handling of Powders and Bulk Solids. New York: Center for Chemical Process Safety/AIChE, 2005: 521.

West Fertilizer Company Final Report January 2016 219 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Developing mechanisms for outreach to communities near the facilities where the products are stored or used. Information sharing is an important component of product stewardship. When information about product hazards or details about the storage practices of a certain facility are known, people and companies dealing with the product or with the facility have the opportunity to effectively manage the risks associated with that product. The same logic applies to the management of FGAN. The WFC incident highlighted the need for greater awareness of the unpredictable nature of AN and the conditions under which it can detonate. Two industry programs, Responsible Care and ResponsibleAg, both advocate information sharing. Accordingly, the programs have serious product stewardship potential. As described in Section 8.8.1.3, the joint TFI-ARA ResponsibleAg program currently addresses some aspects of product stewardship. In particular, fertilizer sellers (i.e., manufacturers and/or distributors) may elect to access the list of ResponsibleAg-participating facilities to determine assessment completion and certification of prospective buyers (i.e., distributors and/or retailers). By doing so, the seller verifies that the buyer safely stores fertilizer (or at least has a record of safely storing fertilizer). Similarly, the American Chemistry Council’s (ACC) Responsible Care initiative includes information sharing in its product stewardship program. Participation in Responsible Care is a condition of membership for ACC members.717 The program specifies 11 management practices and focuses on leadership commitment, accountability and management, prioritization of products, product information, risk characterization, management of new information, product safety management, product design and improvement, value chain communication, cooperation and outreach, information sharing, and performance assessment and continual improvement.718 Serious participation in product stewardship programs such as ResponsibleAg and Responsible Care can promote the safe handling and storage of domestically manufactured FGAN. This is especially true for FGAN because there are only two companies, CF Industries and EDC, that manufacture FGAN in the United States. As such, domestically manufactured FGAN product can be linked to one of these two companies. CF Industries and EDC are already members of ResponsibleAg. Product stewardship programs such as ResponsibleAg can ensure that FGAN management practices, starting with FGAN manufacturers CF Industries and EDC, are subject to greater scrutiny. However, it is also important to make sure that distributors and retailers handle and store the product safely. Because responsibility for a chemical product does not always end after it is manufactured, it is important that manufacturing companies know how the product is handled and stored once it leaves the production site. In other words, a manufacturer cannot simply confirm that its direct buyer safely stores and handles the manufacturer’s product because that buyer may in turn sell to another buyer that does not store or handle the product safely. The same reasoning applies to communicating product hazards. Of course, requiring the manufacturer to communicate the hazards of its product to its buyer is surely a step in the

717 See: http://responsiblecare.americanchemistry.com/ (accessed on November 30, 2015). 718 See: http://responsiblecare.americanchemistry.com/Responsible-Care-Program-Elements/Product-Safety- Code/Responsible-Care-Product-Safety-Code-PDF.pdf (accessed on November 30, 2015).

West Fertilizer Company Final Report January 2016 220 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

right direction, but the buyer must also communicate the same hazards to its buyers, if any. Otherwise, catastrophic incidents can occur. Importantly, therefore, these distribution chains must not break; effective communication must endure from top to bottom. To ensure continuity of communication throughout the supply chain, industry should voluntarily take an active role. Because government agencies cannot reasonably be expected to routinely inspect every FGAN facility, industry’s product stewardship programs must play a significant role in making sure that this top-to-bottom approach is implemented. Product stewardship offers an important opportunity for industry to further manage risk, beyond providing SDSs to retailers. Although CF Industries and EDC use different business models, both have executed initiatives that ascribe to product stewardship elements post-incident. 8.8.4 Efforts to Address FGAN Hazards Post-Incident Since the WFC incident, both CF Industries and EDC have made additional efforts to make sure that their FGAN product is stored and handled safely as it moves out of their manufacturing facilities. CF Industries has implemented a certification process for its customers (purchasing organizations as well as facilities that receive FGAN deliveries) to confirm that customers communicate both the hazards and safe storage and handling practices of FGAN. As of December 31, 2014, CF Industries requires existing facilities to certify through a signed certification letter that they are in compliance with applicable guidelines and regulations before they can receive FGAN product. All new purchasing organizations and sites must also return the signed certification letter before receiving FGAN from CF Industries. Specifically, the letter requires senior responsible officials at both the purchasing organization and the delivery facility to certify that they are either in compliance with, or legally exempt from, 17 items. These items include, for example, attestations that: • The purchasing organization provided the FGAN SDS developed by CF Industries to all of its sites. • The purchasing organization and site provided copies of the CF Industries FGAN SDS to all employees. • The site complies with OSHA requirements for FGAN storage. • The site filed EPCRA and SARA Tier II Chemical Inventory Reports with appropriate emergency response organizations. • The site maintains and follows an emergency response plan and written procedures for the safe handling of AN. By signing the certification statement, officials at the purchasing organization certify that all relevant personnel at the site are aware of FGAN safety handling requirements and that adequate procedures are in place to comply with all 17 listed items. The certification packet also includes an up-to-date FGAN SDS developed by CF Industries and the TFI-ARA guidance for FGAN. CSB determined that this process could provide a reasonable degree of assurance that FGAN product hazards are being communicated as the product is delivered to new and existing customers and, most important, that those customers comply

West Fertilizer Company Final Report January 2016 221 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with applicable regulations and practices in order to receive product. If CF Industries does not receive a completed and signed certification statement, it will not sell FGAN product. Although not in the form of a certification statement program, EDC also took steps to enhance the safety of its FGAN product post-incident. EDC updated its SDS for FGAN to include more information regarding firefighter precautions and added a reference to NFPA 400.719 Moreover, EDC developed a product information bulletin to accompany its SDS to emphasize FGAN hazards and safety measures.720 To better communicate FGAN hazards in response to the WFC incident, EDC conducted mass mailings to all of its customers. The mailings included the following: • EDC’s revised SDS (September 2013 and November 2014 versions). • TFI-ARA Safety and Security Guidelines for Ammonium Nitrate. • OSHA Guidance on Ammonium Nitrate Storage Requirements in 29 CFR 1910.109(i). In addition, EDC repaired and replaced wooden bins at its own owned-and-operated retail site locations to ensure compliance with OSHA requirements regarding the protection of bins against AN impregnation. In gathering information regarding these post-incident safety initiatives, CSB found that CF Industries and EDC operate under different business models, despite their status as the only two manufacturers of FGAN in the United States. CF Industries does not directly sell to retailers, but may deliver directly to retailers at the instruction of a direct customer. It delivers FGAN only to independently owned and operated distributors or their retail customers. CF Industries does not own any of the distribution facilities to which it ships product, and it does not sell directly to retailers, although it might deliver directly to retailers at the instruction of a direct customer. Unlike CF Industries, EDC delivers some FGAN product to its own owned-and-operated distribution sites. In this regard, the business models of CF Industries and EDC differ. EDC produces FGAN in El Dorado, Arkansas, which is shipped by rail or truck to either (1) its own distribution sites, which operate under the name EDC Ag Products Company, LLC (EDC Ag Products),721 or (2) its larger customers. Approximately 40 percent of the FGAN produced at the EDC Arkansas manufacturing facility is shipped to its 11 EDC Ag Products distributor locations (most in Texas), and approximately 60 percent is sold directly to customers. From the EDC Ag Products distributor locations, FGAN may be sold to other distributors or to retailers or farmers. All of the FGAN sold directly from the EDC manufacturing facility in Arkansas is delivered mainly to dealers, with a small quantity to brokers.

719 See: http://eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No v_2014.pdf (accessed December 29, 2015). 720 Ibid. 721 At the time of the incident, the distribution sites operated under the name El Dorado Chemical. El Dorado Chemical Company and EDC Ag Products Company, LLC are subsidiaries of LSB Industries, a manufacturing and marketing company.

West Fertilizer Company Final Report January 2016 222 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the time of the WFC incident and as long ago as 2004, EDC sold products to International Chemical Company (Inter-Chem), which acted as a trader or supplier of FGAN, among other fertilizer products. Through its Domestic Plant Foods Group, Inter-Chem is a distributor of phosphate, nitrogen, and potash products in the United States.722 Essentially, Inter-Chem served as a broker and consignee of finished fertilizer products to the WFC. Although Inter-Chem did not produce or manufacture the fertilizer product that was sold to the WFC, its role as a broker was significant. Importantly, Inter-Chem functioned as another link in the chain of commerce as the FGAN traveled from manufacturer to retailer through the broker. To better understand the chain of hazard communication involved in this investigation, CSB started at the top with the manufacturers and analyzed the pre-incident SDSs and hazard communication practices of both EDC and CF Industries. Before the WFC incident, EDC provided a copy of its SDS to its customers and to Inter-Chem. The EDC SDS in use at the time of the 2013 WFC incident was last revised in 2011. CSB reviewed the SDS and found that it lacked certain safety information, specifically related to firefighting measures. The 2011 EDC SDS included warnings about the hazards of AN, such as its capability to support combustion and become explosive in the presence of contaminants or when under confinement. Under the firefighting measures section, the SDS instructed firefighters to “flood with water” but did not address the proper way to handle massive and uncontrollable fires, the need to extinguish such fires from a distance, or the possible need for evacuation. In addition, the SDS lacked references to applicable AN safety standards, such as the OSHA Explosives and Blasting Agents standard and NFPA 400 (2010 Edition). On the other hand, the CF Industries pre-incident SDS included a comprehensive list of AN hazards and firefighting measures. Nonetheless, both CF Industries and EDC made changes to enhance the safe handling of their products after the WFC incident. As previously discussed, both U.S. FGAN manufacturers have improved communications with their customers about FGAN hazards and safe storage practices since the WFC incident. CF Industries implemented a program to certify compliance with applicable standards and guidelines as a condition of sale. In contrast, EDC conducted hazard communication in the form of mass mailings, replaced and repaired its own wooden bins at EDC Ag Products facilities, and continues to audit and inspect its retail sites (which it can readily do because EDC owns and operates these retail divisions) to make sure that about 40 percent of its manufactured FGAN is stored in compliance with applicable standards. These efforts represent a step in the right direction. However, because both EDC and CF Industries sell significant quantities of FGAN through brokers or through independent warehouses or distributors, whose direct customers may be unknown to EDC and CF Industries, it might not be possible in certain situations for the manufacturers to always ensure that their product is handled and stored in accordance with safety guidelines as the product moves downstream. At the very least, however, the certification statement program implemented by CF Industries attempts to ensure compliance with applicable regulations by causing its customers to attest to having knowledge of them.

722 See: http://www.ictulsa.com/domestic_fert.html (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 223 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

As previously discussed, the CF Industries certification program strives to certify compliance by requiring purchasing organizations to affirm that their customers are in compliance with the CF Industries certification program elements. CSB found no evidence of such a program at EDC. Because EDC also sells product through wholesalers and distributors, a similar certification program, if implemented properly in conjunction with other components of product stewardship, will ensure that EDC product is handled safely throughout by its chain of customers. In concert with CF Industries’ efforts, this can effectively promote the safety of all domestically manufactured FGAN. 9.0 Land Use The West Fertilizer Company (WFC) incident led many observers to ask a seemingly simple question: Why would a community be located so close to a facility storing a potentially dangerous chemical? Although the question might be simple, the answer is not. In fact, the city of West, Texas, was so near the WFC facility primarily because of the following factors: • The city “came to” the WFC facility over the years. • There was a lack of zoning regulations. These factors are interrelated. The growth of the community near the WFC facility made it difficult for the city to later enact zoning regulations to require risk mitigating actions such as a buffer zone between the facility and the community. This is not to say that West is an anomaly. Many communities in Texas and nationwide are located too close to facilities resembling the WFC plant.723 This reality highlights the need to explore why communities live with these hazards so that authorities can better mitigate the offsite consequences from incidents such as the fire and explosion at the WFC plant in West. In this section, CSB seeks to explain the previously mentioned factors, providing insights into the proximity of the WFC facility to the West community. Following that discussion, other CSB investigations involving offsite consequences are highlighted to emphasize the scope of the problem. International land use perspectives also are provided to compare various approaches to the issue. In addition, efforts to address land use planning after the WFC incident are discussed. 9.1 Land Use Planning: An Introduction Land use planning is a complex and controversial topic. It provides a framework for limiting private land use when necessary for the public benefit. However, economic, social, safety, and environmental interests must be effectively balanced to achieve this benefit. Such competing interests generate highly emotional and contentious debates. Ultimately, however, the decision is political in nature. The community must decide on the best use of land for its development and growth. Urban sprawl,

723 As of December 6, 2013, Texas had 104 facilities storing 10,000 pounds or more of FGAN.

West Fertilizer Company Final Report January 2016 224 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

environmental concerns, and hazardous conditions are just some of the issues that land use planning addresses. The United States takes a decentralized approach to land use planning; that is, states are largely vested with the authority to regulate and enforce the private use of land. In turn, the states delegate this authority to local governments. This approach generally results in municipalities establishing land use regulations for various areas within their respective jurisdictions. The federal or state government has asserted authority in some areas of land use planning, but the majority of land use planning authority in the United States lies with local governments. The benefits of such an approach stem from the regulatory flexibility to address issues of land use. The judiciary resolves any potential conflicts. Land use planning cannot be said to solve all developmental issues that a community encounters. Land use regulation does give the community a control mechanism to reduce the consequences of an incident but does not eliminate the need for preventive controls. Rather, the mitigative control of land use planning must be combined with preventive controls employed by a variety of different stakeholders. Land use planning is a critical control to foster community development, but it must be integrated with other complementary approaches. At its heart, land use planning offers the means for dealing with development and growth. However, many interests must be taken into account when attempting to effectively ensure a safe and satisfying community. Land use planning considerations can offer insights into the issues evident in the WFC incident. The location of the city of West near the WFC facility produced numerous benefits for the community; however, as the WFC fire and explosion revealed, such siting also had deadly consequences. 9.2 The City That “Came to” the WFC Over the Years The WFC facilities were constructed and began operations in 1962.724 At the time, the facilities were largely surrounded by open fields, raising little concern about any potential offsite consequences. Furthermore, no zoning regulations existed when the WFC began business.725 Over the years, however, the city of West began to slowly develop around the WFC property. As the WFC was grandfathered into West ordinances and the city was subsequently zoned residential, little attention was paid to the city’s slow but steady encroachment toward the WFC facility.

724 Crain, Zac. “Love and Loss in a Small Texas Town.” D Magazine (July 2013). See: http://www.dmagazine.com/Home/D_Magazine/2013/July/West_Texas_Love_and_Loss_in_a_Small_Town.aspx?p age=1 (accessed on November 25, 2014). 725 According to the West Code of Ordinances, the earliest zoning regulation was adopted on March 21, 1967. City of West. Chapter 14, Section 14.01.001. Code of Ordinances. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014).

West Fertilizer Company Final Report January 2016 225 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

West was officially incorporated as a city in 1892, and with the help of a railroad track and fertile land for farming, it thrived.726 Before construction of the WFC plant, the area north of the city was largely open fields used for agriculture and ranching. At the time that the WFC began operations, the area maintained the same character except for a residence located approximately 250 feet north of the WFC property line.727 The location was ideal for such a business—just outside of the city, next to a railroad track, and within a convenient distance for local farmers. West lacked zoning regulations when the WFC completed its construction, and there appeared to be little need for such regulations as the WFC facilities were far removed from the city. Furthermore, the portion of the WFC property where fertilizers and pesticides were stored was outside of the West city limits and thus outside of its jurisdiction.728 Within this framework, the city of West began to expand and grow around the WFC facility. As shown in Figure 74, the city began developing further north over the years. This growth continued until the community was adjacent to the WFC property. Parks, subdivisions, nursing homes, schools, and an apartment complex sat within a 600-foot radius of the facilities. Furthermore, as the city continued to build its infrastructure near the WFC facility, the area became an even more attractive target for development. The community hardly noticed the WFC facility. It was only aware of the risk of accidental releases of anhydrous ammonia but viewed such events with little concern. Figure 75 shows the WFC facility before and after the incident.

726 City of West. “City of West, Our History.” See: http://www.cityofwest.com/our-history (accessed on November 25, 2014). 727 Determined by using the December 14, 1964, aerial photograph of West, Texas, and employing Google Earth. 728 McLennan CAD. “Property Search Results: Property ID 2013357, Adair Grain, Inc. for Year 2013.” See: https://propaccess.trueautomation.com/Map/View/Map/20/201357/2013 (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 226 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 74. Progressive Development of West (Source: GeoSearch)

West Fertilizer Company Final Report January 2016 227 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: NBC News) This lack of proper foresight played a significant role in explaining why West came to be located so close to the WFC plant. Unfortunately, as the WFC was grandfathered into the city’s Code of Ordinances,729 the city was not required to address the risks involved in this encroachment. Not that West is a peculiar case; in many instances across the country, similar problems exist.730 9.3 Lack of Zoning Regulations Both the federal government and Texas have failed to issue regulations relating to siting facilities that store and distribute FGAN near communities such as West. If a regulation had addressed issues such as buffer zones, barricades, or other techniques to mitigate consequences, the severity of the casualties and damage experienced in West could have been significantly reduced. Moreover, although regulation cannot solve all problems, it serves as a mechanism to compel all industries to adopt and implement safer operations. Ultimately, the failure to mitigate the consequences of incidents such as the WFC fire and explosion in West exists at all levels of government. U.S. law largely assigns the authority to regulate private land use to the individual states.731 In turn, the states generally assign this authority to individual municipalities. It is important to note, however, that

729 City of West. Chapter 14. Code of Ordinances. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014). 730 For example, CSB reports on NDK, DPC, Concept Sciences, and the Caribbean Petroleum Refining tank explosion and fire. 731 Because the Federal government is only vested with the powers delegated to it through the Constitution—such as the power to regulate interstate commerce, coin money, and so forth—it is limited in its capability to regulate issues

West Fertilizer Company Final Report January 2016 228 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the state’s authority can be preempted by the federal government in certain instances, and two of the main instances are matters concerning interstate commerce732 and international treaties.733 This dual sovereignty can allow for greater flexibility in resolving land use issues that affect the public. Over time, the federal government has assumed an increasing role in the regulation of land use issues, including those relating to storing chemicals such as FGAN. ATF, the U.S. Department of Housing and Urban Development (HUD), the Pipeline and Hazardous Materials Safety Administration (PHMSA), OSHA, and EPA have all promulgated regulations or recommendations relating to the siting of explosives, reactives, oxidizers such as FGAN, and flammable cryogenics such as liquefied natural gas (LNG) near populated areas. Table 14 briefly lists the relevant regulations issued by these agencies. Table 14. Relevant Siting Regulations Agency Regulation CFR ATF Commerce in Explosives 27 CFR Part 555 DOT Liquefied Natural Gas Facilities: Federal Safety Standards 49 CFR Part 193 HUD Environmental Criteria and Standards 24 CFR Part 51 OSHA Occupational Safety and Health Standards 29 CFR Part 1910 EPA Chemical Accident Prevention Provisions 40 CFR Part 68 Standards for Owners and Operators of Hazardous Waste Treatment, Storage, and Disposal Facilities 40 CFR Part 264

ATF holds the authority to require setting off stored explosive materials and low-explosive materials from inhabited buildings, public highways, public railways, and magazines.734 Although explosive grades of FGAN are currently listed as explosive materials, the FGAN stored at the WFC facility is not categorized as an explosive material or a low-explosive735 material.736 Therefore, WFC storage of FGAN was not

related to land use. See: 10th Amendment, U.S. Constitution. However, state zoning regulations are subject to Federal preemption in areas where the use of land affects interstate commerce, international treaties, and Federal government spending powers. 732 U.S. Constitution, Article I, Section 8. 733 U.S. Constitution, Article VI. 734 27 CFR 555.218–219: “Explosive materials” are defined as explosives, blasting agents, water gels, and detonators. 27 CFR 555.11: “Explosives” are defined as any chemical compound, mixture, or device, the primary or common purpose of which is to function by explosion. 735 Low explosives are defined as “explosive materials which can be caused to deflagrate when confined. See: http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 29, 2015). 736 See: http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 28, 2015). See also: 27 CFR 555.220 Note (1), which states: “FGAN, by itself, is not considered to be a [explosive or blasting

West Fertilizer Company Final Report January 2016 229 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

subject to ATF set-off distances.737 However, ATF has the authority to require a minimum separation distance between the FGAN stored at the WFC facility and certain blasting agents.738 DOT received Congressional authorization to “prescribe minimum safety standards for deciding on the location of a new liquefied natural gas [LNG] pipeline facility,” which it oversees through PHMSA.739 In turn, PHMSA has promulgated a series of recommendations concerning siting requirements for LNG facilities.740 The regulations are based on NFPA 59A concerning the production, storage, and handling of LNG.741 The siting requirements address issues such as thermal radiation protection, flammable vapor- gas dispersion protection, and wind forces. PHMSA applies the regulations to LNG facilities “designed, constructed, replaced, relocated or significantly altered after March 31, 2000,” thereby grandfathering LNG facilities that existed before the March 31 date.742 However, PHMSA has no regulations concerning the siting of AN facilities. HUD requires projects receiving its assistance to be separated by an acceptable distance from specific stationary hazardous operations that store, handle, or process hazardous substances.743 Hazardous substances are defined as “petroleum products (petrochemicals)” and other hazardous chemicals identified by HUD that can produce blast overpressure or thermal radiation levels in excess of HUD standards.744 FGAN is not identified as a hazardous substance for the purposes of this standard.745 In addition, the city of West would not qualify for HUD assistance as it does not meet HUD eligibility requirements.746

agent].” See also: 72 Federal Register 18792, 18796, which states: “[A]lthough FGAN is a component of certain explosives such as ANFO, by itself, it is not an explosive. Therefore, it is not regulated by these ATF regulations.” 737 The purpose behind regulating the siting of ANFO was “to protect interstate and foreign commerce against interference and interruption by reducing the hazard to persons and property arising from misuse and unsafe or insecure storage of explosive materials.” Section 1101, Public Law 91-452, reprinted in: U.S. Code Congressional and Administrative News 1109 (1970). 738 27 CFR 555.220. 739 49 U.S.C. § 60103 (2014). 740 49 CFR 193 Subpart B (2014). 741 65 CFR 10950 (2000) and 69 Federal Register 11330 (2004). 742 49 CFR § 193.2051(2014). 743 24 CFR Subpart C; specifically 24 CFR 51.204 and 24 CFR 51.205. See: http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/environment/training/guidebooks/hazfa cilities (accessed on December 28, 2015). The intent in creating these regulations was “to encourage improvements in housing standards and conditions.” “The National Housing Act.” See: http://portal.hud.gov/hudportal/documents/huddoc?id=HUD-Guidebook.pdf (accessed on December 28, 2015): 3–4. 744 24 CFR 51.201, 203. 745 24 CFR Part 51, Appendix I to Subpart C. Anhydrous ammonia is also not listed as a hazardous substance; however, under special circumstances, the Secretary may require the application of a substance not listed in Appendix I to Subpart C. See: 24 CFR 51.207 (2014). 746 See: http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/communitydevelopment/programs/entit lement (accessed on December 28, 2015). Eligible HUD grantees include (1) principal cities of metropolitan statistical areas, (2) other metropolitan cities with populations of at least 50,000, and (3) qualified urban counties with populations of at least 200,000 (excluding the population of entitled cities).

West Fertilizer Company Final Report January 2016 230 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

OSHA requires facilities handling highly hazardous chemicals to address facility siting issues; however, the requirement only deals with onsite consequences, not the issue of siting communities near highly hazardous chemical facilities.747 This requirement is part of the Process Safety Management (PSM) regulation, which seeks to prevent or minimize the consequences of catastrophic releases of “highly hazardous chemicals.”748 However, the PSM regulation does not include FGAN as a highly hazardous chemical.749 In addition, OSHA has the authority to require separation distances between FGAN and blasting agents,750 in the same manner as ATF.751 The federal agency concerned with offsite consequences, EPA, addresses the siting of hazardous facilities near population centers by issuing various regulations and guidance.752 For example, EPA regulates facility siting through its Risk Management Program rule, which calls on operators to address “stationary source siting” in its Program Level 3 process hazard analysis.753 However, EPA offers little to no guidance to operators on how to satisfy the “stationary source siting” requirement.754 The Risk Management Program rule also requires operators to conduct an offsite consequence analysis to provide government officials and the public with information about the potential consequences of an accidental release.755 However, as FGAN is not classified as a hazardous regulated substance under the Risk Management Program rule, the WFC was not required to conduct such an analysis for its stored FGAN. In addition, EPA is currently considering the inclusion of “facility and equipment siting factors” in the Risk Management Program rule.756 Furthermore, EPA addresses facility siting through regulation and guidance concerning the siting of hazardous waste management facilities near communities and sensitive environments.757 EPA also has issued guidelines relating to siting schools near potential environmental hazards, which could have proven

747 29 CFR 1910.119(e)(3)(vii). 748 29 CFR 1910.119. 749 29 CFR 1910.119, Appendix A. 750 29 CFR 1910.109, Table H-22. 751 27 CFR 555.220. 752 See: http://www.epa.gov/statelocalclimate/local/topics/land.html (accessed on December 28, 2015). 753 40 CFR 68.67(c)(5) (2014). 754 The only real guidance on these terms is found in API RP 752, “Permanent Building Siting”; API RP 753, “Portable Building Siting”; and API RP 756, Tent Siting (to be issued in 2014). However, these guidance documents have been developed without any regulatory guidance. Furthermore, the identified standards have nothing to do with the relationship of the facility to its surrounding community. See: http://www.absconsulting.com/webinars/facility-siting.cfm (accessed on December 28, 2015). 755 40 CFR 68.150–68.195 (2014). The analysis consists of two elements, a worst case release scenario and alternative release scenarios. 756 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 28, 2015): 36. 757 See: http://www.epa.gov/osw/hazard/tsd/permit/site/sites.htm (accessed on December 28, 2015); 42 U.S.C. § 6924 (2014); 40 CFR 264.18 (2014); 40 CFR 265.18 (2014); 40 CFR 270.14(b)(11) (2014); and 40 CFR 270.32(b)(2) (2014). See also: http://homer.ornl.gov/sesa/environment/guidance/rcra/locate.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 231 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

helpful to West and similarly situated communities.758 Moreover, EPA has recommended using information related to the Emergency Planning and Community Right-to-Know Act to inform a community’s decisions concerning zoning and land use planning.759 Thus, federal regulations and guidance on land use do exist and do give communities valuable information regarding various chemical hazards. However, because FGAN is not defined as an explosive or hazardous material, it is excluded from federal zoning regulations. Unfortunately, this situation allows fertilizer facilities to store FGAN onsite without any federal oversight to confirm that the associated risks of locating communities nearby are mitigated to sufficient levels. At the state level, Texas does little to oversee land use issues.760 Instead, Texas grants the most land use oversight authority to its municipalities.761 Texas has no regulation relating to siting hazardous facilities near communities.762 Moreover, no state administrative agency oversees hazardous facility siting.763 At the county level, regulatory authority is limited to zoning specific areas (such as Padre Island, Lake Tawakoni, and Falcon Lake), which results in a failure to approach county zoning from a general perspective.764 This observation does not indicate that a one-size-fits-all approach to zoning is always desired.765 In fact, in many instances, land use oversight needs to be tailored to specific political, social, economic, and environmental needs of the community.766

758 See: http://www.epa.gov/schools/siting/basic.html (accessed on December 28, 2015). 759 See: http://www.epa.gov/osweroe1/docs/chem/notice.pdf (accessed on January 6, 2016): 7; see also: http://www.nicsinfo.org/docs/LEPCStudyFinalReport.pdf (accessed on December 28, 2015): 7. 760 See: http://stateimpact.npr.org/texas/2013/04/22/after-west-fertilizer-explosion-concerns-over-safety-regulation- and-zoning/ (accessed on December 28, 2015). 761 Texas Statute, Local Government Code, Title 7, “Regulation of Land Use, Structures, Businesses, and Related Activities.” See: http://www.statutes.legis.state.tx.us/ (accessed on January 6, 2016). For instance, municipalities must adopt a zoning ordinance in accordance with a comprehensive plan; county zoning ordinances deal with specific areas such as military zones, Padre Island, and Amistad Recreation Area. See: http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015). 762 The Texas Administrative Code fails to address such siting issues. The Texas Department of Public Safety, Division of Emergency Management, holds responsibility for preparing the state emergency management plan, which may include “recommendations for zoning, building restrictions, and other land-use controls . . . to eliminate or reduce disasters or their impact . . . .” Texas Government Code, Title 4, Subtitle B, Chapter 418, Section 418.042. However, the state has not issued any such recommendations. See: https://www.txdps.state.tx.us/dem/downloadableforms.htm#stateplan (accessed on December 28, 2015). 763 See: http://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC (accessed on December 29, 2015). 764 See: http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015). Texas House of Representatives, Committee on County Affairs. “Interim Report to the 80th Texas Legislature,” December 2006: 7. See also: http://www.lrl.state.tx.us/scanned/interim/79/C832.pdf (accessed on December 8, 2014). 765 APA discussion on Growing Smart project with Stuart Meck. See: http://www.planning.org/growingsmart/background.htm (accessed on January 6, 2016). 766 See: http://www.planning.org/growingsmart/background.htm (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 232 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the local level, Texas municipalities are granted the authority to regulate private land, including the location of hazardous facilities.767 Among other requirements, the zoning regulations must be designed to ensure public safety from fires and other dangers.768 However, the municipality is not given the authority to remove the hazardous condition on the property that exists at the time the governing body implements zoning authority and that is used in a public service business.769 The municipality is allowed to impose zoning regulations relevant to the storage and use of hazardous substances.770 In the case of West, Texas, this arrangement led to the city being vested with the most authority in regulating public use. West exercised this authority through its Code of Ordinances.771 West had zoned all property within the city limits for residential purposes only. However, all real property that had been used for commercial purposes before 1987 could remain commercial in nature. Any future development with commercial intent required a rezoning procedure.772 This provision is consistent with West’s comprehensive plan to zone all property within the city limits as residential property. In essence, regulatory authority has been delegated to municipalities to oversee the siting of facilities storing and distributing FGAN near cities such as West. Neither the federal government nor the state of Texas takes any part in oversight. In many instances, however, municipalities are unable to adequately address this complex issue through regulatory mechanisms. For instance, facilities such as the WFC plant existed before promulgation of the city’s Code of Ordinances, posing an issue of grandfathered facilities. Many different economic, safety, environmental, and agricultural interests must also be balanced. Furthermore, municipalities already face a shortage of resources for other essential governmental functions. However, safety issues can be addressed through reasoned regulation, using a number of methods. For example, a regulation requiring separation distances between public receptors and facilities handling FGAN could help mitigate offsite consequences in cities such as West. At root, however, locating these facilities near communities represents a national concern; therefore, all levels of government should give consideration to developing land use regulations to counter this problem.

767 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.003. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 768 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.004. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 769 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.013. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 770 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.017. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). The term “hazardous substances” is not defined in the chapter. 771 See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on December 28, 2015). 772 Section 14.01.002. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 233 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1 Importance of Land Use Planning in Siting Communities Near Facilities

Storing FGAN and Other Hazardous Chemicals The issue of siting hazardous facilities storing FGAN near cities such as West is not an anomaly; it is a nationwide problem. In addition, although not directly associated with FGAN storage facilities, land use issues have been at the forefront of multiple CSB investigations. Furthermore, CSB has identified— multiple times—the risks of locating a hazardous chemical facility near public receptors. Table 15 lists CSB investigations that involved land use issues. Table 15. Investigations Involving Land Use Issues Investigation Public Receptors Chemical Involved Offsite Consequences NDK Crystal, Inc. Interstate commerce, businesses Synthetic quartz crystal (silica and NaOH) 1 fatality DPC (Festus, MO) Highways, railroads, residences, businesses, farms Chlorine 63 residents who sought medical treatment Concept Sciences Businesses, residences Hydroxylamine 5 fatalities, 14 injuries, significant damage to buildings and shattered windows at residences CAI/Arnel Businesses, residences Heptane, isopropyl alcohol, n-propyl alcohol 10 injuries, 24 houses and 6 businesses significantly destroyed DPC (Glendale, AZ) Residences Chlorine 14 injuries Freedom Industries Residences, businesses, drinking water supply MCHM, PPH 369 residents who sought medical treatment for exposure Millard Refrigerated Services Businesses, environment Anhydrous ammonia 150 people who sought medical treatment for ammonia exposure T-2 Laboratories Inc. Businesses, residences, railroads Methylcyclopentadienyl manganese tri-carbonyl 28 injuries, significant property damage to nearby businesses Silver Eagle Refinery Residences Hydrocarbons Damage to residences Kaltech Residences, businesses, public streets Chemical waste At least 36 injured people, damage to residences and businesses Chevron Refinery Residences, businesses, public streets Hydrocarbons Approximately 15,000 people who sought medical treatment

West Fertilizer Company Final Report January 2016 234 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Investigation Public Receptors Chemical Involved Offsite Consequences Caribbean Petroleum Residences, businesses, public streets Hydrocarbons Shutdown of major highways, evacuation of local residents Bayer CropScience Residences, college, businesses, interstate commerce, waterways Methomyl, methyl isobutyl ketone Property damage, community shelter-in- place activated

In light of this information, the WFC incident in West serves as yet another unnecessary and deadly reminder that little has been done to address the risks of locating communities near facilities handling hazardous chemicals such as FGAN. Furthermore, if the incident had occurred during school hours, many more adults and children could have been injured. This incident represents a microcosm of the potential harms that many communities across the nations could endure.773 9.3.2 International Perspectives Other countries have confronted problems similar to those in West, Texas, and have taken a variety of approaches to address them. The European and Australian strategies merit consideration given their sophistication relative to the current U.S. approach. The discussion in this section explores the approaches taken by the European Union (EU), the United Kingdom (U.K.), and Australia. 9.3.2.1 European Union Through its Seveso III Directive, the EU requires member countries to take land use planning policies “into account” as part of major accident prevention.774 The policy behind the requirement is designed to mitigate the consequences of major chemical accidents experienced by public receptors. The EU developed this requirement in the aftermath of major industrial incidents, including the FGAN explosion in Toulouse.775 In fact, the Seveso III Directive lists AN as a “dangerous substance,” classifying the chemical into four different categories, depending on whether it is FGAN, technical grade ammonium

773 See: http://news.yahoo.com/devastated-texas-town-ponders-schools-140711695.html (accessed on December 29, 2015). Jaeah Lee. “Map: Is There a Risky Chemical Plant Near You?” Mother Jones (April 17, 2014). See: http://www.motherjones.com/environment/2014/04/west-texas-hazardous-chemical-map (accessed on July 8, 2014). 774 Seveso III Directive, Article 13, “Land-use planning.” See: http://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November, 2, 2015). 775 G. Vierendeels, et al. “Modeling the major accident prevention legislation change process within Europe.” Safety Science. 516 (2010).

West Fertilizer Company Final Report January 2016 235 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

nitrate (TGAN), off-specification ammonium nitrate (AN), or AN capable of self-sustaining decomposition.776 Under the Seveso III requirements, member countries are to ensure that their policies address “appropriate distances” between covered facilities and residential areas. Furthermore, the countries must “set up appropriate consultation procedures” with competent authorities to “facilitate the implementation” of the land use planning policies. The Seveso III Directive applies to new facilities, facilities undergoing modifications, and new developments. Existing facilities must determine whether additional technical measures are required to avoid an increase in risk to the nearby community.777 The Seveso III Directive does not prescribe best practice guidance for its technical requirements (such as separation distances), consistent with its respect for each country’s political, cultural, technical, and economic differences. However, various entities such as the Institute for Systems and Informatics and Safety provide best practice guidance, which refers to the use of technical approaches and procedural issues.778 Although such guidance offers helpful insights to member countries, the appropriate response for a specific site is still recognized as a matter of interpretation for each country. Given the immense differences among the approaches to land use planning of the member countries, it is difficult to compare EU country land use policies. However, the establishment of groups such as the European Commission and the Committee of the Competent Authorities under the Seveso III Directive emphasizes the important role that land use planning issues play in the European community.779 Although issues still remain relating to each country’s practices and methodologies, the emphasis on siting of facilities storing hazardous materials near public receptors highlights the importance that the European community places on land use planning in major accident prevention. 9.3.2.2 United Kingdom The U.K. vests a hazardous substances authority with the power to administer and enforce land use planning as it relates to storing or using hazardous substances. The hazardous substances authority is generally an entity charged with dealing with land use planning and zoning issues, known as the local

776 Seveso III Directive, Notes Section, “AN compounds with more that 28% by weight and AN based fertilizers.” 2012/18/EU. See: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November 2, 2015). 777 Seveso III Directive, Article 13, “Land-use planning.” 2012/18/EU. See: http://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November 2, 2015). 778 Christou, M.D., and S. Porter. “Guidance on Land Use Planning as Required by Council Directive 96/82/EC (Seveso II).” Institute for Systems Informatics and Safety, 1999. See: http://ipsc.jrc.ec.europa.eu/fileadmin/repository/sta/mahb/docs/LandUsePlanning/EUR18695EN_LandUsePlanning Guidance.pdf (accessed on December 28, 2015). 779 Major Accident Hazards Bureau. “Land Use Planning.” See: http://ipsc.jrc.ec.europa.eu/index.php/Land-use- planning/694/0/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 236 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

planning authority.780 Consequently, the U.K. takes an approach similar to that of the United States in decentralizing land use planning to allow a local authority to promulgate and enforce land use requirements.781 For the WFC incident in West, Texas, the West City Council would be the analogue to the U.K. hazardous substances authority. The U.K., however, requires land use policies to account for major accidents caused by hazardous substances.782 This responsibility is executed through a collaborative effort among the hazardous substances authority, U.K. Health and Safety Executive (HSE),783 U.K. Environment Agency,784 and other interested stakeholders. Essentially, organizers of a proposed development must seek a hazardous substances consent from the hazardous substances authority to establish a facility that will store or use hazardous substances785 within its jurisdiction.786 When the hazardous substances authority receives an application for consent, it must consult with the HSE and the U.K. Environment Agency for advice on whether consent to the proposed development is warranted. Other interested stakeholders are also consulted or given the opportunity to publicly comment on the proposed development.787 Using all of the relevant information provided, the hazardous substances authority weighs all competing interests and decides whether to grant a hazardous substances consent to the proposed development.788 The U.K. attempts to balance each local community’s interest in deciding the risks that it will tolerate, drawing on the expertise and resources of national governmental bodies. Such an approach makes it more likely that all relevant issues and concerns about locating a development that stores or uses hazardous substances near the public will be presented to the hazardous substances authority before a

780 See: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf (accessed on December 28, 2015). 781 The U.K. has experienced similar catastrophic incidents that had effects on the population, including the Flixborough (Nypro UK) Explosion in 1974 and the Buncefield incident in 2005. See: http://www.hse.gov.uk/comah/sragtech/caseflixboroug74.htm and http://www.buncefieldinvestigation.gov.uk/, respectively (accessed on December 28, 2015). 782 Seveso Directive II, Article 12, “Land Use Planning.” See: http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed on December 28, 2015). 783 The U.K. HSE is a governmental body responsible for enforcing health and safety at workplaces. See: http://www.hse.gov.uk/contact/authority.htm (accessed on December 28, 2015). 784 The U.K. Environment Agency is a governmental body responsible for protecting and improving the environment and for promoting sustainable development. See: http://www.environment-agency.gov.uk/aboutus/default.aspx (accessed on December 28, 2015). 785 FGAN is included within the definition of a “hazardous substance.” See: http://www.legislation.gov.uk/uksi/1999/981/schedule/1/made (accessed on December 28, 2015). 786 See: http://www.hse.gov.uk/landuseplanning/what.htm (accessed on December 28, 2015). 787 Other stakeholders include the local parish council, fire and civil defense authorities, and the governmental agency English Nature. 788 See: http://www.environment-agency.gov.uk/aboutus/default.aspx (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 237 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

decision is rendered. The U.K. thus believes that major offsite risks can be effectively managed before permitting a hazardous substance to be stored near a population in its vicinity.789 9.3.2.3 Western Australia Australia’s land use planning methods regarding hazardous substances vary across jurisdictions.790 Although each Australian state and territory applies varying regulations regarding land use planning of FGAN storage facilities, the Government of Western Australia employs an insightful and sophisticated approach to the issue. In essence, Western Australia uses a risk-based method that subjects FGAN storage facility siting to government approval.791 Western Australia legislatively addresses land use issues concerning FGAN through its Dangerous Goods Safety Act 2004 (the Dangerous Goods Act). This act places a duty on all people involved with dangerous goods to minimize risk associated with those goods.792 To minimize risk, the Dangerous Goods Act requires that “all reasonably practicable measures” be used. In determining whether a measure is “reasonably practicable,” consideration is given to issues such as the severity of the harm, severity of the risk to people, and suitability of the means in question.793 FGAN is treated as a dangerous good under the Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007 and the Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007, which both support the Dangerous Goods Act.794

789 See: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf (accessed on December 28, 2015). 790 See: http://www.chemicalspolicy.org/downloads/chemicals-plastics-regulation.pdf (accessed on December 29, 2015). 791 Dangerous Goods Safety Act 2004. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of- solid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). 792 Dangerous Goods Safety Act 2004, Part 2. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 2015). 793 Ibid. 794 Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of- solid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 238 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Land use planning as related to siting facilities storing FGAN near public receptors is implemented by applying separation distances. These distances are subject to acceptance by Resource Safety, a department of the Government of Western Australia.795 If it is determined that an FGAN facility is not satisfying the separation distance requirement, Resource Safety may limit the quantity of FGAN within the facility or require that other safety conditions be met.796 The New South Wales Department developed the required separation distances with the intent of reducing the risk of offsite consequences insofar as reasonably practicable.797 The distances were not designed to completely eliminate the risks associated with offsite consequences, nor were they intended to replace preventive controls.798 The separation distances are categorized by a threshold quantity (i.e., whether FGAN is stored in quantities greater than or less than 10 metric tons). For instance, if FGAN exceeding 10 tons is stored at a facility, it must be separated by at least 300 meters (985 feet) from critical infrastructure, 240 meters (790 feet) from residential buildings, and 140 meters (460 feet) from commercial buildings.799 Western Australia seeks to address land use planning through a risk-based scheme that requires government permission to site FGAN facilities near public receptors. Depending on the quantity of FGAN stored, each facility must be sited at a minimum distance from such public receptors. Furthermore, if the facility is not sited at the required minimum distance, it might have to limit the maximum quantity of FGAN that it can store. A study of the risk associated with a particular facility might be required to reach agreement between the government and the facility on appropriate separation

795 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). See also: http://www.dmp.wa.gov.au/6611.aspx (accessed on December 28, 2015). 796 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). 797 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf. Government of Western Australia. Code of Practice: Safe Storage of solid FGAN, 3rd Edition: 6-7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015). Hazardous Industry Planning Advisory Paper No. 4—Risk criteria for land use safety planning. HIPAP4. See: http://www.planning.nsw.gov.au/Policy-and- Legislation/~/media/0D39F08E7889409BBA1FA88D5FB859FD.ashx (accessed on January 7, 2014). 798 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid Ammonium Nitrate: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe- storage-of-solid-ammonium-nitrate-code-of-practice.pdf (accessed on January 6, 2016). Government of Western Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015). 799 Government of Western Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 239 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

distances. This approach gives Western Australia the capability to balance the risk associated with storing FGAN against the need for land development. 9.4 Efforts to Address Land Use Planning After the West Incident In the weeks, months, and years following the West incident, few inroads have been made to resolve land use issues. The federal government has developed a working group that is tasked with developing recommendations related to chemical facility safety and security; however, the timeline for delivery has been extended.800 At the state level, general opposition remains to any type of change in the Texas approach to land use planning.801 In fact, strong opposition has contested any regulation of FGAN facilities in Texas.802 The city of West is currently awaiting recommendations from state and federal officials; however, it does plan on siting any new fertilizer facilities away from the community.803 The Texas State Fire Marshal’s Office (SFMO) has taken a proactive approach by providing all counties with software demonstrations that estimate blast zones from facilities storing FGAN.804 In addition to assisting first responders, the software gives community leaders the opportunity to assess community impacts relating to the siting of a new FGAN facility. In addition, the SFMO will assist each county in reviewing best practices for dealing with the storage and handling of FGAN. At the county level, the McLennan County Local Emergency Planning Committee (LEPC) has emphasized the importance of land use issues in agreeing to focus on “upfront planning” when siting community buildings such as schools or hospitals near chemical facilities.805 The LEPC has agreed to continue to meet quarterly. The city of West has also committed to advising other communities about identifying the potential hazards that they might face in locating chemical facilities near their towns and citizens.806 Applied Research Associates, Inc. (Applied Research) has engaged in an effort to understand and validate the separation distances prescribed in NFPA 400. After completing a literature review, Applied Research selected a consequence-based case study and developed a test plan. The firm then carried out the case

800 See: https://www.osha.gov/chemicalexecutiveorder/index.html (accessed on December 28, 2015). 801 See: http://www.nytimes.com/2013/05/10/us/after-plant-explosion-texas-remains-wary-of-regulation.html?_r=0 (accessed on December 28, 2015). 802 Henry, Terrence, NPR. “Proposals to Prevent Another Fertilizer Explosion Immediately Meet Resistance,” July 2,

1. See: http://stateimpact.npr.org/texas/2014/07/02/proposals-to-prevent-another-fertilizer-explosion-

immediately-meet-resistance/ (accessed on December 8, 2014). The Associated Press. “New bill on West blast would delay new rules.” CBS DFW (August 5, 2014). See: http://dfw.cbslocal.com/2014/08/05/new-bill-on-west- blast-would-delay-new-rules/ (accessed on December 29, 2015). 803 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html (accessed on December 28, 2015). 804 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_assessment.html (accessed on December 28, 2015). 805 Ibid. 806 Ibid.

West Fertilizer Company Final Report January 2016 240 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

study test plan to assess the adequacy of the separation distance for safe storage of AN and the safe separation distance for personnel in a process building in the event of an explosion. Applied Research then developed a series of recommendations regarding separation distances in NFPA 400, including possible approaches for improving those distances, to guide NFPA and its affiliated Fire Protection Research Foundation project panel in future research efforts.807 The city of West is currently rebuilding. The blast substantially damaged more than 350 homes, completely destroying 150 of them, and caused approximately $100 million in damages.808 The West High School has been razed, and a new school will be constructed on the same site.809 The site of the accident will likely become an industrial park.810 10.0 Key Findings Technical Findings

1. The presence of combustible materials used for construction of the facility and the fertilizer grade

ammonium nitrate (FGAN) storage bins, in addition to the West Fertilizer Company (WFC) practice of storing combustibles near the FGAN pile, contributed to the progression and intensity of the fire and likely resulted in the detonation.

1. The WFC facility did not have a fire detection system to alert emergency responders or an

automatic sprinkler system to extinguish the fire at an earlier stage of the incident.

1. On the basis of interviews with eyewitnesses and supporting photographic evidence, the first

observed fire and smoke originated in and above the seed room and progressed throughout the northern half of the WFC facility. The radiant heat from the fire, fueled by the structure, flammable building contents, and the asphalt roof shingles, likely heated the surface of the FGAN pile. Contamination from soot, molten asphalt, and molten polyvinyl chloride (PVC) from an overhead conveyer produced a detonable mixture of combustibles and FGAN oxidizers. Increased ventilation generated a brighter and hotter flame, heating the FGAN-fuel mixture on the surface of the pile. Regulatory Findings

1. Occupational Safety and Health Administration (OSHA) efforts to oversee facilities that store and

handle FGAN fell short at the time of the incident.

807 Fire Protection Research Foundation. “Separation Distances in NFPA Codes and Standards, 2014.” See: http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf (accessed on September 25, 2015). 808 See: http://www.hazmatmag.com/news/in-harms-way/1002482923/ (accessed on January 6, 2016) and http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_whatwelearned.html (accessed on December 28, 2015). 809 CBS. “DFW, West Getting New Schools After Explosion,” October 30, 2014. See: http://dfw.cbslocal.com/2014/10/30/west-getting-new-schools-after-explosion/ (accessed on December 6, 2014). 810 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 241 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Section (i) of the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109(i), was not very well known among those in the fertilizer industry, likely due in part to the fact that (1) application of the section was unclear; and (2) the section had rarely been used previously to cite fertilizer facilities. b. OSHA inadvertently omitted ammonium nitrate (AN) from the List of Highly Hazardous Chemicals, Toxics and Reactives in its Process Safety Management (PSM) standard, 29 CFR 1910.119, even though AN possesses reactive characteristics that would have triggered its inclusion.

1. Because the WFC facility was covered under the U.S. Environmental Protection Agency (EPA)

Risk Management Program rule for its anhydrous ammonia tanks (but not for its FGAN), WFC employees and emergency responders demonstrated a greater awareness of the hazards associated with onsite storage of anhydrous ammonia than those associated with FGAN. AN is not on the EPA Risk Management Program list of chemicals, so the WFC was not required to take safety measures for FGAN similar to those for ammonia. Insurance Findings

1. WFC’s previous property and liability insurer, which provided insurance to WFC from 2006

through 2009, did not focus on FGAN hazards in its annual insurance inspections because it was not required to do so. However, the insurer did not renew WFC’s commercial property policy in 2010 because WFC repeatedly failed to comply with the insurer’s safety-related recommendations (e.g., to replace corroded electrical wiring), which were identified in loss control surveys. The CSB found little evidence of onsite activity or inspections by WFC’s subsequent insurer, U.S. Fire, which insured the facility at the time of the incident. Emergency Response Findings

1. The West Volunteer Fire Department (WVFD) did not conduct pre-incident planning or response

training at the WFC facility to address FGAN-related incidents because was no such regulatory requirement. Thus, the firefighters who responded to the WFC fire did not have sufficient information to make an informed decision on how best to respond to the fire at the fertilizer facility.

1. Federal and state of Texas curriculum manuals used for hazardous materials (HAZMAT) training

and certification of firefighters placed little emphasis on emergency response to storage sites containing FGAN. On the other hand, HAZMAT shipping and transportation were covered frequently in the courses. Many federal and state grants support the resource needs of firefighters and fire departments; however, these grants are used more often for resources such as personal protection equipment or firefighting equipment rather than for training.

1. Lessons learned from previous FGAN-related fires and explosions were not shared with volunteer

fire departments, including the WVFD. If previous lessons learned had been applied in West, the firefighters and emergency personnel who responded to the incident might have better understood the risks associated with FGAN-related fire.

West Fertilizer Company Final Report January 2016 242 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emergency Planning Findings

1. Despite WFC documentation of its FGAN in a 2012 Tier II report, the WVFD did not conduct

drills and exercises at the WFC facility before the 2013 fire and explosion.

1. The agricultural use exemption under the Emergency Planning and Community Right-to-Know

Act (EPCRA) is not clear about which facilities are covered under the exemption. Before the WFC fire and explosion, the state of Texas determined that the WFC was exempt under the EPCRA agricultural use exemption. Land Use Planning Findings

1. At the time of its construction, the WFC facility was surrounded by open fields, and no zoning

regulations existed when it began operations.

1. As the city of West developed over the years, it expanded toward the WFC facility.
2. The proximity of the city of West to the WFC facility magnified the offsite consequence impacts.
3. Other FGAN facilities throughout Texas are located in close proximity to schools, residences, and

care facilities. Of the 40 FGAN facilities in Texas as of October 2015, 48 percent are within 0.5 miles of a school, nursing home, or hospital while 83 percent are within 0.25 miles of a residence.

1. 0 Recommendations

U.S. Environmental Protection Agency (EPA) 2013-02-I-TX R1

Develop a guidance document on Emergency Planning and Community Right-to-Know Act (EPCRA) requirements that is issued annually to State Emergency Response Commissions (SERCs) and Local Emergency Planning Committees (LEPCs) and ensure that the guidance focuses on the following: a. Explains which chemicals are exempt and which must be reported. b. Describes how emergency responders should use Tier I and Tier II inventory reports and Safety Data Sheets, such as in safety training, practice drills, and for emergency planning. c. Includes comprehensive LEPC planning requirements, with an emphasis on annual training exercises and drills for local emergency response agencies.

2013-02-I-TX R2

Develop a general guidance document on the agricultural exemption under EPCRA Section 311(e)(5) and its associated regulation, 40 CFR 370.13(c)(3), to clarify that fertilizer facilities that store or blend fertilizer are covered under EPCRA. Communicate to the fertilizer industry publication of this guidance document as well as the intention of Section 311(e)(5).

West Fertilizer Company Final Report January 2016 243 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2013-02-I-TX R3

Revise the Risk Management Program rule to include fertilizer grade ammonium nitrate (FGAN) at an appropriate threshold quantity on the List of Regulated Substances. a. Ensure that the calculation for the offsite consequence analysis considers the unique explosive characteristics of FGAN explosions to determine the endpoint for explosive effects and overpressure levels. Examples of such analyses include that adopted by the 2014 Fire Protection Research Foundation report, “Separation Distances in NFPA Codes and Standards,” Great Britain’s Health and Safety Executive, and other technical guidance. b. Develop Risk Management Program rule guidance document(s) for regulated FGAN facilities. U.S. Occupational Safety and Health Administration (OSHA) 2013-02-I-TX R4

Develop and issue a Regional Emphasis Program for Section (i) of the Explosives and Blasting Agent standard, 29 CFR 1910.109(i), in appropriate regions (such as Regions IV, VI, and VII) where fertilizer grade ammonium nitrate (FGAN) facilities similar to the West Fertilizer Company facility are prevalent. Establish a minimum number of emphasis program inspections per region for each fiscal year. Work with regional offices to communicate information about the emphasis program to potential inspection recipients.

2013-02-I-TX R5

Implement one of the following two regulatory changes, either option (a) or (b) below, to address FGAN hazards: a. Add FGAN to the OSHA Process Safety Management (PSM) standard List of Highly Hazardous Chemicals, Toxics and Reactives in 29 CFR 1910.119, Appendix A, and establish an appropriate threshold quantity. Identify National Fire Protection Association (NFPA) 400 as a source of Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) for PSM-covered FGAN equipment and processes. b. Revise the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109, to ensure that the title, scope, or both make(s) clear that the standard applies to facilities that store bulk quantities of FGAN. Revise 1910.109(i), “Storage of Ammonium Nitrate,” to include requirements similar to those in NFPA 400, Hazardous Materials Code (2016 Edition), Chapter 11. Ensure the following elements are considered: i. For new construction, prohibit combustible materials of construction for FGAN facilities and FGAN bins. For existing facilities, establish a phase-in requirement for the replacement of wooden bins with bins made of noncombustible materials of construction within a reasonable time period (e.g., 3 to 5 years from the date standard revisions are enacted), based on feedback from the fertilizer industry. ii. Require automatic fire sprinkler systems and fire detection systems for indoor FGAN storage areas.

West Fertilizer Company Final Report January 2016 244 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

iii. Define adequate ventilation for FGAN for indoor storage areas. iv. Require all FGAN storage areas to be isolated from the storage of combustible, flammable, and other contaminating materials. v. Establish separation distances between FGAN storage areas and other hazardous chemicals, processes, and facility boundaries. International Code Council (ICC) 2013-02-I-TX R6

In a subsequent edition of the International Fire Code, develop a chapter or a separate section under Chapter 50 (“Hazardous Materials”) or Chapter 63 (“Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids”) that includes the following requirements for the storage and handling of ammonium nitrate (AN): a. Require automatic fire detection and suppression systems in existing buildings constructed of combustible materials b. Provide ventilation requirements in accordance with the International Mechanical Code to prevent the accumulation of off-gases produced during AN decomposition c. Provide smoke and heat vents to remove heat from AN during fire situations d. Establish minimum safe separation distances between AN and combustible materials to avoid contamination in the event of fire. e. Prohibit the use of combustible materials of construction. Department of Homeland Security, Federal Emergency Management Agency (FEMA) 2013-02-I-TX R7

Through a new or existing program and in conjunction with training partners, create and implement a competitive funding mechanism to provide training to regional, state, and local career and volunteer fire departments on how to respond to fire and explosion incidents at facilities that store fertilizer grade ammonium nitrate (FGAN). Continue to use available funding to ensure training effectiveness.

2013-02-I-TX R8

During the proposal review process for the program, ensure that the FGAN training includes multiple delivery methods to enable a broad reach. Training should allow for instructor-led, web- based, and train-the-trainer courses; initial orientation; and refresher training. Training also should accommodate both resident and mobile capabilities to facilitate flexible delivery.

Objectives of the selected training course should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals

West Fertilizer Company Final Report January 2016 245 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R9

Assist training partners to develop and provide continual oversight for an FGAN training program. In addition, evaluate the training curriculum to confirm that it adequately meets course objectives as well as the details of recommendation 2013-02-I-TX R8.

2013-02-I-TX R10

Develop an outreach program that notifies regional, state, and local fire departments about available FGAN training opportunities. The program should include the following: a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Details on how to obtain FGAN training by submitting a proposal in response to the funding opportunity c. Information on training partners and programs that provide FGAN training. Texas Commission on Fire Protection (TCFP) 2013-02-I-TX R11

Develop minimum standards for course curricula to include hazard awareness of fertilizer grade ammonium nitrate (FGAN) for those fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to other jurisdictions with FGAN facilities. In addition, develop a training program specific to FGAN.

Objectives of the program’s training course should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R12

Implement outreach to regional, state, and local fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to jurisdictions with FGAN facilities, informing them about the new FGAN training certification requirements and opportunities to receive training. Include the following in the outreach:

West Fertilizer Company Final Report January 2016 246 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Encouragement for fire departments in jurisdictions with FGAN facilities to become certified in FGAN training. State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA) 2013-02-I-TX R13

Develop a fertilizer grade ammonium nitrate (FGAN) training certification program for fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to other jurisdictions with FGAN facilities. The certification program should include multiple delivery methods to enable a broad reach. The certification program should allow for instructor- led, web-based, and train-the-trainer courses; initial orientation; and refresher training. The training also should accommodate both resident and mobile capabilities to facilitate flexibility in delivery.

The criteria for the certification program should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R14

Develop an outreach component for the training certification program that notifies regional, state, and local fire departments with FGAN facilities in their jurisdictions about the training certification opportunities available for FGAN. Ensure that the following items are included in the development of this program: a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Encouragement for members in jurisdictions with FGAN facilities to become certified in FGAN training c. Information on training partners and programs that provide FGAN training. Texas A&M Engineering Extension Services (TEEX) 2013-02-I-TX R15

West Fertilizer Company Final Report January 2016 247 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Develop and administer a hazardous materials training module for career and volunteer fire departments that addresses fertilizer grade ammonium nitrate (FGAN) and other hazardous materials or chemicals that could pose new specialized hazards. Ensure that the training includes multiple delivery methods to enable a broad reach. The training should allow for instructor-led, web-based, and train-the-trainer courses; initial orientation; and refresher training. The training also should accommodate both resident and mobile capabilities to facilitate flexibility in delivery.

Objectives of the training course should address the following: a. How to respond to industrial fires involving FGAN and other hazardous materials or chemicals that could pose new specialized hazards to responding firefighters b. Previous FGAN fire and explosion incidents, incorporating lessons learned c. Hazards posed by other materials and chemicals stored near the FGAN, including FGAN incompatibility with those materials and chemicals d. Pre-incident planning for fires involving FGAN and other hazardous materials or chemicals that could pose new specialized hazards to responding firefighters e. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness f. National Incident Management System and Incident Command System.

2013-02-I-TX R16

Develop an outreach program that notifies state, regional, and local fire departments about available FGAN training opportunities. The program should include the following elements: a. Guidance for fire departments on how to identify FGAN and other recognized hazards associated with other hazardous materials or chemicals within their communities by engaging with State Emergency Response Commissions and Local Emergency Planning Committees b. Promotion of use of the hazardous materials training module with TEEX training partners. Texas Department of Insurance (TDI) 2013-02-I-TX R17

For companies that provide insurance to agricultural facilities storing bulk fertilizer grade ammonium nitrate (FGAN) in Texas, including surplus lines insurers and Texas-registered risk retention groups, develop and issue guidance to assist in underwriting risk and conducting annual loss control surveys. Guidance should include the following: a. Combustible materials of construction for facilities and bins storing FGAN b. Storage of combustible materials near FGAN piles c. Adequate ventilation for indoor FGAN storage areas d. Automatic sprinklers and smoke detection systems for indoor FGAN storage areas e. Separation distances between FGAN and other hazardous materials onsite

West Fertilizer Company Final Report January 2016 248 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

f. Potential for offsite consequences from a fire or explosion, including the proximity of FGAN facilities to nearby residences, schools, hospitals, and other community structures. Provide references in the guidance document to existing materials from the following sources or to other equivalent guidance: a. National Fire Protection Association (NFPA), NFPA 400, Hazardous Materials Code, 2016 Edition, Chapter 11, “Ammonium Nitrate” b. FM Global, “Property Loss Prevention Data Sheet 7-89” c. U.S. Environmental Protection Agency, Occupational Safety and Health Administration, and Bureau of Alcohol, Tobacco, Firearms and Explosives; “Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills” d. TDI, “Best Practices for the Storage of Ammonium Nitrate” e. National Fire Protection Research Foundation, “Separation Distances and NFPA Codes and Standards.” West Volunteer Fire Department (WVFD) 2013-02-I-TX R18

Develop standard operating procedures for pre-incident planning for facilities that store or handle hazardous materials such as fertilizer grade ammonium nitrate (FGAN). El Dorado Chemical Company (EDC) 2013-02-I-TX R19

For all distributors and bulk retail sites (i.e., customers) that receive fertilizer grade ammonium nitrate (FGAN) manufactured by El Dorado Chemical Company (EDC) for storage, shipment, and sale: a. Encourage customers to conduct internal monitoring and auditing (in accordance with recent industry standards and guidelines) in locations where FGAN will be stored or used. Communicate that such internal monitoring and auditing may be conducted through established product safety programs, including ResponsibleAg. b. Develop a process to establish mutual product stewardship expectations for the downstream chain of customers. Communicate expectations to existing customers, and to new customers before their first shipment of FGAN. Include the following components: i. For all FGAN sold to distributors, encourage distributors to provide Safety Data Sheets and FGAN safety guidance to their customers and bulk retail sites to which FGAN is sold or shipped ii. For all EDC bulk retailers and non-EDC bulk retailers that store and sell FGAN, encourage bulk retailers to address, such as through certification checklists, the following: • Written procedures for the safe handling of FGAN, including employee training

West Fertilizer Company Final Report January 2016 249 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Emergency response plans to be sent to Local Emergency Planning Committees and local fire departments • Tier II Chemical Inventory Report submissions. This signature block is placed immediately after the last recommendation. By the U.S. Chemical Safety and Hazard Investigation Board

Vanessa Allen Sutherland

Chair

Kristen Kulinowski

Member

Manuel Ehrlich

Member

Richard Engler

Member

Date of Board Approval

West Fertilizer Company Final Report January 2016 250 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Appendix A: Rebuilding of the West Independent School

District The West Independent School District (WISD) ultimately decided to demolish the West Intermediate School (WIS),1 West High School (WHS), and approximately half of West Middle School (WMS) based on the level of damage to these buildings. The WISD is rebuilding by constructing a combined middle school and high school consisting of a common entryway, cafeteria, and auditorium but separate offices and gymnasiums for each school. The left side of the structure will accommodate the middle school students (grades 6 through 8), and the right side will serve high school students (grades 9 through 12). Table 16 shows the distribution of grade levels within the old facilities and the new facilities. Groundbreaking took place on October 30, 2014, and construction began shortly thereafter; the WISD expects the school to open in September 2016. The new West Middle School/West High School will be located on the same site as the previous WHS campus. The site will house the WISD baseball field, softball field, eight-lane running track and facilities for field events, two practice fields, four tennis courts, and supporting concession and restroom facilities.2 Although the city demolished the WIS campus, the existing site paving remained in place so that it could serve as temporary parking for the WISD transportation department. The former WIS site currently houses a donated metal building used for agriculture shop for WHS students3 but could potentially become the final location of the WISD transportation, maintenance, and receiving facility.

1 WIS will not be rebuilt. 2 See: http://www.restorewestisd.com/assets/sd_west-hs-ms-final-web.pdf (accessed on December 30, 2015). 3 The donated metal building is approximately a block and a half from the temporary high school; however, it would take up too much instructional time for students to walk there, so buses take each class to the shop on days when students participate in agriculture class.

West Fertilizer Company Final Report January 2016 251 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 16. Distribution of Grade Levels at the Old and New WISD Schools School Old Facilities (Grades) New Facilities (Grades) West Intermediate School 4 and 5 Not rebuilt West Middle School 6 and 7 6 through 8 West High School 7 through 12 9 through 12 West Elementary School K through 3 K through 5

During the rebuild, the WISD created a temporary campus for middle and high school students, ultimately locating it on the existing middle school site. Students in grades pre-K through 5 attended school at West Elementary School, which sustained minimal damage in the explosion. Students in grades 6 through 12 were housed in temporary facilities at the existing WMS site.4 The sixth graders from WMS initially transferred to portable structures behind the elementary school until the end of the school year before moving to the middle school site for the 2013–2014 school year. The students in grades 7 through 12 moved to empty buildings owned by the Connally Independent School District,5 which is about 9 miles south of West, from April 17, 2013, until the end of the school year. Although the physical location of classes changed, WISD teachers still taught these students, who were still enrolled in the WISD. In August 2013, all of the students in grades 7 through 12 returned to West for classes in modular and portable buildings, and they eventually will transfer to the new school once the rebuild is complete. The temporary middle school and high school site consisted of 17 temporary portable facilities, 10 portable facilities donated by surrounding school districts that were leased by the WISD, and a temporary structure to cover the existing foundation and floor system saved from the original practice gymnasium.6 FEMA provided the WISD with a grant totaling nearly $20.8 million to assist in providing secure temporary classrooms and administrative buildings to replace those that were destroyed.7 The FEMA grant will pay the federal share, or 75 percent, of the eligible costs for the rebuild, and the WISD will

4 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 5 Connally Independent School District is a Texas public school district located in central McLennan County, serving the cities of Lacy, Lakeview, and Waco as well as the communities of Elm Mott, Chalk Bluff, and Gholson. 6 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 7 See: http://www.fema.gov/news-release/2013/08/01/fema-obligates-nearly-28-million-west-texas-independent- school-district (accessed on December 30, 2015). See: http://www.wfaa.com/story/local/2015/07/06/14167886/ (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 252 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cover the remaining 25 percent of the cost. The remaining cost to rebuild will be funded by the Texas Education Agency, which is providing the WISD with almost $10.3 million in Foundation School Program funds. At the time of the incident, the WISD was insured for $58 million. The school district received $30 million from the Argonaut Insurance Company, the WISD’s insurance carrier at the time of the explosion; however, WISD assessments indicate that the damage to its four schools far exceeded $30 million. Currently, the WISD is in litigation with Argonaut Insurance Company,8 Trident Insurance Services LLC,9and the Texas Association of Public Educators.10 Based on a district assessment and planning presentation to the WISD Board of Trustees on April 29, 2013, the proposed cost for rebuilding temporary facilities and renovating the facilities damaged by the explosion would amount to $16,562,706.11 This Phase One cost estimate for temporary facilities and renovations includes the following: • Existing administrative and office building renovations. • High school football stadium renovations. • Existing middle school site (1967 gymnasium repair, 1923 and 1957 building weatherization, maintenance and transportation building replacement). • Existing elementary school cafeteria additions and building renovations. • WISD-wide demolition and temporary classrooms. • Loose equipment moving and temporary storage. • WISD-wide technology connectivity. • Contingency funds. The initial proposed estimated cost for Phase Two rebuilding—including a new high school, new intermediate and middle school, new track and field facility, new maintenance and transportation permanent replacement building and contingency, and program financial audit—was $100,791,719.12 13.0 Appendix B: FGAN Incidents Tables Appendix B provides two tables, both depicting incidents involving FGAN. CSB listed only those incidents that it could confirm. As such, these lists are not meant to be comprehensive. The first table

8 Argonaut Insurance provides specialty property and casualty insurance and is a subsidiary of Argo Group International Holdings, Ltd. 9 Trident Insurance Services is a specialty commercial insurance provider for small- to middle-market public sector entities; it served as the administrator and adjustor for the insurance policy sold by Argonaut Insurance Company. 10 The Texas Association of Public Educators is a nonprofit organization managed by Argonaut Insurance Company to assist in the procurement of insurance and the administration of claims for school districts. 11 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015). 12 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 253 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

(Table 17) provides only those FGAN incidents that occurred at stationary sites. The second table (Table 18) shows all other FGAN incidents, many of which are transportation-related. The incidents are listed chronologically. Date, location, and a brief description of each incident are provided. For transportation incidents, the location given is the location where the incident occurred. An indication of whether the incident involved fire and/or explosion is also included. Quantity, or mass, of FGAN involved in each incident is provided as well. This information may or may not reflect the quantity of FGAN that actually caught fire and/or detonated. Where available, a description of casualties and property damage is given. Where information could not be found or determined, entries appear blank. Of the 32 total confirmed FGAN incidents researched by CSB, 22 occurred at stationary sites. At least 654 fatalities resulted from these stationary-site incidents. Thousands were injured and/or evacuated. Of the 10 FGAN incidents that occurred at non-stationary sites, at least 823 were fatally injured. Again, thousands were injured and/or evacuated.

West Fertilizer Company Final Report January 2016 254 Table 17. FGAN Incidents at Stationary Sites Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 14-Jan- 1916 Gibbstown NJ, USA Explosion occurred in evaporating pan

x 4K • One fatality • 12 injured Plant property heavily damaged 1 21-May -1921 Oppau, Germany Detonation involved FGAN and ammonium sulfate mixture or hidden explosives

x 900K • 561 fatalities • 2,000 injured Buildings flattened 2 1-Mar- 1924 New Brunswick (Nixon), NJ Explosion occurred at fertilizer building x x

• At least 20 fatalities • A dozen missing

3 5-Aug- 1940 Miramas, France Explosion of freight car launched explosive shell into burning mixture of FGAN and toluene at storage building x x 480K

4 26-Aug- 1947 Presque Isle, ME Fire involving fertilizers occurred

x

5

1 NFPA. Quarterly of the NFPA, Vol. 16, No. 1. July 1922. See: https://books.google.com/books?id=- MAdAQAAIAAJ&printsec=frontcover&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false (accessed on December 30, 2015). 2 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 3 See: http://query.nytimes.com/gst/abstract.html?res=9E05EEDD1E3CE733A25751C0A9659C946595D6CF (accessed on December 31, 2015). 4 See: http://www.societechimiquedefrance.fr/extras/Guiochon%20VO/exinvolontaireVO.htm (accessed on December 31, 2015). 5 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

West Fertilizer Company Final Report January 2016 255 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 1-Sep- 1947 St. Stephens, Canada Fire occurred in warehouse containing bagged FGAN

x

800K

6 14-Oct- 1949 Independence, KS Fire occurred in warehouse next to storage building containing FGAN piled in paper bags

x

1. 8– 5.4 million

7 9-Nov- 1966 Mt. Vernon, MO Explosion involving bagged FGAN occurred x x 100K

8 c. 1967 USA Screw conveyor shaft for FGAN burst after welding operation x x

9 c. 1973 Cherokee, OK Severe storage fire occurred in wooden FGAN storage area x x 28 million None injured

10 c. 1978 Rocky Mountain, NC Fire occurred at storage facility containing FGAN

x

1 million

Storage facility destroyed by fire 11

6 Ibid. 7 Ibid. 8 Ibid. 9 ABS Consulting. “West Fertilizer Incident Support Services Final Report.” August 28, 2015. 10 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 11 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

West Fertilizer Company Final Report January 2016 256 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References c. 1979 Moreland, ID Fire involved wood framework and belting of overhead conveyor system in fertilizer plant while being used to unload railroad car of FGAN

x

400K

Fire spread to roof 12 c. 1982 United Kingdom Fire in warehouse where wooden furniture stored near FGAN resulted in deflagration x x 6 million 750–1,000 evacuated

13 13-Dec- 1994 Port Neal, IA Two explosions occurred at the Terra Industries AN plant

x

• Four fatalities • 18 injured • Anhydrous ammonia released • Ground water under plant contaminated 14 6-Jan- 1998 Xingping, Shaanxi, China Explosions occurred at fertilizer company

x

• 24 fatalities • 56 injured

12 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013. 13 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 14 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 257 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 21-Sep- 2001 Toulouse, France Explosion occurred in warehouse containing FGAN and TGAN

x 400 – 600 K (TGAN+FGAN) • 29 fatalities • Nearly 2,500 injured, 30 of which severe Severe damage to plant and surrounding community 15 Jan- 2003 Cartagena, Murcia, Spain Fertilizer storage facility held self-sustained detonation fire x x

16 Oct- 2003 Saint-Romain- en-Jarez, France Fire occurred in end user storage facility containing FGAN in bags x x 10K Three heavily injured

17 30-Jul- 2009 Bryan, TX Fertilizer plant caught fire x

Over 80,000 evacuated

18

15 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 16 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013. 17 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 18 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 258 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 17-Apr- 2013 West, TX Fire and explosion occurred at fertilizer plant x x 80 – 100 K • 15 fatalities • Over 236 injured • Facility destroyed • Widespread damage to over 150 offsite buildings, including high school, middle school, intermediate school, apartment complex, and nursing home • Early estimates placed property damage at over $100 million

29-May- 2014 Athens, TX Fertilizer warehouse containing FGAN caught fire and burned x

19 12-Aug- 2015 Tianjin, China Hazardous materials storage warehouse containing AN* caught fire and exploded x x

Over 100 fatalities

20

19 Babrauskas, Vytenis. “Explosions of ammonium nitrate fertilizer in storage or transportation are preventable accidents.” Journal of Hazardous Materials (2015). 20 See: http://www.theguardian.com/world/2015/aug/18/tianjin-blasts-warehouse-handled-toxic-chemicals-without-licence-reports (accessed on January 19, 2016)

West Fertilizer Company Final Report January 2016 259 Table 18. Non-Stationary FGAN Incidents Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 16-Apr- 1947 Texas City, TX Fire occurred in hold of ship and detonated x x 4–11 million • Approximately 500 fatalities • Approximately 3,000 injured • 2,000 left homeless

• Commercial and residential buildings damaged or destroyed • Ships destroyed • Two planes knocked out of sky • Barge lifted out of water • Early property damage total estimated at approximately $40 million 21 23-Jan- 1953 Red Sea, Israel Spontaneous ignition of paper bags containing FGAN on ship x x 8–16 K

Ship destroyed 22 17-Dec- 1960 Traskwood, AR Explosion occurred in cars containing FGAN, petroleum, and paper x x 80—100 K

23

21 NFPA. “The Texas City Disaster.” The Quarterly. July 1947. 22 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 23 Ibid.

West Fertilizer Company Final Report January 2016 260 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 1972 Taroon, Australia Transport of low density bagged AN prills involved in fire and explosion x x

Three fatalities

24 c. 1997 Brazil Delayed explosion occurred involving truck loaded with FGAN that caught fire due to nearby petrol tanker x x

25 c. 2000 FL Collision occurred between AN truck and gasoline tanker

x

26 18-Feb- 2004 Neyshabur, Khorasan, Iran Fire and explosion resulted from derailment of train containing bagged FGAN x x 840K 300 fatalities

27 Feb- 2004 Barracas, Spain Accident occurred during road transport of FGAN x x 50K • Two fatalities • Three injured

28

24 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 25 Ibid. 26 Ibid. 27 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 28 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28.

West Fertilizer Company Final Report January 2016 261 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References May- 2004 Near Bucharest, Romania Truck accident occurred during road transport of bagged FGAN x x 50K At least 18 fatalities

29 17-Feb- 2007 Estaca de Bares, Spain Self-sustained decomposition fire of nitrogen, phosphorous, potassium (NPK) fertilizer occurred in cargo of ship x

1. 024

million (NPK)

30

29 Ibid. 30 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 262 14.0 Appendix C: TFI Safety and Security Tools The Fertilizer Institute (TFI) offers a wide variety of tools designed to support the fertilizer industry. Most of these tools are information based and readily accessible online; some of the tools, however, are also interactive, allowing for personalization and customization. These tools include the following: • Access to a new online Compliance Assessment Tool. • General fertilizer retail industry information resources, such as industry fact sheets, fertilizer product fact sheets, and infographics. • New fertilizer grade ammonium nitrate (FGAN) guidelines, “Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Retail Facilities.” • An educational brochure, “America’s Security Begins with You,” designed to alert the agriculture community of the dangers associated with ammonium nitrate (AN) if it ends up in the wrong hands. • A brochure, “Health Effects of Ammonia,” discussing the sources and uses of ammonia as well as how the body processes it. • Newly updated liquid fertilizer guidelines, “Aboveground Storage Tanks Containing Liquid Fertilizer–Recommended Mechanical Integrity Practices,” which provides recommended uniform industry inspection and maintenance procedures for aboveground storage tanks of liquid fertilizer.1 • An anhydrous ammonia brochure, “Recommended Practices for Loading/Unloading Anhydrous Ammonia Rail Tank Cars in North America–Reduce and Eliminate Non-Accidental Release,” accompanied by an associated DVD. • Access to a new nonprofit organization, ResponsibleAg, an industry-led stewardship2 initiative founded to promote the public welfare by helping agribusinesses comply with safety and security rules regarding the handling and storage of fertilizer products.3 • Access to a multimedia safety training program, the “Anhydrous Ammonia Training Tour,” developed through TFI sponsorship of the Transportation Community Awareness and Emergency Response and focused on the provision of pertinent information regarding the properties of ammonia, steps that should be taken to ensure safe transport of ammonia, appropriate emergency response measures in case of an ammonia release, and hands-on training.4 • Access to free web-based anhydrous ammonia safety training, composed of subject-based training modules on (1) properties of ammonia, (2) personal protective equipment, (3) transportation of ammonia to and from the field, (4) safe hook-up of ammonia tanks in the field, and (5) emergency response and first aid procedures.5

1 See: http://www.tfi.org/safety-and-security-tools/recommended-mechanical-integrity-guidelines-aboveground- storage-tanks-liqu (accessed on December 30, 2015). 2 Merriam-Webster defines a stewardship as “the activity or job of protecting and being responsible for something.” 3 See: http://www.responsibleag.org/FAQ.cgi (accessed on December 30, 2015). 4 See: http://www.tfi.org/safety-and-security-tools/transcaer%C2%AE-anhydrous-ammonia-safety-training (accessed on December 30, 2015). 5 See: http://www.tfi.org/safety-and-security-tools/web-based-anhydrous-ammonia-safety-training (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 263 • Access to a web-based compliance tool, myRMP Suite of Guidance Materials, a revised version of the Retail Guidance Document for Agricultural Retailers supported by the U.S. Environmental Protection Agency.6 • A new suite of second-generation web-based tools, mySPCC Suite of Guidance Materials Version 2.0, developed exclusively to assist agricultural retailers in implementing their Spill Prevention, Control, and Countermeasures (SPCC) plans, which enables the personalization of such plans to specific facilities and incorporates base information from the SPCC rule with accumulated knowledge gained by industry over the last 20 years.7

6 See: http://www.tfi.org/safety-and-security-tools/myrmp (accessed on December 30, 2015). 7 See: https://www.asmark.org/mySPCC/ (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 264 15.0 Appendix D: ResponsibleAg As part of the ResponsibleAg program, participating facilities undergo an audit once every 3 years, and as many as 17 areas of a facility (e.g., dry fertilizer, liquid fertilizer, anhydrous ammonia, shop, office, and grounds) are assessed.1 Within 24 hours after completing the audit, the auditor enters findings into a secure portal on the ResponsibleAg website.2 Once the information is processed, the participating facility receives a corrective action plan if applicable, detailing any issues detected during the audit.3 This plan not only lists the issues discovered but also provides information on how to correct the issues and a recommended time frame for doing so.4 At the end of the recommended period of time, the auditor visits the facility again for a verification audit. The participating facility obtains certification only after all outstanding issues are addressed.5 To ensure a high level of reliability, a statistically valid sample of all participating facilities receives random verification from an independent auditor, approved by ResponsibleAg, every year.6 An annual accountability report includes the number of registered facilities, credentialed auditors, completed assessments, and random verifications.

1 See: http://www.responsibleag.org/About.cgi (accessed on December 30, 2015). 2 Ibid. 3 Ibid. 4 Ibid. 5 Ibid. 6 See: http://www.tfi.org/node/736 (accessed on January 6, 2016). See also: https://www.responsibleag.org/documents/RAHandout.pdf (accessed on December 30, 2015).

FD06458 ｜ 2013_美国_West 肥料 爆炸 与 火灾 - West Fertilizer Explosion and Fire__最终报告.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因：燃气/爆炸 ｜ 来源格式：pdf

U.S. Chemical Safety and Hazard Investigation Board

Rafael Moure-Eraso, Ph.D. Chairperson

Mark Griffon Board Member

Beth J. Rosenberg, ScD, MPH Board Member

May 17, 2013

The Honorable Barbara Boxer Chairman U.S. Senate Committee on Environment and Public Works 410 Dirksen Senate Office Building Washington, DC 20510

Dear Chairman Boxer:

Thank you for the opportunity to share information on the U.S. Chemical Safety Board’s (CSB’s) ongoing investigation into the tragic explosion and fire on April 17, 2013, at the West Fertilizer Company in West, Texas. I would also like to thank you for your ongoing support and interest in the CSB’s investigations and mission.

The CSB deployed a team of 18 investigators and other technical experts within 24 hours of the incident and has maintained a continuous presence in West. The sudden blast at West Fertilizer led to at least 14 fatalities, approximately 200 injuries, and widespread damage and destruction to the surrounding community. The damage to homes and apartments – as well as vulnerable facilities like schools and a nursing home – are the worst the CSB has ever seen from any chemical incident since we were established in 1998.

To summarize what is currently known about the incident: the disaster occurred at the West Fertilizer site after normal business hours, at about 8 p.m. on April 17. The facility was a small retail distribution center that served farmers in the surrounding community and had approximately 15 employees. No manufacturing occurred at the site, only blending of fertilizers for retail customers. Fertilizers such as ammonium nitrate and anhydrous ammonia were delivered to the site by rail car or truck. The ammonium nitrate, a granular solid, was stored in the facility’s fertilizer warehouse building in bins. Both the warehouse building itself and the bins were of combustible wooden construction, and the building also contained significant quantities of combustible materials such as seeds stored near the ammonium nitrate. Not only did the building lack fire protection systems such as automatic sprinklers, but current U.S. fire codes do not clearly require sprinklers in such buildings, leaving such decisions to the discretion of local authorities. Since the state of Texas and many Texas counties (including McLennan

U.S. Chemical Safety and Hazard Investigation Board

County where the West facility was located) have not adopted any mandatory fire code, it is not clear that sprinklers could have been required at West Fertilizer.

The incident began with a small fire that spread to involve the combustible materials surrounding the ammonium nitrate. Through an as-yet undetermined mechanism, this caused the ammonium nitrate to detonate with the force of multiple tons of TNT. First responders who were nearby were killed or severely injured, and the resulting shockwave damaged or destroyed buildings in a large area of West, including three public schools, an apartment block, and a nursing home.

We have received valuable cooperation in the investigation from West Fertilizer company personnel as well as the mayor and other civic leaders in West. We have also had exchanges of information with the fertilizer industry, including The Fertilizer Institute, which represents manufacturers and distributors of ammonium nitrate as well as many other fertilizer materials. We believe the industry is committed to learning from this incident and making any appropriate safety improvements.

The CSB is dedicated to providing a thorough public account of all the factors that led to this catastrophe. After a disaster of this scale, it is essential to pursue improved safety as we look toward the future. Here are our answers to the specific questions you asked in your April 30 letter.

Question 1: Please describe the CSB’s plans to investigate the explosion at the West facility, including the scope and timelines of the investigation.

The CSB will be examining many issues surrounding the explosion such as the safe storage and handling of ammonium nitrate, the siting of hazardous chemical facilities in proximity to vulnerable buildings and residences, and emergency responder safety. The investigation will examine the adequacy of national standards, industry practices, and regulations for the safe storage and handling of ammonium nitrate.

The CSB’s timeline for completion of its investigation is 12 – 18 months but we will seek to release preliminary findings, and possibly interim or urgent safety recommendations, as appropriate prior to the release of a final report. The investigation is occurring at time of many challenges for the agency, including a longstanding backlog of open investigations (related to a limited number of investigators on staff) and the impact of the current budget sequestration, which greatly constrains new hiring.

The CSB’s investigative team has identified a number of key areas of inquiry that we will pursue over the course of our investigation:

• Analysis of the adequacy of existing standards for the safe handling and storage

of ammonium nitrate (AN). Two prominent U.S. code organizations (the National Fire Protection Association and the International Code Council) have developed fire safety codes for AN. The CSB will examine the adequacy of these codes (such as NFPA 400) in light of the findings about this incident. The current codes discourage U.S. Chemical Safety and Hazard Investigation Board

the storage of combustibles near AN but have not incorporated recommendations from overseas regulators for measures such as dedicated, noncombustible storage buildings for AN.

1. Application of fire codes to the West facility. As the CSB pointed out in a 2003

investigation of a major petroleum blending facility fire south of Houston, Texas has no statewide fire code and has adopted unusual provisions prohibiting many rural counties from adopting any fire code. As a result, the West facility was not legally required to follow either NFPA or ICC consensus fire codes related to ammonium nitrate storage.

1. Hazardous facility siting, zoning and land use planning. The West Fertilizer site

had existed since at least the early 1960’s before the northern section of West was extensively developed. Over the ensuing years, numerous residences, a nursing home, a health care facility, several schools, athletic fields, and other facilities were constructed nearby the fertilizer site. The explosion destroyed buildings hundreds of feet away and caused significant damage to buildings as much as half a mile distant. Several fatalities occurred offsite in public or residential facilities. The CSB will examine how land use planning around hazardous facilities can be improved to better protect the public. The CSB will also conduct vulnerability assessments to seek to understand the potential “worst case” from an ammonium nitrate explosion near structures like schools. In West, the town’s Intermediate School was located only a few hundred feet from the site and was virtually destroyed; had children been present at the time of the explosion, the effects could have extremely severe. The fact there are several thousand retail fertilizer facilities across the country underscores the importance of these assessments.

1. Ammonium nitrate detonation mechanisms. Catastrophic ammonium nitrate

explosions have occurred periodically around the world over the past hundred years. Scientific literature suggests that pure ammonium nitrate is difficult to detonate but can be sensitized by heating, shock, contamination, and/or confinement. The CSB will examine which of these factors may have contributed to the West explosion and how other facilities that store AN fertilizer should minimize the risk of an explosion.

1. Inherently safety alternatives. The CSB has already began a dialogue with the

fertilizer industry and others to better understand the usage of AN fertilizer, which currently represents only about 2% of applied nitrogen fertilizer in the U.S. The CSB will examine whether other AN or nitrogen formulations could achieve the same benefit for farmers with a significantly reduced risk of explosion for storage sites.

1. EPA Risk Management Program (RMP). Following the Bhopal disaster in India in

1984, Congress mandated in 1990 that EPA adopt a regulatory Risk Management Program (RMP) to prevent acute chemical catastrophes that would threaten the public. EPA’s final rule in 1996 imposed safety requirements for certain toxic and flammable substances but did not include reactive or explosive materials like AN. In 2002, the CSB recommended that EPA broaden the coverage under the RMP program

U.S. Chemical Safety and Hazard Investigation Board

to include hazardous reactive chemicals, of which AN is an example.1

1. Emergency preparedness for chemical disasters. Numerous CSB investigations

around the country have highlighted community challenges in preparing for and responding to major chemical incidents. In 1986, Congress established a system to improve preparedness through state and local emergency planning committees, which were required to be set up across the country. However, this system has no federal funding mechanism and often relies on the services of volunteers and local committees that lack much real authority. The CSB will examine the efforts of West Fertilizer and community authorities to exchange information about the site’s hazards. EPA has not acted on the recommendation to broaden coverage, and as EPA Inspector General reports have noted the agency has also had difficulty providing resources and adequate inspections to enforce even the existing programs at thousands of hazardous facilities across the country. This issue should be revisited in light of the community devastation from the West explosion, as well as the ongoing occurrence of a significant number of other reactive incidents nationally.

1. Firefighter training and hazard awareness. The extensive and tragic loss of life in

West – the incident killed ten responders along with two members of the public who were assisting the response – makes it important to look for opportunities to improve training materials and guidance for fighting fires that may involve ammonium nitrate. The CSB will review fire codes, DOT guidance for firefighters, and others materials that may guide responses to future AN fires.

Questions 2: Please provide a list and description of all recommendations you have made in the past relating to reducing risks at facilities that handle highly explosive and toxic materials and whether they have been adopted by government or industry Question 3: Please identify the recipients of these recommendations

The CSB identified a number of prior investigations that related to highly explosive or toxic materials, dating back to the CSB’s establishment in 1998. Most CSB reports include multiple recommendations designed to promote improved safety in the future. The attached table summarizes the recommendations from these reports, including the text, date of issue, and current status or date of closure. Across all of its investigations, the CSB has now achieved a favorable closure rate of approximately 72%, and this figure continues to increase. However, the CSB recognizes that certain key recommendations over the years – including the above-mentioned recommendations for strengthening the EPA Risk Management Program – continue to need further action.

Additional Relevant Issues and Challenges For the CSB’s West Investigation

The CSB considers the West explosion to be among the most serious U.S. chemical incidents affecting the public in many decades. We believe that an independent root-

1 The West Fertilizer facility was covered under the RMP program for its anhydrous ammonia but not for its ammonium nitrate. The ammonia was not directly involved in the explosion.

U.S. Chemical Safety and Hazard Investigation Board

cause investigation is therefore of the utmost priority. In addition the CSB is statutorily compelled to investigate the accident under its authorizing statute, due to the fatalities among members of the public. Although we remain hopeful of meeting the timeline and key objectives discussed above, we also note that the investigation has encountered very significant obstacles and challenges.

At the same time the CSB deployed its investigative team and associated fire and blast experts, the Justice Department’s Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) mobilized a large “national response team” that assumed essentially exclusive control of the incident site in concert with Texas State Fire Marshal’s Office (SFMO) personnel. These criminal investigators have exercised exclusive control of the site for a full one-month period, from April 17, 2013, until today and have altered or removed almost all relevant physical evidence at the site. The ATF and SFMO consistently expressed the position that CSB was not permitted to conduct separate interviews, prepare expert analysis, or author its own independent report. The ATF and SFMO stated that because in their view this was exclusively a criminal investigation, there could be only one version of what occurred and one report.

During the critical period before the accident site was completely altered, CSB investigators were explicitly excluded from the site by ATF/SFMO and received only limited access days later. The CSB investigative leadership had no meaningful input into how the site was managed or what pieces of potential evidence were collected, altered, removed, destroyed, or discarded. Throughout this period, the incident site was massively and irreversibly altered by and under the direction of ATF personnel, who used cranes, bulldozers, and other excavation apparatus in an ultimately unsuccessful quest to find a single ignition source for the original fire. In a news statement on May 16, the ATF said that over the past month it has “spent approximately $500,000 in the rental of heavy equipment, which assisted in excavating the scene”2

– fully half the cost of their overall inquiry. In return for limited and unsatisfactory site access, the CSB had to agree to conduct no witness interviews, which form an integral and essential part of the CSB investigative process. This state of affairs with witness interviews continued for almost three weeks after the incident -- an unprecedented and harmful delay. On the morning of May 7, the CSB finally commenced its interview process with a knowledgeable plant employee who had already been interviewed multiple times by the ATF. As soon as the witness left his car near the CSB’s temporary offices in downtown West, he was suddenly surrounded by four armed ATF and SFMO agents and taken away for further ATF interrogation at an unknown location. This occurred without any explanation or prior notice to the CSB. Only after numerous protests and inquiries did the witness eventually reappear about four hours later.

2 http://www.atf.gov/press/releases/2013/05/051613-hou-atf-and-the-state-fire-marshals-office-conclude- scene-investigation-at-the-west-fertilizer-plant.html (Accessed May 17, 2013).

U.S. Chemical Safety and Hazard Investigation Board

Other troubling occurrences include the removal by ATF of chemical evidence from the site (such as residual ammonium nitrate masses that might show signs of how the material became sensitized to explosion). These actions followed a May 4 written agreement between the ATF and the CSB that explicitly provided the CSB with authority to take its own chemical samples. ATF further disregarded the May 4 agreement by denying site access to CSB personnel after May 13, including denying access to two presidentially appointed CSB board members.

Finally in announcing its departure from the site in a news conference on May 16, ATF officials called the incident of “undetermined” origin and proposed three possible ignition sources for the initial small fire: an electric fault, a golf cart, or an “intentional act.”3 In response to media questions, the state’s assistant fire marshal said the ATF/SFMO team would not release its collected evidence to the CSB because of what he termed the “ongoing criminal investigation.” This collected evidence, which remains unavailable, includes chemical samples, unique company documents that potential include chemical inventory information and safety records,4

debris objects collected from the site, and digital measurements of the AN explosion crater that the ATF obtained and then denied the CSB and other parties the right to obtain separately. The ATF then dug up the crater with heavy equipment, making duplication of the measurements impossible. Conclusion

The CSB is uniquely positioned to determine the root cause of major chemical accidents and to make safety recommendations that will assure greater safety at industrial facilities around the country. The April 17 explosion at West Fertilizer was a terrible tragedy and one of the worst chemical accidents in the U.S. in decades. We believe the CSB’s findings and safety recommendations will be important not only to the community of West, Texas, but also to similar facilities and communities across the country where ammonium nitrate or other hazardous substances are produced, stored, or distributed.

Due to the circumstances outlined above, whereby the CSB was precluded from obtaining key evidentiary materials currently in the possession of ATF, we would like to

3 We are not aware of any affirmative evidence of an intentional criminal act that led or contributed to the fire of explosion. All indications are that the event was an industrial accident within the CSB’s investigative jurisdiction. Although ATF personnel detained a West paramedic on illegal munitions charges on May 3, no evidence has surfaced linking him to the initiation of the incident. West municipal officials have stated they believe the incident was of accidental original and discounted any role of the paramedic. 4 During periods when they did have limited access to the site, CSB investigators observed unsecured company documents blowing around the site and exposed to rain and the elements. The ATF had no apparent interest in the documents, which the CSB observed included potentially unique records of chemicals stored or sold at the site. The CSB team pointed out this issue to ATF field personnel, and then the CSB chairperson raised the issue to U.S. Deputy Attorney General James Cole in a meeting in Washington, DC, on April 26, at which meeting the deputy attorney general and the chairperson pledged cooperation, preservation of evidence at West, and the ability for the CSB to conduct its independent statutory investigation. ATF later asserted the documents at West had been secured but has nonetheless refused to provide any copies to the CSB, and their current location is unknown.

U.S. Chemical Safety and Hazard Investigation Board

request your assistance in obtaining a number of specific items that remain under ATF/SFMO custody. They include but are not limited to:

• Continued access to the accident site • GIS mapping of the crater and GPS debris coordinates • Priority access to the physical evidence • Unique company documents including: o records of chemical inventories o safety records o employee training records o any other company documents • Debris collected from the site • Digital measurements of the AN explosion crater

To date the CSB has experienced significant obstacles that potentially compromise and delay our ability to complete the “comprehensive investigation” that you have rightly demanded, and that we would very much like to produce. We expect that with your support we can obtain the critical investigation data necessary to generate a valuable safety investigation that will provide clear, actionable recommendations to prevent the repetition of this tragedy.

Again, thank you for your continued support of the CSB’s mission and activities.

Sincerely,

Rafael Moure-Eraso, Ph.D., CIH Chairperson

FD06459 ｜ 2013_美国_West 肥料 爆炸 与 火灾 - West Fertilizer Explosion and Fire__最终报告_3.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因：燃气/爆炸 ｜ 来源格式：pdf

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD INVESTIGATION REPORT FINAL WEST FERTILIZER COMPANY FIRE AND EXPLOSION (15 Fatalities, More Than 260 Injured) WEST FERTILIZER COMPANY WEST, TX KEY ISSUES: APRIL 17, 2013 • REGULATORY OVERSIGHT • HAZARD AWARENESS • EMERGENCY PLANNING AND RESPONSE • FERTILIZER GRADE AMMONIUM NITRATE STORAGE PRACTICES • LAND USE PLANNING AND ZONING REPORT 2013-02-I-TX

[This page intentionally left blank.]

West Fertilizer Company Final Report January 2016

Dedication This report is dedicated to the 12 emergency responders and 3 members of the public who lost their lives as a result of the explosion at the West Fertilizer Company on April 17, 2013.

Morris Bridges Perry Calvin Jerry Dane Chapman Cody Frank Dragoo Kenneth Harris Adolph Lander James Matus Judith Ann Monroe Joseph Pustejovsky Cyrus Adam Reed Mariano C. Saldivar Kevin William Sanders Douglas Snokhous Robert Snokhous William Uptmor, Jr.

West Fertilizer Company Final Report January 2016 1 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Contents 1.0 EXECUTIVE SUMMARY ........................................................................................................... 13 1.1 Overview ........................................................................................................................................ 13 1.2 Federal and State Response ........................................................................................................... 14 1.2.1 Joint SFMO/ATF Investigation ........................................................................................ 14 1.2.2 CSB Response ................................................................................................................... 15 2.0 BACKGROUND ........................................................................................................................... 16 2.1 West Fertilizer Company ............................................................................................................... 16 2.1.1 Facility Operations Description ........................................................................................ 18 2.1.2 Facility Layout and Materials of Construction ................................................................. 23 2.1.3 Unloading of Fertilizer ...................................................................................................... 25 2.1.4 Housekeeping .................................................................................................................... 26 3.0 INCIDENT DESCRIPTION .......................................................................................................... 27 3.1 West Police Department ................................................................................................................ 27 3.2 West Volunteer Fire Department (WVFD) .................................................................................... 28 3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer Fire Departments .................... 29 3.4 Consequences ................................................................................................................................. 30 3.4.1 Fatalities and Injuries ........................................................................................................ 30 3.4.2 Property Damage .............................................................................................................. 32 3.4.3 West Independent School District .................................................................................... 39 3.4.4 West Rest Haven Nursing Home ...................................................................................... 49 3.4.5 West Terrace Apartment Complex ................................................................................... 53 3.4.6 Private Residences ............................................................................................................ 54 3.4.7 Infrastructure Damage to the City of West ....................................................................... 55 4.0 INCIDENT ANALYSIS ................................................................................................................ 57 4.1 Fertilizer Grade Ammonium Nitrate (FGAN) ............................................................................... 57 4.1.1 The Fertilizer Industry ...................................................................................................... 57 4.1.2 FGAN Properties .............................................................................................................. 57 4.1.3 FGAN Hazards ................................................................................................................. 58 4.1.4 Previous Incidents Involving FGAN ................................................................................ 61 4.1.5 Historical Knowledge of FGAN Fire and Explosion Hazards .......................................... 62

West Fertilizer Company Final Report January 2016 2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2

Factors Contributing to the Massive Fire and Explosion at the WFC ........................................... 64 4.2.1 Contamination of the FGAN Pile ..................................................................................... 64 4.2.2 Heating and Ventilation .................................................................................................... 66 4.3 Detonation Scenarios ..................................................................................................................... 68 4.3.1 Scenario 1: Detonation from the Top of the FGAN Pile .................................................. 69 4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to Fire ............. 71 4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin ......................... 73 4.4 Forensic Testing of West Fertilizer Company Samples ................................................................. 73 4.5 Blast and Impact Analysis ............................................................................................................. 78 4.5.1 Seismic Data ..................................................................................................................... 81 5.0 COMMERCIAL PROPERTY AND LIABILITY INSURANCE ................................................. 82 5.1 Triangle Insurance Coverage and Audits (2006–2010) ................................................................. 83 5.1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards ............................ 86 5.2 U.S. Fire Insurance Coverage and Audits (2010–2013) ................................................................ 86 5.3 Insurance Claims and Other Aid after the Explosion .................................................................... 87 5.4 FGAN Facilities in Texas and the Potential for Offsite Consequences ......................................... 88 5.5 Limits of Insurance Coverage in Texas ......................................................................................... 90 5.6 Insurance Services Office Rating ................................................................................................... 94 5.6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer Company ............ 95 6.0 INHERENTLY SAFER TECHNOLOGY ..................................................................................... 97 6.1 Alternative Formulations of FGAN ............................................................................................... 99 6.2 Inherently Safe Building Design and Storage .............................................................................. 102 7.0 EMERGENCY RESPONSE ........................................................................................................ 104 7.1 Firefighter Response .................................................................................................................... 105 7.2 Key Contributing Factors to Emergency Responders’ Fatality ................................................... 107 7.2.1 Lack of Incident Command System ................................................................................ 107 7.2.2 Lack of Established Incident Management System ........................................................ 108 7.2.3 Firefighter Training ......................................................................................................... 110 7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training ................................... 112 7.2.5 Lack of Situational Awareness and Risk Assessment Knowledge ................................. 116 7.2.6 Lack of Pre-Incident Planning at Facility ....................................................................... 117 7.3 Limited and Conflicting Technical Guidance on FGAN ............................................................. 119

West Fertilizer Company Final Report January 2016 3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1

Emergency Response Guidebook ................................................................................... 120 7.3.2 Safety Data Sheets .......................................................................................................... 125 7.4 Lessons Not Learned and Lessons Learned ................................................................................. 127 7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not Learned ........... 127 7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned ............................................ 131 7.5 Other Post-Incident Investigation Reports Related to Firefighting .............................................. 136 7.5.1 Texas State Fire Marshal’s Office (SFMO) .................................................................... 136 7.5.2 NIOSH Findings and Recommendations ........................................................................ 137 7.6 Summary of Incident Emergency Response ................................................................................ 138 7.7 Firefighter Training Grants and Programs ................................................................................... 139 7.7.1 Need for Training ............................................................................................................ 139 7.7.2 National Firefighter Training Funds and Programs ........................................................ 142 7.7.3 National Membership Firefighter Associations .............................................................. 163 8.0 REGULATORY ANALYSIS ...................................................................................................... 164 8.1 President Obama’s Executive Order 13650 ................................................................................. 164 8.2 OSHA Explosives and Blasting Agents Standard ........................................................................ 165 8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard .................. 171 8.2.2 Need for an Emphasis Program ...................................................................................... 173 8.3 Chemical Facility Anti-Terrorism Standards (CFATS) ............................................................... 173 8.3.1 AN Screening Thresholds ............................................................................................... 174 8.4 Safety Management Programs ..................................................................................................... 176 8.4.1 OSHA Process Safety Management Standard ................................................................ 176 8.4.2 EPA Risk Management Program Rule ........................................................................... 183 8.5 Emergency Planning .................................................................................................................... 195 8.5.1 Federal Emergency Planning .......................................................................................... 196 8.5.2 State Emergency Planning in the State of Texas ............................................................ 199 8.5.3 City Emergency Planning in the City of West ................................................................ 200 8.5.4 Other Emergency Planning Requirements ...................................................................... 204 8.6 Fire Protection Codes and Standards ........................................................................................... 205 8.6.1 National Fire Protection Association .............................................................................. 206 8.6.2 International Code Council ............................................................................................. 209 8.6.3 State Fire Codes .............................................................................................................. 210

West Fertilizer Company Final Report January 2016 4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7

Post-Incident State and Local Regulatory Developments ............................................................ 213 8.7.1 Texas Commercial Fertilizer Rules ................................................................................ 214 8.7.2 Texas House Bill 942 ...................................................................................................... 214 8.7.3 Athens City Ordinance .................................................................................................... 215 8.8 Industry Standards ....................................................................................................................... 216 8.8.1 The Fertilizer Institute (TFI) ........................................................................................... 216 8.8.2 Agricultural Retailers Association (ARA) ...................................................................... 218 8.8.3 Product Stewardship ....................................................................................................... 218 8.8.4 Efforts to Address FGAN Hazards Post-Incident ........................................................... 220 9.0 LAND USE .................................................................................................................................. 223 9.1 Land Use Planning: An Introduction ........................................................................................... 223 9.2 The City That “Came to” the WFC Over the Years .................................................................... 224 9.3 Lack of Zoning Regulations ......................................................................................................... 227 9.3.1 Importance of Land Use Planning in Siting Communities Near Facilities Storing FGAN and Other Hazardous Chemicals ..................................................................................... 233 9.3.2 International Perspectives ............................................................................................... 234 9.4 Efforts to Address Land Use Planning After the West Incident .................................................. 239 10.0 KEY FINDINGS .......................................................................................................................... 240 11.0 RECOMMENDATIONS ............................................................................................................. 242 12.0 APPENDIX A: REBUILDING OF THE WEST INDEPENDENT SCHOOL DISTRICT ........ 250 13.0 APPENDIX B: FGAN INCIDENTS TABLES ........................................................................... 252 14.0 APPENDIX C: TFI SAFETY AND SECURITY TOOLS .......................................................... 262 15.0 APPENDIX D: RESPONSIBLEAG ............................................................................................ 264

West Fertilizer Company Final Report January 2016 5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figures Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps) ............................................................... 18 Figure 2. Grain Silos (Source: WFC Insurer) ............................................................................................. 19 Figure 3. West View of Fertilizer Building (Source: Bing Maps) .............................................................. 20 Figure 4. Fertilizer Building Overview (Source: Atlas Engineering) ......................................................... 21 Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer) ............. 21 Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer) ............................................................... 22 Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer) .......................................... 23 Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB) ..................................................................... 24 Figure 9. Elevator System Recovered from Blast Debris (Source: CSB) ................................................... 25 Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public) ............................... 30 Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health District) ..................................................................................................................................... 31 Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol) .................................. 33 Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting) ..................................................... 34 Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting) ....................... 34 Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB) ............ 35 Figure 16. Liquid Fertilizer Tank Damage (Source: CSB) ......................................................................... 35 Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB) ............................................................ 36 Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB) ....................................... 37 Figure 19. Damaged Playground Equipment (Source: ABS Consulting) ................................................... 37 Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting) .......................................... 38 Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB) ............................................... 39 Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth) ... 40 Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB) ............................................................. 42 Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting) .......... 43 Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting) ................................................... 43 Figure 26. Embedded Glass in Assignment Poster in WIS Room 12 (Source: ABS Consulting) ............. 44 Figure 27. Interior of Burned Northeast Section of WIS (Source: ABS Consulting) ................................ 44 Figure 28. WIS Gymnasium (Source: ABS Consulting) ............................................................................ 45 Figure 29. WIS Classroom 20 (Source: ABS Consulting) .......................................................................... 46 Figure 30. WHS Evacuation Map (Source: WISD) .................................................................................... 47

West Fertilizer Company Final Report January 2016 6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps) ........................................................................................... 48 Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS (Source: ABS Consulting) 49 Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting) ..................... 50 Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB) ....................................... 52 Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West Rest Haven (Source: ABS Consulting) ..................................................................................... 53 Figure 36. West Terrace Apartment Complex East Façade (Source: CSB) ................................................ 54 Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting) ......... 55 Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) (Source: Member of the Public) .. 65 Figure 39. Dark and Heavy Smoke, Rich in Soot (Source: Member of the Public) .................................. 66 Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke and Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the Public) ....................................................................................................................................... 67 Figure 41. Plume of Smoke from AN Fire in Bryan, Texas (Source: College Station Fire Department).. 68 Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB) ..................... 70 Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the Public) ....................................................................................................................................... 72 Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: Forensic Laboratory) ................................................................................................................. 75 Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory) ........ 75 Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory) ............................... 75 Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory) ................................... 77 Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB) ................................................ 79 Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) ................ 80 Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering) .................. 81 Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering) ........... 81 Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National Earthquake Information Center (Source: USGS) ...................................................................... 82 Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey (Source: Triangle Insurance Company) .................................................................................................................................. 84 Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey (Source: Triangle Insurance Company) .................................................................................................................................. 85 Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: Google Earth) ............................................................................................................................ 89

West Fertilizer Company Final Report January 2016 7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) Within 1 Mile of a Texas School (Source: CSB) ............................................................................................................... 89 Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School (Source: Google Earth) ............................................................................................................. 90 Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO) .......... 95 Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO) ........... 96 Figure 60. Risk Control Hierarchy (Source: CCPS) ................................................................................... 98 Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB) ................................................. 104 Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB) ....................... 106 Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA) ................................................ 121 Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA) ................................................ 124 Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: Bryan- College Station Eagle) ............................................................................................................ 130 Figure 66. Dark Grey Smoke Originating from East Texas Ag Supply Facility in Downtown Athens, Texas (Source: Athens Fire Department) ................................................................................ 133 Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas (Source: Athens Fire Department) .......................................................................................... 134 Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke (Source: Athens Fire Department) ......................................................................................................... 135 Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA) ....... 141 Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA) ..................... 147 Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA) .................................................. 148 Figure 72. FP&S Grant Recipients in Texas (Source: FEMA) ................................................................. 148 Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS) ............................................ 175 Figure 74. Progressive Development of West (Source: GeoSearch) ........................................................ 226 Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: NBC News) ............................................................................................................................. 227

Tables Table 1. WFC Fertilizer Inventory in April 2013 ...................................................................................... 16 Table 2. Estimated Number of Students and Staff During School Hours .................................................. 41 Table 3. Infrastructure Repaired with FEMA Funding .............................................................................. 55 Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC ............ 76 Table 5. Minimum Insurance Requirements in Texas ................................................................................ 92

West Fertilizer Company Final Report January 2016 8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 6. Inherently Safer Approaches for Handling FGAN ....................................................................... 98 Table 7. Examples of AN Fertilizer Alternatives...................................................................................... 100 Table 8. Training and Experience Information of the Fatally Injured Firefighters ................................... 112 Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013 ................................ 126 Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program ................................ 158 Table 11. OSHA 29 CFR 1910.109(i) Citation History ............................................................................ 169 Table 12. CSB Investigations Involving Reactive Chemicals Since 2002 ............................................... 192 Table 13. EPCRA Chemicals and Reporting Thresholds ......................................................................... 196 Table 14. Relevant Siting Regulations ...................................................................................................... 228 Table 15. Investigations Involving Land Use Issues ................................................................................ 233 Table 16. Distribution of Grade Levels at the Old and New WISD Schools ............................................ 251 Table 17. FGAN Incidents at Stationary Sites .......................................................................................... 254 Table 18. Non-Stationary FGAN Incidents .............................................................................................. 259

West Fertilizer Company Final Report January 2016 9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Acronyms and Abbreviations

°C degrees Celsius °F degrees Fahrenheit AC air conditioning AFG Assistance to Firefighters Grant AHJ Authority Having Jurisdiction AN ammonium nitrate ANFO ammonium nitrate/fuel oil ANSI American National Standards Institute API American Petroleum Institute ARA Agricultural Retailers Association AS ammonium sulfate ATF Bureau of Alcohol, Tobacco, Firearms and Explosives CDC Centers for Disease Control and Prevention CDP Center for Domestic Preparedness CDT central daylight time CEPP Chemical Emergency Preparedness Program CERCLA Comprehensive Environmental Response, Compensation, and Liability Act CFATS Chemical Facility Anti-Terrorism Standards CFR Code of Federal Regulations CMU concrete masonry unit COI chemical of interest CSAT Chemical Security Assessment Tool CSB U.S. Chemical Safety and Hazard Investigation Board CTG Continuing Training Grant DHS U.S. Department of Homeland Security DOL U.S. Department of Labor DOT U.S. Department of Transportation DWC Division of Workers’ Compensation EDT eastern daylight time EHS extremely hazardous substance EMPG Emergency Management Performance Grant EMS emergency medical services EMT emergency medical technician

West Fertilizer Company Final Report January 2016 10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

EO Executive Order EPA U.S. Environmental Protection Agency EPCRA Emergency Planning and Community Right-to-Know Act ERDC Engineer Research and Development Center ERG Emergency Response Guidebook ERP Emergency Response Plan EU European Union FAST firefighter assist and search team FEMA Federal Emergency Management Agency FFFIPP Fire Fighter Fatality Investigation and Prevention Program FGAN fertilizer grade ammonium nitrate FP&S Fire Prevention and Safety FR Federal Register FRS Facility Registry Service g/cm3 grams per cubic centimeter GAO U.S. Government Accountability Office GPD Grant Programs Directorate HAZMAT hazardous material HAZWOPER Hazardous Waste Operations and Emergency Response HCS Hazard Communication Standard HUD U.S. Department of Housing and Urban Development HSE UK Health and Safety Executive HSNTP Homeland Security National Training Program HVAC heating, ventilation, and air conditioning IAFC International Association of Fire Chiefs IAFF International Association of Fire Fighters IAP Incident Action Plan IBC International Building Code IC incident commander ICC International Code Council ICS Incident Command System ICT Insurance Council of Texas IFC International Fire Code IME Institute of Makers of Explosives ISO Insurance Services Office

West Fertilizer Company Final Report January 2016 11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

IST inherently safer technology K-Mag potassium magnesium LEPC Local Emergency Planning Committee LNG liquefied natural gas MOU memorandum of understanding MSDS Material Safety Data Sheet NAICS North American Industry Classification System NEIC National Earthquake Information Center NERRTC National Emergency Response and Rescue Training Center NEW net explosive weight NFA National Fire Academy NFPA National Fire Protection Association NIMS National Incident Management System NIOSH National Institute for Occupational Safety and Health NOX nitrogen oxide NPD National Preparedness Directorate NTED National Training and Education Division NVFC National Volunteer Fire Council NYC New York City OSHA Occupational Safety and Health Administration OTSC Office of the Texas State Chemist PHMSA Pipeline and Hazardous Materials Safety Administration PPC Public Protection Classification PPE personal protective equipment PRV pressure relief valve PSI pounds per square inch PSM Process Safety Management (standard) PVC polyvinyl chloride Q&A question and answer RCRA Resource Conservation and Recovery Act RDPC Rural Domestic Preparedness Consortium RFI request for information RMP Risk Management Plan SAA State Administrative Agency SAFER Staffing for Adequate Fire and Emergency Response

West Fertilizer Company Final Report January 2016 12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SARA Superfund Amendments and Reauthorization Act SBA Small Business Administration SDS Safety Data Sheet SERC State Emergency Response Commission SFFMA State Firefighters’ and Fire Marshals’ Association SFMO State Fire Marshal’s Office SIC Standard Industrial Classification SOP standard operating procedure SPCC spill prevention, control, and countermeasures TAC Texas Administrative Code TCEQ Texas Commission on Environmental Quality TCFP Texas Commission on Fire Protection TDI Texas Department of Insurance TEEX Texas A&M Engineering Extension Service TFI The Fertilizer Institute TGAN technical grade ammonium nitrate TIESB Texas Industrial Emergency Services Board TNT Trinitrotoluene TR technical report TRANSCAER Transportation Community Awareness and Emergency Response TRI Toxics Release Inventory TX Texas U.K. United Kingdom USFA U.S. Fire Administration USGS U.S. Geological Survey VFD volunteer fire department WFC West Fertilizer Company WFD West Fire Department WIS West Intermediate School WISD West Independent School District WMS West Middle School WVFD West Volunteer Fire Department

West Fertilizer Company Final Report January 2016 13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Executive Summary
2. 1 Overview

On April 17, 2013, a fire and explosion occurred at the West Fertilizer Company (WFC), a fertilizer blending, retail, and distribution facility in West, Texas. The violent detonation fatally injured 12 emergency responders and three members of the public. Local hospitals treated more than 260 injured victims, many of whom required hospital admission. The blast completely destroyed the WFC facility and caused widespread damage to more than 150 offsite buildings. The WFC explosion is one of the most destructive incidents ever investigated by the U.S. Chemical Safety and Hazard Investigation Board (CSB) as measured by the loss of life among emergency responders and civilians; the many injuries sustained by people both inside and outside the facility fenceline; and the extensive damage to residences, schools, and other structures. Following the explosion, WFC filed for bankruptcy. The explosion happened at about 7:51 pm central daylight time (CDT), approximately 20 minutes after the first signs of a fire were reported to the local 911 emergency response dispatch center. Several local volunteer fire departments responded to the facility, which had a stockpile of between 40 and 60 tons (80,000 to 120,000 pounds) fertilizer grade ammonium nitrate (FGAN), not counting additional FGAN not yet offloaded from a railcar. More than half of the structures damaged during the explosion were demolished to make way for reconstruction. The demolished buildings include an intermediate school (552 feet southwest of the facility), a high school (1,263 feet southeast), a two-story apartment complex with 22 units (450 feet west) where two members of the public were fatally injured, and a 145-bed nursing home (500 feet west) where many of the seriously injured civilians resided. A middle school (2,000 feet southwest) also sustained serious but reparable damage. Section 3 describes the incident and its consequences in detail. The CSB investigated the factors that contributed to the detonation of FGAN. Section 4 describes the properties of FGAN and posits three scenarios that could lead to its detonation under the conditions present during the WFC fire. CSB concluded that the construction of the bins and other building materials as well as the lack of an automatic sprinkler system plausibly contributed to the detonation. Section 6 describes inherently safer approaches to FGAN use and storage that reduce the risk of an FGAN detonation. The total insurance-related losses from the explosion are estimated to be around $230 million and federal disaster assistance is estimated to exceed $16 million. WFC was only insured for $1 million, which fell far short of the incident’s damage. Section 5 presents CSB’s analysis of the policies and regulations that led to this as well as to the failure of the insurer to identify the risks posed by FGAN. A few years prior to the incident, WFC was dropped by one insurer for failing to address safety concerns identified in loss control surveys. The company that insured WFC at the time of the incident did not appear to have conducted its own safety inspections of the facility.

West Fertilizer Company Final Report January 2016 14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB’s analysis of the emergency response, found in Section 7, concludes that the West Volunteer Fire Department did not conduct pre-incident planning or response training at WFC, was likely unaware of the potential for FGAN detonation, did not take recommended incident response actions at the fire scene, and did not have appropriate training in hazardous materials response. CSB found several shortcomings in federal and state regulations and standards that could reduce the risk of another incident of this type. These include the Occupational Safety and Health Administration’s Explosives and Blasting Agents and Process Safety Management standards, the Environmental Protection Agency’s Risk Management Program and Emergency Planning and Community Right-to-Know Act, and training provided or certified by the Texas Commission on Fire Protection and the State Firefighters’ and Fire Marshals’ Association of Texas. CSB’s complete analysis is presented in Section 8. The location of the WFC relative to the surrounding community exacerbated the offsite consequences, leading CSB to assess whether other FGAN storage facilities could pose significant offsite risks. CSB’s analysis shows that the risk to the public from a catastrophic incident exists at least within the state of Texas, if not more broadly. For example, 19 other Texas facilities storing more than 10,000 pounds of FGAN are located within 0.5 miles of a school, hospital, or nursing home, raising concerns that an incident with offsite consequences of this magnitude could happen again. Section 9 explores the connection between land use planning and offsite consequences. 1.2 Federal and State Response In response to this incident, President Barack Obama issued Executive Order (EO) 13650, “Improving Chemical Facility Safety and Security” to coordinate federal actions to reduce the risks of another incident of this type.1 Details and updates on the status of the EO are included in Section 8.1. Early investigation activities focused on law enforcement efforts to determine if there was a criminal element to the incident. Responding governmental agencies included the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) National Response Team, Texas State Fire Marshal’s Office (SFMO), U.S. Occupational Safety and Health Administration (OSHA), Texas Commission on Environmental Equality, U.S. Federal Emergency Management Agency (FEMA), and U.S. Environmental Protection Agency (EPA). In addition, multiple state and local law enforcement and emergency response organizations responded to the scene. 1.2.1 Joint SFMO/ATF Investigation Immediately following the incident, ATF deployed to West at the invitation of SFMO and assumed control of the WFC site to conduct a joint investigation of the immediate cause and origin of the fire and explosion and determine whether the initiating fire was intentionally set. The two agencies retained

1 Executive Order 13650. “Improving Chemical Facility Safety and Security,” August 1, 2013. See: https://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facility-safety-and- security (accessed on December 8, 2015).

West Fertilizer Company Final Report January 2016 15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

control of the scene for about four weeks, interviewing witnesses, excavating the WFC site, and reconstructing the electrical system. To date, law enforcement has not made a final determination of the cause of the fire and ensuing explosion. Three possible scenarios remain under consideration: (1) faulty electrical wiring, (2) short circuit in an electrical golf cart, and (3) intentional act of arson.2 1.2.2 CSB Response CSB investigators from both the Washington, DC, and Denver, Colorado, offices deployed on April 18, 2013, supported by a contingent of contractors that included blast modeling, structural, urban search and rescue, and fire and explosion experts. The joint ATF-SFMO control of the site as a crime scene limited CSB site access and delayed CSB investigator execution of evidence-gathering protocols, chemical testing, and witness interviews. Despite the limited access in the initial stages, driven by the criminal investigation, CSB continued with its investigation. The investigation of the WFC incident analyzed several root causes and considered multiple contributing causes. Investigative teams partnered with urban search and rescue experts and fire and explosion consultants to survey damage to residences, schools, the nursing home, and other structures. The teams also conducted interviews with eyewitnesses, WFC managers, and hourly workers and gathered physical evidence for further laboratory testing and analysis. Key Findings The CSB’s analysis includes findings on the technical causes of the fire and explosion; regulatory changes that could have resulted in safety enhancements to the facility; the failure of the insurer to conduct safety inspections or provide an adequate level of coverage; shortcomings in emergency response, including pre-incident planning or response training of the volunteer fire fighters; and deficiencies in land use planning that permitted the City of West to encroach upon the WFC over the years. Section 10 presents the CSB’s key findings on the WFC incident. Recommendations As a result of the investigation of the WFC fire and explosion, CSB developed recommendations and directed them to the following recipients: • Environmental Protection Agency (EPA). • Occupational Safety and Health Administration (OSHA), U.S. Department of Labor. • Federal Emergency Management Agency (FEMA), U.S. Department of Homeland Security. • International Codes Council. • Texas Department of Insurance. • Texas Commission on Fire Protection. • State Firefighters’ and Fire Marshals’ Association of Texas. • Texas A&M Engineering Extension Services (TEEX).

2 See: http://www.tdi.texas.gov/news/2013/news201320.html (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• El Dorado Chemical Company (EDC). • West Volunteer Fire Department (WVFD).

Section 11 contains the complete set of recommendations. 2.0 Background 2.1 West Fertilizer Company The West Fertilizer Company (WFC) was located in the city of West, Texas. The city is approximately 80 miles south of Dallas, Texas, and has a population of about 2,800.3 The WFC stored and distributed fertilizers, chemicals, grains, and various other farming supplies. At the time of the incident, stockpiles of about 40 to 60 tons of FGAN were estimated to be onsite, and about 30 tons detonated. Table 1 shows the WFC inventory at the time of the explosion and fire. Table 1. WFC Fertilizer Inventory in April 2013 Fertilizer Name Amount (in tons) FGAN (fertilizer building) 40 to 60 FGAN (railcar) 100 Anhydrous ammonia 17 Potash4 45 Diammonium phosphate5 70 Diammonium phosphate and potash 25 Ammonium sulfate6 60 to 70 Zinc sulfate7 17.5

The fertilizer building was constructed in 1961, and business operations started in 1962. Photographs from 1972 show the closest residence about 265 feet from the WFC property. In addition, a baseball field

3 The 2010 U.S. Census data indicate that the population of West, Texas, is 2,807. See: http://www.census.gov/2010census/popmap/ (accessed on December 8, 2015). 4 Potash is an agricultural fertilizer and is a source of soluble potassium (K). 5 Diammonium phosphate (DAP), (NH4)2HPO4, is one of a series of water-soluble ammonium phosphate salts that can be produced when ammonia reacts with phosphoric acid. 6 Ammonium sulfate, (NH4)2SO4, is an inorganic salt with a number of commercial uses. The most common use is as a soil fertilizer. 7 Zinc sulfate, ZnSO4, is an inorganic compound and is a colorless solid that is a common source of soluble zinc ions.

West Fertilizer Company Final Report January 2016 17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 58 feet from the property. In 1972, the town nursing home and the nearest group of homes were constructed about 500 feet away.8 Over the years, growth in the city of West led to the development of land closer to the WFC property line, including a park (less than 150 feet), an apartment complex, the nearest aggregation of homes (about 370 feet), West Intermediate School (a little more than 200 feet), and West High School (about 500 feet). Sections 3.4.2 through 3.4.7 provide additional details on the property damage resulting from the explosion.9 Figure 1 shows the WFC facility before the fire and explosion in relation to the nearby community, including details on the site and the location of various structures.

8 This information was determined using Image 272-37A provided by McLennan County and distances calculated using Google Earth (accessed on June 6, 2013). 9 Calculated using Google Earth (accessed on June 6, 2013).

West Fertilizer Company Final Report January 2016 18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC Facility Legend Figures in Report 1 Grain Silos 2 2 Location of Overturned FGAN Railcar (post-explosion) 15 3

Corn Silo

4

Office/Chemical Storage

5 Fertilizer Building 3-5, 7 6 Liquid Fertilizer Tanks 16 7 Anhydrous Ammonia Pressure Vessels 6, 17, 21 8

Scale House

9

Nearest Fire Hydrant

City of West Legend Figures in Report Approximate Distance from Seat of Blast to Fenceline (Feet)

West Fertilizer Company 2-8, 12 0

West High School 30 1157

West Intermediate School 23-29 552

Basketball Court 20 249

Playground 19 366

West Terrace Apartment Complex 36 454

West Rest Haven Nursing Home 33-35 629

Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps) 2.1.1 Facility Operations Description The West, Texas, site consisted of two companies owned by the same family. Adair Grain, Inc., bought and sold grain while the WFC sold fertilizer, farming chemicals (pesticides and herbicides), and basic farm equipment (such as barbed wire, baling twine, and fencing). The WFC also rented farming equipment (fertilizer spreading equipment, tillage equipment) and spread fertilizer on farmland when needed, and its daily activities were largely based on season and weather.

West Fertilizer Company Final Report January 2016 19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Adair Grain bought grain (milo10 and corn) from farmers and stored it in four onsite silos (shown in Figure 1 and Figure 2). Adair Grain received grain from farmers’ trucks and deposited it into pits (Figure 3). An auger then transferred the grain from these pits, depositing it into the grain bin.

Figure 2. Grain Silos (Source: WFC Insurer)

10 Milo, also called grain sorghum, is a major feed grain for cattle.

West Fertilizer Company Final Report January 2016 20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Fertilizer Loading Pit and Conveyor Belt Railcar of Fertilizer

Figure 3. West View of Fertilizer Building (Source: Bing Maps) The WFC operated two buildings and a number of tanks (shown in Figures 1 and 3). One building served as a chemical warehouse, shop area, and office space. Most chemicals purchased by farmers were stored in that building. Such chemicals included Roundup®, Sevin®, and additives to make pesticides adhere to plants (such as Weedmaster® and Grazonnext®) and were stored in containers ranging in size from 2 to 300 gallons. The WFC also owned the fertilizer building, constructed in the 1960s, where dry fertilizer was stored (Figure 4). Fertilizers stored in that building included diammonium phosphate, ammonium sulfate, potash (potassium chloride), potassium magnesium sulfate (K-Mag), and FGAN. A seed room was located at the north end of this building (Figure 5).

West Fertilizer Company Final Report January 2016 21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 4. Fertilizer Building Overview (Source: Atlas Engineering) Bagged Fertilizer Abandoned Bin Primary Ammonium Nitrate Bin Palletized Zinc Golf Cart Front End Loader Hay Seed Hay Seed Hay Seed Old Seed Storage Top of Elevator Twine

Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer) The WFC facility had two 12,000-gallon anhydrous ammonia11 (NH3) storage vessels, located to the south of the fertilizer building, for distribution and sale of the product to farmers (Figure 6). The

11 Anhydrous ammonia is a colorless and extremely water-soluble gas at room temperature, with a strong irritating odor. Ammonia gas is lighter than air, but under certain conditions, ammonia vapor can settle close to the ground during a leak, forming a white cloud. Ammonia can be compressed into a liquid under pressure, and within a concentration in air range of 15 to 28 percent, it is flammable. This is known as the lower explosive limit (LEL) and upper explosive limit (UEL), respectively. Ammonia exposure at lower concentrations can irritate the skin, eyes, and respiratory system, and at high concentrations, exposure can result in pulmonary edema and death.

West Fertilizer Company Final Report January 2016 22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD anhydrous ammonia was primarily trucked into the facility, but delivery by rail was also possible. Although anhydrous ammonia is used in the manufacture of AN, the WFC stored it onsite solely for sale to consumers as liquid fertilizer. Adjacent to the anhydrous ammonia tanks, liquid fertilizer was stored outside in several vertical tanks. This type of fertilizer included a urea ammonium nitrate (UAN) solution or liquid phosphate, and could be blended to meet specific farmer needs. One outside tank was normally full of water to mix with chemicals or liquid fertilizer. No products were manufactured onsite; the WFC was essentially a distribution center for suppliers such as Mosaic, BASF, Agri-Phos, El Dorado Chemical Company (EDC), and CF Industries. EDC and CF Industries are the only manufacturers of FGAN in the United States. The WFC mixed and sold bulk fertilizer components or unaltered products such as pure FGAN and ammonium sulfate. Farmers came to the WFC and bought fertilizer that was weighed in a hopper, blended in a mixer, and distributed by conveyor belt (the mixer and conveyor belt can be seen in Figure 7). The WFC also delivered and applied fertilizer or chemicals to a farmer’s fields if needed. Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer)

West Fertilizer Company Final Report January 2016 23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer) 2.1.2 Facility Layout and Materials of Construction The fertilizer building (Figure 4) was a wood-framed structure with a concrete floor, at an elevation about 3 feet above grade. The building was constructed piecemeal over the years, starting with the original construction in 1961. The seed room was fabricated in the early 1980s, with a roof constructed of wooden rafters topped with plywood and covered with asphalt shingles. The only trench or drain in the building was in the cattle trough, which was used to collect fertilizer slurry when it became moist. A series of ladders were positioned adjacent to the elevator. FGAN was stored in two plywood bins along the west wall of the building and in one primary FGAN bin at the north end of building. The primary FGAN bin was normally no more than half full while the fertilizer bins on the west wall could be filled to the top of the containment. In the northeast corner of the building, an abandoned bin had been used to store fertilizer in the past but was unused at the time of the incident. The primary FGAN bin was constructed differently than the bins on the west wall. The bins on the west wall were composed of three walls rising to a height of about 10 feet and an open front. The primary bin was constructed by attaching plywood sheets to the inside of the exterior beams of the structure. The interior walls were also constructed of 6-inch beams with plywood attached. The main bin was estimated to be 8 feet wide, 20 feet long, and 30 feet high. A large hinged door covered the south end of the bin, with a 3-foot opening at the bottom. Holes were cut in the bin to provide air circulation, and a set of holes on the west wall allowed the bin to overflow into a smaller adjacent bin.

West Fertilizer Company Final Report January 2016 24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The door to the bin was normally closed when the bin was filled, and it could be opened to provide access after the inventory was reduced so that the fertilizer was not resting against the door. The bin was just wide enough (8 to 10 feet) to allow a front-end loader to drive in to access and gather the remaining FGAN. Like the west bins, the primary FGAN bin had plywood sheets (including some particle boards) and a wooden frame for support (shown post-explosion in Figure 8). The primary bin also had metal rods connected at opposite sides of the bin, providing internal stiffening support. About 2 years before the WFC explosion, the northeast corner of the north wall of the primary FGAN bin failed, and employees erected steel and concrete reinforcement around the bottom of the northeast corner to provide support and hold up the bin. As a result, the WFC never completely filled the primary bin to avoid another failure. A seed room,12 fabricated in 1980 and located at the north end of the fertilizer building served as the warehouse for seeds sold to consumers. Asphalt shingles covered the roof of the seed room of the fertilizer building. The seed room also stored more than 700 bags of zinc sulfate on the day of the fire and explosion. The zinc sulfate and seeds were stored in bags on pallets, with about 40 to 50 bags per pallet, stacked to a height of about 3 to 4 feet on each pallet. The seed room also contained two pallets of lawn and garden fertilizer (bagged at the WFC), twine, bailing wire, and fencing materials. At the west end of the seed room, 8 to 10 pallets of out-of-season seeds were segregated in an area cooled by an air

12 The seed room was used for storage of seed, bagged fertilizer, equipment, and vehicles, including a riding lawnmower, a golf cart, and a fork lift. It was constructed as an addition to the main fertilizer building in the early 1980s. . Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB)

West Fertilizer Company Final Report January 2016 25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

conditioner. The east end of the seed room stored twine and netting. At the time of the incident, the room held a relatively low inventory of seeds (approximately 30 percent of the room’s capacity, or 3,000 bags of out-of-season seeds). 2.1.3 Unloading of Fertilizer Historically, suppliers delivered bulk fertilizer product by truck or rail, but immediately before the incident, most shipments arrived by truck. All bulk fertilizer was transferred into the bins (located as shown in Figure 4), using the same conveyor belt system described in the previous section. Delivered fertilizer was first deposited into a loading pit. An uncovered 20-inch-wide rubber conveyor belt then transported the product into the fertilizer building. The belt was cupped to hold the fertilizer, which was transferred from this conveyor belt to a bucket elevator (pictured post-explosion in Figure 9).

Figure 9. Elevator System Recovered from Blast Debris (Source: CSB) The elevator lifted the fertilizer to the cupola (the highest structure) and deposited it into polyvinyl chloride (PVC) pipes, which in turn conveyed the fertilizer to either the main FGAN bin or a horizontal conveyor belt for distribution to the bins along the west wall. A valve was used to gravity-feed material to either the large FGAN bin by way of PVC piping (approximately 20 feet long by 1 foot in diameter) or through an approximately 40-foot downpipe toward the horizontal conveyor belt in the main portion of the building. A piece of PVC piping could be added to the downpipe to direct product from the horizontal conveyor belt and to direct FGAN to the two FGAN overload bins on the west wall. The horizontal conveyor belt transported product to the bins in the southern portions of the building. A 6- to 8-foot “kicker” conveyor belt transferred the fertilizer from the horizontal conveyor belt to its final destination in any of the west wall bins. Electric motors powered the conveyor belts. Every fertilizer product used the same conveyor system process for filling the respective bins.

West Fertilizer Company Final Report January 2016 26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Workers used a front-end loader to move the fertilizer within the fertilizer building. For a blended fertilizer product, the operator would place a load of each product in a predetermined quantity into the weigh hopper. After all of the ingredients were weighed, the product was sent via a conveyor belt to a mixer, which had the appearance of a stationary concrete mixer. The mixed product was deposited on a conveyor belt and loaded into a truck or spreader. A yellow auger next to the conveyor mixed seed with fertilizer. Zinc sulfate could also be added to fertilizer. 2.1.4 Housekeeping Because unloading operations in the fertilizer building created a dusty environment, the first task of the day in the fertilizer building was cleaning the floor after work during the previous day and evening. To address these conditions during operating hours, the WFC used fans to control the dust during unloading, and on some occasions, workers added a vegetable oil coating to the ammonium phosphate to reduce the dust.13 An employee reported to CSB that some products were dustier than others and that floor sweeping compound was also applied to the fertilizer building floor on very wet days. When mixing fertilizer, operators usually added phosphate to the hopper and mixer first to eliminate any moisture. The employees reported that because FGAN tends to absorb moisture and dissolve, the WFC used air conditioning to cool and remove moisture from the primary FGAN bin. After the FGAN bin was emptied, it was swept to remove moisture. On damp or humid days, operators minimized handling FGAN unless necessary because it would “melt” and become lost product. When the fertilizer became damp and began to “sweat” onto the floor, it was swept into a trench (cattle trough) on the east side of the fertilizer building. The liquid captured as slurry in the trough was then pumped into a liquid fertilizer tank for disposal. Employees reported that the plywood walls between the bins “stayed pretty clean” and did not require any housekeeping. After a shipment of one type of fertilizer was unloaded, no cleaning process was used to clear the conveyor belt before the next load was transferred. During the unloading process, the fertilizer occasionally spilled because the conveyor belts got off track or ripped. In such cases, operators attempted to separate the products as best they could, but intermixing and cross-contamination nonetheless would occur. The fertilizer in the west bins was occasionally changed out, and if the product became damp and moist, it might have been emptied out with a “drier” product such as K-Mag placed into that bin. The K- Mag would dry out the bin, and afterward, the bin could revert to storage space for another product. Occasionally, the bin walls developed holes or cracks, and when that occurred, either new wood walls were put in place to replace the old ones or caulk was used to fill the holes.

13 Ammonium phosphate was the only product at the WFC with an oil coating.

West Fertilizer Company Final Report January 2016 27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Incident Description

On April 17, 2013, at approximately 7:29 pm, citizens reported signs of smoke and fire at the West Fertilizer Company (WFC) facility to the local 911 dispatch center. Within 20 minutes, a massive explosion occurred, killing 15 people and sending a blast wave through the town that damaged or destroyed many buildings and homes. The fire was witnessed from several vantage points by different individuals associated with the West Police Department, Dallas Fire-Rescue Department, and volunteer fire departments (VFDs) from West, Abbott, Bruceville-Eddy, Mertens, and Navarro Mills. These accounts assisted CSB in determining how the events of the day transpired. 3.1 West Police Department One of the first responders to the incident was a West Police Department officer who was on routine patrol that evening. The officer reported that he smelled smoke as he was driving through the city park14 but was not able to identify the exact location of the smoke until he encountered a concerned citizen who advised him that smoke was venting from the highest portion of the WFC building. The officer advised the dispatch center of the smoke and requested that the West Volunteer Fire Department (WVFD) be dispatched to the WFC facility. Once the officer arrived on scene, he witnessed flames that were visible through the wall, extending upward from the lower level to the upper level of the northeast corner of the two-story fertilizer storage building. Then he called dispatchers again and asked them to inform the WVFD that the smoke had escalated to a structure fire. The WVFD contacted the officer via radio and requested that he establish traffic control to prevent citizens from driving over the fire hoses once the fire engines arrived and laid down fire hoses. The officer agreed but notified the WVFD that he needed to evacuate the city park first. As the officer proceeded to the city park, the responding West firefighters drove past him, heading toward the facility. Once the officer reached the city park, he used his public address system to order an evacuation of the park. After the park was evacuated, he left the area to establish traffic control on the north end of the fertilizer facility. There was no traffic control at the south end toward West High School (WHS), so the officer asked a nearby resident to assist by using his truck to block that intersection. At this time, the officer contacted the police chief and another officer who had called to determine whether he needed assistance. The officer asked the police chief to establish traffic control by the West Intermediate School (WIS) and requested that the other officer relieve the resident who was helping near the high school. Numerous citizens began parking their cars at WHS to watch the fire. The WVFD truck left the WFC facility and headed toward the police officer. The manager of the WFC arrived on scene to assist the WVFD. Via radio traffic, the officer learned that the entire fertilizer storage building was engulfed in flames, and shortly thereafter he saw and felt the explosion. The officer was briefly disoriented and then unsuccessfully attempted via radio and cell phone to notify the dispatch center of the explosion. An

14 The city park consisted of the basketball court and the playground.

West Fertilizer Company Final Report January 2016 28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injured member of the public and an injured firefighter approached the officer, who assisted them. The possibility of further explosions or toxic releases was a concern because of the anhydrous ammonia pressure vessels on the south side of the WFC property. On the basis of this information, the officer decided to evacuate homes within a 1-mile radius. Because the officer’s patrol car would not start, he proceeded on foot along Jerry Mashek Drive and Main Street to alert people to evacuate (refer to Figure 1 for a map of the area). By the time the officer made his way to Reagan Street, he had become aware that other emergency responders had initiated the evacuation of the northern portion of the city. 3.2 West Volunteer Fire Department (WVFD) Emergency dispatchers paged the WVFD, and firefighters responded to the scene with two fire engines, two initial attack apparatus or brush trucks,15 and a water tender truck16 at various times. Dispatchers also paged mutual aid personnel from neighboring counties, including Abbott, which responded. Many of the firefighters also responded by using their personally owned vehicles (POVs). According to eyewitness accounts, the fire intensified very quickly and was described as a rolling fire that moved from the northeast end of the fertilizer building (in the seed storage area north of the office) toward the southern end of the building. Five firefighters arrived on scene in two fire engines at different times. The first fire engine arrived on scene and staged east of the burning structure while one of the brush trucks staged to the north of the first fire engine. Four other firefighters directed water (using two 1.5-inch hoses) from the first fire engine’s internal tank onto the fire through the northeast doorway of the bagged fertilizer room, where fire was present. Once the second fire engine arrived on scene, the two firefighters from that fire engine began laying 1,000 feet of 4-inch hose line from the fire hydrant near the high school (1,600 feet away) toward the fertilizer facility. After laying all of the hose lines from the second fire engine, they discovered that the hose was approximately 700 feet short of the length needed to effectively fight the fire. After assessing the situation, one firefighter arranged to take the first fire engine, which had a better pump with greater pressure capabilities and additional hose that would allow him to continue to reverse-lay the lines.17 However, rather than resuming where the first fire engine ran out of hose, the firefighter went back to the fire hydrant near the high school to connect the first engine to the hydrant without laying the additional length of hose needed to supplement the hose that had already been laid from the second

15 Initial attack fire apparatus as defined in NFPA 1901 is fire apparatus with a permanently mounted fire pump of at least 250 gallons per minute (gpm) capacity, water tank, and hose body whose primary purpose is to initiate a fire suppression attack on structural, vehicular, or vegetation fires and to support associated fire department operations. Normally, most initial attack fire apparatus are constructed on commercial-style chassis. NFPA 190:1 Standard for Automotive Fire Apparatus, 2016 Edition. Quincy, MA: NFPA, 2016. 16 A water tender is the National Incident Management Systems (NIMS) approved term for a wheeled vehicle carrying water for fire suppression. 17 In firefighting, reverse lay refers to the nozzle end of the hose being laid from the fire to a water source. This method is used when the pumper must first go to the fire location to size it up before laying supply line, and it is the most expedient way to lay hose if the apparatus must stay close to the water source.

West Fertilizer Company Final Report January 2016 29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

engine. He saw flames (40 to 50 feet high) coming out of the cupola atop the fertilizer storage building and out of the door on the northeast corner of the building. Before the firefighter could make his way back to the end of the hose run, the explosion occurred. Before the explosion, the WVFD assistant chief arrived at the WFC facility, spoke with the police officer on scene, and advised him to begin evacuating nearby homes. He also made a radio request to the dispatch center, asking for a ladder truck to set up at the West Terrace Apartments in case a fire started there, but a ladder truck was not available. The WVFD chief and assistant fire chief were assessing the situation just before the explosion and were considering a total evacuation, even though neither believed that the FGAN would explode.18 On the basis of interviews that CSB conducted after the incident, the WVFD came to understand that it did not have enough water to effectively fight the fire.19 Accordingly, the WVFD was considering the appropriate course of action—possibly standing down, letting the structure burn, and focusing on evacuation. 3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer Fire Departments On the evening of the incident, a group of volunteer firefighters from neighboring city fire departments (including Bruceville-Eddy, Mertens, and Navarro Mills), who were taking an Emergency Medical Technician (EMT)–Basic class at the West Emergency Medical Services (EMS) building, responded to the fire. The West EMS facility is located a few blocks west of the WFC facility.20 When these volunteer firefighters heard the sirens activated in the city, they immediately made their way to the site. In addition, an ambulance responded with two EMTs and a volunteer firefighter. According to interviews that CSB conducted with emergency responders, radio and cell phone capabilities at the scene were limited after the explosion. Following the explosion, officials established two different staging areas. The first staging area, at the high school football field about 0.25 miles from the blast site, was used as a triage area for injured residents. Injured personnel and residents were relocated from the football field to the second staging area, at the community center about 1 mile away.21 After the explosion at approximately 8:15 pm, additional volunteer firefighters from the neighboring cities of Abbott, Bruceville-Eddy, Mertens, and Navarro Mills responded to the WFC facility. Figure 10 shows the WFC explosion as it unfolded.

18 Section 7 of this report provides further details on how the evacuation occurred. 19 Employees and emergency responders should not fight AN fires past the incipient stage. Further details on responding to AN fires is available in Section 7.5 and Section 7.6 of this report. 20 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 21 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West Fertilizer Plant Explosion,” October 8, 2013.

West Fertilizer Company Final Report January 2016 30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public) 3.4 Consequences 3.4.1 Fatalities and Injuries The violent explosion at the WFC facility fatally injured 12 emergency responders and 3 members of the public. All of the fatalities except one resulted from fractures, blunt force trauma, or blast force injuries sustained at the time of the explosion. Two fatally injured members of the public lived at a nearby apartment complex while the third resided at the nursing home and died from injuries brought on by the trauma of the explosion shortly after the incident. According to the Waco-McLennan County Public Health District’s report, 22 the incident resulted in more than 260 injured victims, including emergency responders and members of the public.23 Hill County (Hill Regional Hospital and Lake Whitney Medical Center) and McLennan County (Hillcrest Baptist Medical Center and Providence Health Center) hospitals received 81 percent of patient visits, with 104 injury visits at Hillcrest Baptist Medical Center, 82 visits at Providence Health Center, 41 injury visits to Hill Regional Hospital, and 1 injury visit at Lake Whitney Medical Center.24 The injuries ranged from relatively minor wounds (such as contusions, abrasions, and lacerations) to more serious injuries (such as fractures, closed head injuries, traumatic brain injuries, and skin burns). The majority of patients were treated and released after their initial visit to a hospital, medical center, or mobile medical unit. Figure 11 categorizes all injury types sustained by the 252 patients injured directly by the explosion; many patients received multiple types of injuries. The Waco- McLennan County Public Health report also identified the location where 76 percent of the reported 252

22 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014. 23 The number of injured victims includes patients who were treated after the explosion and sustained injuries during clean-up or by debris in the neighborhood. 24 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014: 7.

West Fertilizer Company Final Report January 2016 31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injuries occurred, outside or inside of a structure. More than half of the injured patients reported being inside a structure (55 percent), and the rest said they were outside (13 percent) or inside of a vehicle (8 percent). The locations cited by the injured also reflected the most common types of injuries. Patients who were inside a structure were twice as likely to suffer abrasions, contusions, and lacerations. People who were outside or inside of a vehicle were eight times more likely to have hearing loss or tinnitus, tympanic membrane rupture, or inhalation injuries. The majority of the injured were within 1,500 feet of the blast, although some were more than 2,000 feet from the explosion; people who were hospitalized were closer to the center of the blast than those who were not admitted. Notably, eye injuries—and traumatic brain injuries and concussions—were equally distributed among the injured, regardless of location.25 Detailed information regarding the cause of nonfatal injuries was not collected and analyzed. Possible causes of injuries include being struck by primary fragment projectiles, by secondary fragments from remote structures and vehicles, or directly by the blast wave.

Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health District)26 During the investigation, CSB noted two potential scenarios that could have led to more severe consequences. First, if the fire had started during the middle of a normal school day instead of the

25 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) Fertilizer Plant Explosion,” June 24, 2014. 26 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014). 141 134 53 34 31 30 29 21 12 12 6 0 20 40 60 80 100 120 140 160 Abrasions/contusions Lacerations/penetrating trauma Traumatic brain injuries/concussions Tinnitus/hearing problems Eye injuries Inhalation injuries Sprains/strains Fractures/dislocations Blast injuries Tympanic membrane ruptures Burns Number of Injuries

West Fertilizer Company Final Report January 2016 32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

evening and if all other conditions remained unchanged (specifically, if onsite WFC employees were unable to extinguish the fire), students would have been present at the intermediate and high schools. Had the schools evacuated, students likely would have assembled in areas such as the gymnasium and multipurpose rooms within the schools (and in other pre-designated areas outside of the schools) before the evacuation to conduct a head count. Given the short time that elapsed before the explosion, many students and staff members might have been injured in the 20 minutes from the first discovery of a fire until the explosion. Second, a railcar loaded with more than 100 tons of FGAN toppled during the explosion but did not detonate. If the contents of the railcar had detonated, the damage, injuries, and fatalities would have been significantly worse. These scenarios are important to consider because throughout the United States, there are many facilities that, like WFC, are located near public structures such as schools.27 3.4.2 Property Damage The West incident caused considerable property damage, including the complete destruction of the WFC facility (Figure 12). An initial estimate by the Texas Department of Insurance set total property damage resulting from the explosion and fire at $100 million. CSB hired a consulting firm28 to perform an assessment of the structural and property damage caused by the fire and explosion. The assessment involved a thorough examination of damage to the WFC facility and to the community structures and facilities.29 As of the publication of this report, neither the owners of the WFC nor the city of West has decided whether the WFC facility would be rebuilt. Currently, the local farmers are using fertilizer from another fertilizer facility in Leroy, Texas, seven miles east of the city of West.

27 Section 5.4 provides further details on the location of schools in relation to FGAN facilities throughout Texas. 28 ABSG Consulting Inc. See: http://www.absconsulting.com/ (accessed on June 26, 2015). 29 Sites examined included the West Intermediate School (WIS), West High School (WHS), West Middle School (WMS), West Rest Haven nursing home, and the park.

West Fertilizer Company Final Report January 2016 33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol) The explosion, overpressure, and debris completely destroyed a WVFD brush truck, water tender, and fire engine (Figure 13). The water tender was located southeast of the crater and likely moved about 6 inches south as a result of the blast overpressure. The explosion propelled the door from the water tender to the east. A large farm truck south of the fertilizer storage building and toward the scale house moved about 6 inches south of its original location because of the blast wave (Figure 14). All of the POVs belonging to responding volunteer firefighters who parked onsite were damaged or destroyed in the explosion. In addition, the explosion overturned and destroyed the railroad car loaded with FGAN, approximately 190 feet to the north of the crater (Figure 15).

Overturned FGAN Railcar Vertical Liquid Fertilizer Tanks Fire Department Water Tender EMS Vehicle Damaged Railroad Anhydrous Ammonia Pressure Vessels Overturned FGAN Railcar Vertical Liquid Fertilizer Tanks Fire Department Water Tender EMS Vehicle Anhydrous Ammonia Pressure Vessels

West Fertilizer Company Final Report January 2016 34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting)

Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB) The explosion completely demolished the scale house; the roof and all four walls failed. The explosion flattened the chemical storage and office building east of the fertilizer storage building—all that remained was a stack of metal debris where the building once stood. The explosion also destroyed the corn silo north of the fertilizer storage building. In addition, the blast heavily damaged the above-ground vertical liquid fertilizer storage tanks. As shown in Figure 16, the liquid level during the explosion in the tank to the left is clearly visible by the crease at the top of the tank where the deformation begins. The tank on the right in Figure 16 clearly shows a large debris impact that folded and crushed the tank.

Figure 16. Liquid Fertilizer Tank Damage (Source: CSB)

West Fertilizer Company Final Report January 2016 36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The two 12,000-gallon anhydrous ammonia pressure vessels were approximately 30 percent full of ammonia at the time of the explosion. As shown in Figure 17, the anhydrous ammonia pressure vessels were south of the crater. The pressure relief valves (PRVs) on the northern anhydrous ammonia pressure vessel still had their weather caps on and consequently did not relieve the pressure. The weather caps were missing on the PRVs in the middle of the southern anhydrous ammonia pressure vessel.30 Two additional liquid fertilizer storage tanks sat parallel to the railroad track southwest of the anhydrous ammonia pressure vessels. The blast of the explosion also damaged the tracks on the railroad between the WFC property and the park. The blast was sufficiently powerful to shift the tracks more than 2 feet to one side, creating a prominent curve in the tracks (Figure 18).

Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB)

30 The condition of the anhydrous ammonia pressure vessels is discussed in further detail in Section 3.4.2.1 of this report.

West Fertilizer Company Final Report January 2016 37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB) The explosion damaged a playground and basketball court in a park located a few hundred feet west of the WFC facility (Figure 19). The blast destroyed equipment on the playground, including damaging the basketball goal posts on the basketball court (Figure 20). In addition, the trees in the vicinity of the park showed evidence of scorching,31 likely from the fireball when the explosion occurred. The trees were directly downwind of the anhydrous ammonia pressure vessels and were not within the smoke plume from the fire. Pre-explosion video of the fire shows the smoke traveling with the wind but crossing the playground equipment to the north of the basketball courts.

Figure 19. Damaged Playground Equipment (Source: ABS Consulting)

31 The ABS damage assessment did not include making a determination about whether the trees were scorched by the fire or by another source.

West Fertilizer Company Final Report January 2016 38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting) 3.4.2.1 WFC Anhydrous Ammonia Vessels The two 12,000-gallon anhydrous ammonia vessels were located at the south end of the storage building, about 150 feet from the site where the initial fire and smoke were observed. Each vessel was more than 46 feet long, with two affixed PRVs set to vent the tanks to the atmosphere if the pressure inside the tanks exceeded predetermined set points, estimated by one employee as between 250 and 300 pounds per square inch (psi). Both sets of PRVs were fitted with orange plastic caps intended to protect the devices from rain and dirt. The vessels shared a common pipeline that allowed switching between the tanks on occasion, but under normal operation, the connecting pipe was kept in a closed position. CSB observed the intact PRVs on top of the vessels (Figure 21) on May 28, 2013, although the polyvinyl chloride (PVC) protective caps were no longer in place on the PRVs of the southernmost tank. The absence of detectable residue of this protective material on the PRV suggested that it was exposed to fire to the degree that it melted. The caps were not found during any post-incident salvage or recovery activities. During salvage operations, a crane with lift bucket reportedly struck the PRV for the northernmost tank, knocking it to the ground where it was found.

West Fertilizer Company Final Report January 2016 39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB) From interviews with employees who were knowledgeable about the frequency of deliveries and volumes in the tanks, CSB learned that the site received as many as four deliveries of anhydrous ammonia per day under normal operating conditions with good weather and that each vessel was at 30 percent capacity, or about 7,200 gallons, at the time of the fire and explosion. After the incident, technicians removed all remaining contents in both vessels. When hazardous materials technicians in fully encapsulated personal protection equipment initially entered the area of the anhydrous ammonia vessels after the site was secured, they observed a leaking valve at the east end of the tanks. In light of a buildup of ice around the valve, it is thought that the material leaking was liquid anhydrous ammonia. Notably, anhydrous ammonia stored under pressure contains latent heat. As the liquid is released, it cools rapidly and interacts with moisture in the atmosphere and can freeze on the pipe and adjacent vessel. However, the vessels did not catastrophically fail on the night of the incident. The CSB considers this to be a near-miss of potentially significant consequence. 3.4.3 West Independent School District The WFC built its facility in 1962, before much of the surrounding community developed. In 1923, the West Independent School District (WISD) (Figure 22) built the West Middle School (WMS), which at the time served as the high school for the city of West. The WMS campus added a building in 1957 that served as supplementary classrooms and library space. The WISD also built West Elementary School (WES) in the early 1960s. WIS was built around 1985, and WHS was constructed in 2000, after the WFC facility was built. Four schools were in close proximity to the facility, including WIS (552 feet southwest

West Fertilizer Company Final Report January 2016 40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the facility), WHS (1,263 feet southeast of the facility), WMS (2,000 feet southwest of the facility), and WES (4,867 feet southwest of the facility).32

Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth)

32 The growth of the community around the WFC facility is discussed in further detail in Section 9 of this report. West Fertilizer Company West High School Playground West Rest Haven West Intermediate School West Middle School West Terrace Apartments West Elementary School

West Fertilizer Company Final Report January 2016 41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The overpressure from the explosion’s blast wave caused most of the damage, although some fires started post-explosion, including those at WIS and many nearby homes. At the time of the incident, school was not in session, which limited the number of fatalities and injuries to members of the public (including students, teachers, and other staff members). However, if the explosion had occurred during normal school hours, the number of injuries and fatalities from the blast wave could have been much higher. Table 2 indicates the projected number of students and staff members who would have been affected and could potentially have been injured or killed by the blast if school had been in session. If all enrolled students had been in school that day, approximately 1,486 students would have been present and vulnerable. Of this total, 665 students would have been at WIS and WHS, which suffered the most severe damage. If the explosion had occurred during school hours and all staff members had been present that day, approximately 191 staff members would have been vulnerable. Of this total, 86 staff members would have been at WIS and WHS. Because of the breadth of damage at the schools, the WISD decided to demolish WIS, WHS, and all WMS facilities except for the gymnasium and the 1923 building. The WISD also demolished select portions of the 1967 annex and the entire cafeteria at WMS. Appendix A includes a discussion of the details of WISD plans to restore and rebuild the school system. For a more complete understanding of the magnitude of the injuries and fatalities that the WFC incident could have caused, this report considers in greater detail the extent of damage at the schools. Table 2. Estimated Number of Students and Staff During School Hours School Grades Estimated Number of Students Enrolled Estimated Number of Staff Members West Intermediate School 4-5 246 22 West Middle School 6 320 40 West High School 7-12 419 64 West Elementary School K-3 501 45 Total Occupants

1,486 171

West Fertilizer Company Final Report January 2016 42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.3.1 Damage Assessment of the West Intermediate School

The original WIS was a pre-engineered metal building consisting of lightweight steel frames, cold-formed girts,33 and purlins34 supporting lightweight metal decks. The gymnasium and cafeteria were also pre- engineered metal buildings. The remainder of the school was constructed of precast concrete tilt-up load- bearing walls that supported open webbed steel joists and a metal roof deck with a built-up roof. Figure 23 shows the building room layout in the school evacuation plan and highlights in yellow some classrooms with extensive damage. A considerable amount of debris accumulated in the hallway outside of rooms 11 and 12 (Figure 24). An interior doorframe blocked the hallway; the acoustic ceiling had collapsed; and numerous obstacles would have made exiting the building difficult for students and staff. In addition, the original metal school building just south of this location was involved in a fire after the explosion at the WFC facility, so students and staff members also would have been exposed to smoke and heat. The acoustic ceiling, light fixtures, and other debris were thrown onto all of the desks in the interior of classroom 12 (Figure 25). Moreover, the window on the north facade failed violently, and a large shard of glass (approximately 3 inches long) was embedded in the assignment poster on the south wall of the classroom (Figure 26). Room 8 Room 7 Room 6 Room 5 Room 9 5th Grade Lab Room 10 Girls RR Book Room Boys RR Lounge Workroom Storage Ja Nurse Asst Princ Room 12 Room 11 PRR Room 13 4th Grade Lab Library Room 4 Room 3 Room 2 Tech Room 1 Tech Room 18 Room 17 Room 16 Room 15 Comp Labs Room 19 Cafeteria Gym Gym RRs Room 21 Room 22 Room 23 Room 20 RRs Princ Office Area West Intermediate School Evacuation Route N REAGAN ST.

Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB)

33 A horizontal structural member that spans columns or posts in framed construction and is used to support cladding. Dictionary of Construction, Surveying and Civil Engineering (2012). 34 A horizontal roof member that runs parallel to the ridge and spans the roof trusses and is used to support the roof covering. Dictionary of Construction, Surveying and Civil Engineering (2012).

West Fertilizer Company Final Report January 2016 43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting)

Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 26. Embedded Glass in Assignment Poster in WIS Room 12 (Source: ABS Consulting) The pre-engineered portion of the school in the northeast corner was heavily damaged by blast overpressure and was also fully engulfed in flames. At the time of the physical survey, blast damage to this portion of the building could not be evaluated because of the magnitude of the fire and associated heat; however, Figure 27 does provide a view looking east down the hallway of this part of the school after the fire.

Figure 27. Interior of Burned Northeast Section of WIS (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The WFC explosion heavily damaged the WIS gymnasium (Figure 28). There was evidence that some of the built-up roof over the gymnasium burned; however, the level of heat damage to the roof was minor compared to the damage from blast overpressure. The north half of the gymnasium roof failed. Within the gymnasium, the blast heavily damaged the pre-engineered frames, which were unstable as a result. The roof purlins were moderately deformed, with the exception of the failure that occurred on the north half of the frame spans. Furthermore, the windows from the south facade of the gymnasium failed, and the overpressure propelled them over the south bleachers and onto the gym floor. The explosion also heavily damaged the roof in the cafeteria to the south of the gymnasium.

Figure 28. WIS Gymnasium (Source: ABS Consulting) The interior of classroom 20 also sustained significant damage (Figure 29). The acoustic ceiling, light fixtures, and insulation were blown down onto the floor by a combination of the roof motion and the air blast entering through the heating, ventilation, and air conditioning (HVAC) duct after the explosion displaced the rooftop air conditioner. After the incident, the entire contents of the ceiling plenum were found on top of the desks. If the explosion had occurred during school hours, any students or staff members in the room would have been covered in this debris and would have had to climb over (or through) it to reach the exit. In addition, there was evidence that overpressure entered the room through the HVAC opening and was of sufficient magnitude to cause the door latch to fail. The damage to WIS decreased as the distance from the explosion source increased from the northeast to the southwest. WIS also housed the technical department where all of the school servers were kept. The servers and the data stored on them were lost in the explosion and fire.

West Fertilizer Company Final Report January 2016 46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 29. WIS Classroom 20 (Source: ABS Consulting) 3.4.3.2 Damage Assessment of West High School WHS was constructed of concrete masonry unit walls supporting open webbed steel joists and a metal deck with built-up roofing and gravel ballast.35 The building room layout (on the basis of the school evacuation plan) shows that the school was organized into two wings (Figure 31). The north wing contained the activities area, including the two gymnasiums, two weight rooms, boy’s athletics locker room, girl’s athletics locker room, and band hall. The south wing included the classrooms as well as a large lecture hall. Between the two wings were the entry hall, administrative offices, common areas, kitchen, and (to the rear) auditorium. A pre-engineered maintenance building sat directly behind the school to the east.

35 Small gravel placed on a built-up roof to protect the roof from ultraviolet light, heat, and weather and to protect the roof membrane from degradation.

West Fertilizer Company Final Report January 2016 47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

N

Figure 30. WHS Evacuation Map (Source: WISD) The WHS auditorium was a steel frame structure with masonry infill walls. After the WFC explosion, some of the masonry veneer on the exterior was loose near the northeast corner. Inside the auditorium, large areas of the hanging ceiling were unstable, and the supporting structure was compromised, especially one area of the ceiling (between the seating and the stage), which was near collapse because of the failed hanger connections. Viewed from underneath, evidence of damage to the ceiling was observable at light fixtures, and evidence of cracking and separation was visible near the walls. However, the severity of the damage and compromise to the ceiling hangers became fully evident when they were inspected from the catwalks above the auditorium. 3.4.3.3 Damage Assessment of West Middle School WMS was the school third farthest from the WFC site, and although it sustained less damage than WIS and WHS, it was nonetheless severely damaged in the explosion. WMS resided at the site of the original WHS, constructed in 1923. The athletic field east of WMS was the site employed for triage and evacuation of the wounded after the explosion (Figure 31).

West Fertilizer Company Final Report January 2016 48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps) The practice gymnasium was a lightweight pre-engineered metal building with a brick facade. The pre- engineered frames buckled after the explosion, resulting in a small permanent deformation of the roof purlins. In addition, the overpressure damaged the roof purlins and frames. An external assessment of the cafeteria and auditorium indicated damage to the ceiling components. Many of the windows on the west facade were unbroken. The original high school classroom building at WMS was constructed in

1. The windows facing north toward the WFC facility were broken, but only some of the remaining

windows had failed. The building originally was not air conditioned and had a high tin ceiling, but at a later date, a new drop ceiling was installed to accommodate central air conditioning. After the explosion, the new drop ceiling failed, but the original tin ceiling was still in place, and some of the windows were broken. Window hazards thus were low to moderate, and the damage to the exterior appeared to be superficial. The classroom annex building roof structures were open web steel joists supporting a built-up roof on metal deck. The roof structure showed no observable damage; however, the suspended ceiling failed because of the motion of the roof (Figure 32).

West Fertilizer Company Final Report January 2016 49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.3.4 Damage Assessment of West Elementary School

WES was the campus farthest from the WFC site and sustained very minimal damage. WES received minor renovations, such as removing and replacing damaged ceilings, replacing damaged windows, and performing general interior clean-up.36 3.4.4 West Rest Haven Nursing Home The explosion also destroyed the West Rest Haven nursing home, located west and within 600 feet of the WFC facility, at the corner of North Reagan Street and West Haven Street (Figure 33). Since 1967, the nursing home had provided residents with routine care and also treated patients with Alzheimer’s disease, diabetes, and hypertension, among many medical conditions. Approximately 20 of the 155 staff members and 130 patients37 were in the nursing home during the explosion. All were evacuated with the assistance of the nursing home staff and neighborhood volunteers, yet 72 patients sustained injuries. The level of severity of the injuries varied from cuts caused by broken glass and building materials to broken bones. An 87-year-old man succumbed to a stress-related heart attack; however, his death was not a direct result of the explosion. Before the explosion, the nursing home’s medical director came to the Reagan Street entrance and directed the charge nurse to begin evacuating residents to the other side of the facility in response to the ongoing fire at the WFC facility. As the charge nurse began the evacuation process, the explosion occurred. During the post-blast evacuation, staff members and volunteers removed many bedridden

36 See: http://www.restorewestisd.com/plans.html (accessed on December 22, 2015). 37 The nursing home had a capacity of 145 individual licenses.

Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS (Source: ABS Consulting)

West Fertilizer Company Final Report January 2016 50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

residents from the building through the windows instead of the hallways out of concern that the structure would collapse. The residents were moved from the back of the nursing home to the front during the fire, evacuated after the explosion to a helicopter pad and football field, and eventually moved to the community center. The 72 injured residents were transported to Providence Health Center and Hillcrest Baptist Medical Center to receive treatment. After the residents were treated and released, they were relocated to various nursing homes in the neighboring cities of Waco, Midway, Hewitt, Clifton, and Hillsboro. Uninjured residents were also relocated to these nursing homes. Within 2 months of the incident, 14 of the West Rest Haven nursing home residents died, a figure cited as unusually high by the facility’s administrator,38 and since the incident, approximately 50 patients have died. According to information the nursing home provided to CSB in May 2015, almost all of the 80 living patients who formerly resided at West Rest Haven tentatively planned to return to the nursing home once the new construction was complete.

Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting)

38 See: http://www.dallasnews.com/news/west-explosion/human-toll/20130617-some-say-west-blast-rushed-nursing- home-patients-deaths.ece (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.4.1 West Rest Haven Nursing Home Disaster and Evacuation Plan

West Rest Haven followed a disaster and evacuation plan that include policies and procedures39 to meet all potential types of emergency and nonemergency situations, including fires, disasters, explosions, toxic fumes, train derailments, broken gas mains, auto and truck collisions, and fire drills. The plan included detailed evacuation procedures in the event of a fire as well as shelter-in-place procedures for events such as severe weather. Depending on the location of the fire, patients could be evacuated to another portion of the building rather than being completely removed from the premises. The disaster and evacuation plan also contained transportation and sheltering agreements if needed during an emergency evacuation of the facility. The plan also provided guidance to the facility’s operators on responses to a derailed train or ruptured tank cars containing potentially hazardous liquids and on steps to shelter in place if the facility were exposed to hazardous gas or vapors.40 West Rest Haven scheduled monthly fire drills to meet the requirement to conduct fire drills during each of the three work shifts. In addition, the nursing home held a mock disaster drill approximately 3 months before the explosion, employing a scenario that assumed a toxic gas release from the WFC facility. 3.4.4.2 Damage Assessment of West Rest Haven Nursing Home The West Rest Haven nursing home was irreparably damaged (Figure 33), leading the city to completely demolish the structure 3 months after the incident.41 The nursing home was constructed of load-bearing wood stud walls (with brick veneer) and wood trusses that spanned the wings from exterior wall to exterior wall (east to west). The nursing home’s emergency exit plan (Figure 34) shows the floor plan and room layout. The explosion most heavily damaged the eastern-most corridor of the building. As a result of the explosion, the roof trusses collapsed, and the east wall failed. The eastern rooms were heavily damaged and subjected to flying wall debris and window fragments in addition to failing drywall, insulation, and light fixtures from the ceiling. Investigators observed high glazing hazards, including glass shards that penetrated the wall opposite the windows. The ceilings, insulation, and interior contents of rooms were lying on beds and blocking doorways, posing hazards to any occupants of these rooms. In addition, the air blast would have infiltrated the rooms through the failed windows. Pieces of broken glass littered the inside of the nursing home, with the exception of hallway corridors that were shielded from windows by interior partitions. The great rooms, lobby, and patient rooms were also subjected to significant hazards from broken shards of glass.

39 The disaster and evacuation plan also includes policy and procedures for severe weather, bomb threats, water shortages, electrical power outages, loss of comfort heating, heat and humidity, and floods. 40 West Rest Haven Inc. “Disaster and Evacuation Plan.” 41 See: http://video.dallasnews.com/Damaged-West-nursing-home-razed-3-months-after-blast- 24951515?freewheel=90850&sitesection=dallasnews_nws_non_non&VID=24951515#.Uv58DMKYbIU (accessed on January 4, 2016).

West Fertilizer Company Final Report January 2016 52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB) The blast also inflicted significant damage to the western portion of the nursing home, and the great rooms, such as the lobby, were hit particularly hard because of the large spans of the overhead trusses that failed and collapsed onto the furniture. In addition, hallways in this area presented many hazards, including hanging light fixtures, failed ceiling joists, and collapsed drywall and insulation on the floors. Moreover, the debris field of the nursing home contained secondary fragments from massive pieces of the WFC facility’s concrete foundation and also significant masses of earth. Observations indicated that a large piece of the WFC foundation, measuring 16 inches wide by 16 inches tall and 36 inches long (Figure 35, right) impacted room 79, traveling through the roof and the exterior wall (Figure 35, left). This debris fragment was calculated at a weight of approximately 800 pounds and had sufficient momentum after the impact to exit the nursing home, strike the ground, and then travel an additional 60 feet before coming to rest just to the west of North Davis Street.

West Fertilizer Company Final Report January 2016 53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West Rest Haven (Source: ABS Consulting) On April 4, 2014, the city of West broke ground at 503 Meadow Drive, a block away from the original site, on the new 120-bed West Rest Haven nursing home (with 75,000 square feet), which opened in summer 2015.42 The estimated construction cost is $11 million. West Rest Haven did not receive any grants or federal money to rebuild the facility. 3.4.5 West Terrace Apartment Complex The West Terrace Apartment Complex, a 22-unit apartment complex built in 1979 and owned by J&B Realty Ltd., was 450 feet due west of the epicenter of the explosion. Two members of the public were fatally injured at the apartment complex. One of the victims was most likely standing on the east side of the complex and watching the fire shortly before the explosion occurred. The second victim was most likely inside her lower-level one-bedroom apartment. The apartment building had four vacant units that were being used for storage. At the time of the explosion, a member of the cleaning staff was just finishing servicing one of the recently vacant units; she was injured in the blast while exiting the apartment building and walking down the stairs to her car. This worker’s mother accompanied her on the job that day and was in the just-serviced unit, waiting for her daughter to return with the car, when the explosion occurred; however, the worker’s mother was not injured. Four residents of the apartment

42 See: http://dfw.cbslocal.com/2014/04/04/groundbreaking-symbolizes-hope-in-west-one-year-later/ (accessed on April 4, 2014).

West Fertilizer Company Final Report January 2016 54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

complex were treated at Hillcrest Baptist Medical Hospital, and two residents were treated at Providence Health Center for injuries sustained. The explosion completely destroyed West Terrace. The roof and walls of the building completely failed (Figure 36).

Figure 36. West Terrace Apartment Complex East Façade (Source: CSB) 3.4.6 Private Residences According to the Texas Department of State Health Services, the fire and explosion affected many of the homes within a 2-mile radius of the WFC facility. West had a total of 700 homes, and 350 of those were impacted— with 142with homes damaged beyond repair,43 51 homes suffering major damage, 27 homes incurring minor damage, and 130 homes otherwise affected.44 CSB consultants examined damage to 190 single-family residential buildings within a radius of 3,500 feet of the explosion crater45 and documented broken windows, facade damage, and nonstructural and structural component (e.g., wall and roof system) failures (Figure 37). The damage assessments were performed in the majority of the cases by inspecting the perimeter of the property. Access to home interiors was limited because owners either were not present or were unwilling to grant access.

43 Not all homes that were damaged beyond repair have been rebuilt. 44 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West Fertilizer Plant Explosion,” October 8, 2013. See: http://www.astho.org/Preparedness/DPHP-Materials- 2013/WestTexasExplosion/ (accessed on January 18, 2016). 45 CSB contractors assessed damage that was measured to 3,500 feet from the WFC site, but damage occurred beyond that distance.

West Fertilizer Company Final Report January 2016 55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting) According to the city of West, 259 building permits were issued as of October 2014. Of those, 79 were for building new homes, 117 for remodeling homes, and 63 for making miscellaneous repairs (such as fence, shed, and carport restoration). 3.4.7 Infrastructure Damage to the City of West The explosion at the WFC facility damaged the West city infrastructure; it ruptured water lines, deformed sewer manholes, damaged water storage tanks, further rendered wells unusable, cracked walls of a pump house, and caused the loss of water supply to the community. Access to water was restored gradually as the affected infrastructure was repaired. As a result of the explosion, FEMA assisted the city in repairing some of the damaged infrastructure listed in Table 3, such as water facilities and water lines. Table 3. Infrastructure Repaired with FEMA Funding Affected Infrastructure Cost to Repair Damage Well 4, Ground Storage Tank $365,000

West Fertilizer Company Final Report January 2016 56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Well 4, Pump Station Door and Window $2,000 Davis Street Water Line $74,000 Walnut Street Sewer Manhole $9,200 Total $450,200

The West water system is fed by a 12-inch supply line from the city of Waco at a pump station 11 miles south of West. The pump station supplies 700 gallons per minute, with a storage capacity of 167,000 gallons. Water pressure for homes is usually 48 to 50 psi; however, on the morning after the incident, water pressure was measured at less than 20 psi because of damaged water lines. In response to the abnormal water pressure, the city issued a boil water order. West used two water wells to supply water to the community. The first well had a capacity of 250,000 gallons; however, it had been out of service for about 7 years at the time of the explosion. The second well also had a capacity of 250,000 gallons and was removed from service in January 2013 for rehabilitation.46 This well also was damaged as a result of the explosion but has since been repaired and was back online as of September 1, 2014. The city also has an above-ground water tower with a storage capacity of 150,000 gallons; the tower was nearly drained by the post-explosion fire department response.47 According to CSB interviews conducted with the Abbott Fire Department, West had a history of improperly working water hydrants and consistently low water pressure. Abbott firefighters had previously responded to fires in West and were unable to get hydrants to work adequately. The city had installed the above-ground water tower before the WFC incident to address the issue of low pressure. According to the Mayor of West, “The city generates its revenue in three ways—water and sewer rates, property tax, and sales tax.” During the first 2 months after the explosion, West experienced a loss of income (65 percent of water and sewer revenue and 30 percent of property tax values).48 As of June 2013, the city of West indicated that the fire and explosion at WFC had cost the city $17 million in actual damages; however, the total cost-to-date may be greater as additional demolition, renovation, and construction projects continue throughout the city. On April 15, 2014, the State of Texas provided additional disaster grant assistance49 to the city of West in the amount of $4,853,500 to fund the disaster recovery work on the water plants, water tank rehabilitation, wastewater outfall interceptor, and disaster zone infrastructure repairs.50 The first infrastructure project (costing $400,000) was completed in August 2014 and involved installation of a new well and upgrading of a storage tank located by the new nursing home.

46 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 47 Ibid. 48 See: http://www.cityofwest.com/wp-content/uploads/2012/12/June-2013.pdf (accessed on December 22, 2015). 49 The State of Texas provided an initial $3.2 million disaster grant in August 2013. 50 The State of Texas. Office of the Governor, “Letter to the City of West,” April 15, 2014.

West Fertilizer Company Final Report January 2016 57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Incident Analysis
2. 1 Fertilizer Grade Ammonium Nitrate (FGAN)
3. 1.1 The Fertilizer Industry

The Fertilizer Institute defines fertilizer as a “collection of elements needed for plants to grow well.”51 The application of fertilizer to soil provides nutrients for plants to enhance fertility and the production of crops. The primary nutrients for plant nutrition are nitrogen (N), phosphorous (P), and potassium (K). Nitrogen is considered the most important of the three nutrients because it is critical to the formation of protein, which composes the tissue of most living things. Although nitrogen exists in the composition of air, it does not exist in a form that plants can readily absorb. Accordingly, farmers apply fertilizers containing nitrogen compounds to their soils to enhance crop production. Nitrogen is most readily available for plants in its inorganic forms, such as ammonium (NH4+) or nitrate (NO3-) ions. It is applied to crops in different forms such as dry granules, liquid, or injection into the soil as a gas. The largest source of nitrogen by volume in commercial fertilizer is anhydrous ammonia, which is applied directly to crops.52 Other important nitrogen fertilizers include aqueous ammonia (NH3), ammonium sulfate ((NH4)2SO4)), ammonium thiosulfate (H8N2O3S2), calcium nitrate (Ca(NO3)2), sodium nitrate (NaNO3) and FGAN. FGAN, the substance in the fertilizer involved in the West Fertilizer Company (WFC) explosion, is primarily used on pastureland, hay, and fruit and vegetable crops. FGAN is most commonly used in the Southeast and Midwest in the United States, and the largest AN consumers are Missouri (20 percent), Tennessee (14 percent), Alabama (10 percent), and Texas (8 percent). 53 4.1.2 AN Properties AN (NH4NO3) is a salt compound produced by neutralizing nitric acid (HNO3) with anhydrous ammonia (NH3). The AN manufacturing process involves several steps, including solution formation and concentration; solids formation, finishing, screening, and coating; and product bagging, bulk shipping, or both. AN is marketed in different forms depending on its use, but it is primarily manufactured for use in fertilizers or as a precursor in the manufacture of explosives. Liquid FGAN can be sold as a fertilizer or may be concentrated to form a dry solid product. This solid product may be used for fertilizer or fertilizer blends or may be incorporated as part of an explosive. Pure solid AN is a white or grey odorless material that is marketed in several different forms, such as prills, grains, granules, or crystals. Prills are the most commonly produced form and take the shape of spherical pellets. High-density prills are used for FGAN;

51 The Fertilizer Institute. Fertilizer 101, Nourish, Replenish, Grow. Washington, DC: The Fertilizer Institute, 2010: 13. 52 See: https://www.tfi.org/safety-and-security-tools/get-know-fertilizer-retailer/infographics/ammonium-nitrate- infographic (accessed on November 18, 2015). 53 Ibid.

West Fertilizer Company Final Report January 2016 58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

low-density porous prills are generally considered technical grade ammonium nitrate (TGAN) or explosive grade ammonium nitrate, both of which are used in the manufacturing of explosives. Chemically, however, these prills are identical; the difference is that small quantities of coatings and stabilizers are added to FGAN to prevent caking and degradation. 4.1.3 AN Hazards Under normal conditions, pure solid AN is a stable material; it usually is not sensitive to mild shock or other typical sources of detonation (such as sparks or friction). However, AN exhibits three main hazards in fire situations:

1. Uncontrollable fire.
2. Decomposition with the formation of toxic gases.
3. Explosion.54

These hazards arise in part because AN is an oxidizer. This classification is demonstrated both by the U.S. Department of Transportation (DOT), which categorizes AN as a Class 5.1 oxidizer,55 and by OSHA, which describes it as an oxidizer in its Explosives and Blasting Agents standard, 29 CFR 1910.109. 56 Significantly, AN is classified as an “explosive” when the prills are produced with more than 0.2 percent carbonaceous material. Carbonaceous material is a substance rich in carbon, such as a hydrocarbon. OSHA defines “oxidizer” as a chemical that “initiates or promotes combustion in other materials, thereby causing fire either of itself or through the release of oxygen or other gases.”57 As an oxidizer, AN can increase the flammability or explosibility (or both) of other combustible substances when it decomposes after exposure to heat. As AN decomposes when in contact with heat or fire, the reactions can release gases such as nitric acid (HNO3), ammonia (NH3), nitrogen oxides (NO, NO2), nitrous oxide (N2O), nitrogen, oxygen, and water vapor, depending on the heat and pressure. Some by- products can be toxic when emitted. During fires, AN presents serious risks of explosion beyond those attributed to its oxidizing properties and ability to decompose and emit toxic gases. When AN is contaminated with organic carbon- containing materials or certain inorganic chemicals, its behavior can become dangerously unpredictable,

54 Resources Safety, Division of Mines and Petroleum. Safe Practice: Safe Storage of Solid Ammonium Nitrate. East Perth, Western Australia: Government of Western Australia, 2013. See: http://www.dmp.wa.gov.au/documents/Code_of_Practice/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on August 4, 2015). 55 U.S. DOT. “Hazardous Material Table,” 49 CFR 172.101. See: http://www.phmsa.dot.gov/portal/site/PHMSA/menuitem.6f23687cf7b00b0f22e4c6962d9c8789/?vgnextoid=d84ddf 479bd7d110VgnVCM1000009ed07898RCRD&vgnextchannel=4f347fd9b896b110VgnVCM1000009ed07898RCR D (accessed on August 4, 2015). 56 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9755 (accessed on January 13, 2016). 57 OSHA. See: https://www.osha.gov/dsg/hazcom/ghoshacomparison.html (accessed on August 4, 2015).

West Fertilizer Company Final Report January 2016 59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

especially when the AN is confined and in the presence of fire or high heat.58 Thus, when AN is combined with contaminants, its explosive sensitivity increases sharply, and the result can lead to detonation.59 Examples of contaminants include organic chemicals, acids, and flammable and combustible materials.60 4.1.3.1 Decomposition of AN AN has a melting point between 311°F and 337°F (155°C and 169°C). It begins to rapidly decompose at a significant rate soon thereafter.61 When it is exposed to high heat and pressure, AN experiences endothermic (heat-absorbing) and exothermic (heat-producing) reactions simultaneously, causing the compound to split into its constituent molecules and also transforming it from solid state to molten, or liquefied, state. When AN decomposes or breaks down under thermal conditions, at least seven unique reactions can occur at varying temperatures, with different heat outputs and rates of reaction.62 Some reactions can produce toxic and detonable by-products. All of the reaction pathways begin with the AN splitting into gaseous ammonia (NH3) and nitric acid (HNO3), although that step is usually not explicit. In the following main exothermic reaction (Eq. 1), which can occur in conditions up to 482°F (250°C), AN yields nitrous oxide and water: NH4NO3 (s)  N2O (g) + 2 H2O (g) (Eq. 1) Above 482°F (250°C), a reversible endothermic reaction (Eq. 2) takes place at a significant rate, splitting the AN to form ammonia and nitric acid: NH4NO3 (s) ↔ NH3 (g) + HNO3 (g) (Eq. 2) This endothermic reaction is accompanied by a number of exothermic reactions between gaseous ammonia (NH3) and nitric acid (HNO3) that vary by degree, depending on reaction conditions. As previously described, AN is in a liquid or molten state, which is aerated with off-gases such as nitrogen oxides (NO, NO2), water vapor, and nitrous oxide (N2O). This bubbly liquid is much more sensitive to detonation than solid prills or unaerated liquid. Depending on the rate of these endothermic and

58 Greiner, Maurice. “Ammonium Nitrate: Hazards and Handling.” Fertilizer Progress January/February (1983): 26– 38. 59 Sun, J. et al. “Catalytic effects of inorganic acids on decomposition of ammonium nitrate.” Journal of Hazardous Materials B127 (2005): 204–210. 60 The OSHA Explosives and Blasting Agents Standard, 29 CFR 1910.109)(i)(5)(i)(a), lists examples of combustible materials or other contaminating substances, including animal fats, baled cotton, baled rags, baled scrap paper, bleaching powder, burlap or cotton bags, caustic soda, coal, coke, charcoal, cork, camphor, excelsior, fibers of any kind, fish oils, fish meal, foam rubber, hay, lubricating oil, linseed oil, or other oxidizable or drying oils, naphthalene, oakum, oiled clothing, oiled paper, oiled textiles, paint, straw, sawdust, wood shavings, or vegetable oil. 61 CF Industries. “FGAN.” Material Safety Data Sheet Number 004. See: http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on August 4, 2015). 62 U.S. Department of the Army. Department of the Army Technical Manual, Ammunition, General, TM 9-1300-214. Washington, DC: U.S. Department of Defense, September 1984.

West Fertilizer Company Final Report January 2016 60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

exothermic reactions, detonation can occur. Conditions other than heat and pressure, such as pH levels and the presence of impurities, can also influence the rate of reaction.63 The decomposition of AN can be controlled to the extent that the main exothermic reaction (Eq. 1) can be used to produce hospital-grade nitrous oxide.64 However, if the rate of reaction is uncontrolled (which happens, for example, when FGAN is exposed to fire), other reactions can occur as AN decomposes and melts. As the temperature rises over 482°F (250°C), liquid AN becomes less dense and contains many small bubbles of gaseous decomposition products and their reactants, primarily water vapor and nitrous oxide. At 500°F (260°C), liquid AN becomes much more sensitive to shock because these bubbles act as “hot spots” that focus the shock or magnify the energy input. Many tests have shown the direct correlation between temperature and sensitivity in molten AN.65 In other words, molten AN becomes more sensitive as the temperature under which it is kept rises. Although the exact sequence of chemical reactions is variable, the primary end products of the detonation process are consistently water, nitrogen (N2), and oxygen (O2). As reactions involving nitric acid (HNO3) and ammonia (NH3) (Eq. 2) produce these end products, heat is released, which adds energy to a detonation. The nitrous oxide (N2O) production process (Eq. 1) combines all of the internal fuel (hydrogen) with the oxygen from nitric acid to form water, so no additional oxidation can take place in the pure AN during the detonation reaction. The difference between the uncontrolled detonation reaction and the nitrous oxide reactions is the rate of the reaction and the formation of the triple bond in N2 and the double bond in O2, which are exothermic and therefore add to the energy yield during detonation. The following formula (Eq. 3) describes this overall decomposition reaction from the intermediate reactions where AN yields nitrogen, oxygen, and water: NH4NO3 (s)  N2 (g) + ½ O2 (g) + 2H2O (g) (Eq. 3) When mixed with AN, many combustible contaminants—including organic materials, fuels, and finely divided materials (e.g., flour, seed or grain dusts, asphalt or fuel oil, or very small metal flakes)—will provide additional fuel that can combine exothermically with the oxygen produced during detonation. Thus, for explosive uses, AN is nearly always combined with a fuel source. This approach increases the energy of the intended explosion and also reduces the toxicity of the end products by reducing nitrogen

63 Lees, F.P., and M.L. Ang (eds.). Safety Cases Within Control of Industrial Major Accident Hazards (CIMAH) Regulations, Chapter 9. Butterworth-Heinemann, 1984; January 1, 1989: 160. 64 Asia Industrial Gases Association. Safe Practices for the Production of Nitrous Oxide from Ammonium Nitrate, AIGA 080/13. Singapore: Asia Industrial Gases Association, 2013. See: http://www.asiaiga.org/docs/AIGA%20080_13%20Safe%20practices%20for%20the%20production%20of%20nitro us%20oxide%20from%20ammonium%20nitrate.pdf (accessed on November 19, 2015). 65 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos ure.pdf (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

oxide (NOx) production. Nitrogen oxides are produced, for example, by the following reaction (Eq. 4), which shows AN yielding nitrogen, water vapor, and nitrogen oxides: 4NH4NO3 (s)  2NO2 (g) + 8H2O (g) + 3N2 (g) (Eq. 4) An example of fueling AN to produce a blasting agent is the addition of fuel oil at around 6 percent by weight to produce ammonium nitrate/fuel oil (ANFO). ANFO may be used for mining and other purposes. Moreover, the military uses a mixture of fuel-rich trinitrotoluene (TNT), AN, and sometimes aluminum to produce a more effective explosive than TNT alone.66 4.1.4 Previous Incidents Involving FGAN AN-related explosions have occurred ever since large-scale AN production began in the late 19th century.67 One of the earlier notable explosions involving FGAN took place in Oppau, Germany, in 1921, when workers fired explosives into a caked mixture of fertilizer to loosen 4,500 tons of ammonium sulfate (AS) and FGAN. The explosion killed 500 to 600 people, injured an additional 2,000 more, and caused as much as $1.7 million (US) in property damage, destroying 80 percent of the city.68 Today, that property damage would equate to more than $22 million.69 Since then, a number of other FGAN incidents have occurred that involved a major fire, explosion, or both. This report highlights the following four incidents involving FGAN because they provide important information about the behavior of FGAN when exposed to fire: • Cherokee incident (1973). A fire in the storage building of FGAN producer Cherokee Nitrogen resulted in an FGAN detonation in Pryor Creek, OK. Of the 14,000 tons of FGAN in storage, only a few tons were involved. The detonation was believed to have been underneath a front-end loader parked in an area with FGAN on the floor and might have been initiated by one of the loader’s components exploding. It was theorized that contamination of the FGAN with flammable fluids in the loader occurred before the detonation. The detonation occurred 25 minutes after the fire was discovered but did not propagate into the main pile.70 • Cory’s Warehouse incident (1982). A fire in a warehouse storing wooden furniture, charcoal, and more than 3,000 tons of bagged FGAN and mixtures based on FGAN produced some deflagration of the FGAN but no detonation.71 Several small explosions occurred but were thought to be due

66 Ibid. 67 Barbrauskas, Vytenis. “Explosions of Ammonium Nitrate Fertilizer in Storage or Transportation Are Preventable Accidents.” Journal of Hazardous Materials 304, 5 (2016): 134–149. 68See: http://www.aria.developpement-durable.gouv.fr/wp-content/files_mf/FD_14373_oppau_1921_ang.pdf (accessed on December 19, 2015). 69 The CPI Inflation calculator. See: http://data.bls.gov/cgi- bin/cpicalc.pl?cost1=1%2C700%2C000&year1=1921&year2=2014 (accessed on December 30, 2014). 70 Freeman, R. “Cherokee Ammonia Plant Explosion.” Chemical Engineering Progress 71, 11 (1975). 71 A deflagration occurs when a combustion wave propagates at a velocity less than the speed of sound. A detonation is a combustion wave that propagates at a velocity greater than the speed of sound. Detonations create high-pressure shock waves that can cause damage at large distances from the source.

West Fertilizer Company Final Report January 2016 62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to reactions between sodium nitrate and charcoal. More than 1,000 people were evacuated, and controlling the fire took 6 hours. • EDC incident (2009). A fertilizer distribution facility in Bryan, Texas, caught fire and completely burned. Firefighters withdrew and evacuated the area. Unlike the West fire, the Bryan AN-related fire produced light-colored smoke as burning progressed, indicating that the fire was ventilated. No explosion occurred, and after the fire, much of the FGAN was still there. Some of the FGAN melted, spread away from the pile, and then re-solidified in a dark mass. The FGAN remaining in the pile had a black crust on it, but beneath that crust, the prills appeared to be unaffected.72 • East Texas Ag Supply incident (2014). A fertilizer warehouse in Athens, Texas, caught fire and burned. The warehouse was near the center of town, and the first responders evacuated the area as rapidly as possible. No explosion occurred. The walls of the structure were masonry, but the bins and roof structure were wood.73

A more comprehensive list of FGAN incidents involving fires and explosions is provided in Appendix B. 4.1.5 Historical Knowledge of AN Fire and Explosion Hazards Over the years, the explosibility and fire hazards of AN have been the subject of a number of research papers. Some of those papers were first published through the U.S. Department of Agriculture (USDA),74 U.S. Bureau of Mines,75 and other sources abroad. In 1945, a USDA-archived publication discussed in detail the properties of pure AN, based on worldwide research conducted up to that date.76 The paper notes the following: • Under favorable conditions of pressure, rapid heating, and retention of heat, AN may be exploded partially from heat alone near 300°F. • AN can detonate if subjected to a very strong initial impulse. • Six factors influence the sensitivity of AN toward an explosion: temperature, strength of initial impulse, density, packing, particle size, and moisture content of the material. Later, the Bureau of Mines (U.S. Department of the Interior) published reports on its investigation of the detonation of AN.77 Some of the key findings of a 1966 Bureau of Mines report indicated the following: • No transition to detonation of AN occurred in numerous burning experiments.

72 CSB conducted an assessment of the Bryan, Texas, incident. 73 CSB collected information after the Athens, Texas, incident. 74 Davis, R.O.E. “Explosibility and Fire Hazard of Ammonium Nitrate Fertilizer,” no. 719. Washington, DC: U.S. Department of Agriculture, 1945. 75 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: Bureau of Mines, 1966. 76 See: https://ia601703.us.archive.org/1/items/explosibilityfir719davi/explosibilityfir719davi.pdf (accessed on January 6, 2016). 77 In 1961, the Manufacturing Chemists’ Association asked the Bureau of Mines to investigate the potential explosion hazards of AN under the conditions of fire exposure that could occur in storage and transportation incidents.

West Fertilizer Company Final Report January 2016 63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• The critical diameter (minimum diameter to sustain detonation) of AN was quite small when just below the melting point. • Initiation of prills by oxygen-acetylene gas detonation was shown to be unlikely. • Detonations were achieved with fuel added in vessels with restricted vents. • The initiation of detonation in AN from fire exposure in normal storage is quite improbable. • The chance of modern AN detonating as the result of fire has been considered to be small or even nonexistent. • The initial shock need not have an amplitude adequate for immediate initiation of detonation. • Failure to detonate at a small scale should not be interpreted as meaning that the material is incapable of detonation. • An acetylene-oxygen mixture in a 3-inch tube failed to detonate hot pulverized AN prills. No attempt was made to initiate detonation in foaming liquid AN by using a gas mixture. • Large fire tests with bagged AN showed that heat penetrated less than 2 inches into the prills and that a crust formed, preventing liquid from penetrating the prills.78 The Bureau of Mines conducted a large-scale study (also in 1966) to determine distances for safe storage of AN. Cardboard tubes 1 meter in diameter were used as the donors and acceptors (the donor is detonated conventionally, and the acceptor, which is placed at a test-determined distance from the donor, either detonates or fails in each test). ANFO was the donor, and the acceptors were ANFO and straight AN. The tests were well documented and were of sufficient scale to produce reliable results. One of the findings was that sheet metal covering the donor increased the distance where sympathetic detonation (a follow-on detonation induced by the explosive effects of an initiating explosion) occurred. In a case with ANFO as the acceptor, a sympathetic detonation was produced over a 50-foot gap. With straight AN, the maximum gap was 19 feet. Without the metal, the gap was 12 feet for AN. The Bureau of Mines also conducted tests at smaller diameters, but no detonation was initiated in AN. One significant finding was that “strong evidence exists that the apparent insensitiveness of AN results largely from a manifestation of critical diameter effects,” highlighting the importance of scale. When evaluating test results, small-scale tests are not reliable indicators of large-scale behavior. In December 1997, EPA published an alert, “Explosion Hazard from Ammonium Nitrate,” with the following recommendations:79 • Avoid heating AN in a confined space (e.g., consider that processes involving AN should be designed to avoid this possibility). • Avoid localized heating of AN, which potentially leads to development of high-temperature areas. • Ensure that AN is not exposed to strong shock waves from explosives.

78 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: Bureau of Mines, 1966. 79 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Avoid contamination of AN with combustible materials or organic substances, such as oils and waxes. • Avoid contamination of AN with inorganic materials that can contribute to its sensitivity to explosion, including chlorides and some metals, such as chromium, copper, cobalt, and nickel. • Maintain the pH of AN solutions within the safe operating range of the process, in particular avoiding low pH (acidic) conditions. This alert was later expanded in August 2013 as a joint EPA, OSHA, and ATF advisory, “Chemical Advisory: Safe Storage, Handling, and Management of Ammonium Nitrate.” A June 2015 revision refers explicitly to AN prills.80 4.2 Factors Contributing to the Massive Fire and Explosion at the WFC Because of the unpredictable behavior of FGAN in fire situations, the scenario that contributed to the detonation at the WFC might never be precisely determined; however, several detonation scenarios are plausible. CSB identified two factors or conditions that likely contributed to the intensity of the fire and detonation: (1) the contamination of FGAN with materials that served as fuel and (2) the nature of the heat buildup and ventilation of the FGAN storage space. These factors and scenarios for how the FGAN behaved on the night of the incident are based on the physical evidence that remained, blast analysis commissioned by CSB, U.S. Army Corps of Engineers crater analysis of the WFC explosion, eyewitness accounts, and previous research on FGAN incidents and testing. 4.2.1 Contamination of the FGAN Pile In fire situations, the behavior of FGAN is unpredictable, in part because of the number of endothermic and exothermic decomposition reactions that take place with increasing temperature. FGAN decomposition reactions beyond the first step have yet to be uniquely defined, and subsequent decomposition reactions of FGAN can only be assumed.81 When contaminants are added to AN, the decomposition reactions become increasingly more complex.82 Possible sources of contamination in an FGAN storage area can include ignitable liquids, finely divided metals or organic materials, chloride salts, carbons, acids, fibers, and sulfides. These contaminants can increase the explosive sensitivity of FGAN.

80 EPA, OSHA, and ATF. “Chemical Advisory: Safe Storage, Handling and Management of Solid Ammonium Nitrate Prills.” See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on December 7, 2015). 81 Cagnina, Stefania; Rotureau, Patricia; and Carlo Adamo. “Study of Incompatibility of Ammonium Nitrate and its Mechanism of Decomposition by Theoretical Approach.” Chemical Engineering Transactions 31 (2013). See: http://www.aidic.it/lp2013/webpapers/141cagnina.pdf (accessed on December 7, 2015). 82 Ibid.

West Fertilizer Company Final Report January 2016 65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The molten FGAN at the WFC likely came in contact with contaminants that were stored in the fertilizer warehouse or were produced during the fire that preceded the explosion. Seed materials, zinc, and other organic products, including the wood-constructed bins, were present near the FGAN storage area or could have come in contact with molten FGAN. During the fire, soot from the smoke and also collapsing wood and roofing material might have mixed with the FGAN pile. The presence of possible contamination in the FGAN pile can be evidenced by changes in the smoke observed in the WFC fire before the explosion. The earliest sign of the WFC fire was white smoke streaming from vents in the elevator cupola on top of the fertilizer warehouse that stored the FGAN. Light-colored smoke is evidence of a well-ventilated fire, which would be typical of the early phase of a structure fire before it depletes the oxygen in the room. The initial smoke observed at the WFC was from the incipient fire, now believed to have started in the seed room. Shortly after authorities were notified, the smoke darkened and became opaque, indicating large quantities of soot83 or hydrocarbons burning (Figure 38). Such soot can be the result of a ventilation-limited fire or a soot-producing fuel such as plastic or asphalt, which produces large amounts of soot even in well-ventilated fires.84 The fact that smoke was observed coming from the same room that held the FGAN bin suggests that the bin was burning at that time. It is likely that soot or molten asphalt began accumulating on the AN shortly after the fire spread to the roof and the FGAN bin. The soot provided a source of fuel as it contaminated the surface of the pile. Soot also greatly increases the absorption of radiant heat from a fire.85

Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) (Source: Member of the Public)

83 Soot is finely divided carbon deposited from flames during the incomplete combustion of organic substances. 84 Fire Development and Behavior Indicators. See: http://cfbt-us.com/pdfs/FBIandFireDevelopment.pdf (accessed on November 19, 2015). 85 Glassman, Irvin and Yetter, Richard. Combustion. Burlington, MA: Academic Press, 2009: 458.

West Fertilizer Company Final Report January 2016 66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.2 Heating and Ventilation

As the fire progressed, the available oxygen in the building was depleted as it was consumed in the fire. Although the fertilizer warehouse structure had some ventilation louvers in the cupola at the top, ventilation at ground level was limited to only a few louvered vents and the normal infiltration that exists around doors. The limited ventilation increased the quantity of soot in the smoke and the potential contamination of the FGAN pile. The path of the fire from the seed room to the main structure is unknown, but an opening, perhaps resulting from an interior wall or the roof burning, seems to have allowed hot smoke and later flame to flow from the seed room into the main structure and out the cupola. Initially, no flames were visible at the cupola, but as the fire progressed, videos and photographs taken before the explosion show the fuel-rich smoke generated by the burning material inside the structure. Subsequently, asphalt roof shingles ignited and began burning vigorously. With limited ventilation inside the structure, a hot layer of smoke likely would have developed in the upper portion of the room containing the FGAN bin. Because cooler air settles below warmer air, the air temperatures would have remained relatively cooler inside the bin. The ground-hugging nature of the evolving smoke plume, as evidenced in Figure 39, is a characteristic of partially cooled smoke, perhaps cooling as it passed through the elevator structure before it exited the cupola. Because the elevator likely was filled with opaque black smoke, radiant heat from the fire on the FGAN pile would be reduced because the opaque black smoke shielded the pile from the heat.

Figure 39. Dark and Heavy Smoke, Rich in Soot (Source: Member of the Public) At some point around 5 to 6 minutes before the detonation, the character of the fire changed, according to eyewitness accounts and photographic evidence (Figure 40). This change was most likely caused by increased ventilation through an opening low in the building, possibly when the fire burned through the seed room doors or the roof. The fire also might have been enhanced by oxidizing gases from the heated FGAN pile.

West Fertilizer Company Final Report January 2016 67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke and Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the Public) The additional ventilation caused a marked decrease in dark smoke and probably was accompanied by a major increase in heat radiation inside the fertilizer building because of increased oxygen availability to the burning wood and other fuels. With the dark smoke inside of the structure reduced, radiant heat would reach the surface of the FGAN in the bin, and the increased airflow through the building would greatly increase the radiant heat flux by raising the temperature of the burning wood. The surface of the FGAN, covered with soot or molten asphalt, would absorb the heat flux and cause a very rapid heating of the surface of the FGAN pile. The very hot and contaminated surface of the pile was then sensitive to detonation. If the building had been well ventilated, the ventilation-limited phase of the fire would not have been as prolonged, reducing the amount of soot and creosote on the pile. In this scenario, the increased intensity of the fire would heat the FGAN pile. The lighter color smoke would allow more heat to be reflected, and the liquid FGAN might have run off as it developed. CSB collected data on similar incidents at the facilities in Bryan, Texas, and Athens, Texas. These incidents demonstrate that an FGAN pile can experience a major structure fire without detonating. The plumes of smoke at the Bryan facility (Figure 41) and Athens facility indicated cleaner-burning fires with less soot production. One source of the difference in the fire plumes might be the level of ventilation inside of the structure, as described to CSB investigators by the Athens fire chief. Some materials, such as asphalt and polyvinyl chloride (PVC), will

West Fertilizer Company Final Report January 2016 68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

produce dark plumes even when burning in the open air, but if that smoke production is outside of the structure, no contamination of the FGAN will occur.

Figure 41. Plume of Smoke from AN Fire in Bryan, Texas (Source: College Station Fire Department) 4.3 Detonation Scenarios CSB found that contamination (likely from the storage of nearby combustibles or the combustible materials used to construct the FGAN bins and building) and the lack of ventilation were contributing factors that ultimately led to the detonation. However, the exact behavior of the FGAN—specifically how the contaminants, decomposition by-products, ventilation issues, or a combination of those conditions led to the explosion—may never be known. Previous studies indicated that a detonation of modern FGAN prills under normal standard storage conditions when exposed to fire (unconfined storage without the potential for pressure buildup) was highly unlikely based on a number of factors. Therefore, the three scenarios in this section are considered plausible, but large-scale testing is needed to estimate their relative likelihood. One of the three scenarios (or a combination) is considered plausible as an explanation of event sequences: • Scenario 1: Detonation from the top of the FGAN pile. • Scenario 2: Detonation in heated FGAN along exterior wall exposed to fire. • Scenario 3: Detonation in elevator pit that spread to main FGAN bin.

West Fertilizer Company Final Report January 2016 69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1 Scenario 1: Detonation from the Top of the FGAN Pile

Based on the location of the pile and the properties of the bin along with the circumstances of other fire- induced incidents, one possible scenario is that a period of contamination with soot and other organics (possibly including molten asphalt and plastic dripping from the burning composite shingle roof and PVC drop pipe from the elevator mechanism) was followed by about 5 to 6 minutes of intense radiant heating from the flames above and adjacent to the main FGAN bin. During this time, a layer of very hot, contaminated, and sensitive liquid FGAN could have built up on the pile. The foaming FGAN likely produced oxidizing gases, and those mixed with flammable smoke to produce a detonable gas cloud over the FGAN pile in the main bin and possibly in an adjoining bin linked to the main bin through a series of holes cut in the partition between the bins. The cloud consisted of powerful oxidizers that would be expected when FGAN undergoes thermal decomposition—such as NO2, O2, and HNO3 as wells as fuel- rich smoke and pyrolysis86 products off-gassing from the molten FGAN. The gas cloud then might have ignited from above, undergoing a gas-phase deflagration-to-detonation transition (DDT) in the confinement of the bin. This transition could have been enhanced by the passage of the burning front through the openings between the main and secondary bins, which possibly contained a few hundred pounds of FGAN, in a process known as hot gas injection.87 Given the powerful oxidizers and mixture of fuels possible in this environment, a direct gas-phase DDT in the partial containment of the main bin by itself might be another possible initiator. This gas detonation then initiated an explosive train on the surface of the pile (Figure 42), moving through the contaminated and sensitive low-density foam, into the mixture of high-density foam and prills beneath, and then into the ambient prills composing the bulk of the pile.

86 Pyrolysis is the chemical decomposition of a substance by heat. 87 Byers, Kenneth J. “Pressure Piling and Other Issues Affecting Flameproof Enclosures.” Redbank, Australia: Testing and Certification Centre, SIMTARS, 1996.

West Fertilizer Company Final Report January 2016 70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB) In tests using 1-meter (diameter) cardboard tubes, ambient temperature FGAN has been detonated by a 10-centimeter layer of ANFO at the end of the tube, initiated by a flat shock wave.88 If a large portion of the surface of the AN pile was detonated by a gas explosion and if the sensitized layer detonated, then the minimum diameter for unconfined FGAN prills (around 1 meter) would be exceeded, and the detonation could potentially proceed through the pile in a complete detonation. In many historical accidents, only part of the AN detonates because of the inability of the detonation wave to spread from a small detonation source into the main pile.89 This type of incomplete or partial detonation does not seem to have occurred at the WFC; the crater and blast damage indicate a complete detonation of the main pile, however it is unknown how much of the FGAN burned prior to the explosion. Falling material from a roof collapse has been proposed as a possible initiator in previous accidents, but subsequent testing of falling objects and high-speed projectiles entering solid and molten FGAN did not support this scenario. Although tests have shown that high-velocity impacts (such as those from high-

88 Winning, C.H. “Detonation Characteristics of Prilled Ammonium Nitrate.” Fire Technology 1, 1 (1965): 23. 89 Freeman, R. “Cherokee Nitrogen Co., Pryor OK.” Chemical Engineering Progress 71, 11 (1975).

West Fertilizer Company Final Report January 2016 71 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caliber bullets) can detonate molten FGAN, the low velocities of falling objects do not appear to provide the energy density needed to detonate even sensitized FGAN.90 Fragments from a fire-induced explosion—such as the materials that might be produced in a hot steel roller with FGAN trapped inside—are another potential initiation source at the top of the pile but likely would not create the large flat shock wave required to fully detonate FGAN. No known vehicles or pressure tanks were close enough to the bin to produce high-speed fragments or a strong shock wave on the top of the FGAN pile. A golf cart was in the seed room, and fire extinguishers and an air conditioner could have failed from overpressure due to overheating, but they were separated from the FGAN bin by the substantial walls of the bin and are unlikely to have produced high-speed fragments. As other researchers have noted, the common element linking recent fire-induced FGAN detonations is some level of confinement.91 At the WFC building in West, the confinement was the wooden bin, whereas in the transportation accidents in Mexico and Romania cited in the reference, the confinement was the semitrailer. The confinement provided by a wooden bin or a trailer would not allow sufficient pressure to build up to support a solid-phase DDT92 but could allow the gases escaping the heated FGAN to accumulate over the pile. Additional field testing of this possibility would be useful. 4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to Fire Another possible scenario is that the detonation at the WFC facility was initiated along one of the exterior walls of the bin. The north and east sides of the bin were exposed to the fire and could have been heated through the walls. No evidence indicates that the bin failed during the fire, although that cannot be ruled out, so the side of the FGAN pile likely would have no direct contact with flame, but some heat could have penetrated through the wall of the bin—more heat if the exterior wall adjacent to the seed room was penetrated and fire entered the space between the exterior sheathing and the plywood bin lining. Figure 43 shows some of the features of the fire on the north side of the structure a few minutes before detonation. The structure above the bin had lost its siding and was burning with good air flow. Flames were appearing through the siding outside the bin, indicating that the wooden exterior sheathing and roofing were beginning to burn. The seed room was just a burning frame, and most of its roof had burned and collapsed.

90 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos ure.pdf (accessed on November 19, 2015). 91 Nygaard, E.C. “Large Scale Testing of Ammonium Nitrate.” 4th EFEE World Conference of Explosives and Blasting 4(1), 2007. 92 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. Department of the Interior, Bureau of Mines, 1966. See: http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateunderFireExpos ure.pdf.pdf (accessed on December 22, 2015).

West Fertilizer Company Final Report January 2016 72 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the Public) Even with some heating of the pile through the bin wall, it is difficult to envision a potential detonation source; FGAN does not normally detonate when heated except under severe confinement.93 Contamination also would be less likely in the FGAN exposed to heat along the exterior seed room wall, but some liquid AN, contaminated by soot and roofing components, on the pile surface might have penetrated along the heated wall of the bin if the temperature was high enough or the wall was partially breached. A small amount of wood from the bin also might be nitrated by nitric acid off-gassing from the heated FGAN to form nitrocellulose, but such a reaction has not been observed in testing, and no research papers supporting such a scenario were found. The WFC facility had a concrete floor that would have prevented heating of the pile from the bottom. Bin failure, preceded by leakage of the FGAN or FGAN liquid onto burning material such as seed or plastic cannot be ruled out. Because the bin floor was well above the floor of the seed room, the falling material would have some momentum and could produce

93 Arthur D. Little, Inc. Study of Ammonium Nitrate Materials. Springfield, VA: National Technical Information Service, 1952: 1–49. See: http://www.dtic.mil/dtic/tr/fulltext/u2/786334.pdf (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 73 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

significant pressure under ideal conditions. Whether this situation could lead to a detonation is an open question. 4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin Another possible detonation scenario focuses on the elevator pit near the FGAN bin. A fiberglass lid covered the pit, and the floor sloped away from the pit to prevent runoff from entering it, but the fire might have melted the cover, and FGAN remnants could have been in the pit. The typical elevator mechanism would not provide any areas for strong confinement leading to high pressures, nor does it seem plausible that a small detonation in the pit could have initiated the main FGAN pile. If the detonation began in the pit, then the most feasible mechanism would be a collapse of the west wall of the bin, spilling FGAN into a mixture of burning rubber from the melted elevator belt and residual FGAN in the bottom of the pit. The mass of the falling FGAN, combined with the strong confinement of the concrete pit walls, might have provided the conditions for a solid phase DDT beginning in the bottom of pit and spreading into the main pile. The likelihood of sufficient FGAN near the door, where the pit was located, seems quite low. Liquid FGAN, if it somehow leaked into the pit, would have been under confinement conditions similar to those for liquid in the bin, with no obvious areas where pressure could build. The elevator itself is a belt with cups protected by a sheet metal box open at the top and bottom. The belt that brought the material in from the unloading pit outside provides no obvious containment other than the rollers, which are often hollow metal. Unlike the rollers above the bin, these rollers would have been shielded from the heat of the main fire but could have been heated by a fire (if it existed) in the pit. Molten and contaminated FGAN on the floor, initiated by an explosion from a burning loader, was suspected in the 1973 Cherokee FGAN storage explosion, but no known source of an initiating detonation existed at the WFC, and the detonation at Cherokee did not propagate into the main pile. The circumstances of the two accidents were too different to draw any firm conclusions about the role of molten AN in the detonations. Other fires involving FGAN (such as the fires in Bryan, Texas, and Athens, Texas) did not result in detonation, even though the fires totally consumed the structures housing the FGAN bins and the roofs collapsed. This evidence demonstrates the unpredictable behavior of FGAN exposed to fire. Possible differences between the fire incidents and the WFC are ventilation of the fire, which determines the degree of contamination from smoke products; level of confinement in the bin; and degree of direct heating on the FGAN pile. 4.4 Forensic Testing of West Fertilizer Company Samples On the day before the explosion, the WFC sold 8,000 pounds of an FGAN/AS blend of fertilizer to a farmer in Abbot, Texas. The farmer told CSB investigators that the fertilizer he received, which he estimated was about 75 percent FGAN and 25 percent AS, was dustier than usual during spreading. After

West Fertilizer Company Final Report January 2016 74 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the incident, the Office of the Texas State Chemist (OTSC) retained a portion of the fertilizer and provided a sample to CSB for further testing. The OTSC is part of the Texas A&M University System and administers the requirements of the Texas Feed and Fertilizer Control Service. The OTSC regulates the sale of fertilizer and also conducts laboratory testing of FGAN to ensure that it meets quality guidelines for fertilizer. The OTSC conducted testing of the samples and shared the results with CSB. The OTSC spectral analysis found no activated carbon or any evidence of contamination of the FGAN sample. According to the report, the testing concluded that the sample was a mixture of FGAN and AS. The OTSC ran a nitrogen analysis in the state’s combustion laboratory; this is a routine test run by the OTSC to check the concentration of nitrogen in fertilizers. The OTSC determined that the amount of nitrogen contained in the FGAN/AS sample mixture had nitrogen percentages that ranged from 34.33 to 34.61 percent.94 The laboratory also conducted tests to determine the particle size distribution of the prills in the farmer’s FGAN/AS sample. Results verified that the FGAN/AS samples had high concentrations of fines (smaller broken-down prills). Approximately half (50 to 55 percent) of the farmer’s sample consisted of particles smaller than 200 micrometers (0.2 millimeters). Operating under the assumption that the farmer’s sample was a blend of FGAN and AS prills, the laboratory obtained a control sample of FGAN and AS mixed in 70:30 portions, respectively. The control sample contained 10 percent particles smaller than 200 micrometers. Although the farmer’s sample included a larger than usual number of fines, the particle sizes in this sample are not necessarily representative of the FGAN in the main bin at the WFC because of the addition of AS to the farmer’s mixture. Mechanical action such as blending might have taken place when creating the FGAN/AS mixture, reducing the particle size, and further breakage might have occurred during transit. CSB investigators collected samples of the fertilizer remaining at the WFC facility and the OTSC and in March 2015 commissioned a forensics laboratory to characterize the composition of eight samples by semi-quantitative analysis. Samples 1 through 5 were categorized as solidified and pulverized fertilizer collected from various bins (Figure 44); sample 6 was collected from the FGAN railcar on the WFC property that was the least disturbed by the explosion and firefighting efforts (Figure 45); and samples 7 and 8 were collected from the FGAN mixture purchased by the farmer on the day before the incident (Figure 46). According to shipment records, the railcar contained pure FGAN manufactured by CF Industries. The railcar arrived at the WFC site in early April 2013. At the time of the incident, the WFC had not yet unloaded the railcar. The WFC also received truckloads of EDC pure FGAN product in early April 2013. CSB is unable to conclude whether the CF Industries or EDC product, or a mixture of both, was present in the FGAN main bin at the WFC facility at the time of the explosion.

94 The percent of nitrogen (34 percent minimum) is typical for a high-density FGAN prill.

West Fertilizer Company Final Report January 2016 75 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: Forensic Laboratory)

Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory)

Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory)

West Fertilizer Company Final Report January 2016 76 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The laboratory used infrared spectroscopy and electron microscopy methods to determine the elemental compositions of each sample. Results of this testing confirmed the presence or absence of AN and other salts in some of the samples. Four of the eight samples (1, 2, 3, and 5) contained no FGAN (Table 4). The sample collected from the railcar (no. 6) was determined to contain wholly AN with 36 percent95 nitrogen and had a prill density of 1.59 grams per cubic centimeter (g/cm3).96 The railcar sample consisted of prilled particles with a polyolefin coating, which is commonly applied to reduce caking.97 Magnesium nitrate or magnesium oxide is also occasionally used as an additive to FGAN prills during the manufacturing process.98 The purpose of the additive is to act as a desiccant (absorbs moisture) and also to protect against the breakdown of prills at higher temperatures.99 CSB concluded that the chemical composition of the FGAN obtained from the rail car (no. 6) was typical of FGAN prills commonly used for fertilizer and for creation of fertilizer blends.

Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC

95 FGAN prills typically contain about 34 percent nitrogen. The 36 percent nitrogen result in the sample is likely attributed to the percent error in the analytical method used. The laboratory conducted a linear regression analysis to determine the percentage error in the determination of elemental sulfur in the FGAN/AS samples compared to a control sample, and it estimated the error to be within +/- 0.3 percent of the sample. The laboratory concluded that the percentage error estimates would be similar for oxygen and nitrogen in the samples that underwent electron dispersive spectroscopy (EDS) methods. 96 FGAN is a higher-density prill in the range of 1.72 g/cm3. 97 According to the FGAN Safety Data Sheet (SDS) from CF Industries, the FGAN prills contain a 0 to 0.2 percent proprietary polyolefin conditioning agent. 98 Ammonium nitrate particulate fertilizer and method for producing the same. See: http://www.google.com/patents/US5720794 (accessed on November 25, 2015). 99 U.N. Industrial Development Organization. Fertilizer Manual, 3rd Edition. The Netherlands: Kluwer Academic Publishers, 1998: 227. No. Sample Location (if known) Sample Description Detected Compounds FGAN Detected 1 Unknown White and pink encrusted and prilled layers AS, magnesium phosphate (with iron), potassium sulfate No 2 Ammonium phosphate/potassium chloride bin White prilled particles, pink fragmented particles, and grey encrusted particles AS, ammonium phosphate, and possibly potassium chloride No 3 Space between FGAN and potassium chloride bins Dark pink fragments Ammonium phosphate, sulfate, alkali salts of fluoride, trace iron No 4 Backside of diammonium phosphate bin White powder with red streaks AN, AS, chlorides, ammonium phosphate, and trace amounts of potassium chloride Yes

West Fertilizer Company Final Report January 2016 77 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The FGAN/AS mixture purchased by the farmer on the day before the incident was the only available sample representative of materials stored in the fertilizer building before the incident. In addition to the testing conducted by the OTSC to determine the percentage of nitrogen and quantity of fine in these samples, CSB commissioned additional laboratory testing of the prills contained in the FGAN/AS mixture (samples 7 and 8 in Table 4) in October 2015. Because the FGAN sample from the railcar on the WFC property remained relatively undisturbed during the fire and explosion, the laboratory also selected a prill from that sample (no. 6 in Table 4) for comparison. An image from a macroscopic examination of an individual prill from sample items 6, 7, and 8 is shown in Figure 47. Item 6, which was collected from the railcar, had a smooth and uniform coating-like texture, whereas evidence items 7 and 8, which were sampled from the farmer’s mixture, had an uneven surface made up of an agglomeration of amorphous (formless) and semicrystalline particles.

Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory) 5 Backside of ammonium sulfate bin Sample containing gravel and pebbles (separated before analysis) AS, sulfates, and chlorides No 6 Railcar White prilled particles Prilled AN coated with polyolefin Yes 7 Farmer AS/FGAN mixture White prilled particles (partially agglomerated from wetting) AN, AS, sulfate, extractable polyolefin Yes 8 Farmer AS/FGAN mixture White prilled particles AN, AS, sulfate, extractable polyolefin Yes

West Fertilizer Company Final Report January 2016 78 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Under a microscope, the polyolefin coating was visually apparent on the surface of the item 6 prill. Through infrared spectral analysis, the laboratory was able to chemically identify the external prill coating as a polyolefin. However, the external polyolefin coating on the surface of sample items 7 and 8 could not be identified through the same analysis. To determine whether a coating had been present, the laboratory quantitatively extracted residues from the prills in a solvent that could be analyzed through infrared spectra analysis. Although direct surface scans of items 7 and 8 did not reveal the presence of the coating, solvent extracts indicated the presence of a polyolefin. This coating could have been applied to the prills at some point in time but was no longer acting as a prill coating on the observed sample items 7 and 8. 4.5 Blast and Impact Analysis CSB commissioned a consultant firm to survey the property damage to the WFC and the surrounding community. On the basis of information obtained from the survey, the consultants characterized the force of the blast and estimated the energy produced during the explosion. Using indicators from the observed damage to residences and community structures, the consultants applied a guideline100 from the U.S. Army Corps of Engineers and created a three-dimensional model to predict the blast overpressure and determine the explosive weight that was best explained by the physical damage observed in West, Texas. The computational models and calculations expressed the AN explosive energy estimation normalized against the explosive power of TNT,101 a high-explosive compound commonly used to quantify blast loads. A TNT equivalence calculation provides an approximation of explosive energy in pounds of TNT. Several TNT equivalent equations are used in industry that employ actual and estimated explosion parameters such as heat capacity, weight of explosive charge, and explosion percent efficiency. Many of the parameters are specific to the material involved. TNT equivalent values are a rough approximation of explosive effects, and the variability of TNT equivalence (20 to 40 percent) might be a result of the ways that it is calculated based on pressure, impulse, crater size, or other damage measures.102 The blast modeling consultants estimated the range of potential explosive yields from the WFC explosion to be equivalent to a range of 20,000 to 40,000 pounds of TNT, based on the blast damage indicators recorded and analyzed from 20 lightweight metal buildings, the deformed basketball goalposts, and the condition of the apartment complex and nursing home. To further refine a specific explosive weight most consistent with all of the observed damage, the consultants used another modeling tool that incorporates a number of different blast prediction methodologies, including the development of a computational fluid dynamic simulation to characterize the shock wave as it wrapped around structures and other obstacles during the explosion. The CSB-

100 U.S. Army Corps of Engineers. “Estimating Damage to Structures from Terrorist Bombs Field Operations Guide,” ETL 1110-3-495. Washington, DC: U.S. Army Corps of Engineers, 1999. 101 One ton of TNT has an explosive energy of 4.184 gigajoules. 102 National Assessment Group. “Ammonium Nitrate Detonability Review and Assessment, Final Report.” Prepared for the Technical Support Working Groups, For Official Use Only. Kirtland AFB, NM: September 2, 2011: 7.

West Fertilizer Company Final Report January 2016 79 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD commissioned blast experts determined that the explosive energy of the WFC explosion that is most consistent with the observed damage is 25,000 pounds (12.5 tons) of TNT. With an estimated 30 tons of FGAN in the main WFC bin at the time of the blast, the 12.5-ton TNT equivalent is based on a 42 percent efficiency of the material that contributed to the explosive energy. Because the quantity of FGAN consumed in the fire before the explosion was not determined, the exact quantity of FGAN that contributed to the explosion remains unknown. The ATF National Response Team also requested that the U.S. Army Engineer Research and Development Center (ERDC) conduct an assessment of the WFC explosion damage and then estimate the equivalent explosive yield of the blast. The ERDC team arrived in West on April 29, 2013. As part of the site study, the ERDC team conducted a detailed survey of the crater left by the explosion (Figure 48), using survey and three-dimensional scanning equipment to verify critical dimensions. The shape of the crater was asymmetric, with an apparent diameter of 75 feet and a depth of nearly 8 feet (Figure 49). Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB)

West Fertilizer Company Final Report January 2016 80 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) The ERDC team compared the field crater measurements with experimental data for blast craters and other sources to produce an estimate of the net explosive weight of the FGAN. The experimental data also took into consideration the near-surface geology (soil type and underlying rocks) surrounding the explosion, which has an effect on the crater depth and size. The ERDC team compared the crater dimensions and soil types from the WFC explosion with similar experimental data to estimate the explosive weight of FGAN. The final report on this analysis concluded that this method entails a degree of uncertainty because none of the experimental data included the type of soil with limestone found in Texas.103 In addition, the experimental charge was C-4, which might have a different explosive or cratering efficiency than FGAN. The ERDC team made assumptions to account for the lack of available data and, on the basis of the crater analysis, estimated the WFC explosion to be within the range of 10,000 to 21,500 pounds of TNT. The center of the crater was almost directly under the WFC facility’s main FGAN bin, which was likely the source of fuel for the explosion. This main bin contained an estimated 20 to 30 tons of FGAN at the time of the incident; however, the blast analyses from consultants hired by CSB and from the Army Corps of Engineers indicate that the quantity of FGAN that contributed to the explosion could have been smaller, based on the observed damage. To demonstrate the location of the crater in reference to the fertilizer storage building and the main FGAN bin, CSB commissioned a structural engineering firm to create a three-dimensional rendering of the fertilizer facility over the crater location (Figure 50).104 Figure 51 shows an elevation view of the fertilizer building, with the underlying crater. 103 The soil at the WFC consists of limestone with varying amounts of chalk and clay. This soil type is consistent with what would be expected in West, Texas. 104 Crater and building location are estimated to be within +/- 2 feet, based on global positioning information.

West Fertilizer Company Final Report January 2016 81 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering)

Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering) 4.5.1 Seismic Data According to the United States Geological Survey (USGS), the WFC explosion registered as an earthquake of magnitude 2.1 on the Richter scale. The Lake Whitney seismic station in Meridian, Texas, about 25 miles west-northwest of the WFC site, recorded seismic signals from the April 17, 2013, explosion. ATF concluded that there were two separate explosions, “one smaller and one larger,” based

West Fertilizer Company Final Report January 2016 82 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

on eyewitness accounts and seismic evidence.105 After conversations with USGS seismologists, CSB later learned that a system error occurred, and only one event was recorded at the Lake Whitney station. According to USGS, seismic signals resulting from the WFC explosion were recorded on nine seismic stations within a range of 25 to 360 miles. Using the onset time of the seismic energy at these stations and the known location of the explosion, the USGS National Earthquake Information Center estimated that the time of the explosion was 7:50:38 pm local time. According to USGS, the seismic data recording shows both energy that propagated through the earth as well as later-arriving energy that propagated through the air (Figure 52). USGS concluded that the event was a single large explosion, but it could not rule out the possibility of multiple closely timed explosions.

Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National Earthquake Information Center (Source: USGS) 5.0 Commercial Property and Liability Insurance The West Fertilizer Company (WFC) had commercial property insurance to cover losses (such as building damage, damage to product, or loss of income due to property damage) from certain loss events, such as fires. The company also held a commercial liability insurance policy to protect itself against claims for bodily injury while onsite or while operating company automobiles. CSB examined available documentation of the WFC’s insurance coverage and inspections from 2007 until the April 2013 explosion. The WFC was insured by two different insurance companies, Triangle Insurance Company,

105 ATF. “ATF Press Conference Video,” May 16, 2013, minute 12:45. See: http://www.youtube.com/watch?v=OpLjSvcRqzU (accessed on November 19, 2015).

West Fertilizer Company Final Report January 2016 83 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Inc. (Triangle) and the United States Fire Insurance Company (U.S. Fire). Triangle issued policies that included coverage for property damage, business interruption, bodily injury, and automobile accidents from 2007 to the end of 2009. In late 2009, Triangle decided not to renew the insurance policy because of the WFC’s lack of compliance with loss control recommendations. The WFC insurance policy expired on December 31, 2009. Thereafter, the WFC obtained similar coverage from U.S. Fire in January 2010 and renewed it in 2011, 2012, and 2013. The U.S. Fire insurance policy was in effect at the time of the 2013 explosion. 5.1 Triangle Insurance Coverage and Audits (2006–2010) Triangle conducted an initial onsite survey of the WFC facility in 2006 and provided insurance coverage from 2007 until 2010. The WFC had a $1 million commercial general liability policy and $2 million in coverage to cover onsite property and business losses. In 2009, Triangle gave notice to the WFC that it was not renewing the policy because of the WFC’s lack of compliance with loss control recommendations issued by Triangle following several onsite audits. Triangle conducted annual loss control surveys at the WFC facility from 2006 through 2009, and it issued a number of recommendations for suggested improvements to WFC operations. The Triangle loss control surveys included an evaluation of WFC automobiles and drivers, storage and application of dry and liquid fertilizers, grain and feed milling, and anhydrous ammonia. CSB investigators requested and reviewed insurance documentation from Triangle, including risk profiles, insurance audit reports, and communications from Triangle to the WFC. In 2006, Triangle performed an initial survey of the WFC facility before issuing coverage. Triangle loss control specialists made four recommendations to the WFC for safety improvements, including replacing missing guards on augers and conveyors and addressing visual damage to one of the grain bins. Triangle’s overall risk assessment categorized the facility as average, with housekeeping, maintenance, and grounds in average to fair condition. During the anhydrous ammonia survey, Triangle noted the close proximity of the WFC facility to schools, residences, and businesses and also documented concerns about the ammonia risk management plan (RMP) being out of date (discussed in Section 8.4.2.4). Triangle assigned a representative to work with the WFC to update and improve the RMP submission. In 2007, Triangle conducted another loss control survey and submitted 10 recommendations to the WFC; 4 of the 10 recommendations were restated from the 2006 survey because they remained unresolved. The loss control specialist identified several safety and compliance issues, including: • A corroded 440-volt wire ran from the pole on the north side of the plant through the bulk fertilizer facility to the anhydrous ammonia tank area on the south side of the facility. • An aluminum ground wire showed noticeable signs of corrosion from the fertilizer. The loss control specialist noted that the wire could lose its ability to ground, potentially causing shock and fire hazards (Figure 53). • Several temporary lighting sockets needed to be wired in permanently to reduce the potential for electrical shocks and fire hazards.

West Fertilizer Company Final Report January 2016 84 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

About 2 months later, the WFC responded to some of the Triangle recommendations and reported that 3 of the 10 recommendations were resolved, including replacing guards and repairing an electrical cord on an auger. The remaining seven recommendations, including the exposed 440-volt wire, remained outstanding. The Triangle loss control specialist’s overall opinion of risk, documented from this survey, was fair; housekeeping received a fair rating; and maintenance received a fair to poor rating.

Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey (Source: Triangle Insurance Company) In September 2008, a loss control specialist from Triangle conducted another renewal survey and made 14 recommendations, including several outstanding recommendations from the previous year. During this survey, Triangle identified additional damaged electrical wires at the facility in need of repair (Figure 54). The WFC submitted a completed recommendation form to Triangle later that month, stating that seven recommendations were addressed or in the process of being settled.

West Fertilizer Company Final Report January 2016 85 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey (Source: Triangle Insurance Company) In August 2009, Triangle identified six additional recommendations during the annual loss control survey. One recommendation was restated and designated as “critical” for a lack of safety chains on towing equipment. The Triangle consultant also noted that the WFC “seems to be resistant” to implementing a training program to address the frequency of vehicle and mobile equipment accidents. Triangle documented a large quantity of temporary exposed wiring in the WFC facility that needed to be run in conduits. When evaluating WFC safety programs in 2009, Triangle noted that the company had no positive safety culture and that “written programs are incomplete and outdated, there is no structured safety program.” In addition, Triangle found no accident investigation program and no evidence that the WFC held regular safety meetings for employees. The following excerpt from the 2009 survey indicates Triangle concerns: They need a SCMP (Safety and Compliance Management Programs) person to help them with safety issues, permits, etc. To my knowledge they have not had a safety meeting since we started insuring them in 2006…I have a concern with the wiring at both grain operation & the dry fertilizer plant. Only about 10% is run in conduit. The rest consist of a heavy flexible 4-wire cable, the type you would normally use to put outside on poles but it is not protected from cuts & abrasion.106 In September 2009, the loss control specialist stated in an internal Triangle email that “because of losses and non-compliance of recommendations, Triangle should non-renew Adair Grain, Inc./West Fertilizer Co. in West, Texas.”107 In September 2009, Triangle sent notification to the WFC that all policies would not be renewed for the following year. In 2010, the WFC retained U.S. Fire for insurance coverage.

106 Triangle Insurance Company Documentation, Loss Control Survey at Adair Grain/WFC. August 2009. 107 Triangle Representative. “Adair Grain,” email message to manager, Underwriting Services Triangle, September 14, 2009.

West Fertilizer Company Final Report January 2016 86 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards

CSB reviewed the WFC loss control survey documentation and the Triangle “Loss Control Best Practice Manual” for insurance inspectors and found no focus on FGAN fire and explosion hazards between 2006 and 2009. In the 2006 survey and subsequent surveys, Triangle documented the presence of ammonium nitrate (AN) onsite for security concerns and answered, “Yes” to the question, “Does the account meet state regulations for the storage and transportation of product?” Although no state-specific regulations for AN storage existed at the time, the survey did not include federal regulations, such as the OSHA Explosives and Blasting Agents standard (29 CFR 1910.109, discussed in Section 8.2), or industry consensus standards, such as National Fire Protection Association (NFPA) 400, Hazardous Materials Code (addressed in Section 8.6.1). Triangle guidance included a description of combustible and noncombustible bulk fertilizer storage buildings for informational purposes, but Triangle did not provide guidelines or requirements for specific storage practices, such as separation from potential contaminants, materials of construction, or mechanism for fire and explosion prevention. Other survey focus areas, such as grain milling and anhydrous ammonia, included a more detailed review of federal requirements, such as the OSHA Grain Handling Facilities Standard (29 CFR 1910.272) for the prevention of grain dust explosions and the EPA Risk Management Program rule for anhydrous ammonia storage. In November 2013, Triangle updated the best practice manual to include compliance with federal regulations in addition to state regulations for fertilizer storage and transportation. 5.2 U.S. Fire Insurance Coverage and Audits (2010–2013) U.S. Fire started providing insurance to the WFC in 2010 and renewed coverage for 2011, 2012, and

1. The WFC was insured by U.S. Fire at the time of the April 2013 incident. The WFC general

liability policy had a maximum limit of $1 million, and the commercial property insurance policy had a limit of about $4.45 million, which included all buildings and equipment on the WFC property. In 2013, the WFC held U.S. Fire coverage for commercial property, general liability, inland marine,108 and commercial automobile. According to the insurance policy documentation for the WFC, U.S. Fire offered policyholders a loss control service that included onsite surveys of the facility to provide: • Safety information and educational material to minimize loss costs. • Initial survey and evaluation. • Specific suggestions for improving loss control practices. • Consultation and training to help management understand hazards associated with operations. • Follow-up surveys.

108 Commercial inland marine insurance covers property in transit or property that is movable or portable and is not at a fixed location.

West Fertilizer Company Final Report January 2016 87 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB requested additional information from U.S. Fire related to the WFC insurance policy, including claims, audits and inspections, and training requirements for U.S. Fire loss consultants. CSB also requested documentation of U.S. Fire’s onsite inspections at the WFC facility over the time period it was insured. To date, U.S. Fire has not provided CSB with the requested documentation. Outside counsel for U.S. Fire indicated to a CSB investigator that the $1 million policy amount did not necessitate much onsite activity, such as audits or inspections, during the time that the WFC was insured. 109 5.3 Insurance Claims and Other Aid after the Explosion The Texas Department of Insurance (TDI) regulates the business of insurance in Texas and provides resources for people and businesses to obtain insurance in the state. In response to the WFC explosion, TDI assisted in securing the scene and mobilizing a disaster response program to assist consumers with filing insurance claims related to the incident. The Texas State Fire Marshal’s Office (SFMO) and the Division of Workers’ Compensation are units within TDI. The total insurance-related losses due to the explosion are estimated to be in the range of $230 million.110 Many of the residents in the area did not have home or rental insurance. Those individuals relied on aid from FEMA, Salvation Army, and American Red Cross operations. FEMA received a total of 1,108 applications for assistance as a result of the fire and explosion at the WFC facility.111 Nearly 6 months after the incident, FEMA112 reported providing federal disaster assistance exceeding $16 million to eligible survivors. This sum included more than $9 million in federal disaster loans from the U.S. Small Business Administration (SBA), nearly $840,000 in individual assistance grants from FEMA, and more than $6.2 million in FEMA Public Assistance funding.113 Low-interest disaster assistance loans from the SBA114 were also available to homeowners, renters, businesses of all sizes, and private nonprofit organizations whose property was damaged or destroyed by the incident. On the basis of data provided by FEMA, 580 applications were submitted for individuals or families that had homeowners, homeowners with small business loans, and mobile home insurance. FEMA verified losses totaled about $9,052,308. The real property FEMA verified losses amounted to about $8,145,750. The personal property FEMA verified losses totaled roughly $906,557. Although all losses related to the fire and explosion totaled nearly $250 million, the

109 Outside Counsel for U.S. Fire, conversation with CSB Investigator, January 20, 2015. 110 Texas House of Representatives, 84th Texas Legislative Session. Testimony on House Bill 2470. See: http://www.house.state.tx.us/video-audio/committee-broadcasts/ (accessed on January 6, 2016). 111 Official data provided by FEMA. 112 FEMA—under the authority of Section 408 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. § 5174, and Title 44 of the Code of Federal Regulations (CFR)—may provide financial assistance and, if necessary, direct services to eligible individuals and households that, as a direct result of a major disaster, have necessary expenses and serious needs and are unable to meet such expenses or needs through other means. 113 See: http://www.fema.gov/news-release/2013/10/07/federal-disaster-assistance-tops-16-million-west-texas (accessed on January 6, 2016). 114 The SBA serves as the Federal government’s primary source of money for the long-term rebuilding of disaster- damaged private property. These disaster loans cover uninsured and uncompensated losses and do not duplicate benefits of other agencies or organizations.

West Fertilizer Company Final Report January 2016 88 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC carried a policy from U.S. Fire at the time of the incident with a limit of only $1 million for bodily injury and offsite property damage. 5.4 FGAN Facilities in Texas and the Potential for Offsite Consequences Under the Texas Commercial Fertilizer Rule (described in Section 8.7.1), facilities that sell or offer to sell FGAN or FGAN-containing materials must obtain annual registrations from the Office of the Texas State Chemist (OTSC) to do business. The OTSC collects information on each facility storing more than 10,000 pounds (5 tons) of AN in Texas. According to the OTSC list of facilities as of September 2014, 80 facilities statewide stored AN in quantities exceeding 10,000 pounds. Of those 80 facilities, 43 stored FGAN, and 37 stored technical grade ammonium nitrate (TGAN). In October 2015, the OTSC reported 40 FGAN facilities in Texas.115 Of those 40 facilities, only nine (23 percent) are located in jurisdictions with an adopted fire code. CSB found that West, Texas, is not the only town in the state with FGAN storage in close proximity to residential areas, schools, and hospitals. In fact, some of these occupancies are directly adjacent to, or across the street from, FGAN storage. Because the WFC operated in close proximity to schools, residences, and a nursing home, CSB plotted the 40 FGAN storage facilities in Google Earth™ to determine whether FGAN storage facilities are also in close proximity to residential areas, schools, or other large population clusters. CSB found that 19 (48 percent) of the facilities storing more than 10,000 pounds of FGAN are located within 0.5 miles of a school, hospital, nursing home, or a combination of those occupancies. Of the 40 FGAN facilities, 33 (83 percent) of the FGAN storage facilities are located within 0.25 miles of a residence or apartment building.116 The WFC facility was about 550 feet (0.16 miles) from the closest school, which sustained catastrophic damage as a result of the explosion, which could have resulted in additional loss of life had the school been in session at the time of the incident. CSB identified one other school in Texas that is 529 feet (0.12 miles) from an FGAN storage facility, even closer than the school destroyed in West, Texas (Figure 55). Of the 40 FGAN storage facilities, 16 (40 percent) are within 0.5 miles of an elementary school, secondary school, or high school (Figure 56).

115 CSB noted that two new FGAN facilities registered with the OTSC between September 2014 and October 2015 and that five facilities were listed in September 2014 that did not register to sell FGAN in October 2015. 116 The closest structures with obvious characteristics of a private residence were selected for this measurement using Google Earth and Google Street View.

West Fertilizer Company Final Report January 2016 89 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

529 Feet FGAN Facility School

Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: Google Earth)

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) Within 1 Mile of a Texas School (Source: CSB) 0 2 4 6 8 10 12 14 16 18 Less than 0.25 miles (< 0.4 km) 0.25 to 0.50 miles (0.4 to 0.8 km) 0.50 to 1 mile (0.8 to 1.6 km) Greater than 1 mile (> 1.6 km) Number of Texas FGAN Facilities Distance to Schools Fire Code No Fire Code

West Fertilizer Company Final Report January 2016 90 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The West Rest Haven nursing home was located about 600 feet from the WFC facility and sustained irreparable damage as a result of the blast. CSB measured distances between Texas FGAN storage facilities and nearby hospitals and nursing homes and found that 38 percent of the facilities are within 1 mile of a nursing home or hospital. In one case, a fertilizer facility is adjacent to a 50-bed hospital and a residence, also a few blocks from a school (Figure 57). Hospital 278 Ft. FGAN Facility Residence 220 Ft. School 1432 Ft.

Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School (Source: Google Earth) Findings from the analysis of the proximity of FGAN storage facilities to various community structures show that the risk to the public from a catastrophic incident exists throughout the state of Texas. Injury data published by the Waco-McLennan County Health Department supported the conclusion that people within 1,500 feet (or 0.28 miles) from the blast epicenter were the majority of those injured in the WFC fire and explosion, particularly those who were inside a structure at the time of the blast.117 5.5 Limits of Insurance Coverage in Texas Property and liability insurance companies can complement government oversight of industry by identifying hazards and reducing losses through the insurance process. In some ways, insurance can

117 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014).

West Fertilizer Company Final Report January 2016 91 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

augment government standards and safety monitoring.118 The insurance industry provides coverage for losses at established premiums but also has an incentive to reduce and manage risks. Insurers perform functions of risk reduction and risk management by using tools such as auditing and inspecting their clients, managing loss prevention efforts, analyzing loss histories, identifying causes of accidents, and teaching clients how to avoid premium increases (or how to secure premium reductions).119 Insurance reinforces existing government regulations by expecting that policyholders comply with existing requirements. This approach can be effective at reducing risk and preventing incidents because annual insurance audits can be more frequent than state or federal enforcement inspections, such as those by SFMO or OSHA. Texas law does not require facilities that store FGAN to obtain commercial general liability or property insurance; however, the WFC voluntarily obtained insurance. The WFC’s $1 million general liability policy with U.S. Fire did not include excess or umbrella coverage for the consequences of serious incidents, such as bodily injury and property damage. If the WFC is found responsible for this incident in civil cases, its insurance would not be sufficient to pay the full amount of insurance claims for the catastrophic consequences caused by the blast. Texas law requires some businesses to have liability insurance for operations that potentially pose a lower level of public risk than the WFC incident (Table 5). Air conditioning and refrigeration contractors, mold assessors, and plumbers are some of the businesses or services subject to commercial general liability requirements in Texas. For amusement ride owners and operators, Texas set the minimum requirements for insurance at $1.5 million per occurrence and requires proof of insurance to operate an amusement ride. For an amusement park ride to operate in the state, the ride must be inspected at least annually by the insurer.120 The ride also must meet the standards for coverage and have an adequate amount of insurance coverage.121 Operators of amusement park rides annually must file copies of the inspection certificate and insurance policy with the TDI Commissioner. The Texas amusement ride regulation also requires operators of coin-operated rides and bounce houses to obtain liability insurance. However, FGAN storage facilities such as the WFC facility can operate next to schools, residential areas, and hospitals with little or no general liability insurance. Adequate levels of coverage would likely prompt rigorous onsite loss control audits by insurers.

118 Ben-Shahar, Omri, and Kyle D. Logue. “Outsourcing Regulation: How Insurance Reduces Moral Hazard,” Michigan Law Review 111:2 (2012); University of Michigan Law and Economics Research Paper No. 12-004; University of Chicago Institute for Law and Economics Olin Research Paper No. 593. See: http://ssrn.com/abstract=2038105 (accessed on January 6, 2016). 119 Ibid. 120 Texas Occupations Code, § 2151.101, “Regulations of Amusement Rides: Requirements for Operation.” See: http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.2151.htm (accessed on August 4, 2015). 121 Ibid.

West Fertilizer Company Final Report January 2016 92 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 5. Minimum Insurance Requirements in Texas122 Business/Operation Minimum Amount Amusement ride operators $1.5 million Elevator/escalator contractors $1.5 million123 Mold assessors and remediators $1 million124 Electricians $600,000125 Residential appliance installers $600,000126 Plumbers $300,000127 Tow truck operators $300,000128 Structural pest control providers $300,000129 Used automotive parts recyclers $250,000130 Air conditioning service providers $200,000131

Previous incidents in Athens, Bryan, and West have demonstrated the risk imposed by FGAN facilities on Texas communities and the public. In the absence of a state fire code, there is limited state oversight to ensure that facilities are addressing conditions that could potentially lead to an incident similar to the WFC fire and explosion.

122 See: http://www.dallasnews.com/news/west-explosion/headlines/20130508-texas-makes-bounce-house-operators- carry-liability-coverage-but-not-plants-like-west-fertilizer.ece (accessed on January 6, 2016). 123 See: https://www.tdlr.texas.gov/elevator/Elevapp.pdf (accessed on January 6, 2016). 124 Texas Administrative Code Licensing Requirements. See: http://txrules.elaws.us/rule/title25_chapter295_sec.295.309 (accessed on January 6, 2016). 125 See: http://www.tdlr.texas.gov/electricians/forms/ElectricianCOI.pdf (accessed on January 6, 2016). 126 See: http://www.tdlr.texas.gov/electricians/forms/ELC012 Residential Appliance Installation Contractor License Application.pdf (accessed on January 6, 2016). 127 See: http://www.tsbpe.state.tx.us/common/CertificateofInsuranceForm-fillablefeb2012.pdf (accessed on January 6, 2016). 128 Administrative Rules of the Texas Department of Licensing and Regulation, § 86.400, “Insurance Requirements— Tow Truck Permits.” 33 TexReg 2940. New section adopted, effective April 15, 2008. 129 Texas Occupations Code, § 1951.312, “Liability Insurance.” See: http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.1951.htm (accessed on January 6, 2016). 130 See: https://www.tdlr.texas.gov/parts/aprrules.htm#8740 (accessed on January 6, 2016). 131 Proof of insurance is required only with an initial application for licensure, a change in license assignment (new company), or a request by the Department of Insurance.

West Fertilizer Company Final Report January 2016 93 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Triangle conducted annual inspections at the WFC facility and identified conditions that could result in potential losses, such as fires and worker injuries. Although Triangle did not focus specifically on hazards related to FGAN storage, it offered recommendations to the WFC to correct conditions, such as electrical hazards, that could result in a fire. CSB did not receive any documentation that U.S. Fire continued performing similar audits and inspections at the WFC facility after Triangle’s nonrenewal. It is not common for states to have prescriptive requirements for insuring specific industries. However, TDI does impose liability insurance and inspection requirements for amusement park rides and establishes minimum liability insurance coverage for certain operations and services, as listed in Table 5. CSB identified other FGAN storage facilities located in close proximity to community structures; however, the level of insurance carried by these facilities remains unknown. In response to the WFC incident, TDI conducted a voluntary survey of 95 Texas fertilizer facilities in June 2013 and requested the names of the companies that insure those facilities against general liability, property, and workers’ compensation losses. TDI received 12 responses to the 95 inquiries. Although the number of responses does not suggest that the remaining fertilizer facilities are uninsured, there is no way to determine whether these facilities have insurance policies that incorporate audits and inspections to focus on safe FGAN storage and handling conditions. On March 5, 2015, House Bill 2470 proposed amendments to the Texas Commercial Fertilizer Rules to require proof of liability insurance coverage for annual registration, similar to the requirements for amusement park rides. The bill proposed to amend the Texas Agriculture Code to require public liability insurance to produce, store, transfer, blend, or sell FGAN or FGAN-containing materials upon applying for a permit under the Texas Commercial Fertilizer Rules.132 However, this bill did not pass the state legislature. Without insurance and inspection requirements for FGAN facilities, operators can sell bulk quantities of fertilizer with little or no insurance coverage. The process of obtaining insurance could encourage both agricultural insurers and insured parties to assess current risks and to increase the awareness and rigor of insurance audits to ensure that companies are safely storing FGAN in accordance with guidance released as part of Executive Order 13650 (addressed in Section 8.1), OSHA standards, and industry consensus standards such as NFPA 400. Minimum coverage requirements will spur more realistic risk analysis by insurers that write coverage for FGAN bulk storage retail facilities. By providing agricultural businesses the guidance to identify and address FGAN hazards when underwriting and conducting annual loss control inspections, insurers can play a role in ensuring that FGAN facilities mitigate hazardous conditions.

132 The required liability insurance policy proposed by HB 2470 afforded bodily injury and property damage protection in an amount determined by TDI to compensate a person who incurred damages as a result of FGAN operations. The bill also directed TDI to coordinate with the Texas State Fire Marshal, Department of Health Services, Office of the Texas State Chemist, and other agencies to study the risk exposure for FGAN activities to determine the appropriate requirements for a liability insurance policy.

West Fertilizer Company Final Report January 2016 94 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 6 Insurance Services Office Rating

The Insurance Services Office (ISO)133 is an independent commercial enterprise and insurance industry advisory company that provides information, evaluation, and underwriting on safety and risk management related to community fire protection and building code effectiveness, serving insurance companies and other fire safety organizations. ISO adopts a public protection classification (PPC) system to develop fire insurance premiums for residential and commercial properties.134 ISO obtains information on municipal fire protection efforts in communities throughout the United States. Those data are then analyzed and evaluated for communities, using a standardized method and criteria known as the Fire Suppression Rating Schedule (FSRS). The FSRS assigns a PPC rating (from 1 to 10) to fire departments in each community. Class 1 represents exemplary public protection, and Class 10 indicates that the area’s fire suppression program does not meet ISO minimum criteria. ISO develops a split classification; for example, 5/9. The first class (Class 5 in the example) applies to properties within 5 road miles of a fire station and within 1,000 feet of a fire hydrant. The second class (Class 9 in the example) applies to properties within 5 road miles of a fire station but farther than 1,000 feet from a hydrant. ISO generally assigns Class 10 to properties farther than 5 road miles from a fire station. To determine a community’s PPC, ISO conducts a field survey, with ISO staff members visiting the community to observe and evaluate features of the fire protection systems. Using the FSRS, ISO objectively evaluates three major areas: fire department,135 water supply,136 and fire alarm and communication systems.137 When ISO allocates a high class rating to a fire department, ISO works with the affected fire department and the city to make improvements to the fire department, water system, and/or fire and alarm communication systems. Once these improvements are completed, the city then requests a new ISO reclassification. ISO reevaluates the city and then notifies the fire department of the new PPC rating. If a lower rating is received, the city notifies all homeowners and business owners to inform their insurance carriers to adjust their policies based on the new classification.

133 See: http://www.isomitigation.com/index.php/about-iso (accessed on January 7, 2016). 134 Insurance companies often rely on information from ISO about a community’s fire protection services to evaluate claims and damages. 135 A review of the fire department accounts for 50 percent of the total classification. ISO focuses on a fire department’s first-alarm response and initial attack to minimize potential loss. Here, ISO reviews items such as engine companies, ladder or service companies, distribution of fire stations and fire companies, equipment carried on apparatus, pumping capacity, reserve apparatus, department personnel, and training. 136 A review of the water supply system accounts for 40 percent of the total classification. ISO reviews the water supply that a community uses to determine the adequacy for fire suppression purposes. It also considers hydrant size, type, and installation as well as the inspection frequency and condition of fire hydrants. 137 An ISO review of the fire alarm system accounts for 10 percent of the total classification. The review focuses on the community’s facilities and support for handling and dispatching fire alarms.

West Fertilizer Company Final Report January 2016 95 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer

Company According to the West Fire Department, ISO rated the city of West at Class 5 before April 17, 2013. The pre-incident ISO classification and PPC rating of the West Volunteer Fire Department (WVFD) placed the city of West among the top 25 percent of all Texas communities (Figure 58). The average classification rating for communities and fire departments in Texas is Class 7.

Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO)138 On the national scale, the average PPC for cities, fire departments, and communities in the United States is Class 7 (the same as the average for Texas). The current ISO rating of the WVFD places the city of West among the top 30 percent of all communities nationwide (Figure 59).

138 See: http://www.isomitigation.com/index.php/ppc-program/how-the-ppc-program-works/facts-and-figures (accessed on December 20, 2015).

West Fertilizer Company Final Report January 2016 96 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO)139 Firefighters who responded to the WFC fire reported difficulty in extending their 4-inch fire hoses to the nearest fire hydrant, which was located at West High School, more than 1,500 feet from the burning fertilizer plant. A surviving firefighter testified that the emergency responders had to use one of their fire trucks as a connector line to reach the nearest fire hydrant at the high school. After dropping all of the hose lines on the engine, they discovered that they were about 700 feet short of the length needed to effectively fight the fire. Some of the volunteer firefighters then arranged to take the engine with hose and continue to string lines. One of the firefighters subsequently returned to the hydrant near the high school to attempt to establish a connection from the hose line to the fire hydrant. The explosion occurred just as the firefighter arrived at the fire hydrant, and he survived the explosion, although with severe injuries. The WFC plant was not incorporated into the West city limits,140 so an ISO assessment of the city of West did not capture the fertilizer plant as a high-risk facility. An ISO evaluation of the WFC plant would have increased the city’s ISO rating and would have compelled the insured residents141 and industrial facilities to carry higher homeowners and industrial hazard insurance premiums.142 The WFC

139 Ibid. 140 Section 9 discusses land use planning and zoning. 141 If the WFC plant had been included in the ISO rating, the city of West would have had a higher classification score, with an increased insurance premium for homeowners in West because of the proximity of the fertilizer plant to residential neighborhoods. 142 The rating directly impacts the premiums that insurance companies charge for commercial and industrial facilities as well as homeowner’s coverage. A lower ISO rating means a lower price for insurance coverage.

West Fertilizer Company Final Report January 2016 97 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

had insurance coverage of $1 million, without any prior evaluation from ISO. If ISO had evaluated the fertilizer plant, insurance underwriters would have charged a higher premium for the WFC plant based on the level of risks and hazards associated with the chemicals and operations at the WFC facility. Also, the ISO rating system would have revealed the distance from the nearest fire hydrant to the fertilizer plant, which would have increased the PPC rating. To obtain lower ISO PPC ratings, the city of West would have had to make adjustments by installing and regularly maintaining fire hydrants with ISO-minimum water flow rates closer to the fertilizer plant to enable ease of reach during emergencies.143 6.0 Inherently Safer Technology FGAN has certain risk characteristics that can make it inherently dangerous under some conditions. Ammonium nitrate (AN) by itself is a powerful oxidizer; when mixed with fuel oil, it can be used as an industrial explosive when exposed to fire or shock. Traditional safety practices to control FGAN fire and explosion hazards through procedures, hazard awareness, and emergency response are important. However, applying the concept of inherently safer technology (IST) or inherently safer design (ISD) can substantially reduce risk. IST and ISD are recognized approaches for decreasing risk by permanently reducing or eliminating the hazards associated with materials and operations used in an industrial process.144 Trevor Kletz, an acknowledged expert on IST and chemical process safety, defined IST as the avoidance of hazards rather than the control of hazards by adding protective equipment.145 Inherently safer processes can be achieved by strategies such as: • Substituting dangerous chemicals or processes with safer alternatives. • Simplifying processes. • Minimizing the quantity of a chemical on hand or in a process. • Moderating the operating conditions of a process. Before the widespread adoption of IST, plant designs in the chemical industry tended to address reduction of risk by relying on layers of protective equipment, procedures, and alarms.146 IST is preferable to adding layers of protection because, while this approach might reduce the likelihood or impact of an event, the inherent hazards remain.147 The concept of IST can be derived from a list of strategies for

143 To qualify for rating credit, fire hydrants must be capable of delivering a minimum of 500 gpm for 30 minutes. 144 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second Edition. New York: John Wiley & Sons, 2009. 145 Kletz, Trevor A., and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design. Boca Raton, FL: CRC Press, 2009. 146 Kletz, Trevor, and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design, Second Edition. Boca Raton, FL: Taylor & Francis, 2010. 147 Ibid.

West Fertilizer Company Final Report January 2016 98 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

reducing risk (Figure 60). IST is most effective when implemented during the earliest stages of the process design, but it can be applied at all stages of a life cycle (design, operation, shutdown, and demolition).148

Figure 60. Risk Control Hierarchy (Source: CCPS)149 Table 6 lists some IST approaches that can be applied to FGAN. Table 6. Inherently Safer Approaches for Handling FGAN150 Inherently Safer Strategy Description Examples Substitution Replacing a hazardous material with a safer option Use a fertilizer with less explosive potential than FGAN Minimization Reducing the quantity of a hazardous material used in a chemical process Store FGAN in purpose-built buildings holding smaller quantities of materials, well separated from one another and from potential sources of contamination Moderation Using a hazardous material under the least hazardous conditions Store FGAN in bins constructed of materials impervious to the effects of AN and in areas where electric service is not required Limitation of effects (a form of moderation) Changing designs or reaction conditions rather than adding protective equipment Construct FGAN storage bins to minimize the consequence of a possible explosion Simplification Eliminating process complexity to provide fewer opportunities for error and equipment failure Limit the types of FGAN blends sold to minimize the need for staff to handle FGAN.

148 National Research Council. The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience. Washington, DC: The National Academies Press, 2012. 149 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second Edition. New York: John Wiley & Sons, 2009: 3, 27. 150 Ibid.

West Fertilizer Company Final Report January 2016 99 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Once all hazards associated with a chemical process are identified and understood, IST can be applied in the design phase or to existing processes. According to Kletz, the concepts of IST are not sharply defined and can merge into each other, depending on how they are applied.151 Although not always feasible or cost-effective, substitution is often the most desired approach for reducing hazards because it involves replacing a hazardous material with a safer alternative. Minimization to reduce the quantity of a hazardous chemical stored or used within a process can often have a dramatic effect on risk, albeit usually only locally. The concept of moderation usually involves processing or storing chemicals under conditions that are less likely to add to or exacerbate risk—such as lower temperatures and pressures, removal of potential catalysts and sources of ignition, or use of materials of construction that minimize heat exposure near FGAN. In addition, the concept of simplification involves modifying procedures to reduce the likelihood of operator error and designing processes that require little or no operator actions to render the process safe in the event of a loss of control. The implementation of one or more of the inherently safer options, if feasible, can eliminate or minimize hazards instead of controlling them. IST might not eliminate all risks associated with a process, and some apparently inherently safer options might introduce new hazards that are of greater concern than those eliminated. For example, a reduced quantity of a hazardous chemical at a plant can lead to greater risk in transportation systems or at the originating plant. Elimination of large FGAN inventories at facilities similar to the West Fertilizer Company (WFC) is impractical because farmers rely on large quantities of fertilizer for their crops. Lower inventories could potentially introduce new hazards from the larger number of FGAN shipments needed to supply storage facilities. Accordingly, before implementation, IST options must be thoroughly analyzed and assessed, considering all risks and not only the interests of an individual facility. In terms of reducing the fire and explosion hazards associated with storage and handling of FGAN, two inherently safe measures are described in the rest of this section: (1) modify or substitute for the formulation of FGAN, making it less susceptible to fire or explosion, and (2) modify the conditions in which FGAN is stored to eliminate the possibility of a large fire and explosion. 6.1 Alternative Formulations of FGAN An alternative formulation of FGAN could reduce the potential for a detonation under fire conditions. However, more testing is necessary to ensure that these formulations are safer in bulk quantities, agriculturally compatible, and environmentally acceptable. In response to the 1947 FGAN explosion in Texas City, Texas, and to subsequent AN-based bombings across the United States,152 researchers have

151 Ibid. 152 Past AN-based bombings in the United States include the 1970 University of Wisconsin bombing, the 1990 Internal Revenue Service building bombing and other attempted bombings in California, the 1995 Murrah Federal Building bombing in Oklahoma City, and the 1996 attempted bombing of the FBI fingerprint database complex in Clarksburg, West Virginia.

West Fertilizer Company Final Report January 2016 100 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

explored several options for inerting or desensitizing FGAN to lower the detonation sensitivity of the material. One method introduced in 1968 claimed to render FGAN inert with the addition of 5 to 10 percent monoammonium phosphate and diammonium phosphate.153 However, in 1995, a test showed that the mixture was detonable with a larger charge diameter than the initially presented charge.154 In 1997, the International Fertilizer Development Center conducted a study for ATF to study the feasibility, practicability, and impact of making nitrate-based fertilizer chemicals inert. The study concluded that it is not feasible to inert AN without adversely affecting its effectiveness and efficiency as a fertilizer.155 In 1998, the National Research Council (NRC) released a report that addressed existing studies for inerting AN. The NRC examination concluded that FGAN with altered prill porosity, dilutants, or chemical additives could still be detonable156 and that no current technology would reduce the risk without seriously affecting the utility of AN as a fertilizer.157 The NRC recommends further examinations of the impacts of alternate formulations on agricultural suitability, costs to the end-user and environmental impacts of additives or inertants.158 Large quantities of inert materials mixed with AN might not be practical because of the cost and the reduction in fertilizer effectiveness. Adding a percentage of another chemical to AN can make it safer, but farmers might need to buy and transport more fertilizer to deliver the same quantity of nitrogen to their crops.159 CSB has reviewed documentation and publications that describe a few of those alternatives to AN based on the addition of inert chemicals (Table 7). Table 7. Examples of AN Fertilizer Alternatives Name Method Claims

153 Porter, S.J. “Method of desensitizing fertilizer grade FGAN and the product contained,” U.S. Patent 3,366,468, 1968. 154 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on June 26, 2014). 155 See: https://www.atf.gov/file/57516/download (accessed on January 20, 2016). 156 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on June 26, 2014). 157 Ibid. 158 Ibid. 159 Thompson, Steve. Dallas News. Quoting Bob Best, Pentagon scientist: “There are safer alternatives to FGAN fertilizer. But a safer form?” See: http://watchdogblog.dallasnews.com/2013/10/there-are-safer-alternatives-to- ammonium-nitrate-fertilizer-but-a-safer-form.html/ (accessed on June 26, 2014).

West Fertilizer Company Final Report January 2016 101 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Sulf-N® 26160 (ASN 26) FGAN fused with ammonium sulfate161 The addition of ammonium sulfate dampens the role of FGAN combustion.162 Ferti-Safe163 Fly-ash-coated and gypsum- coated fertilizer Detonation potential can be reduced or eliminated. Calcium ammonium nitrate (CAN) Mixture of FGAN and limestone (calcium carbonate) or dolomite (calcium magnesium carbonate) Some tests revealed less oxidizing capability than FGAN. CAN is less prone to thermal decomposition than FGAN.

Honeywell has developed a fertilizer called Sulf-N 26 (later marketed by J.R. Simplot Company as ASN 26), claimed to be inherently safer than FGAN. Sulf-N 26 is made of nitrogen and sulfur164 by fusing FGAN with ammonium sulfate (AS), a fire retardant. For the patent, tests were conducted according to United Nations Recommendations on the Transport of Dangerous Goods.165 The test method is designed to measure the potential for a solid substance to increase the burning rate or burning intensity of a combustible substance when the two are thoroughly mixed. The mixture of FGAN fused with AS did not burn in the test, and the mixture was not classified as an oxidizer. Sulf-N 26 contains significantly less nitrogen than FGAN (26 percent compared to 34 percent).166 This nitrogen level can be an issue for some farmers as the effective absorption rate of nitrogen is vitally important to plants. Sulf-N 26 also contains higher quantities of sulfur, which farmers can need for certain types of crops and soils but not for others. Further examination is necessary to fully assess the use of Sulf-N 26 as an inherently safer alternative to FGAN. Notably, a 50/50 mixture of AS and FGAN was involved in the 1921 Oppau, Germany, explosion. Researchers from the University of Kentucky developed a technology called Ferti-Safe to desensitize FGAN by coating it with an ash-like coal combustion by-product.167 They developed the technology with the intention of preventing the malicious use of FGAN for explosive devices. The Ferti-Safe formulation

160 Sulf-N 26 was not commercially available at the time of the WFC incident. 161 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 162 Ibid. 163 Ferti-Safe was not commercially available at the time of the WFC incident. 164 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 165 United Nations. Recommendations on the Transport of Dangerous Goods, Manual of Tests and Criteria, ST/SG/AC.10/11/Rev2, Section 34, Classification Procedures, Test Methods and Criteria Relating To Oxidizing Substances of Division 5.1, Test O.1: Test for Oxidizing Solids, 1995. 166 Bomgardener, Melody M. “Safer Fertilizer,” Chemical and Engineering News, December 6 (2011). See: http://cen.acs.org/articles/89/web/2011/12/Safer-Fertilizer.html (accessed on May-June 2015). 167 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National Institute of Hometown Security, Lexington, KY (2012).

West Fertilizer Company Final Report January 2016 102 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

involves coating FGAN with gypsum (calcium sulfate) and fly ash.168 Both coating options are claimed to be effective in stopping an explosion of a blend of ammonium nitrate/fuel oil (ANFO).169 Calcium ammonium nitrate (CAN) contains 26 percent nitrogen and about 25 percent inert calcium carbonate. Formulations of CAN have been used in Europe and other countries since the 1920s, but it is not manufactured in the United States. European safety data sheets state that CAN is not capable of self- sustaining progressive thermal decomposition.170 The scope of most existing studies on alternative forms of FGAN is focused on reducing or eliminating the security threats associated with using FGAN to construct improvised explosive devices with the addition of fuel oil, but such studies do not focus on FGAN used in agricultural operations. Although some of the available information on these options suggests that they might be inherently safer, only limited testing has been performed to characterize the behavior of the alternatives in fire situations similar to that at the WFC. FGAN is vital to the nourishment of crops across the country, and alternative formulations must also be capable of meeting agricultural fertilizer needs. Because of the lack of scientific literature to show that alternative formulations of bulk FGAN can resist detonation in fires, CSB concludes that FGAN detonations can currently best be avoided through better compliance with storage practices and the application of inherently safe building design and storage. 6.2 Inherently Safe Building Design and Storage In the United States, FGAN storage practices at facilities similar to the WFC have not significantly changed over time. Before the fires in Bryan, Athens, and West, these Texas FGAN facilities had similar construction, with combustible materials and construction and limited fire safety features. CSB visited another EDC facility in Itasca, Texas, in 2013 and also noted combustible construction for the storage facility and bins. Findings from the WFC incident demonstrate that inherently safer concepts can be applied to storage practices to significantly reduce the risk of a fire or explosion. Modifying existing facilities or constructing new storage facilities with inherently safe options—such as facility set-back distances and the use of noncombustible construction materials—can reduce such risks. Because FGAN behavior is unpredictable in fire conditions, the most immediately effective strategy for reducing risk in existing and future FGAN storage facilities is to use inherently safer building design options to avoid creating the hazardous conditions that can contribute to a large uncontrollable FGAN fire and detonation. CSB concluded that the storage of combustible materials near FGAN storage piles and the use of combustible bins likely facilitated the spread of the FGAN-related fire to other bins and nearby

168 Fly ash is a fine particle residue of coal combustion. 169 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National Institute of Hometown Security, Lexington, KY (2012). 170 See: http://www.eurochem.ru/wp-content/uploads/2012/08/SDB_27_KASweiss_0124_EU.pdf (accessed on January 7, 2016).

West Fertilizer Company Final Report January 2016 103 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

combustibles. The combustibles also likely acted as a fuel during the fire; the soot, creosote, and other contaminants from the burning wood materials mixed with the surface of the FGAN, potentially increasing its energy and sensitivity to detonation. By eliminating wood and other combustibles as construction materials for FGAN bins and storage facilities and also for the storage of nearby combustible materials, the possibility of contaminating FGAN during a fire or smoldering event is greatly reduced. However, organic materials (such as packing materials or seeds) that are commonly present with the storage of bulk fertilizer will increase the likelihood of an explosion and will make the FGAN explosion more energetic. Certain inorganic contaminants, including chlorides and some metals (such as aluminum powder, chromium, copper alloys, cobalt, and nickel), can also sensitize FGAN, increasing the likelihood of detonation.171 Current OSHA requirements in the Explosives and Blasting Agents standard in 29 CFR 1910.109(i) do not prohibit the use of wooden FGAN storage bins; instead, OSHA requires bins that are protected against FGAN impregnation (as noted in Section 8.2). The installation and use of concrete or metal172 storage bins would reduce the potential for a fire to spread throughout the facility and to other piles of FGAN or nearby combustible materials. It is also inherently safer to store FGAN in places where sources of ignition are not present. For example, a storage building without electric service eliminates the one of the possible sources of ignition and is thus inherently safer. In July 2009, an FGAN-related fire at the EDC fertilizer storage facility in Bryan, Texas, burned the facility to the ground, but the FGAN did not explode. The fire forced an evacuation of more than 80,000 residents in the Bryan area and students at the Texas A&M College Station campus. EDC rebuilt the facility, originally a wooden structure, with concrete bins surrounded by a concrete dome (Figure 61). EDC’s insurance company required the use of concrete construction materials instead of wood to minimize the fire risk.

171 EPA. “EPA Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills.” See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on November 30, 2015). 172 Galvanized iron, copper or copper alloys, lead, and zinc are not recommended metals for AN storage.

West Fertilizer Company Final Report January 2016 104 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB)

Use of concrete bins or external metal hoppers instead of wooden structures is considered an inherently safer option for FGAN storage. According to Kletz, the IST concept of moderation entails storing or transporting a hazardous material in a less hazardous manner.173 In this case, eliminating the presence of the combustibles removes an obvious and principal source of fuel and heat that contribute to detonation. Replacing bins with structures made of concrete instead of combustible materials also limits the quantity of FGAN available to support combustion by confining it to the bin and preventing the acceleration of a fire. It is well recognized that wood is not a preferred material of construction for buildings or bins storing FGAN, and untreated wooden bins should never be used to store FGAN because of the oxidizing properties of FGAN that will increase the burning temperature and rate of burn of the structure itself, facilitating the spread of a fire. Concrete or compatible metals should be used to avoid contamination during fires. The Health and Safety Executive in the United Kingdom states that FGAN storage “should be constructed of a material that does not burn, preferably concrete.”174 In March 2014, CSB responded to OSHA’s request for information (RFI) (at 78 Federal Register 73756) on future possible revisions to OSHA safety standards, including the Explosives and Blasting Agents standard in 29 CFR 1910.109(i) and the Process Safety Management standard in 29 CFR 1910.119. In response to the RFI, CSB urged OSHA to consider revising existing standards to provide more explicit requirements for the storage and handling of FGAN, including prohibiting wooden or combustible FGAN storage bins. 175 In May 2015, the NFPA issued a new edition of NFPA 400-2016, Hazardous Materials Code (Chapter 11, “Ammonium Nitrate”), which prohibits combustible construction materials for new FGAN storage facilities and establishes requirements for automated fire detection, fire suppression, alarm activation, and evacuation plans for existing facilities with combustible construction. CSB recommends that OSHA revise its standards to include requirements similar to those in NFPA 400-2016 for FGAN storage facilities to reduce the likelihood of a detonation when FGAN is exposed to fire. 7.0 Emergency Response The FGAN explosion at the West Fertilizer Company (WFC) facility killed 15 people and caused more than 260 injuries. Of the 15 fatalities, 12 were first responders (firefighters and emergency services) personnel who responded to the fire—eight volunteer firefighters, with five from the West Volunteer Fire Department (WVFD), two from the City of Abbott Fire Department, and one from the Mertens and

173 Kletz, Trevor, and Paul Amyotte. “Attenuation.” Process Plants: A Handbook for Inherently Safer Design, Second Edition. Boca Raton, FL: CRC Press, 2010: 103. 174 Health and Safety Executive (HSE). Storing and Handling Ammonium Nitrate. United Kingdom: Health and Safety Executive, 2004. See: http://www.hse.gov.uk/pubns/indg230.pdf (accessed on January 6, 2016). 175 CSB. “CSB Comments on the OSHA Proposed Rule: Process Safety Management and Prevention of Major Chemical Accidents.” See: http://www.regulations.gov/#!documentDetail;D=OSHA-2013-0020-0074 (accessed on November 30, 2015).

West Fertilizer Company Final Report January 2016 105 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Navarro Mills Fire Department; an off-duty career firefighter (captain) from the City of Dallas Fire Department; an emergency medical technician (EMT) from West; and two good Samaritans who supported the emergency response at the fertilizer plant.176 One of the deceased volunteer firefighters who responded to the fire was also an employee of the WFC. CSB developed this section of our report to provide information to fire departments across the country by evaluating the key factors that contributed to the firefighter fatalities and to share lessons learned so that similar events can be avoided in the future. Accordingly, to determine what went wrong, CSB used emergency response documents, interviews, and video footage to analyze in detail the actions that were taken before and during the approximately 20 minutes that elapsed from the first call for assistance until the explosion occurred. This analysis is not focused only on volunteer firefighters; it demonstrates the need for effective pre- incident planning and firefighter training. Firefighters are expected to make risk assessments and decisions under time pressure with limited visibility during an actual response to a fire, which is almost impossible without adequate training. Although this analysis indicates that the emergency responders involved in this incident accepted an extremely high level of risk that resulted in multiple deaths, CSB recognizes that they were attempting to develop a plan of action for a fire scenario that none of them had prior practical experience with. 7.1 Firefighter Response The chain of events—from the time the volunteer firefighters and other emergency responders arrived at WFC until the time of the explosion—can never be precisely known. On the basis of interviews with surviving firefighters and the evaluation of the incident scene, CSB was able to assess the emergency response process on April 17, 2013. On the evening of the incident, the emergency responders who were initially dispatched to the fire arrived at the scene at different times. CSB obtained a street surveillance camera video recording and also camera footage from the inside of a neighboring hardware store in West.177 The surveillance recording indicated that four emergency response vehicles were en route between 7:37 pm and 7:51 pm, when the explosion occurred, as shown in the timeline of events in Figure 62.

176 One of these Good Samaritans was familiar with the equipment used by the WVFD and volunteered to assist the second, who was in the area tending to cattle and offered his help to the firefighters. These two deceased Good Samaritans were made honorary volunteer firefighters at the memorial for the fallen West, Texas, firefighters and other emergency responders held in Waco, Texas, on April 25, 2013. 177 The convenience store and street surveillance camera are located about a mile from the WFC facility at the intersection between East Pine Street and North Roberts Street.

West Fertilizer Company Final Report January 2016 106 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB)

Emergency responders were notified and dispatched to the scene at about 7:29 pm on April 17. The firefighters arrived on scene over a span of about 14 minutes, as recorded on surveillance footage of emergency vehicles en route to the WFC site that night.178 In the video footage, the WVFD fire chief can be observed driving the water tender toward the incident scene at about 7:41 pm. Firefighters were dispatched to the scene of the emergency without anyone’s knowledge of how long the fire had been

178 Because the WVFD is a volunteer-based service, it should be noted that the volunteer firefighters were not at the station at the time of the incident. Several firefighters were at home, attending to other personal activities or participating in an EMT training class.

West Fertilizer Company Final Report January 2016 107 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

burning or smoldering before being noticed.179 Upon arrival, they concentrated their efforts initially on the incident scene, preparing to suppress flames that were visible at the northeast portion of the storage structure. Without a robust incident pre-planning process in place, without adequate hazardous materials awareness training, and with no previous FGAN-related fire emergency training or drills, the firefighters had no expectation of a possible FGAN explosion. The firefighters were advised by the career fire captain that they did not have the resources to combat the growing fire and should concentrate on cooling the liquid anhydrous ammonia tanks located near the burning building to prevent the tank from rupturing or venting. However, they had not established that stream of water when the explosion occurred because they had to shut off the attack lines while the pumpers were repositioned.180 7.2 Key Contributing Factors to Emergency Responders’ Fatality CSB identified the following seven key factors that contributed to the fatalities of firefighters and other emergency responders in West:

1. Lack of incident command system.
2. Lack of established incident management system.
3. Lack of hazardous materials (HAZMAT) and dangerous goods training.
4. Lack of knowledge and understanding of the detonation hazards of FGAN.
5. Lack of situational awareness and risk assessment knowledge on the scene of an FGAN-related

fire.

1. Lack of pre-incident planning at the WFC facility.
2. Limited and conflicting technical guidance on AN.
3. 2.1 Lack of Incident Command System

CSB found that none of the responding emergency response personnel trained and certified in the National Incident Management System (NIMS) process formally assumed the position of Incident Commander (IC) who would have been responsible for conducting and coordinating an incident command system (ICS). Senior emergency response personnel at the WVFD arrived at the scene of the WFC incident at different times and did not delegate an IC to be in charge of the incident. Also, there was no record that arriving firefighters conducted an initial incident size-up or risk assessment to determine initial actions (offensive or defensive) that would be most suitable in responding to the incident based on the situation and available resources without putting emergency personnel at risk. Despite multiple responders having ICS training, none of them reportedly established command or took control of the fire ground. On the basis of a review of radio communications and interviews with surviving firefighters, CSB found no clear messaging or discussion among the responding firefighters on who should assume the role of the designated IC. Without a delegated IC officially taking control of the

179 CSB was unable to determine how long the fire had been burning before the firefighters were notified. 180 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 108 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

fire ground operations, no ICS was established. Consequently, no senior emergency response personnel or IC was responsible for coordinating the various response activities carried out by individual firefighters on the scene. The West fire chief arrived on scene at about 7:41 pm and did not critically assess the conditions on the ground before the explosion 10 minutes later, at about 7:51 pm. The fire chief and assistant chief provided support and advisory functions but did not actively engage in fire ground function or take control of the fire ground; no record indicated that the West fire chief took command of the incident upon his arrival.181 Without direction to the contrary, the firefighters immediately took offensive action against the flames coming from the doors on north end of the east side of the structure. CSB interviews with surviving firefighters indicated that before the arrival of the fire chief, the other senior firefighters who had reached the incident scene about six minutes earlier had not delegated senior personnel with the training and expertise needed to formally assume responsibility as the IC. The firefighters had not reached a conclusion about how to establish a best approach and how to respond to the fire when the explosion occurred. Despite being trained for the ICS and NIMS process, none of the certified firefighters had prior practical experience in establishing incident command or coordinating and maintaining control of any previous emergency that merited the same approach as an FGAN-related fire scene. 7.2.2 Lack of Established Incident Management System CSB found that the emergency response personnel who responded to the WFC incident did not take time to set up, implement, and coordinate an effective incident management system plan that would have ensured evacuation of the nearby residents. Because no formal IC was in charge of the incident, none of the firefighters took responsibility for formally establishing and coordinating an effective incident management system. Witness testimonies revealed that emergency alert systems for the public were not activated before the explosion, although McLennan County had such systems in place.182 Many of the injuries might have been avoided or might have been less severe if an immediate evacuation had occurred. When the fire was first detected by a police officer, he ordered people in the parks near the facility to evacuate, and he blocked off roads. In addition, employees from the nursing home took the initiative as part of their company emergency response policy to move occupants to the back of the building for fear of smoke or an ammonia release. However, without a formal evacuation order to the entire affected community, many of the residents were left unaware of the risk and chose to watch the fire from inside their homes or vehicles or from the street, placing them within range of the high-pressure blast wave and in the line of flight of debris. In a study conducted after the WFC incident of FGAN-related fires worldwide since

181 NIMS requires that the ICS should be established by the first arriving NIMS qualified personnel. Best practices indicate that the fire chief does not need to be on the scene of a fire before the ICS can be established. 182 See Section 8.5 of this report.

West Fertilizer Company Final Report January 2016 109 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1970, the majority of detonations occurred within 60 minutes of the initial fire report.183 Because this elapsed time to detonation might be shorter than the response times for emergency operations and potential firefighting, a ‘let-it-burn’ approach with a precautionary evacuation of the surrounding neighborhood is appropriate.184 An incident management system is intended to provide a standard approach to management of emergency incidents. The U.S. Department of Homeland Security (DHS) established NIMS in 2004.185 NFPA 1561 (2014 Edition) indicates, “[T]he incident management system shall provide structure and coordination to the management of emergency incident operations to provide for the safety and health of emergency services organization responders and other persons involved in those activities.”186 DHS developed the NIMS program to standardize the incident management process by facilitating coordination of an emergency among all responders (including all levels of government and public, private, and nongovernmental organizations) so that they work together seamlessly and manage incidents involving threats and hazards (regardless of cause, size, location, or complexity) to reduce loss of life, property damage, and harm to the environment. To achieve this objective, FEMA, an organization within DHS, developed a NIMS training program.187 All federal emergency responders, including firefighters, are required to receive NIMS training.188 Presidential Policy Directive 5, which established the NIMS training program, applies to all federal agencies, and non-federal entities, although not required to participate, are encouraged to do so.189 NFPA 1500 (Standard on Fire Department Occupational Safety and Health Program, 2013 Edition190) and NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition191) emphasize the need to use effective incident management systems at all emergency

183 Marlair, G., et al. Comments about the paper entitled “Lessons to be Learned from an analysis of ammonium nitrate disasters in the last 100 years,” by Pittman et al., Journal of Hazardous Materials 280 (2014). 184 Ibid. 185 See: https://www.fema.gov/national-incident-management-system (accessed on December 28, 2015). 186 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014. 187 The NIMS training program specifies National Integration Center and stakeholder responsibilities and activities for developing, maintaining, and sustaining NIMS training. The NIMS training program outlines responsibilities and activities that are consistent with the National Training Program, as mandated by the Post-Katrina Emergency Management Reform Act of 2006. This program integrates with FEMA training offered through the Emergency Management Institute (EMI) and USFA. See: http://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf (accessed on December 28, 2015). 188 See: https://www.fema.gov/national-incident-management-system/training (accessed on December 28, 2015). 189 To compel non-Federal entities seeking grants, FEMA does require its grant recipients to verify that they are “NIMS-compliant.” However, there is no requirement for fire services not receiving federal grants to participate in NIMS. See: https://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf (accessed on December 28, 2015). 190 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: NFPA, 2013. 191 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014.

West Fertilizer Company Final Report January 2016 110 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

scenes. In most cases, this process is known as the ICS, with the primary objective of managing the incident. NFPA 1561 defines an incident management system as “a system that defines the roles and responsibilities to be assumed by responders and the standard operating procedures to be used in the management and direction of emergency incidents and other functions.” CSB concluded that despite multiple personnel in the WVFD being trained and certified to initiate and manage the NIMS process, none of the certified firefighters who responded to incident was designated to assume or assumed the role of IC to initiate and coordinate the ICS and incident management plan as stipulated in the NIMS process. If the West firefighters had executed a planned, tested, and practiced ICS and incident management plan, the number of injuries and casualties sustained by both responders and neighboring residents could have been reduced. 7.2.3 Firefighter Training Firefighters must cope with extraordinary situations and circumstances that threaten their personal safety. To improve execution and reduce the threat of injury or loss of life, it is vital for both volunteer and career firefighters to receive thorough training and information supporting effective decision making. CSB’s investigation of the WFC incident revealed that no standardized training requirement applies to volunteer firefighters across the nation.192 The NFPA has found that, in general, career firefighters have more funding from their local municipalities and thus are often better trained and better equipped compared to volunteer or hybrid fire departments across the country.193 In some communities, volunteer firefighters receive training in formal or informal settings; however, this training hinges on the state and regulatory authority, and the level and type of this basic and specialty training are not standardized. Some VFDs provide training programs equal to those of paid departments, but most volunteer firefighters either pay out of pocket or raise funds to pay for any additional specialty training. Such specialty training can address wildland firefighting, technical rescue, swift water rescue, HAZMAT response, vehicle extrication, and firefighter assist and search teams. CSB found that since there is no federal agency regulating municipal fire departments, some volunteer firefighters in less populated areas or rural communities rarely receive any major type of course training, and most of their initial training is usually on-the-job experience.194 In addition, some volunteer

192 Career firefighters have a standardized basic minimum training requirement. 193 In its report A Third Needs Assessment of the U.S. Fire Service, the NFPA found that compared to their big city counterparts, fire departments in smaller communities were more likely to report that many firefighters had not had formal training in various activities and did not have sufficient PPE. See: http://www.nfpa.org/~/media/files/research/nfpa-reports/fire-service-statistics/2011needsassessment.pdf?la=en (accessed on December 28, 2015). 194 Many volunteer firefighters near special or large manufacturing and storage facilities do receive training from the facility staff. This observation is particularly true when the volunteers include employees of the facility.

West Fertilizer Company Final Report January 2016 111 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters receive EMT195 and fire academy training.196 After completing the EMT and fire academy training, most firefighters are required to earn state certification. To maintain additional professional competency, some volunteer firefighters become state certified, but they must meet the same levels of requirements as those that apply to career firefighters. For example, in Texas, the general requirements for volunteer fire protection personnel certification programs are the same as those for paid personnel. Certification for paid fire protection personnel in Texas is mandatory, but for volunteer fire protection personnel, participation in a certification program is voluntary and not enforced.197 Texas does not require volunteer firefighters to receive a minimum level of training on how to respond to fires involving hazardous materials. In some cases, volunteer firefighters receive first-level certification, which gives an overview of fire suppression and rescue techniques, including HAZMAT and jaws-of-life training. NFPA 1001 (Standard for Fire Fighter Professional Qualifications, 2013 Edition198) provides recommended basic and minimum training requirements that all firefighters are expected to complete to respond to fire emergency calls. Once the basic training requirement has been met, the subsequent level of training differs between paid career and volunteer firefighters. In Texas, paid career firefighters are required to complete about 500 hours of training certification over four levels—introduction, basic, immediate, and advanced—through an academy-type program. Training and certification for volunteer firefighters are provided through the State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA).199 The SFFMA sets up standards for training and certification, but local jurisdictions are left to decide how many firefighters should be sent for particular training and the level of certification needed to protect their respective localities. For example, VFDs in rural areas and sparsely populated communities might require their firefighters to be certified only at the introductory level because few

195 Some firefighters are mandated to receive certification as an EMT. The general EMT-Basic training requires about 100 hours of classroom or field instruction, usually involving some hours of practice in a hospital or ambulance. At the end of the training, EMT-Basic students must take and pass an examination. Firefighters seeking additional training may enroll in the EMT-Intermediate class or the Advanced EMT class, which includes an additional 1,000 hours of education in advanced medical emergency response and care. See: http://work.chron.com/certifications- need-become-firefighter-17338.html (accessed on December 28, 2015). 196 The fire academy training program prepares firefighters for state firefighter certification. The fire academy program involves the completion of classes in the fire science program. Other courses administered in the fire academy program for entry-level firefighters address building codes, emergency medical procedures, and prevention techniques. In addition, the programs train students to fight fires with standard equipment, such as fire extinguishers, ladders, axes, and chainsaws. See: http://work.chron.com/certifications-need-become-firefighter- 17338.html (accessed on December 28, 2015). 197 See: http://www.tcfp.texas.gov/certification/certification_overview.asp (accessed on December 28, 2015). 198 NFPA. NFPA 1001: Standard for Fire Fighter Professional Qualifications, 2013 Edition. Quincy, MA: NFPA, 2013. 199 According to its website, the SFFMA was established in 1876 to support fire and emergency service providers in Texas and beyond. The SFFMA offers support to more than 1,200 fire departments, 22,000 individual members, 80 industrial fire brigades, and EMS and international departments. See: http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9- 7ae03d5685dd (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 112 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

buildings are in the area. In contrast, other towns or communities (such as West) that are near a chemical plant might require their firefighters to receive HAZMAT training and certification. 7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training CSB determined that lack of knowledge and understanding of FGAN detonation hazards at the WFC facility contributed to the emergency responder fatalities. Interviews with surviving firefighters indicated that they did not have sufficient time and information to properly assess the WFC facility and evaluate the behavior of the FGAN-related fire. Because the firefighters did not have adequate knowledge of the FGAN hazard, they focused their emergency response efforts on the anhydrous ammonia tanks. The lack of adequate HAZMAT training and the lack of FGAN firefighting guidance contributed to the deaths of the emergency responders. A joint NFPA-USFA survey revealed that an estimated 36 percent of U.S. fire departments involved in HAZMAT responses have not provided formal training in those duties to all involved personnel.200 CSB reviewed the training and experience of the firefighters who were fatality injured in the WFC incident and found that all of the responding firefighters had minimum training and certifications for responding to fire emergencies, especially training through FEMA courses.201 In addition, very few of the volunteer firefighters involved in this explosion, including surviving officers, had received HAZMAT training. Only two of the deceased volunteer firefighters had taken the HAZMAT awareness course, which is the introductory basic level for HAZMAT training and includes recognition and use of the Emergency Response Guidebook (ERG) as well as notification protocols.202 Table 8 shows the age, rank, function at the scene, and training and experience levels of the victims. Table 8. Training and Experience Information of the Fatally Injured Firefighters203 Victim Rank Age Years of Experience Training Function on Scene 1 Firefighter 48 15 years with WVFD Landing zone safety, propane emergency response, fire and emergency management services emergency response, HAZMAT awareness, ladder practices, hose handling, live burns, basic self-contained breathing apparatus (SCBA), Introduction to Incident Dispatched to incident site by WVFD

200 NFPA, USFA. “Four Years Later: A Second Needs Assessment of the U.S. Fire Service.” See: www.usfa.fema.gov/downloads/pdf/publications/fa-303-508.pdf (accessed on December 28, 2015). 201 See: https://training.fema.gov/is/crslist.aspx?all=true (accessed on December 28, 2015). 202 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

203 Ibid.

West Fertilizer Company Final Report January 2016 113 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of Experience Training Function on Scene Command System (ICS-100),204 ICS for Single Resources and Initial Action Incidents (ICS-200),205 National Incident Management System (NIMS): An Introduction (IS-700),206 National Response Framework: An Introduction (IS-800b)207 2 Career Fire Captain (off duty) 52 31 years with career fire department 31 years as a career firefighter from Dallas (Training status unknown) Responded voluntarily to assist WVFD 3 Firefighter 26 2 years at mutual aid VFD ICS-100, ICS-200, IS-700a, NIMS Multiagency Coordination System (MACS) Course (IS-701a),208 NIMS Public Information Systems (IS-702a),209 NIMS Resource Management (IS- 703a)210 Dispatched for mutual aid 4 Firefighter 37 17 years at mutual aid VFDs211 Emergency vehicle operations, basic auto extrication, compressed air foam systems,212 basic firefighting, ICS-100, ICS-200, IS-700a, IS-800.b, HAZMAT I & II,213 Various training classes offered by TEEX and other departments since 1996.214 Responded in privately owned vehicle (POV); dispatched for mutual aid 5 Volunteer Captain 29 10 years at mutual aid VFD Training status unknown Attending EMT class nearby. Dispatched for mutual aid; responded in POV

204 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-100.b (accessed on December 28, 2015). 205 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-200.b (accessed on December 28, 2015). 206 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-700.a (accessed on December 28, 2015). 207 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-800.b (accessed on December 28, 2015). 208 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-701.a (accessed on December 28, 2015). 209 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-702.a (accessed on December 28, 2015). 210 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-703.a (accessed on December 28, 2015). 211 Training information provided to the CSB by victim’s family. 212 Ibid. 213 Ibid. 214 Ibid.

West Fertilizer Company Final Report January 2016 114 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of Experience Training Function on Scene 6 EMT, Firefighter 33 1 year at mutual aid VFD Training status unknown Attending EMT class nearby. Rode in city ambulance 7 On E-1 Firefighter 41 2 years with WVFD Basic auto extrication, emergency driving, landing zone safety, ICS-100, IS-700a Responded on Engine 1 8 Firefighter 50 13 years with city VFD Fire and EMS emergency vehicle response, landing zone safety, ground cover (basic and intermediate), EMS emergency vehicle response, vehicle extrication, propane ER, fire and EMS ER, Intro to IC, HAZMAT awareness, fire emergency vehicle response, ladder practices, hose handling, live burns, basic SCBA, ICS-100, ICS-700a, IS-800b Drove the brush truck 9 Volunteer Captain 50 18 years with WVFD Basic firefighting, propane emergency response, ICS-100, IS-700a Responded in POV 10

Firefighter 29 3 years with WVFD Firefighting phase 1, emergency driving, basic auto extrication, landing zone safety, SCBA and smokehouse training, ICS-100, ICS-200b, Intermediate ICS for Expanding Incidents (ICS-300),215 Advanced ICS (ICS-400),216 IS-700a, IS- 701a, IS-702a, IS-703a, NIMS Communication and Information Management (IS-704), NIMS Intrastate Mutual Aid: An Introduction (IS-706),217 IS-800b Drove in Engine 1 Texas provides voluntary certification for HAZMAT technicians and HAZMAT ICs through the Texas Commission on Fire Protection (TCFP).218 The TCFP was established under Texas Government Code, Chapter 419, to develop and enforce recognized professional standards for individuals and the fire service.219 In addition, the TCFP provides education and assistance to the fire service and enforces

215 Intermediate ICS for Expanding Incidents (ICS-300) provides training and resources for personnel who require advanced knowledge and application of the ICS. This course expands on information covered in the ICS-100 and ICS-200 courses. See: http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 28, 2015). 216 The Advanced ICS (ICS-400) course provides training and resources for personnel who require advanced application of ICS. This course expands on information covered in ICS-100 through ICS-300. See: http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 28, 2015). 217 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-706 (accessed on December 28, 2015). 218 See: http://www.tcfp.texas.gov/certification/certification_requirements.asp (accessed on December 28, 2015). 219 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 115 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

statewide fire service standards. The TCFP is responsible for certification, training approval, and testing and compliance.220 CSB evaluated the curriculum manual used for HAZMAT certification for firefighters in Texas and found that FGAN explosion hazards were not covered at all. In fact, the manual mentioned FGAN twice under United Nations (UN)/DOT hazard classes and divisions of hazardous materials and weapons of mass destruction (WMD)—as a Class 1, Division 1.5 insensitive explosive221 and as a Class 5, Division 5.1 oxidizing substance222—in the 349-page document.223 Nationally, CSB found that the curriculum used for HAZMAT training does not fully address the hazards and severity of FGAN-related fires and explosions. A review of the U.S. Fire Administration (USFA) National Fire Academy HAZMAT field course outlines confirmed that they place little emphasis on emergency response to storage sites containing dangerous reactive chemicals and oxidizers such as FGAN. Conversely, HAZMAT shipping and transportation are covered in detail in the courses. A review of one firefighter training reference manual, Fundamentals of Firefighter Skills, compiled by the International Association of Fire Chiefs (IAFC) and the NFPA, indicated that very little guidance is provided to firefighters regarding responses to HAZMAT incidents involving reactive chemicals. Chapter 29 (“Hazardous Materials: Recognizing and Identifying the Hazards”) of the second edition of the Fundamentals of Firefighter Skills reference manual includes in-depth information on various HAZMAT transportation methods and containers but does not consider storage and warehousing for these materials. FGAN is not mentioned in the entire chapter.224 CSB concludes that the current training resources at the local, state, and federal levels do not provide sufficient information for firefighters to understand the hazards of FGAN. It is therefore essential for firefighter and emergency response training institutions to collaborate with fire departments to develop and implement a realistic process for ensuring that hazard response knowledge, once attained, does not become unused and obsolete.225

220 TCFP. See: http://www.tcfp.texas.gov/about/mission_and_goals.asp (accessed on December 28, 2015). 221 AN is mentioned as FGAN fertilizer and fuel oil mixtures (ANFO), an example of a very insensitive explosive with a mass explosion hazard (blasting agent) under Division 1.5 (Explosives). Chapter 6, “Hazardous Materials Awareness.” United Nations/Department of Transportation (UN/DOT) Hazard Class and Division of Hazardous Materials and Weapons of Mass Destruction (WMD), Class 1. Section 601: 3. See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 222 AN is mentioned as an example of a Division 5.1 oxidizing substance under U.N./DOT Hazard Class 5. Chapter 6, “Hazardous Materials Awareness,” Section 601: 4. See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 223 TCFP. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, effective on June 1, 2010. Based on NFPA 472 (2008 Edition). See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 224 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 2008. 225 Hazard response knowledge must be retained, and an effective retraining process must be put in place to prevent the loss of its organizational value.

West Fertilizer Company Final Report January 2016 116 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.5 Lack of Situational Awareness and Risk Assessment Knowledge

Although many firefighter training courses provide overviews of initial fire scene size-up, assessment, incident planning, and execution, CSB found that none of the firefighter HAZMAT field training courses provide sufficient information on firefighter situational awareness and risk assessment that could help them make informed decisions while at the fire scene.226,227 The firefighters who initially responded to WFC did not have the tools to effectively perform the situational awareness and risk assessment that would have enabled them to make an informed decision to not fight the fire. Situational awareness in firefighting involves the capability to “read” the scene of a fire or emergency, including changes in the behavior of a fire. Effective situational awareness supports prompt decision making to either evacuate the scene of a fire or continue fighting the fire by taking a defensive or offensive stance. Chapter 4 of NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition) provides guidance on situational awareness competencies for responder-level personnel.228 In fires involving HAZMAT, it is not always possible for firefighters to obtain needed information before acting, but they might be able to characterize a HAZMAT incident based on initial information acquired from the emergency call center and dispatcher; emergency response manuals and guides; knowledge base on the response area; and visual, auditory, and olfactory (odorous) clues. In some cases, the fire department’s standard operating procedures (SOPs) and the level of training of the emergency response crew might be insufficient to respond at the incident scene to changing events and scenarios that were not planned for or anticipated—hence, the need for effective training on situational awareness and risk assessment. Clearly written SOPs would afford fire department trainees the opportunity to read and understand the operational procedures of their fire department. The NIOSH Alert, “Preventing Injuries and Deaths of Fire Fighters,” emphasizes the need for departments to establish and adhere to the firefighting policies and procedures stipulated in the SOPs.229 NFPA 1500 (Fire Department Occupational Safety and Health Program, 2013 Edition230) emphasizes the need for development of a risk management plan, including risk identification of actual and potential hazards. In addition, it states that “fire departments shall prepare and maintain policies and standard operating procedures that document the organizational structure, membership, roles and responsibilities, expected functions, and training requirements.” NFPA 1500 also

226 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 2008. 227 Texas Commission on Fire Protection. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, effective on June 1, 2010. Based on NFPA 472 (2008 Edition). See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 228 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013. 229 See: http://www.cdc.gov/niosh/docs/2005-132/pdfs/2005-132.pdf (accessed on December 28, 2015). 230 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 117 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

provides guidance on the procedures to initiate and manage operations at the scene of an emergency incident. Moreover, NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition) states that “SOPs shall include the requirements for implementation of the incident management system and shall describe the options available for application according to the needs of each particular situation.”231 Firefighting environments are inherently unpredictable, volatile, and fraught with risk.232 It is therefore important for decisions to be made in a context of changing priorities, uncertain information, and limited resources. Firefighters must be able to rapidly size up233 any situation and create scenarios (or what-ifs) to make quick and informed decisions and predict the nature and behavior of a fire. NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition) offers guidance on competencies for ICs. Scene size-up is essential in any emergency situation, especially for HAZMAT incidents.234 This approach includes a thorough overall assessment of the scene and the identification of all possible hazards to ensure the safety of the emergency response crew. CSB concluded that training references and guides on emergency response do not address how to effectively respond to AN-related fires. 7.2.6 Lack of Pre-Incident Planning at Facility The fire department did not have a formal pre-incident planning program for FGAN at WFC. Firefighters responding to the incident were aware of the risks associated with anhydrous ammonia leaking from the tanks and that it could form a toxic flammable cloud that could leave the facility, drift into nearby homes, and potentially explode. Although some responding firefighters knew that FGAN was onsite, they did not anticipate a possible FGAN explosion. Some of the West fire department officials reported that they were aware of the chemicals routinely stored at the WFC, but there was never any formal training to prepare for a fire or chemical emergency. Effective site-specific pre-incident planning for emergency responders is essential to guide initial and subsequent actions while responders are at an emergency. Onsite pre- incident planning might have identified the possible FGAN explosion hazard. CSB did not find evidence of regularly scheduled training exercises to ensure that the WVFD conducted incident pre-planning and facility tours to address fire safety and chemicals onsite. A pre-incident plan must provide clear information on the magnitude of hazards in a chemical plant or business. A competent incident commander (IC) or designated authority must be capable of executing the pre-incident plan, including analyzing the incident, planning the response, implementing the planned

231 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 Edition. Quincy, MA: NFPA, 2014. 232 Flin, R. Sitting in the Hot Seat: Leaders and Teams for Critical Incident Management. Chichester: Wiley, 1996. 233 Incident size-up uses ongoing processes of information gathering and analysis that will help the firefighters make quick and informed decisions concerning how better to respond to the incident. 234 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 118 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

response, evaluating progress, retreating from the incident, and terminating the response. The NFPA 235 provides guidance on developing an effective incident response plan methodology for emergency responders.236 NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition237) provides guidance on the competencies required for hazardous materials responders (including the IC) involved in pre-incident planning and execution of the plan. The pre-incident plan also must be effectively communicated to other external emergency units in the surrounding areas for times when these agencies are called on for mutual aid. In addition, a pre-incident plan must be systemic and must include a realistic exit and evacuation strategy, especially when a decision is made to not take offensive action at a hazardous materials incident. Pre-incident planning must include all of the HAZMAT onsite. Plans must be put in place to address how to effectively respond to an emergency. NFPA 1620 (Standard for Pre-Incident Planning, 2015 Edition) states that the pre-incident plan “shall identify and document any special hazards recognized by the authority having jurisdiction that present extraordinary life safety challenges, operations challenges, or other challenges to emergency responders.”238 NFPA 1620 further states that the “pre-incident plan should be the foundation for decision making during an emergency situation and provides important data that will assist the IC in developing appropriate strategies and tactics for managing the incident.” This standard also states that the “primary purpose of a pre-incident plan is to help responding personnel effectively manage emergencies with available resources.” Pre-incident planning involves evaluating the protection systems, building construction, building contents, and operating procedures that can affect emergency operations. NFPA 1620 outlines the steps involved in developing, maintaining, and using a pre-incident plan by isolating the incident into pre-incident, incident, and post-incident phases. In the pre-incident phase, for example, the guidance covers factors such as physical elements and site or occupant considerations, protection systems, water supplies, hydrant locations, and special hazard considerations. Building characteristics—including type of construction, materials used, occupancy, fuel load, roof and floor design, and unusual or distinguishing characteristics—should be recorded, shared with other departments that provide mutual aid, and entered into the dispatcher’s computer if possible so that the information is readily available if an incident is reported at the noted address.

235 The NFPA, a nonprofit standards organization, has been developing standards since 1896 that directly affect fire services at the department level. The NFPA produces more than 300 consensus codes and standards intended to minimize the possibility and effects of fire and other risks. The codes are voluntary standards that industry can adopt and that regulatory agencies can enforce once the codes are signed into law. Standards are an attempt by an industry or profession to self-regulate by establishing minimal operating, performance, or safety criteria. See: http://www.nfpa.org/about-nfpa (accessed on December 28, 2015). 236 CSB referred to the most current edition of the NFPA codes and standards throughout this report. 237 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013. 238 NFPA. NFPA 1620: Standard for Pre-Incident Planning, 2015 Edition. Quincy, MA: NFPA, 2015.

West Fertilizer Company Final Report January 2016 119 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An adequate pre-incident plan must include, at a minimum, specific tested and practiced procedures for responding to an emergency at a given facility; a list of potential HAZMAT such as FGAN, including the quantity of each chemical that may be onsite; details on HAZMAT handling and storage; chemical locations at a particular site; the likely behavior of chemicals in a fire, flood, or other emergency; worst case scenario regarding how these chemicals might behave or interact in an emergency; the Safety Data Sheet (SDS)239 for each of the HAZMAT; and specific recommendations on how to respond to a fire when these chemicals are involved. Before the incident, the WVFD did not conduct a pre-inspection for an FGAN-related fire emergency. In most cases, a site-specific pre-incident plan would be developed in partnership with each chemical plant or chemical business in the response jurisdiction. Although WFC reported the quantity and location of each of its hazardous chemicals, including FGAN, to the WVFD, no mechanism ensured that pre-incident drills or inspections were conducted. Although the firefighters in West conducted some onsite anhydrous ammonia drills, none of the drills or training focused on the potential of an FGAN-related fire emergency. A fire pre-plan would enable firefighters to determine various situations where conditions could dramatically change in a burning structure. This information would enable them to consider the hazards associated with each site. Also, the pre-incident plan could provide this advanced information, which might have aided the WVFD in developing a response strategy or might have facilitated a decision to stand down and allow the structure to burn to the ground if no lives were endangered by doing so. Whether a volunteer fire department (VFD) has pre-incident plans in place often depends on the individual fire department. Currently, no federal agency regulates municipal fire departments in the United States. Although the U.S. Congress funded the National Institute for Occupational Safety and Health (NIOSH) in 1998 to establish the Fire Fighter Fatality Investigation and Prevention Program, NIOSH only investigates on-the-job firefighter fatalities and makes recommendations for improvements to the profession. NIOSH lacks authority to enforce regulations or mandate firefighter training requirements.240 7.3 Limited and Conflicting Technical Guidance on FGAN Firefighters might not have at their fingertips all of the hazard information regarding the chemicals that can be found in their communities. Regardless of the instant availability of information on the hazards of a specific chemical, firefighters are required to respond immediately upon dispatch and are expected to

239 An SDS is a document developed by the manufacturer of a hazardous chemical product that communicates the hazards of the product. It is required under OSHA’s Hazard Communication Standard. Under this standard, all chemical manufacturers, distributors, or importers must provide to downstream users an SDS for each hazardous chemical. Previously, SDSs were known as Material Safety Data Sheets (MSDS); however, in 2012, the name underwent a change when OSHA decided to modify the Hazard Communication Standard to adopt the U.N. Globally Harmonized System. 240 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 120 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

make prompt decisions. To make effective decisions in fire emergencies, some fire prevention and emergency response stakeholders have developed technical manuals and guidebooks. These guidebooks help emergency responders and firefighters to better understand chemical hazards. References include the Emergency Response Guidebook (ERG), SDSs, and NFPA standards.241 Although firefighting manuals support the prevention of injuries and fatalities, CSB found conflicting information and inconsistencies in various emergency response guidelines. 7.3.1 Emergency Response Guidebook The ERG is a readily available and widely used guidebook among the emergency response community. Formerly known as the DOT ERG, this document is now jointly produced by DOT, Transport Canada, and the Secretariat of Communications and Transportation (Mexico). The current ERG is designed as a resource for first responders to consult during the initial phase of a dangerous goods or HAZMAT transportation incident. Emergency response personnel (such as firefighters, EMTs, and police officers) in the United States, Canada, Mexico, and other countries use the ERG when responding to transportation emergencies involving HAZMAT. In most cases, firefighters who complete HAZMAT courses, the most basic of which is Awareness Level training, are expected to be familiar with the ERG. Figure 63 shows the 2012 edition of the ERG.

241 Annex E of NFPA 400 (2013 Edition) also provides AN firefighting guidance. NFPA. NFPA 400: Hazardous Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013.

West Fertilizer Company Final Report January 2016 121 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA)242 Most firefighting apparatuses have a copy of the ERG.243 After the WFC incident, NIOSH investigators found copies of the 2012 ERG in the glove boxes of some of the damaged fire equipment and apparatuses.244 However, CSB does not have any evidence that indicates whether the West firefighters consulted the ERG on the night of the explosion. The ERG is especially useful in situations when the relevant SDS is not readily available to firefighters. The ERG gives direction (based on DOT Hazard Classification Criteria) on response to HAZMAT and dangerous goods emergencies during transportation. It does not provide any specific guidance on the

242 DOT Pipeline and Hazardous Materials Safety Administration (PHMSA). See: http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_7410989F4294AE44A2EBF6A80ADB640BCA8E4200/filename/ER G2012.pdf (accessed on December 28, 2015). 243 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition. See: http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 28, 2015). 244 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 122 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

handling of ammonium fertilizer.245 In fact, the ERG includes the following commentary under the heading of its 2012 Edition: This guidebook will assist responders in making initial decisions upon arriving at the scene of a dangerous goods incident. It should not be considered as a substitute for emergency response training, knowledge or sound judgment. ERG2012 does not address all possible circumstances that may be associated with a dangerous goods incident. It is primarily designed for use at a dangerous goods incident occurring on a highway or railroad. Be mindful that there may be limited value in its application at fixed facility locations.246 The current edition of the ERG lists 15 variations of FGAN. Next to each FGAN variant is a guide number that leads to information on the potential hazard and the appropriate emergency response, but the suggested measures are broad and subject to varying interpretations. On October 1, 2014, CSB provided comments on a DOT request for information (RFI), “Hazardous Materials: Revision of Emergency Response Guidebook” (FR Doc. 2014-20683), which was published on August 29, 2014.247 CSB commented as follows: The ERG is intended for incidents involving the transport of hazardous materials and is limited to the size of the transportation containers involved.248 However, the CSB has found in several investigations249 that the ERG manual was used by emergency responders for incidents involving chemical fires, explosions and releases of hazardous materials at fixed facilities. Incidents at fixed facilities may involve larger quantities of hazardous materials as well as additional hazards involving process conditions or other hazardous chemicals stored nearby, resulting in higher risk to emergency responders. The directions regarding response to a chemical release or fire incident intended for transportation may be different when applied to an incident at a fixed chemical or manufacturing facility. For this reason, the CSB suggests that the DOT consider additional language to clarify ERG’s use limitations at fixed facilities. CSB also urged DOT to highlight in bold text on the front cover page of the next edition of the ERG: “Only Intended for Use When Responding to Transportation Incidents.” Realizing that emergency

245 The ERG provides some information and guidance on handling Division 5.1 oxidizers. 246 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition: 356. See: http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 28, 2015). 247 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergency- response-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 248 See: http://www.csb.gov/assets/1/7/DOT_ERG__RFI10_1_14.pdf (accessed on December 28, 2015). 249 Technics, Inc., 2003. See: http://www.csb.gov/technic-inc-ventilation-system-explosion/ (accessed on December 28, 2015); DuPont Belle, 2010. See: http://www.csb.gov/dupont-corporation-toxic-chemical-releases/ (accessed on December 28, 2015); Millard Refrigerated Services, 2010. See: http://www.csb.gov/millard-refrigerated-services-ammonia-release/ (accessed on December 28, 2015); AL Solutions, 2010. See: http://www.csb.gov/al-solutions-fatal-dust-explosion/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 123 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

responders will continue to reference the ERG for incidents involving HAZMAT releases at fixed facilities, CSB suggested that DOT consider adding guidance such as the information that first responders should obtain and reference when responding to an incident at a fixed facility, such as the company SDSs and submitted Tier II information.250 CSB advised that such guidance also should be in the front section of the ERG (for example, on pages 1 and 2). In addition, CSB suggested that DOT move the user’s guide from page 356 to page 1 or 2 of the next ERG edition to provide users with earlier guidance. CSB also urged DOT to take the following actions: • Review and revise the ERG to remove generic and vague information in the emergency response section of Guide 140 and other ERG sections. • Include a statement that urges emergency responders to reference other sources in addition to the ERG to obtain more detailed instructions when responding to emergency incidents at fixed facilities. First responders should obtain and refer to the company SDSs or submitted Tier II information when responding to an incident at a fixed facility. This information should also be in the introduction of the ERG (for example, on pages 1 and 2). • Revise the ERG to address the unpredictable behavior of fires involving FGAN and the potential for detonation within a very short time frame. DOT should consider recommending a more conservative response to fires involving FGAN by emphasizing firefighter and resident evacuation when the threat is to human lives rather than property. • Revise Guide 140 to include a separate discussion of the properties and behaviors unique to FGAN (such as the potential for detonation within a very short time frame) that might differ from those of other oxidizers covered by Guide 140. On its website, DOT provided a preview of updates for the 2016 Edition of the ERG.251 The link to the ERG updates provided by DOT showed that the review working group on the ERG had made the following changes: • Replaced written instructions on page 1 with a flow chart to show how to use the new ERG (2016). • Expanded the Table of Placards and updated the title to Table of Markings, Labels, and Placards and Initial Response Guide to Use on Scene. • Expanded the Railcar Identification Chart and the Road Trailer Identification Chart to two pages each. • Updated Table 1 and Table 3 based on new toxic inhalation hazard (TIH)252 data and reactivity research.

250 Additional information on Tier II information is noted in Section 8.5 of this report. 251 DOT. “Preview of Updates for the ERG 2016.” See: http://www.phmsa.dot.gov/pv_obj_cache/pv_obj_id_CDF7F93A3E0C2F808D9EA09C262749DAEF400200/filena me/ERG2016_Preview.pdf (accessed on December 28, 2015). 252 TIH is the abbreviation for toxic inhalation hazard. Under the Hazardous Materials Regulations (HMR), 49 CFR Parts 171–180, TIH materials are gases or liquids that are known (or presumed on the basis of tests) to be so toxic to humans as to pose a hazard to health in the event of a release during transportation. See:

West Fertilizer Company Final Report January 2016 124 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Updated pipeline emergency response information. • Added information about Globally Harmonized System of Classification and Labeling of Chemicals (GHS) markings. • Added all new dangerous goods and HAZMAT listed in the U.N. Recommendations on the Transport of Dangerous Goods, 19th Revised Edition. • Added information on emergency response assistance plans applicable in Canada.

Also, DOT provided a snapshot of the cover page of the 2016 edition of the ERG (Figure 64) on its website.

Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA)253 CSB noticed (from the preview of the 2016 edition of the ERG), that DOT and other authors of the ERG moved the warning statement, “A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident” from the left side of the cover page of the 2012 edition to the top of the cover page, as recommended by CSB. However, DOT and other authors

https://www.federalregister.gov/articles/2004/08/16/04-18705/hazardous-materials-enhancing-rail-transportation- security-for-toxic-inhalation-hazard-materials (accessed on January 20, 2016). 253 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 125 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the ERG did not include the statement “Only Intended for Use When Responding to Transportation Incidents” in bold on the front cover page of the 2016 edition of the ERG, as suggested by CSB in its response to the DOT RFI for the ERG revision.254 Instead, DOT and other ERG authors modified the statement “A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident” to “A guidebook intended for use by first responders during the initial phase of a transportation incident involving dangerous goods/hazardous materials.”255 Note that “transportation incident involving dangerous goods/hazardous materials” is in bold on the cover page of the 2016 edition of the ERG. 7.3.2 Safety Data Sheets CSB did not find any record that the WVFD consulted the SDS for FGAN and other chemicals present at the WFC facility during the incident. After the incident, CSB reviewed the SDS (that was current at the time of the WFC incident) provided by CF Industries and EDC, the manufacturers of the FGAN used at the WFC. The CF Industries SDS for FGAN (SDS Number 004) provided guidance on FGAN hazards in the December 11, 2012, revision of the SDS.256 Under the Hazards Identification, Emergency Overview heading (item three, page 1), CF Industries described FGAN: Strong oxidizer. Contact with combustible material will increase fire hazard. May undergo detonation if heated under confinement causing pressure buildup or if subjected to strong shocks. Solid AN when sensitized or during decomposition may become unstable and/or explosive. When AN is heated to decomposition it may produce vapor which contains nitrogen oxides (NOX). AN is an oxidizer and as such may increase the flammability and/or explosiveness of other substances. Use water to control fires involving AN, if water is compatible with burning material. AN itself is non-flammable. AN can cause irritation to eyes and skin and may be an inhalation discomfort in confined locations.257 Under the Firefighting Measures heading (item five, page 3), CF Industries noted: Flood burning ammonium nitrate fertilizer with large volumes of low pressure water. Do not use salt water, carbon dioxide, dry chemicals or foam extinguishers. Never attempt to smother fire, such as by sealing off, closing a compartment or building doors when fire occurs. Do not add steam. Ammonium nitrate fertilizer does not have the property of spontaneous combustion. Fire fighters should wear approved self-contained breathing apparatus to protect themselves from the

254 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergency- response-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 255 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on December 28, 2015). 256 CF Industries has since removed its December 11, 2012, SDS for FGAN from its website. CF industries replaced the December 11, 2012, SDS for FGAN with a revised and updated SDS for FGAN (April 23, 2013). See: http://www.cfindustries.com/pdf/Ammonium-Nitrate-Amtrate-MSDS.pdf (accessed on January 20, 2016). On May 15, 2015, CF Industries published its current SDS for Amtrate FGAN fertilizer, which supersedes every other SDS. See: http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on December 28, 2015). 257 CF Industries LLC. “Safety Data Sheet, FGAN.” SDS Number 004, revised December 11, 2012.

West Fertilizer Company Final Report January 2016 126 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

toxic fumes of decomposing ammonium nitrate, and protective clothing to guard against molten nitrate splashes should also be worn.258 This SDS for FGAN referred to NFPA 400 (Hazardous Materials Code, 2013 Edition) under its section on handling and storage but not in its section on firefighting measures. Although Chapter 11 of NFPA 400 provided some recommendations for safe storage, handling, and use of AN, it did not include any specific guidelines on FGAN firefighting measures. Annex E of NFPA 400 outlined some general procedures and suggestions on firefighting for FGAN incidents. Section E.2.1 of Annex E of the 2013 edition of NFPA 400 states: [S]hould a fire break out in an area where FGAN is stored, it is important that the mass be kept cool and the burning be promptly extinguished. Apply large volumes of water as quickly as possible. If fires reach massive and uncontrollable proportions, fire-fighting personnel should evacuate the area and withdraw to a safe location.259 Also, Section E.2.2 of NFPA 400 suggested the provision of as much ventilation as possible to the fire area.260 Although the FGAN SDS provided by CF Industries contained some useful insights and guidance on how to respond to FGAN-related fires, it did not clearly define “a distance” from which a fire could be “flooded” (one of the special firefighting procedures) and did not specify what “volumes of low pressure water” would be needed. CSB compared the firefighting measures in the CF Industries and EDC SDS with those in the SDS provided by a similar large technical grade AN (TGAN) manufacturer (Orica)261 and with those in the current edition of the DOT ERG (Table 9). Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013 EDC SDS (FGAN) CF Industries SDS (FGAN) Orica AN SDS (TGAN) DOT ERG (2012 Edition) If confined when an ignition occurs, an explosion may occur. FGAN may undergo detonation if heated under confinement. FGAN may explode under confinement and high temperature. FGAN may explode from heat or contamination. Flood with water. Flood fire area from a distance. Fires should be fought from a protected location. Flood large fire with water from a distance.

258 Ibid. 259 NFPA. NFPA 400: Hazardous Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013. 260 Ibid. 261 According to its website, Orica is the largest provider of commercial explosives and blasting systems to the mining and infrastructure markets, a global leader in the provision of ground support in mining and tunneling, and a leading supplier of sodium cyanide for gold extraction. See: http://www.orica.com/About-Us#.VlXviHarSUk (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 127 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Firefighters should wear proper protective equipment and self- contained breathing apparatus. For massive fires, use unmanned fire nozzles; if this is impossible, withdraw from area, and let burn. A major fire may involve a risk of explosion. For massive fire, use unmanned hose holders or monitor nozzles; if this is impossible, withdraw from area and let fire burn.

These examples of guidance for fighting fires involving FGAN illustrate hazards that were broadly defined and were not clearly communicated to emergency responders. The use of vague and broad terminologies in some of the guidelines compared in Table 9 indicates that the behavior of FGAN under heat and confinement is not clearly understood because no standardized methods are used to communicate the hazards of FGAN and possible firefighting procedures to emergency responders. Also, terms such as “massive,” “major,” “large,” “protected location,” and “distance” were not clearly defined in the guidelines. The CF Industries SDS and the ERG suggested “flooding” a fire involving FGAN from a distance, and the Orica SDS suggested fighting such fires from a “protected location.” The EDC SDS instructed firefighting personnel to flood with water but did not address the need to extinguish fires from a distance or to evacuate under massive fire situations. In these guidelines, the safe distance or protected location is not clearly defined. Hence, a firefighter must make a judgment to determine which location or area is protected, which distance is safe enough to fight a fire involving FGAN, how much water is needed for flooding, and which fire is massive or major. Unfortunately, firefighters are often forced to make these decisions without adequate training, information, preparation, and pre-planning. The WFC incident highlighted the need for greater awareness of FGAN hazards. In response to the 2013 explosion, EDC updated its SDS to include more information about the explosive hazards of AN and information for firefighters. The revised EDC SDS now advises firefighters to fight AN fires remotely because of the risk of explosion. If an AN-containing structure is fully engulfed in flames, firefighters are instructed not to fight the fire and to evacuate the surrounding area to at least a one-half-mile radius.262 7.4 Lessons Not Learned and Lessons Learned 7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not Learned CSB found that lessons learned from previous firefighter fatalities and emergency responses to FGAN- related incidents were not effectively disseminated to firefighters and emergency responders in other communities where FGAN is stored or used. Had those lessons been applied to the very similar situation

262 See: www.eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No v_2014.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 128 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in West, the firefighters and emergency responders might have better understood the risks associated with FGAN-related fires. Although the firefighters in West knew of the hazards associated with the tanks of anhydrous ammonia as a result of previous releases, they were not alert to the explosion hazard from the FGAN inside the warehouse. Although FGAN itself does not burn, the conditions under which AN might detonate when exposed to fire are unpredictable and not clearly understood, and current guidance does not offer consistent advice on how to attempt to guarantee firefighter safety. The deaths of the volunteer firefighters and emergency responders in West was not the first time that firefighters have been killed when responding to FGAN-related explosion incidents. On April 16, 1947, a ship containing 7,000 tons of wax-coated FGAN263 exploded in the port of Texas City, Texas, killing 581 people, including all 26 Texas City firefighters who responded to the incident.264 The November 29, 1988, Kansas City, Missouri, ammonium nitrate/fuel oil (ANFO) incident, although not directly related to an FGAN fire, is worth mentioning because of its severity, the important lessons learned from the incident, and its implication for emergency response. Six firefighters from the Kansas City, Missouri, fire department were killed in an explosion while they were extinguishing a fire at a construction site.265 About 40 minutes later, a second explosion occurred, followed by several minor explosions. Investigators later learned that after the first explosion, the battalion chief immediately pulled back and prevented other firefighters from entering the area. A command post was set up at a safe distance, which ultimately prevented more firefighter casualties. The initial fire involved a trailer/magazine containing blasting mixtures of FGAN, fuel oil, and aluminum pellets. One end of the trailer contained approximately 3,500 pounds of ANFO mixture while the remainder of the load was approximately 17,000 pounds of ANFO mixed with 5 percent aluminum pellets. In addition, a second explosion rocked another trailer/magazine loaded with approximately 1,000 30-pound sacks of ANFO mixture with 5 percent aluminum pellets.266 Both explosions in Kansas City created large craters where the two trailers had been parked, similar to the impact of the explosion in West. The first trailer explosion produced a swimming-pool-like crater that

263 Although the Texas City incident involved a form of wax-coated FGAN that is no longer manufactured for fertilizer purposes and a form of strong confinement (the locked hull of a ship), the lessons of confinement were developed and incorporated into industry guidance after the Texas City incident. 264 See: https://www.txdps.state.tx.us/dem/temo/archives/2013/Vol60No4/Articles/article2.htm (accessed on December 28, 2015). 265 The Texas City incident is discussed in this section to indicate that firefighters have lost their lives in the past because of a lack of pre-incident planning, inadequate training and information, and erroneous knowledge of the hazards with which they were dealing. The same observation applied to Kansas City, even though it was an ANFO incident; firefighters were not equipped with the right information and had inadequate knowledge of the hazards of the explosive material (ANFO) that they dealt with that evening, and they lost their lives as a result. 266 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf (accessed on January 20, 2016).

West Fertilizer Company Final Report January 2016 129 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 80 feet in diameter with a depth of 8 feet, connected to a smaller crater that was 20 feet in diameter and 6 feet deep. The second trailer explosion gouged a crater approximately 100 feet in diameter and 8 feet deep, similar in dimensions to the crater resulting from the explosion in West, Texas. The Kansas City incident investigation determined that the firefighters were not told specifically about the contents of the trailer/magazine, although the dispatcher did caution them about explosives on the site. The firefighters did not report any indication of the presence of warning placards on the trailers because there was no requirement by firefighters to report the presence or absence of warning placards over the radio upon their arrival at a scene of a fire. Also, it was not clear whether the firefighters realized that the trailers housed an explosive magazine.267 No record of communication among the dispatch official, fire chief, and firefighters indicated that the firefighters knew the contents of the magazine, and the firefighters did not seem alarmed when they arrived at the site. In addition, the fire department was not aware of the presence of the trailers/magazines or their contents before the incident because of a lack of jurisdictional authority. The Kansas City Fire Prevention and Protection Code did not require the city engineer to notify the fire department that blasting permits had been issued, although this provision was changed immediately after the incident. The Kansas City Fire Department had no authority or responsibility to inspect the construction site because it was a state enclave.268 Shortly after the Kansas City explosions, the USFA produced a technical report (USFA-TR- 024/November 1988)269 with findings of its investigation and lessons learned. Although the fertilizer- related incidents in Texas City and West did not involve explosives per se, the Kansas City incident further illustrated that the lack of knowledge about the stored HAZMAT and the lack of pre-incident planning by firefighters before their response led to the fatalities. Most of the recommendations based on lessons learned emphasized the need to be properly prepared through pre-incident planning and through the provision of clear information to firefighters and emergency responders dealing with fires involving HAZMAT. CSB observed that within the last 6 years, three notable FGAN-related incidents in Texas involved emergency responders. Subsequently, CSB reviewed the emergency response activities associated with the FGAN-related fires that occurred in 2009 at the EDC facility in Bryan, Texas, and in 2014 at the East Texas Ag Supply facility in Athens, Texas. On Thursday, July 30, 2009, at about 11:40 am CDT, a fire broke out at the EDC facility in Bryan. The EDC facility stores FGAN and blends it with other materials to create fertilizer. The fire at the EDC fertilizer plant led to the evacuation of more than 80,000 residents in the Bryan and College Station area.

267 An explosive magazine is an enclosed storage structure for holding explosives. 268 A state enclave is any portion of a state that is completely surrounded by the territory of another state. 269 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf (accessed on January 20, 2016).

West Fertilizer Company Final Report January 2016 130 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Although the storage structure burned to the ground, unlike the incident at the WFC facility, no explosion, loss of life, or major injuries were recorded. At Bryan, the firefighters were informed that a welder had accidentally heated an FGAN bin and that the chemical was smoldering. The firefighters decided not to fight the fire, evacuated the area, and let the facility burn to the ground, without any explosion. Their knowledge of FGAN and the risks associated with a probable explosion most likely led the Bryan firefighters to decide to evacuate. Figure 65 shows the post-incident aerial view of the EDC facility wooden fertilizer warehouse.

Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: Bryan-College Station Eagle) After the incident, the Bryan Fire Department—in conjunction with the emergency management divisions for Brazos County, the city of Bryan, the city of College Station, and Texas A&M University—performed an emergency review and analysis and released an after-action report and improvement plan. These documents were shared with fire departments and emergency response agencies that were involved in the incident response and investigation, including local and regional emergency response agencies—mostly

West Fertilizer Company Final Report January 2016 131 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in the Brazos Valley area, where Brazos County, the cities of Bryan and College State, and Texas A&M University are located—and other state agencies that responded to the incident.270 The 2009 EDC fire after-action report for Brazos Valley highlighted the need for emergency response departments to reflect on protection, response, and recovery activities that occurred during the EDC incident, despite the fact that the community-wide response to the incident resulted in no loss of life or serious injuries. In addition, the after-action report identified potential strengths to be maintained and built on, noted potential areas for further improvement, and suggested recommendations for corrective and preventive actions based on the incident. The after-action report indicated: The Texas Division of Emergency Management provides the National Emergency Response and Rescue Training Center (NERRTC) funding to develop regional plans that will enable local emergency management to rapidly respond to disasters using the region’s resources before requesting assistance from State and Federal partners. Within that scope, NERRTC also develops after-action reports on behalf of local, regional and state governments that have been affected by major disasters. As in the case of the EDC fire, lessons learned help recognize needs for plans, policies and procedures revisions to enhance the effectiveness of response (personnel, teams and/or equipment).271 Unfortunately, CSB did not find any record that the WVFD requested or received a copy of the Brazos Valley after-action report and improvement plan. In addition, no record suggested that lessons learned from the EDC incident were discussed or shared with firefighters at West.272 Although circumstances in West might have differed from those in Bryan, if lessons learned had been effectively relayed among the firefighters at West, the volunteer firefighters who responded to the WFC incident possibly could have drawn on the experience of Bryan firefighters to inform response strategies, both in the pre-planning stages and in the response to the incident on the night of April 17, 2013. 7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned On May 29, 2014, at around 5:45 pm, a fire involving FGAN occurred at the East Texas Ag Supply facility in downtown Athens, Texas. Emergency dispatchers and the Athens Police Department promptly notified firefighters from the Athens Fire Department (AFD).273 Emergency response units from the AFD arrived on the scene of the fire at 5:50 pm and found fire and smoke coming from the northwest end of the 3,500-square-foot East Texas Ag Supply facility. This facility was built with masonry bricks and combustible wooden structures, similar to construction at the WFC facility.274 The AFD chief arrived

270 EDC. “2009 El Dorado Chemical Fire After-Action Report for Brazos Valley,” August 11, 2009. 271 Ibid. 272 CSB found that several surviving West firefighters interviewed after the WFC incident did not have adequate information about the EDC incident at Bryan (approximately 100 miles south of West, Texas). 273 The AFD was organized as a volunteer department in 1911. Currently, the AFD is a fully paid fire department with two stations and 27 firefighters. See: http://athenstexas.us/fire.cfm (accessed on December 28, 2015). 274 Shortly after the April 17, 2013, incident at the WFC facility in West, Texas, an investigative reporter from the Dallas news station (WFAA) entered the Athens facility with a camera crew and revealed that East Texas Ag Supply

West Fertilizer Company Final Report January 2016 132 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

about 2 minutes after the first responding units were dispatched to the site of the incident, and he found that the fire had self-ventilated at the northwest end. On the basis of his observation of the enormous scope of the fire and the possibility of detonation of FGAN in the engulfed building, the fire chief promptly decided to let the East Texas Ag Supply facility burn to the ground instead of attempting to fight the fire.275 He ordered his firefighters to retreat from the scene and began an extensive evacuation of the downtown Athens, Texas, area. The Athens Police Department coordinated the evacuation of the nearby residential areas, setting up an initial three-block evacuation perimeter, which was later expanded to five blocks.276 Fortunately, no injuries were associated with this incident. On June 2, 2014, the State Fire Marshal’s Office (SFMO) completed its investigation of the East Texas Ag Supply facility incident and released its findings, ruling and classifying the source of the fire as undetermined.277 The East Texas Ag Supply facility was a privately owned business with annual revenues estimated between $10 million to $20 million and a work force of approximately nine employees. The East Texas Ag Supply facility was an FGAN and potash fertilizer storage facility, and it was registered under Standard Industrial Classification Code 5191 (Farm Supplies) and North American Industry Classification System (NAICS) Code 424910 (Farm Supplies Merchant Wholesalers).278 On the day of this incident, the East Texas Ag Supply facility received approximately 70 tons of FGAN (total) and 100,000 pounds of potash, which were stored inside the building when the fire occurred. CSB gathered information concerning the East Texas Ag Supply incident from the emergency responders and the facility and also conducted an interview with the AFD fire chief. According to the incident statement provided to CSB, the Athens, Texas, fire chief stated: We allowed the fire to mitigate itself, with research showing that some such facilities had burned out with no explosions. We had learned a lot from West and had already removed other products that could cause contamination and had made the owner remove his diesel tractor from within the building and to keep it off site when not in use. We feel this was a major deterrent from having a detonation.279 Figure 66 and Figure 67 show photographs of the East Texas Ag Supply facility during the fire incident.

was receiving and storing the same substance thought to have been involved in the explosion in West. See: http://www.wfaa.com/story/news/local/investigates/2014/08/18/14029198/ (accessed on December 28, 2015). 275 According to the Athens, Texas, fire chief, the initial plan of action was to engage the fire at the incipient stage, but by the time he arrived on scene, the chief knew that the fire was well past the incipient stage and that the quantity of water needed to squelch the fire at that stage was beyond the capabilities of the equipment on hand. He gave the order for his men to cease firefighting based on his early observations and to begin evacuation activities. 276 The City of Athens police chief was in charge of the evacuation and the control of traffic. The police chief set the initial evacuation perimeter at three blocks from the facility based on the immediate resources available to the police chief at that time; the perimeter subsequently was expanded to five blocks. Police and fire personnel conducted the evacuation notification by using their public address systems and going door to door. 277 See: http://www.tdi.texas.gov/news/2014/news201443.html (accessed on December 28, 2015). 278 After the WFC incident in West, the city of Athens, Texas, received a lot of attention because of the presence of a fertilizer storage facility downtown that was similar to and older than the WFC facility. Wooden bins were used for storage of AN at the East Texas Ag Supply facility. 279 The fire incident statement was provided to CSB via email on October 3, 2014, by the Athens, Texas, fire chief.

West Fertilizer Company Final Report January 2016 133 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 66. Dark Grey Smoke280 Originating from East Texas Ag Supply Facility in Downtown Athens, Texas (Source: Athens Fire Department)

280 However, this smoke was not as black as the smoke from the WFC fire (see Section 4 of this report).

West Fertilizer Company Final Report January 2016 134 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas281 (Source: Athens Fire Department) In an interview, the fire chief reported that the AFD conducted extensive pre-planning, visited the East Texas Ag Supply fertilizer storage facility on multiple occasions, and instructed the owner of the facility to repair anything that seemed to be hazardous or noncompliant with the International Fire Code, which the city of Athens adopted in 2009. SFMO officials had also visited the facility previously on at least two occasions and compelled the owner of the East Texas Ag Supply facility to fix old broken machinery that was onsite.282 In addition to these visits from SFMO, AFD officials often toured the facility to randomly inspect loading and unloading operations and to take note of other fire safety issues, including the location and spacing of exits within the facility. Pre-incident assessment of the facility indicated that the fertilizer storage bins were old and constructed of double layer plywood, each about 10 feet from the ceiling of the 35- to 40-foot-tall building, with three of the bins used to store FGAN. Similar to the WFC facility in West, the East Texas Ag Supply facility had no sprinkler systems, and the building was

281 At the East Texas Ag Supply facility incident in Athens, Texas, the flame appeared to be the normal yellow color of many wood and other combustibles burning in normal air. Unlike the WFC incident, there was no detonation of FGAN; hence, no evidence of brighter (higher-temperature) white flame was observed before the detonation at West (see Section 4 of this report). 282 In addition to the actions taken by the city of Athens before the East Texas Ag Supply fire on May 29, 2014, the SFMO—as part of its endeavors to share the lessons learned from the West, Texas, AN explosion—went to all 66 counties with businesses that had 10,000 pounds or more of AN. The statewide tour started on December 12, 2013, and was completed on December 17, 2014. Local first responders, LEPC members, local officials, business staff, and citizens were invited to the public meetings organized by the SFMO. On April 3, 2014, the SFMO visited Athens, Texas (Henderson County) to enlighten the public on the hazards of FGAN. See: http://www.tdi.texas.gov/fire/fman.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 135 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

constructed with masonry brick walls on three sides, covered with an asphalt shingle roof. Figure 68 shows the East Texas Ag Supply facility, including its masonry brick walls completely burned to the ground.

Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke (Source: Athens Fire Department) The Athens community has two community alert systems, CodeRED and FIRST Alert. The CodeRED community alert system was developed to notify residents of any emergency. The FIRST Alert system is directed from the Henderson County 911 dispatch center.283 The protocol for use of the CodeRED system indicates that during any emergency situation or a fire incident, the fire chief or a designee (usually the police chief) would give the order for the CodeRED notification. Once a CodeRED order is given, the designee or authorized emergency staff member is expected to make a recorded speech, which is then broadcast over the Internet and to all landline telephones in the city. The process also notifies mobile phone subscribers. The CodeRED system was not deployed during the East Texas Ag Supply incident to notify Athens residents. 284 However, the CodeRED alert system was used the following day (May 30, 2014) to notify the community about the post-incident status of the East Texas Ag Supply facility and the conditions surrounding that facility. The Athens, Texas, fire chief compared the city’s situation to that in West and stated that the AFD conducted additional research and identified how best to respond to any emergency situation that could

283 Athens, Texas, is located in Henderson County, about 70 miles southeast of Dallas, Texas. 284 On the day of the incident, there was no clear communication on the designation of the appropriate party to make the outgoing emergency notification message. The fire chief maintained that because he was occupied with command firefighting operations, the task of making the announcement should have been transferred to the Athens Police Department (police chief); unfortunately, this was not the case. Moving forward with the post-incident critique, the fire chief indicated that standardizing the designation of who makes the announcement would be better defined for future community notifications.

West Fertilizer Company Final Report January 2016 136 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

arise because of the East Texas Ag Supply facility. In West, the WFC plant was primarily a fertilizer facility, with anhydrous ammonia tanks, carts, loaders, insecticides, and other potential contaminants for FGAN. On the basis of the aftermath of the WFC explosion in West, Henderson County reviewed its existing local emergency planning committee (LEPC) process. About a year before the Athens fire incident, the natural disaster planning LEPC was expanded, with the fire chief as its chair, to address emergencies arising from human activities or industrial facilities. Although the cause of the Athens fire incident has not been determined, the city of Athens initiated reforms aimed at protecting the city from another incident in the future. On May 29, 2015, a year after the fire at the East Texas Ag Supply facility, the city passed an ordinance that banned the bulk storage of FGAN in Athens. The ordinance included a mandatory reporting process for facilities with limited quantities of hazardous chemicals such as FGAN so that they would report the quantities of the hazardous chemicals in their facilities, thereby enabling VFDs to conduct inspections at such facilities.285 CSB investigators conducted a teleconference with the city of Athens fire chief on June 24, 2015. The fire chief stated that the East Texas Ag Supply facility had been torn down and will not be rebuilt within the Athens city limits. In addition, Athens is now considering efforts aimed at monitoring other hazardous chemicals (similar to FGAN) that are currently stored by facilities within the city limits.286 7.5 Other Post-Incident Investigation Reports Related to Firefighting After the fire and explosion at the WFC facility, several other agencies conducted investigations of the incident. EPA and OSHA conducted their investigations for violations of environmental and workplace safety and health laws, while the Texas SFMO and NIOSH conducted their investigations on the firefighters and the emergency response at the WFC facility. The ATF investigation of the WFC incident is ongoing. 7.5.1 Texas State Fire Marshal’s Office (SFMO) The SFMO 287 served as the lead Texas investigatory agency for the WFC incident, working in collaboration with ATF.288 On May 15, 2014, the SFMO released its line-of-duty deaths investigation of the West, Texas, incident, “Firefighter Fatality Investigation” (Investigation FFF FY 13-06).289 The SFMO report described the incident and issued recommendations focused on the emergency response to the WFC incident, including the conditions that led to the fire and explosion. The report indicated that the firefighters at West were not prepared for what they faced on the night of April 17, 2013. Also, the

285 Section 8.7.3 of this report discusses the Athens City ordinance in detail. 286 Section 8.7 of this report addresses state and local regulatory developments (post-West, Texas, and Athens, Texas, incidents). 287 See: http://www.tdi.texas.gov/fire/documents/fmohistory.pdf (accessed on December 28, 2015). 288 Section 1.2.1 of this report addresses the ATF investigation. 289 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 137 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SFMO highlighted that the emergency responders were victims of a “systemic deficiency in the training and preparation” of the WVFD, attempting to put out a fire that was beyond its incipient stage290 and could no longer be extinguished. The report also included findings related to training and operational best practices for firefighters. On page 47, the SFMO report identified training deficiency as a key finding: The State of Texas has not adopted minimum training standards for volunteer fire departments; however, all fire department members must be properly trained and qualified to perform their assigned duties. Members who are authorized to work in high-level assignments (rank) must be trained and evaluated in performing those duties. All members must be periodically re-evaluated to ensure that they are capable of performing their assigned duties safely and effectively.291 The SFMO firefighter fatality report on the WFC incident further proposed several recommendations based on training of firefighters, including establishment of “realistic training and educational requirements for all positions and ranks and a promotional process that ensures that ranking members demonstrate a progressive knowledge, skill, and ability to perform their assigned duties and responsibilities according to their position in the organization.” The SFMO report concludes by recommending that “fire departments should develop standard operating guidelines and appropriate training involving those critical findings specific to incident command, strategy and tactics, and firefighter safety.”292 The SFMO report findings and recommendations are similar to those of CSB in this report with regard to the emergency response in West. Section 7.2 of this report describes in detail pre-incident planning, fire scene risk assessment, and development of a clearly defined incident command structure for emergency situations.293 7.5.2 NIOSH Findings and Recommendations In 1998, the U.S. Congress funded NIOSH to establish the Fire Fighter Fatality Investigation and Prevention Program, which investigates on-the-job fatalities of firefighters and provides improvement recommendations to the profession.294 On November 12, 2014, NIOSH released its report on the emergency responder fatalities caused by the WFC explosion.295 The report, “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an FGAN Explosion at a Fertilizer Plant Fire–Texas,” identified contributing factors to the firefighter fatalities, specifically failure to recognize hazards associated with FGAN, limited pre-incident planning of the commercial facility, quick spread of the fire

290 The term “incipient” has been widely used in the firefighting community and in various fire codes, including NFPA codes. However, CSB believes that it could be easily misinterpreted and imposes on firefighters a responsibility to make a subjective determination regarding the seriousness of a fire. 291 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015). 292 Ibid. 293 Section 7.1 of this report considers the firefighter response and Section 7.2 discussed details of factors contributing to the firefighter and other emergency responder fatalities in West, Texas. 294 See: www.cdc.gov/niosh/fire (accessed on December 28, 2015). 295 See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 138 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to uncontrollable size, unexpected detonation of approximately 40 to 60 tons of solid FGAN, emergency responders working within the blast radius at the time of the explosion, and large non-sprinklered wood construction in the commercial structure.296 In addition, NIOSH issued recommendations to prevent a similar incident from recurring. Recommendations included pre-incident planning inspections of facilities within the jurisdiction of a fire department; development of a written risk management plan; fire department use of risk management principles at all structure fires, especially for incidents involving high-risk hazards; development, implementation, and enforcement of a written incident management system to be applied during all emergency incident operations; standards for firefighters to wear a full array of turnout clothing and personal protective equipment (PPE) appropriate for the assigned tasks; and firefighter training that meets or exceeds NFPA 1001 (Standard for Fire Fighter Professional Qualifications). CSB concluded that most of the key contributing factors and recommendations cited by NIOSH in its WFC incident investigation report are similar to those of CSB.297 7.6 Summary of Incident Emergency Response CSB found no evidence of pre-incident planning addressing the likelihood of a fire involving FGAN at the WFC facility. As a result, the firefighters who responded to the WFC fire did not take the time to critically assess the situation on the ground before the explosion occurred. Senior emergency response personnel from the WVFD arrived at the scene of the incident at different times, and firefighters who were ICS trained and certified in the NIMS process did not assume the role of IC to establish, implement, and coordinate an incident command structure and incident management system for the fire emergency. The firefighters did not fully understand the hazards of FGAN detonation and consequently shifted their firefighting tactics to strategies to ensure that the anhydrous ammonia tanks onsite did not rupture. Also, the emergency response personnel at West did not take the time to implement an incident management system plan, which would have facilitated the prompt and proper evacuation of the nearby residents. The volunteers who responded to the WFC facility fire did not have sufficient HAZMAT training to make an informed decision on how best to respond to the fire at the fertilizer facility. Furthermore, lessons learned from previous firefighter fatalities and emergency responses to FGAN-related incidents were not effectively disseminated to firefighters and emergency responders in other communities, such as West, where FGAN is stored or used. A review of firefighter training courses, information in emergency response guides, manufacturers’ manuals, and other information available to emergency responders concerning AN-related fires at incident sites confirms that such materials place little emphasis on how to effectively respond to fire

296 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

1. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

297 Ibid.

West Fertilizer Company Final Report January 2016 139 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incidents involving the handling and storage of FGAN and might altogether be insufficient to enable firefighters to recognize the potential magnitude of an FGAN explosion. The commonly used emergency response guides and manuals contain inconsistent information regarding the best response to FGAN- related fires. In a fire situation, an FGAN explosion could occur at any time, and without knowing how long an AN-related fire has been burning, firefighters might not be aware of how much time they have to make informed emergency response decisions before an explosion occurs. That is why in the DECIDE model widely used by HAZMAT responders, after it is determined that HAZMAT is present, the next step is to estimate likely harm, without intervention.298 Above all, the conditions under which FGAN might detonate when exposed to a fire are unpredictable and not clearly understood, and current guidance does not offer best practices to protect firefighters from FGAN fire and detonation hazards. 7.7 Firefighter Training Grants and Programs 7.7.1 Need for Training CSB found that currently no federal requirements compel municipal fire departments to develop site- specific pre-incident plans with businesses and chemical plants that process and store HAZMAT such as FGAN. To implement any reform in nationwide inspection of businesses and facilities storing hazardous chemicals, determining the number of fire departments and firefighters in the United States (especially in rural communities such as West, Texas) is important. In addition, it is important to understand how prepared fire departments and firefighters should respond to fires involving FGAN. Part of being prepared is being properly trained on the hazards surrounding a community. 7.7.1.1 U.S. Firefighter Statistics CSB conducted a review of firefighter statistics across the country at the time of the WFC fire and explosion. The review indicated that the majority of the nation’s firefighters are volunteers and that 85 percent of fire departments are composed of volunteer firefighters. In addition, the NFPA estimated the number of firefighters in the United States in 2013 at more than a million, including 345,600 career firefighters (31 percent of the total) and 786,150 volunteer firefighters (69 percent of the total).299 Approximately 95 percent of all volunteer firefighters serve in local fire departments that protect fewer than 25,000 people.300 More than half of these volunteer firefighters support small rural departments that protect fewer than 2,500 residents, such as the WVFD in West, Texas.301 At the end of 2012, an estimated 30,100 fire departments operated in the United States. Of these, 2,610 (9 percent of all departments) were composed of only career firefighters; 1,995 (7 percent) relied on mostly career

298 Ludwig Benner. “D.E.C.I.D.E in Hazardous Materials Emergencies.” See: http://www.henrycoema.org/EMA/HazMat_Training_Materials_files/DECIDE.pdf (accessed on January 8, 2016). 299 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 300 Ibid. 301 Ibid.

West Fertilizer Company Final Report January 2016 140 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters; 5,445 (18 percent) were supported by a mostly volunteer firefighting force; and 20,050 (67 percent) depended entirely on volunteer firefighters.302 Despite the fact that the majority of the nation’s firefighters are volunteers and that 85 percent of fire departments are composed of volunteers, no federal requirements mandate that VFDs work with businesses and chemical plants that process and store HAZMAT (such as FGAN) to develop site-specific pre-incident plans. 7.7.1.2 U.S. On-Duty Firefighter Fatalities Over the last few decades, the fire service industry has made notable advancements, including building code improvements, incorporation of sprinkler systems in commercial and industrial buildings, and development of improved personal protective gear and technologically advanced apparatus. In addition, several laws and programs have been implemented to improve firefighter health and safety in the United States.303,304,305 Despite these laws and improvements, many firefighters are injured or killed while on duty each year. The USFA has recorded the number of firefighter fatalities and conducted an annual analysis since 1977, noting almost 4,500 on-duty firefighter fatalities in the United States in the last 35 years.306 By the end of 2013, 101 firefighter fatalities were reported for the year nationally, including those in West, Texas; four Houston Fire Department firefighters who died while responding to a hotel fire on May 31, 2013; and 19 firefighters from the Prescott Fire Department who lost their lives while responding to a wildland fire in Arizona on June 30, 2013. The NFPA also publishes its own annual study detailing on-duty firefighter fatalities in the United States.307 The annual number of fatalities for volunteer firefighters is substantially higher than the annual number of fatalities for career firefighters (Figure 69).

302 NFPA, Fire Analysis and Research Division. “US Fire Department Profile 2012.” See: http://www.kolb.net/FireReports/2013/US_DeptProfile2012.pdf (accessed on December 28, 2015). 303 Fabio, A. et al. “Incident-level risk factors for firefighter injuries at structural fires.” Journal of Occupational and Environmental Medicine, 44(11) (2002): 1059–63. 304 NFPA. NFPA 1500: Standard on Fire Department Occupational Safety and Health Program. Quincy, MA: NFPA, 2013. 305 Moore-Merrell, L. et al. Contributing Factors to Firefighter Line-of-Duty Injury In Metropolitan Fire Departments in the United States. Emmitsburg, MD: USFA, 2008. 306 USFA. See: http://www.usfa.fema.gov (accessed on December 28, 2015). 307 NFPA. “U.S. Fire Service.” See: http://www.nfpa.org/research/fire-statistics/the-us-fire-service (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 141 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA)308 This discrepancy could be due to a number of factors, such as the larger population of volunteer firefighters (more than 67 percent of all firefighters nationwide) or the lack of standardized training requirements for volunteers. Of the 82 firefighter fatalities in 2012, 39 were volunteer firefighters (47.6 percent of the total), and 32 were career firefighters (39 percent of the total); in addition, four part-time wildland firefighters, three contract wildland firefighters, two paid on-call firefighters, one part-time (paid) firefighter, and one industrial firefighter lost their lives (1.2 percent of the total). CSB believes that adequate training is essential to reduce on-the-job firefighter fatalities, especially among volunteer firefighters who are not required to complete the same level of training as career firefighters. 7.8.1.3 U.S. Volunteer Firefighter Statistics A VFD is a fire department composed of volunteers, usually residents or nearby citizens, who perform fire suppression and other related emergency services for a local jurisdiction or community. The U.S. Department of Labor (DOL) classifies volunteer firefighters as firefighters who receive either no compensation or nominal fees (up to 20 percent of the compensation that a full-time firefighter would receive in the same capacity).309 DOL allows volunteer firefighters to receive benefits such as worker’s compensation, health insurance, life insurance, disability insurance, pension plans, length-of-service

308 See: http://nysfma.org/diyFiles/FirefighterFatalitiesinttheUS2013.pdf (accessed on December 28, 2015). 309 Dodge, G., and M. Mullarkey. Managing Volunteer Firefighters for FLSA Compliance: A Guide for Fire Chiefs and Community Leaders. Fairfax, VA: International Association of Fire Chiefs, 2006.

West Fertilizer Company Final Report January 2016 142 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

awards, and property tax relief. DOL also states that volunteer firefighters may be paid nominal fees on a per-call or per-shift basis or on the basis of various service requirements, but they may not be compensated based on productivity (such as receiving an hourly wage). Career firefighters are fully compensated for their services. Some volunteer firefighters might serve in a hybrid fire department that relies on both full-time and volunteer firefighters. In this approach, career firefighters can regularly staff a station for rapid response with needed apparatuses, and the volunteers can provide supplementary staffing and staff apparatuses before, during, and after an incident or while full- time career personnel are out of service for training. Moreover, volunteer firefighters can sometimes compose a group of part-time or on-call firefighters who have other occupations when not engaged in occasional firefighting. The West volunteer firefighters held other (full-time) jobs and were not financially compensated for their time. Some VFDs compensate their firefighters as employees during the time that they are responding to or attending to an emergency scene and possibly during training. An on-call firefighter can also volunteer time for other nonemergency duties, such as training, fundraising, and equipment maintenance. In addition to fundraising, fire departments and emergency response services often seek alternative sources to support and fund their daily operations and long-term plans. Federal and state funding is available through grants from DHS and FEMA to assist emergency responders and fire departments in addressing EMS and firefighter-related needs such as training and equipment procurement and maintenance. National programs that support the need for emergency preparedness, including firefighter training, are discussed in the next section of this report. 7.7.2 National Firefighter Training Funds and Programs 7.7.2.1 U.S. Department of Homeland Security (DHS) DHS was formed after the terrorist attacks of September 11, 2001, as part of a national effort to safeguard the United States against terrorism. The mission of DHS includes preventing terrorism and enhancing security, managing U.S. borders, administering immigration laws, securing cyberspace, and ensuring disaster resilience. DHS also provides the coordinated comprehensive federal response in the event of a terrorist attack, natural disaster, or other large-scale emergency while working with federal, state, local, and private sector partners to ensure a swift and effective recovery effort. DHS builds a ready and resilient nation through efforts to accomplish the following: • Bolstering information sharing and collaboration. • Providing grants, plans, and training to homeland security and law enforcement partners. • Facilitating rebuilding and recovery.310 Although the scope of DHS is expansive, it contains many components, including FEMA, where much of the federal funding flows to various FEMA programs that assist in elements of national resiliency, such as

310 See: http://www.dhs.gov/building-resilient-nation (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 143 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

rebuilding and recovering after a disaster (such as the West, Texas, incident) or encouraging emergency response preparedness training. Federal Emergency Management Agency (FEMA) FEMA was created in 1979 in an effort to coordinate the federal government’s role in preparing for, preventing, mitigating the effects of, responding to, and recovering from all domestic disasters, whether natural or man-made, including acts of terror.311 On March 1, 2003, FEMA became part of DHS, and FEMA’s Office of National Preparedness was given responsibility for helping to ensure that the nation’s first responders were trained and equipped to deal with WMD along with other types of disasters. FEMA supports preparedness by developing policies; ensuring that adequate plans are in place and are validated; defining the necessary capabilities required to address threats; providing resources and technical assistance to state, local, tribal, and territorial partners; and integrating and synchronizing preparedness efforts throughout the nation. DHS and FEMA achieve their mission of ensuring disaster resiliency partly by providing funding and support to various federal programs that are tasked with preparing the nation to respond to various hazards, such as community exposure to chemicals and hazardous materials. Fire departments use the programs to assist in developing a well-organized, equipped, and trained function for the communities they serve. CSB reviewed the nationwide funding mechanisms available to career and VFDs through DHS and FEMA. Volunteer firefighters similar to those who responded at West have access to these firefighting resource funds if they can demonstrate that they have a need for it. CSB examined whether federal and state funds could be allocated to fire departments to assist them in obtaining the training that firefighters need to address fires and explosions involving HAZMAT such as FGAN. Grants It is important to understand the process for allocating grants to emergency responders such as fire departments. First, this section discusses the application process for a DHS FEMA grant. Second, the FEMA Grant Programs Directorate (GPD), the program that administers these grants once they receive proposals from applicants for funding is discussed. Third, the DHS FEMA preparedness (non-disaster) grants are described. Fourth, the Assistance to Firefighter Grants (AFG) Program is discussed in detail and in relation to funding in Texas. Specifically, the AFG, Staffing for Adequate Fire and Emergency Response (SAFER) grants, and the Fire Prevention and Safety (FP&S) grants are examined. DHS FEMA Grants Application Process Often federal grant funding flows to the local level through the states. However, some states provide direct funding for emergency medical services (EMS), especially in rural areas. On the other hand, some states have no funding for local programs. Most SFMOs and EMS bureaus offer technical assistance to

311 See: http://www.fema.gov/about-agency (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 144 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

local agencies and subsidized training programs to first responders.312 A large portion of the federal grant budget is passed to the states through formula or block313 grants. The states then decide how to use the grant money. However, some direct federal grant programs are for fire departments and EMS agencies such as the AFG.314 Direct grants are given specifically to the applying agency, but pass-through grants315 require the state to apply to the federal government and then distribute grant money to agencies that request it. Project grants are the most common form of federal grant. Depending on the program requirements, EMS organizations gain access to the funds through a competitive bidding process. Application for a project grant does not guarantee an award, and the amount received by grantees is not predetermined by a formula.316 Although most DHS components possess some programs that support grants,317 FEMA has the majority of programs and funding.318 FEMA Grant Programs Directorate (GPD) The purpose of FEMA GPD is to strategically and effectively administer and manage FEMA grants to ensure critical and measurable results for customers and stakeholders. The mission is to manage federal assistance to measurably improve capability and reduce the risks that the nation faces in times of man- made and natural disasters. The focus of GPD is to provide customer service to all grantees as well as internal and external partners; establish and promote consistent outreach and communication with state, local, and tribal stakeholders; ensure transparency in the grant process; and enhance the nation’s level of preparedness and the public’s capability to prevent, protect, mitigate against, respond to, and recover from all hazards. GPD also holds program management responsibility for the suite of preparedness grants that included, and continue to include, the following goals and objectives: • Review, negotiate, award, and manage the FEMA preparedness grant portfolio. • Provide subject matter expertise in response to regional office and stakeholder inquiries. • Develop grant guidance. • Formulate risk methodology to support grant allocations. • Analyze investments. • Manage budget execution and formulation.

312 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012. 313 A block grant does not involve competition. The federal government distributes funds to the states based on an established formula. 314 The AFG Program is discussed in further detail in the Assistance to Firefighters Grant Program Section of this report. 315 Funds issued by a federal agency to a state agency or institution that are then transferred to other state agencies, units of local government, or other eligible groups, per the award eligibility terms. 316 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012. 317 DHS supports a wide variety of financial assistance, including post-disaster relief and resilience, preparedness, boating safety, cybersecurity, research, university centers of excellence, and assistance to firefighters. 318 See: http://www.dhs.gov/dhs-financial-assistance (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 145 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Provide the driving force for grant management initiatives through the strategic delivery of policy, training, systems, and data analysis.319 The GPD carries out its mission through three divisions, including the GPD Front Office, Grant Operations Division, and Preparedness Grant Division.320 The FEMA grants that pertain to firefighter training and emergency response are discussed in the Preparedness (Non-Disaster) Grants and Assistance to Firefighters Grant Program Sections of this report. Preparedness (Non-Disaster) Grants FEMA provides state and local governments with preparedness program funding in the form of Non- Disaster Grants to enhance the capacity of state and local emergency responders to prevent, respond to, and recover from a WMD terrorism incident involving chemical, biological, radiological, nuclear, and explosive (CBRNE) devices and cyber attacks.321 The Emergency Management Performance Grant (EMPG) Program is a preparedness grant that provides more than $350 million to assist local, tribal, territorial, and state governments in enhancing and sustaining all-hazards emergency management capabilities.322 Either the State Administrative Agency (SAA) or the state’s Emergency Management Agency (EMA) is eligible to apply directly to FEMA for EMPG Program funds on behalf of state and local EMAs.323 The fiscal year (FY 2015) EMPG Program will focus on planning, operations, equipment acquisitions, training, exercises, construction, and renovation to enhance and sustain the all-hazards core capabilities of state, local, tribal, and territorial governments.324 The period of performance for the EMPG Program is 24 months. In FY 2015, the EMPG Program allocated $20,163,325 to the state of Texas.325 Assistance to Firefighters Grant Program Within FEMA, the AFG Program consists of three types of grants326 that support improvements in training, staffing, and safety within fire departments. These grants include the AFG, FP&S grants, and SAFER grants:

319 See: https://www.fema.gov/grant-programs-directorate (accessed on October, 23, 2015). 320 The Preparedness Grant Division includes the Preparedness (Non-Disaster) Grants. 321 See: https://www.fema.gov/preparedness-non-disaster-grants (accessed on October, 22, 2015). 322 See: http://www.dhs.gov/news/2015/07/28/dhs-announces-grant-allocations-fiscal-year-fy-2015-preparedness- grants (accessed on October 22, 2015). 323 See: http://www.fema.gov/media-library-data/1427284579730- 8faafd19a62444a974429c3e12d803fa/FY2015EMPG_FAQ.pdf (accessed on December 28, 2015). 324 See: http://www.fema.gov/media-library-data/1438020444107- 4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on October 22, 2015). 325 See: http://www.fema.gov/media-library-data/1438020444107- 4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on November 25, 2015) 326 The AFG Program also includes Assistance to Firefighters Fire Station Construction Grants.

West Fertilizer Company Final Report January 2016 146 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• AFG. The primary goal of the AFG Program is to meet the firefighting and emergency response needs of fire departments and nonaffiliated EMS organizations. Since 2001, the AFG Program has helped firefighters and other first responders to obtain critically needed equipment, protective gear, emergency vehicles, training, and other resources needed to protect the public and emergency personnel from fire and related hazards.327 AFGs are awarded to fire departments, state fire training academies, and EMS organizations. • SAFER Grants. The SAFER Grants were created to provide funding directly to fire departments and volunteer firefighter interest organizations to help them increase the number of trained frontline firefighters available in their communities. The goal of SAFER is to enhance the local fire departments’ capabilities to comply with staffing, response, and operational standards established by the NFPA (NFPA 1710, NFPA 1720, or both).328 • FP&S Grants. The FP&S Grants are part of the AFG Program and support projects that enhance the safety of the public and firefighters from fire and related hazards.329 The primary goal is to reduce injury and prevent death among high-risk populations. In 2005, Congress reauthorized funding for FP&S Grants and expanded the eligible uses of funds to include firefighter safety research and development.330 In FY 2014, the AFG provided more than $300 million in grant money nationwide; of this $300 million, Texas received approximately $6.5 million. The AFG Program issued 2,243 individual grants nationwide, and of those, only 90 grants were to fire departments for the purpose of training firefighters.331 Moreover, in FY 2014, the AFG Program awarded grant money to 40 firefighting and EMS organizations in Texas to provide aid for much needed resources (Figure 70). Of those 40 Texas organizations, 20 career fire departments, but only 14 VFDs, were awarded funding through the AFG Program. The remaining six organizations include emergency service organizations and one state fire training academy. Notably, an interesting finding is that of the grants awarded in Texas, only one award was specific to training personnel while the majority of the awards were used to fund equipment, PPE, facility modifications, vehicle acquisitions, and wellness and fitness programs.

327 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 328 See: http://www.fema.gov/staffing-adequate-fire-emergency-response-grants (accessed on December 28, 2015). 329 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 330 See: http://www.fema.gov/fire-prevention-safety-grants (accessed on December 28, 2015). 331 See: http://www.fema.gov/assistance-firefighters-grants-award-year-2014 (accessed on October 21, 2015).

West Fertilizer Company Final Report January 2016 147 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Organization City State Program Award Amount Activity Breakdown Award Date Martindale Volunteer Fire Dept. Co. Martindale TX Operations and Safety $46,196.00 Personal Protective Equipment ($48,005) 4/24/2015 Northwest Rural Emergency Medical Services Association, Inc. Tomball TX Operations and Safety $160,572.00 EMS Equipment ($168,600) 4/24/2015 Sulphur Springs Fire Rescue Sulphur Springs TX Operations and Safety $57,143.00 Modify Facilities ($60,000) 4/24/2015 Devine Volunteer Fire and Rescue Department Devine TX Operations and Safety $23,982.00 Equipment ($24,056) 5/8/2015 Farmers Branch Fire Department Farmers Branch TX Operations and Safety $223,773.00 Personal Protective Equipment ($246,150) 5/22/2015 Frankston Volunteer Fire Department Frankston TX Operations and Safety $80,000.00

Equipment ($45,900) || Personal Protective Equipment ($38,100) 5/22/2015 City of Paris Fire Department Paris TX Operations and Safety $11,632.00 Equipment ($12,795) 5/29/2015 Commerce Fire Department Commerce TX Operations and Safety $153,048.00 Personal Protective Equipment ($160,075) 5/29/2015 Texas Engineering Extension Service (TEEX) College Station TX State Fire Training Academy $265,243.00 Equipment ($265,600) 6/19/2015 Hitchcock Volunteer Fire Department Hitchcock TX Operations and Safety $160,667.00 Personal Protective Equipment ($167,500) 7/3/2015 Leander Fire Department Leander TX Operations and Safety $22,719.00 Wellness and Fitness Programs ($6,540) 7/10/2015 San Marcos Fire Department San Marcos TX Regional Request $707,546.00 Equipment ($778,300) 7/10/2015 Troup Volunteer Fire Dept Troup TX Vehicle Acquisition $238,096.00 Vehicle Acquisition ($250,000) 7/10/2015 Bonham Fire Department Bonham TX Vehicle Acquisition $663,713.00 Vehicle Acquisition ($696,898) 7/24/2015 Glenn Heights Fire Department Glenn Heights TX Operations and Safety $78,858.00 Personal Protective Equipment ($82,800) 7/24/2015 Houston Fire Department Houston TX Operations and Safety $915,120.00 Training ($1,008,732) 7/24/2015 Itasca Fire Department Itasca TX Vehicle Acquisition $103,621.00 Vehicle Acquisition ($108,802) 7/24/2015 Burnet County Emergency Services District No. 9 Spicewood TX Operations and Safety $72,000.00 Personal Protective Equipment ($75,600) 7/31/2015 Apple Springs Volunteer Fire Dept Apple Springs TX Operations and Safety $53,143.00 Personal Protective Equipment ($55,800) 8/14/2015 Mic-County Volunteer Fire Department Lockhart TX Regional Request $399,637.00 Equipment ($423,600) 8/14/2015 Orange County Emergency Services District #1 Vidor TX Operations and Safety $173,993.00 Personal Protective Equipment ($191,392) 8/14/2015 Anna Fire Department Anna TX Operations and Safety $28,572.00 Modify Facilities ($30,000) 8/21/2015 Cash Fire Department Assoc. Inc. Greenville TX Operations and Safety $71,760.00 Equipment ($74,355) 8/21/2015 City of Palestine Fire Department Palestine TX Operations and Safety $170,667.00 Personal Protective Equipment ($179,200) 8/21/2015 City of Terrell Fire Department Terrell TX Operations and Safety $246,215.00

Modify Facilities ($65,700) || Personal

Protective Equipment ($139,500) || Wellness and Fitness Programs ($53,325) 8/21/2015 eastex freeway volunteer fire department humble TX Operations and Safety $73,119.00 Equipment ($80,430) 8/21/2015 Elm Mott Volunteer Fire and Rescue Elm Mott TX Operations and Safety $31,429.00 Equipment ($33,000) 8/21/2015 Kilgore Fire Department Kilgore TX Operations and Safety $158,364.00 Personal Protective Equipment ($174,200) 8/21/2015 Comanche Volunteer Fire Department Comanche TX Operations and Safety $116,071.00 Personal Protective Equipment ($121,374) 8/28/2015 Sanger Volunteer Fire Department Sanger TX Operations and Safety $36,364.00 Equipment ($40,000) 8/28/2015 Tarkington Volunteer Fire Department Cleveland TX Operations and Safety $62,858.00 Personal Protective Equipment ($66,000) 8/28/2015 Kingsville Fire Department Kingsville TX Vehicle Acquisition $362,728.00 Vehicle Acquisition ($399,000) 9/4/2015 Muenster Volunteer Fire Department Muenster TX Operations and Safety $78,572.00 Personal Protective Equipment ($82,500) 9/4/2015 Richland Hills Fire Rescue Richland Hills TX Operations and Safety $41,214.00 Equipment ($43,274) 9/4/2015 Stafford, City of Stafford TX Operations and Safety $152,728.00 Personal Protective Equipment ($168,000) 9/4/2015 Quitman Fire & Rescue Quitman TX Operations and Safety $111,429.00 Personal Protective Equipment ($117,000) 9/11/2015 CITY OF WEBSTER WEBSTER TX Operations and Safety $23,620.00 Equipment ($24,800) 9/18/2015 Garland Fire Department Garland TX Operations and Safety $18,730.00 Equipment ($20,400) 9/18/2015 Van Alstyne Fire Department Van Alstyne TX Operations and Safety $33,387.00

Modify Facilities ($23,500) || Equipment ($10,056) 9/18/2015 Centerville Volunteer Fire Dept., Inc Centerville TX Operations and Safety $97,381.00 Personal Protective Equipment ($102,250) 9/25/2015 $6,525,910.00 Assistance to Firefighters Grant Program (AFG) FY 2014 Award Recipients Last Updated: 9/25/2015 - www.fema.gov/firegrants/ TOTAL

Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA) In FY 2014, the awarded SAFER Grants totaled approximately $11.7 million to five fire departments in Texas to increase the number of trained firefighters; of these five departments, only one was a VFD (Figure 71). Similarly, the awarded FP&S Grants totaled approximately $1.5 million to two organizations in Texas, neither of which were fire departments, to support projects that enhance the safety of the public and firefighters from fire and related hazards (Figure 72).

West Fertilizer Company Final Report January 2016 148 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA)

Figure 72. FP&S Grant Recipients in Texas (Source: FEMA) On the basis of the analysis of the FEMA FY 2014 funding allocation to fire departments throughout the nation, it can be concluded that much of the grant monies went toward non training-related support. Given the constraints that many VFDs experience regarding funds to support training, fire departments should express a greater interest in also applying for federal grants for training purposes and not solely for supporting other firefighting-related needs such as equipment. For this reason, FEMA should develop a grant that specifically supports firefighter training needs and cannot be used toward funding other resource needs such as equipment or PPE. DHS FEMA Programs A general understanding of the intricate landscape of federal grant programs also enables a better understanding of many of the DHS and FEMA programs specific to training. This section describes the various components and programs that promote preparedness at a national level. First, the FEMA National Preparedness Directorate (NPD) serves as a mechanism for fostering programs and resources. Second, training programs reside within the National Training and Education Division (NTED). Third, the Homeland Security National Training Program (HSNTP) is positioned to create accessible training and specifically addresses national preparedness gaps. Fourth and fifth, the Center for Domestic Preparedness (CDP) and the Rural Domestic Preparedness Consortium (RDPC) are NTED training

West Fertilizer Company Final Report January 2016 149 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

partners. Sixth, the USFA role as a leader in firefighter training is reviewed. Each is discussed in detail in the rest of this section. National Preparedness Directorate (NPD) The NPD is an organizational component of FEMA that provides the doctrine, programs, and resources to prepare the nation to prevent, protect, mitigate, respond to, and recover from disasters while minimizing the loss of lives, infrastructure, and property.332 A variety of courses in all-hazards emergency planning and response constitutes a key aspect of building a culture of preparedness and involves training at many levels, including: • State, local, tribal, and territorial elected officials. • Emergency managers. • First responders. • Appropriate whole community members, such as volunteer organizations, Community Emergency Response Teams, Citizen Corps, and bystanders. • Other emergency responders. Through the NPD, FEMA has established and delivered effective training and professional education programs and developed a national certification system for overall emergency management competency and expertise. This work is accomplished by the National Emergency Training Center (NETC), CDP, and other training partners.333 National Training and Education Division (NTED) NTED serves the nation’s first responder community, offering more than 150 courses to help build critical skills that responders need to function effectively in mass consequence events. NTED primarily serves state, local, and tribal entities in 10 professional disciplines, but has expanded to serve the private sector and citizens as well. Instruction is offered at the awareness, performance, and management and planning levels. Emergency responders attend NTED courses to learn how to apply the basic skills of their profession in the context of preparing, preventing, deterring, responding to, and recovering from acts of terrorism and catastrophic events. Training partners or providers that develop and deliver NTED approved training courses include: • CDP. • Counterterrorism Operations Support. • Louisiana State University. • New Mexico Institute of Mining and Technology.

332 See: http://www.fema.gov/national-preparedness-directorate (accessed on December 28, 2015). 333 See: http://www.dhs.gov/topic/plan-and-prepare-disasters (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 150 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Texas Engineering Extension Service.334 • Transportation Technology Center, Inc. • University of Hawaii, National Disaster Preparedness Training Center. Other training partners, such as the following, have developed or are developing training courses for NTED: • BCFS Health and Human Services. • Frederick Community College. • International Association of Fire Fighters.335 • Naval Postgraduate School. • RDPC.336 NTED training partners deliver training at no cost to the individual or to the individual’s jurisdiction or agency. In some circumstances, with approval from the SAA state/territory training point of contact, Homeland Security Grant Program (HSGP) funds 337 may be used for overtime and backfill costs for those individuals attending NTED courses. Training providers have a limited supply of training for each state. Occasionally, a state exhausts the available free training. In these cases, NTED has an Excess Delivery Acquisition Program that allows NTED training partners to charge for course delivery when more sessions of a requested class are needed than the grant funds can accommodate. Select training partners potentially could support training firefighters on the hazards associated with FGAN fires, as discussed in further detail. NTED courses include multiple delivery methods, specifically instructor-led (direct), train-the-trainers (indirect), customized (conferences and seminars), and web-based deliveries. Instructor-led courses are offered in residence (i.e., at a training facility) or through mobile programs that deliver courses to state and local jurisdictions that request the training. While the GPD, Grant Operations Division manages, administers, and conducts application budget review, creates the award package, approves, amends and closes out awards, the NPD NTED holds programmatic responsibility for the HSNTP Continuing Training Grants (CTG) Program and also maintains the program management function and responsibilities throughout the life cycle of the awarded grant.338

334 TEEX currently has an 8-hour course delivered in any participating jurisdiction that focuses on training responders to meet the requirements established in NFPA 472, Chapter 4, “Competencies for Awareness Level Personnel,” and the OSHA 29 CFR 1910.120 (q)(6)(i) (a–f) First Responder Awareness Level competencies. This course takes an all-hazards approach to HAZMAT incidents. It provides participants with the knowledge to recognize the HAZMAT, protect themselves, notify others, and secure the scene. As part of a DHS FEMA funded HSNTP Cooperative Agreement, this course is available at no direct cost to state, county, and local government agencies. 335 Section 7.7.3.1 of this report provides additional information about the IAFF. 336 RDPC is discussed in further details in the Rural Domestic Preparedness Consortium Section of this report. 337 HSGP funds can be used to reimburse the state agency or local jurisdiction for delivery of, and attendance to, the course. 338 DHS, HSNTP, CTG Program. “Notice of Funding Opportunity.” DHS-15-NPD-005-000-01.

West Fertilizer Company Final Report January 2016 151 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Homeland Security National Training Program, Continuing Training Grants The FY 2015 HSNTP CTG program339 provides funding via cooperative agreements340 to training partners to develop and deliver training to prepare whole communities to prevent, protect against, mitigate, respond to, and recover from acts of terrorism and from natural, man-made, and technological hazards. An objective of the program is to create accessible training solutions to address specific national preparedness gaps across the country. For FY 2015, the total HSNTP funds available under the CTG Program is $11.521 million, to be used for training in the following focus areas: • Cybersecurity. • HAZMAT. • Countering violent extremism. • Rural training. The FY 2015 HSNTP CTG Program is an open and competitive funding opportunity, available to entities with existing programs or demonstrable expertise relevant to the focus areas in the funding opportunity announcement—including state, local, tribal, and territorial entities; nonprofit national associations and organizations; nonprofit higher education institutions; and nonprofits such as community and faith-based organizations. HAZMAT and rural training are two focus areas of interest to this investigation because fire departments with HAZMAT or FGAN facilities in their jurisdiction (or those in rural341 locations) can apply for this grant since they fall under these focus areas. Within the HAZMAT focus area, departments are required to identify current and emerging national gaps in HAZMAT incident planning, response, and recovery as well as the training solutions to address these gaps. The FY 2015 HSNTP CTG Program prescribed the following standards related to HAZMAT training: NFPA standards, including NFPA 472 (Standard for Competence of Responders to Hazardous Materials /Weapons of Mass Destruction Incidents), NFPA 473 (Standard for Competencies for EMS Personnel Responding to Hazardous Materials/Weapons of Mass Destruction Incidents), and 29 CFR 1910.120 (Hazardous Waste Operations and Emergency Response). In addition, Executive Order 13650, “Improving Chemical Facility Safety and Security,” and published reports from the Chemical Facility Safety and Security Working Group have been incorporated. The proposed training should address the following issues:

339 As appropriated by the Department of Homeland Security Appropriations Act, 2015 (Pub. L. 114-4) and authorized by the Implementing Recommendations of the 9/11 Commission Act of 2007 (Pub. L. 110-53) (hereafter the 9/11 Act), and the Homeland Security Act of 2002 (6 U.S.C. § 101 et seq.). 340 A legal instrument of financial assistance between a federal awarding agency or pass-through entity and a non- federal entity that is consistent with 31 U.S.C. 6302–6305. 341 The U.S. Census Bureau defines rural areas as all areas not meeting the following definition of a metropolitan area: Metropolitan statistical area (MSA) must include at least one city with 50,000 or more inhabitants or an urbanized area with at least 50,000 inhabitants and a total MSA population of at least 100,000.

West Fertilizer Company Final Report January 2016 152 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Planning, response and mitigation strategies, defensible critical decision making to save lives and property, and actions for fixed-facility spills and releases. • Increasing knowledge, skills, and abilities to achieve core capabilities of interdiction and disruption, on-scene security and protection, and operational communications and coordination to enhance a jurisdiction’s capability to mitigate and respond to HAZMAT incidents. • Responder health and safety to prepare for, respond to, and recover from HAZMAT incidents by including on-scene health risk assessments and hazard risk analysis, incident safety and health plans, air monitoring plans, PPE selection and use, and safe work practices. Many VFDs similar to the WVFD are situated in rural environments where the funding to support training is limited. The required training objectives for the rural training focus area include HAZMAT, mass fatality planning and response, crisis management for school-based incidents, development of emergency operations plans, railcar safety, agroterrorism and food and animal safety, and media engagement strategies for first responders.342 Center for Domestic Preparedness CDP opened in June 1998 as a training center for the nation’s emergency responders. The CDP mission is to train emergency response providers from state, local, and tribal governments as well as the Federal government, foreign governments, and private entities, as available. CDP training is also available for international, federal, and private sector responders who may participate if space is available on a fee-for- service basis. The scope of training includes preparedness, protection, and response. CDP provides onsite and mobile training at the performance, management, and planning levels while also facilitating the delivery of training by DHS training partners. DHS fully funds CDP training for state, local, and tribal responders. CDP has three distinct facilities that support training, specifically the Chemical, Ordnance, Biological, and Radiological Training Facility (COBRATF), Advanced Responder Training Complex (ARTC), and Noble Training Facility. The CDP COBRATF offers the only program in the nation featuring civilian training exercises in a toxic chemical agent environment, including biological materials. The advanced hands-on training enables responders to effectively respond to real-world incidents involving chemical, biological, explosive, or radiological materials or other HAZMAT. The ARTC provides responders with a realistic training environment to exercise the skills acquired during training. The CDP Noble Training Facility is the nation’s only hospital dedicated solely to preparing the health care, public health, and environmental health communities for mass casualty events related to terrorism or natural disasters. CDP’s federal training partners include agencies such as: • Emergency Management Institute (EMI). • National Fire Academy (NFA). • Federal Law Enforcement Training Centers.

342 DHS HSNTP CTP Program. “Notice of Funding Opportunity (NOFO),” DHS-15-NPD-005-000-01.

West Fertilizer Company Final Report January 2016 153 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Center for Disease Control and Prevention. • Veterans Administration. • DHS Office for Bombing Prevention. • Radiological Emergency Preparedness Program. • Department of Agriculture. • DHS Domestic Nuclear Detection Office. • Health and Human Services Division of Strategic National Stockpile. Rural Domestic Preparedness Consortium (RDPC) Rural emergency responders face unique challenges compared to their urban counterparts, such as limited access to funding for fundamental training. These challenges in providing consistent and high-quality training for first responders were recognized by Congress and DHS, which then established RDPC. Led by the Center for Rural Development, RDPC is a DHS-funded program providing training and resources to rural first responders. RDPC develops and delivers relevant all-hazards training specific to rural environments, and courses are offered both in person and online at no cost. To ensure that training directly reflects the needs of rural emergency responders, RDPC convenes a national rural preparedness summit and completes a biannual national survey of rural stakeholders. Data gathered from these activities are used to determine the type of training needs, level of need, and best delivery methods.343 U.S. Fire Administration (USFA) The USFA is currently an entity within FEMA. The USFA was established by the Federal Fire Prevention and Control Act of 1974. 344 The mission of the USFA is to provide leadership, coordination, and support for the nation’s fire prevention and control, fire training and education, and EMS activities and to prepare first responders and health care leaders to react to all-hazard and terrorism emergencies. One of USFA’s key objectives is to reduce the nation’s loss of life from fire while also reducing property loss and nonfatal injury due to fire.345 The USFA develops and delivers fire prevention and safety education programs in partnership with other federal agencies, the fire and emergency response community, media, and safety interest groups.346 The USFA collaborates with public and private groups to promote and improve fire prevention and life safety through research, testing, and evaluation. The USFA manages many of the federal programs related to firefighting, including the National Fire Incident Reporting System, a dataset and collection of statistical

343 See: https://www.ruraltraining.org/about/overview/ (accessed on October 21, 2015). 344 The U.S. Congress passed P.L. 93-498, the Federal Fire Prevention and Control Act, in 1974, which led to establishment of the USFA and the NFA. See: http://legcounsel.house.gov/Comps/FIREPREV.PDF (accessed on December 28, 2015). 345 See: https://www.fas.org/sgp/crs/homesec/RS20071.pdf (accessed on December 28, 2015). 346 See: http://www.usfa.fema.gov/about/index.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 154 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information relating to fire incidents, public fire education campaign materials, and information on grants and funding. The USFA oversees the NFA at the NETC in Emmitsburg, Maryland. The NFA works to enhance the capability of fire and emergency services and allied professionals to deal more effectively with fire- related emergencies. The NFA offers free training courses and programs on campus, online, and throughout the nation.347 The USFA offers federal funding and grants directly to local career fire departments and VFDs and unaffiliated EMS organizations to help address a variety of equipment, training, and other firefighter and EMS-related needs. The grants are provided through the Fire Act Grants under the FEMA AFG Program, FP&S Grants, and SAFER Grants, which provide grants for hiring, recruiting, and retaining firefighters.348 349 Firefighters often dedicate personal time for training, public education, fundraising, and other nonemergency department-related activities. In addition, they are often members of their local or national firefighter associations. 7.8.2 Texas Firefighting Training Organizations and Programs CSB reviewed the availability of national firefighter training grants and programs. The review revealed that career and volunteer firefighters and fire departments have access to many federally funded training grants and programs throughout the nation. Moreover, CSB reviewed state-level funding and programs available to Texas firefighters and fire departments in an effort to determine how access to HAZMAT and FGAN-specific training can be increased while also improving training standards for FGAN. Select state resources—such as the Texas Commission on Fire Protection (TCFP), Texas Rural Volunteer Fire Department Assistance Program, SFFMA, and Texas A&M Engineering & Extension Services (TEEX) are discussed further. As a result, CSB issues recommendations to some of these state resources, which are identified in Section 11. 7.7.2.2 Texas Commission on Fire Protection (TCFP) The TCFP, a state government agency, is one of many state and local agencies that compose the Texas fire protection community. The commission’s statutory authority and role within this community is to serve Texas fire departments as follows: • Provide training guidelines and assistance to the fire service. • Establish and enforce statewide fire service standards.350

347 See: http://www.usfa.fema.gov/training/nfa/ (accessed on December 28, 2015). 348 See: https://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 349 The AFG, FP&S Grants, and SAFER Grants are discussed in the Assistance to Firefighters Grant Program Section of this report. 350 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on November 13, 2015).

West Fertilizer Company Final Report January 2016 155 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An important TCFP characteristic is its service to regulated organizations, including paid fire departments and those volunteer departments that choose to be voluntarily regulated. The policymaking body of the TCFP is a 13-member board appointed by the governor and confirmed by the Texas Senate. The commissioners adopt policies in accordance with Chapter 419 of the Texas Government Code. Upon adoption by the TCFP, these policies become state administrative laws collected under Part 13 of Title 37 of the Texas Administrative Code (TAC). The TCFP may propose or adopt changes to the TAC. The firefighter advisory committee351 is responsible for reviewing and commenting on the administrative rules that govern the state’s fire service and also assists the TCFP in matters relating to fire protection personnel, volunteer firefighters, fire departments, and VFDs.352 The advisory committee may submit new curricula (or changes to curricula) for study and review before approval by the TCFP. The commission often creates ad hoc advisory committees to assist in creating and updating curricula, validating test questions, and addressing other related matters. Members of the Texas fire service serve voluntarily on these committees.353 The goal of the TCFP compliance program is to ensure the safety of the state’s fire protection personnel by inspecting fire departments and other regulated entities to confirm that they are in compliance with state laws and rules. The compliance inspectors also inspect training records to ensure that fire protection personnel are in compliance with the appropriate certification rules for their disciplines. The commission’s compliance officers travel to every regulated entity at least once every 2 years to inspect fire protection personnel certifications, training records, breathing air test records, protective clothing, and self-contained breathing apparatus. If a fire department is found to be in violation of a state law or TCFP rule, the Compliance Section compels the department to correct the violation immediately or works with it to develop a plan that will lead to compliance.354 The TCFP certification program certifies approximately 32,000 fire protection personnel in Texas. State law requires paid fire protection personnel to be certified by this commission; volunteers and individuals not affiliated with a paid or volunteer department can voluntarily choose to be certified by TCFP. The commission certifies fire protection personnel to multiple levels (basic, intermediate, advanced, and master) in several different disciplines.355 In addition, TCFP certifies training facilities. When fire departments have unmet training needs, TCFP may take a number of actions: • Authorize reimbursement for a local government agency for training program expenses. • Provide staff or educational materials on request to training programs or fire departments.

351 The firefighter advisory committee is created by the TCFP enabling statute, Chapter 419 of the Government Code. The TCFP appoints members. See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm#419.023 (accessed on December 28, 2015). 352 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 3, 2015). 353 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 13, 2015). 354 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on October 27, 2015). 355 Including structure fire protection, aircraft rescue fire protection, marine fire protection, fire inspector, fire and arson investigation, HAZMAT technician, pumper driver and operator, fire instructor, fire officer, and head of department.

West Fertilizer Company Final Report January 2016 156 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Establish minimum curriculum requirements for courses in schools operated by state or local governments. • Provide training assistance to fire departments through the following methods:  Purchase and provide training aids to fire departments, temporarily or permanently.  Finance training seminars for fire departments.  Pay instructor fees to teach specialized courses for fire departments that employ fully paid fire protection personnel.356 Although these four elements are cited in the TCFP statute (Section 419.028), the commission is no longer funded for the type of assistance provided by authorizing reimbursements or delivering training. The TCFP funding program that offers this type of training assistance to fire departments was transferred to the Texas A&M Forest Service in 2009.357 TCFP’s Certification Curriculum Manual supplies the curriculum for the training of structural fire suppression personnel, aircraft rescue fire protection personnel, and marine fire protection personnel as well as fire inspectors, fire investigators, HAZMAT technicians, pumper drivers and operators, fire instructors, fire officers, and wildland firefighters. 358 The Certification Curriculum Manual’s Hazardous Materials Awareness chapter was updated in June 2015. This chapter of the manual includes course material on Class 5 oxidizing substances and organic peroxides; this class includes AN.359 The curriculum sets the minimum standards for materials covered in the course; however, instructors decide whether to go into further detail within specific topic areas such as AN. The TCFP may consult and cooperate with a local governmental agency, other governmental agency, university, college, junior college, or other relevant institutions concerning the development of training schools and associated programs of courses of instruction for fire protection personnel, including the preparation or implementation of continuing education or training programs.360 The TCFP has entered into a memorandum of understanding (MOU) with TEEX361 to coordinate each organization’s training responsibilities. In addition, the TCFP has an MOU with the Texas A&M Forest Service to coordinate the provision of training assistance and other assistance to firefighting entities. The Texas A&M Forest Service consists of many programs directed to VFDs to enhance the ability of firefighters to protect themselves and the public from fire-related hazards. One such program within the Texas A&M Forest Service that supports volunteer firefighter training is discussed in more detail in the next section.

356 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on October 28, 2015), Section 419.028 through Section 419.031. 357 The Rural VFD Assistance Program in the Texas A&M Forest Service is discussed further in Section 7.7.4 of this report. 358 See: http://www.tcfp.texas.gov/manuals/curriculum_manual.asp (accessed on October 28, 2015). 359 See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on October 28, 2015). 360 Section 419.030. 361 Section 7.7.2.5 discusses TEEX in further detail.

West Fertilizer Company Final Report January 2016 157 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7.2.3 Texas Rural Volunteer Fire Department Assistance Program (HB 2604)

In a January 2015 interim report by the Texas Committee on Homeland Security and Public Safety, Chairman Joe Pickett (D-El Paso) submitted recommendations to, and drafted legislation for consideration by, the House of Representatives, 84th Texas Legislature.362 The committee’s report indicates that of the 40 fire departments that represent the authority with jurisdiction for the 43 FGAN facilities across the state, 27 are VFDs; 7 are a combination of paid and volunteer firefighters; and 6 consist only of paid firefighters. A recommendation that stemmed from this finding encouraged the legislature to approve a rider in the Appropriations Bill for Texas A&M Forest Service that addresses funding in the Rural Volunteer Fire Department (Rural VFD) Assistance Program. The purpose of this funding is to provide training for VFDs across the state that are in a jurisdiction with an FGAN facility.363 The 77th Texas Legislature passed House Bill 2604 in 2001, establishing the Rural VFD Assistance Program.364 The primary goal of the VFD Assistance Programs is to enhance the emergency response capabilities of volunteer and combination fire departments with 20 or fewer paid members.365 The Texas Rural VFD Assistance Program provides funding to rural VFDs for the acquisition of firefighting vehicles, fire and rescue equipment, protective clothing, dry hydrants, computer systems, and firefighter training. This cost-share program is funded by the Texas State Legislature. Beginning on September 1, 2015, the annual grant budget for the program increased to $24.3 million from the previous annual budget of $12.8 million. Cost share assistance for training tuition has increased after changes to the Rural VFD Assistance Program that also took effect on September 1, 2015. The new reimbursement rate is 100 percent of the actual cost of tuition, not to exceed $125 per day up to a maximum of $625 per trainee per school. The annual maximum for training tuition grant assistance per fire department is $12,500.366 The Texas A&M Forest Service conducted a funding meeting for FY 2015 on March 11, 2015, to determine how grants would be awarded. During this meeting, approximately $1.4 million in grants was awarded to Texas VFDs. Two VFDs in McLennan County, Texas, were approved for funding, and one is the WVFD, approved for $8,000 for a training library (Table 10).367 All VFDs that apply for state grants,

362 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-Homeland- Security-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015). 363 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-Homeland- Security-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015): 22–24. 364 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New_- _Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 13, 2015). 365 See: http://texasforestservice.tamu.edu/content/article.aspx?id=19857 (accessed on October 28, 2015). 366 See: http://texasforestservice.tamu.edu/uploadedFiles/TFSMain/Preparing_for_Wildfires/Fire_Department_Programs/Lo cal_Volunteer_Fire_Department_Programs/Rural_VFD_AssistanceProgram/Special%20Announcement%20-- %20Program%20Changes%20FY16(1).pdf (accessed on October 27, 2015) 367 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New- _Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 16, 2015).

West Fertilizer Company Final Report January 2016 158 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

including matching federal funds, must certify that they have adopted NIMS. Before the WFC incident in December 2012, the WVFD had requested funds through the Rural VFD Assistance Program for a large brush truck, but the request was not approved. The WVFD requested this funding every year thereafter, although it did not meet the NIMS certification requirement.368 Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program Date Approved Equipment/Training Category Approved Amount January 2003 Truck Chassis Large $40,000 May 2004 C/S Structural Gear $6,000 September 2008 Wildland Gear $5,700 March 2015 Training Library $8,000

The SFFMA of Texas was instrumental in the creation of House Bill 2604, which annually distributes grant funding through the Texas Forest Service to fire departments in need. Similar to the TCFP, the SFFMA assists many volunteer firefighters and fire departments in obtaining training. 7.7.2.4 State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA) Organized in 1876, the SFFMA is Texas’s oldest and largest fire association serving the fire and emergency service responders of Texas. The SFFMA has the support of more than 1,200 fire departments, 22,000 individual members, 80 industrial fire brigades, and EMS and international departments. The association is active in legislative efforts that affect the fire service in Texas.369 The SFFMA is a fee-based membership organization that offers individual and fire department memberships,370 and has partnered with the National Volunteer Fire Council (NVFC)371 to provide joint benefits to their members. The SFFMA consists of a volunteer firefighter certification program that encourages VFDs to initiate the program in an effort to upgrade training standards. A VFD must be a member of the SFFMA to participate in the certification programs. Through the program, the fire department’s selected

368 See: http://tfsweb.tamu.edu/HistoricalFunding/ (accessed on November 17, 2015). 369 See: http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9- 7ae03d5685dd (accessed on October 29, 2015). 370 The fire department membership dues are based on the Federal Census population of the cities and towns that they serve. 371 NVFC is discussed in further detail in Section 7.7.3 of this report.

West Fertilizer Company Final Report January 2016 159 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

certification coordinator is required to attend a free certification workshop at least once every 2 years. The certification workshop is a requirement to maintain the departments’ participation status. The certification coordinator validates that all training and certifications meet state criteria; it is the coordinator’s responsibility to document the training and ensure that a qualified instructor has conducted the training. To verify that a department holds continual training and correctly maintains its records, the coordinator must submit an annual training summary or progress report.372 The SFFMA Certification Board sets the criteria for the training curriculum; however, it does not develop topic- specific training modules for firefighters and departments. The SFFMA relies on firefighter training schools, approved training providers, or certified training instructors to administer the training. The SFFMA Program allows individual departments and their members to decide how far they will go in the process. The process levels include NFPA 1403, Introductory; NFPA 1001, Firefighter I; NFPA 1001, Firefighter II; and Master certifications.373 Currently, the SFFMA does not have an exclusive program that certifies firefighters on HAZMAT or AN; however, part of the certification for the Firefighter I program includes a section on HAZMAT.374 As part of the minimum standards for firefighter certification, the section designates that trainees recognize the hazard classes and divisions of HAZMAT and WMD375 and identify common examples of materials and primary hazards in each hazard class or division, such as Class 5 oxidizers.376 The SFFMA Texas Industrial Emergency Services Board (TIESB) provides guidance for the Texas Industrial Fire Protection Program. The TIESB works with the Texas Chemical Council and the National Petroleum Refiners Association in reviewing differences among various industries in training needs for all emergencies and loss prevention programs. The TIESB has many objectives, including promoting the development of fire training and loss prevention programs for industrial firefighters or members of the SFFMA and also recommending for each member industry-minimum criteria for maintaining effective fire training, loss prevention, and educational programs.377 Currently, the TIESB has a certification program for industrial HAZMAT teams and emergency response personnel378 that establishes minimum criteria for certification but also provides flexibility so that each facility can structure its training programs to address individual needs. The TIESB has formally adopted NIMS, designating it as the incident management system for all members seeking certification of their training programs.379

372 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Navigating_Cert_2015_Apr.pdf (accessed on November 2, 2015). 373 See: http://www.sffma.org/WEB/SFFMAPages/Certification/Resources/Certification_FAQ.pdf?WebsiteKey=65a2a6d5- cf92-4d26-8251-b69cdeecaa68&hkey=1509bff9-ad5b-411d-904d-9de79e384a6d (accessed on October 30, 2015). 374 Of the 22 sections in the program, Section 18 covers HAZMAT. 375 NFPA 472, Section 4.2.1: 2, 3. 376 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Full_Program_2015_02.pdf (accessed on October 29, 2015): 61. 377 See: http://www.sffma.org/web/SFFMA/Divisions/Industrial/SFFMA/TIESB.aspx?hkey=60a9d6ce-7f4f-4d91- b642-d41585bf3597 (accessed on October 30, 2015). 378 Training program certification is for HAZMAT Technician, Specialist, and Incident Command levels. 379 See: http://www.sffma.org/web/SFFMAPages/TIESB/Policy_Docs/TIESB010.pdf (accessed on October 30, 2015).

West Fertilizer Company Final Report January 2016 160 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Within Texas, multiple organizations support firefighter standards for training curricula and certification. These organizations work with training partners such as TEEX in the development of course curricula and the implementation of training programs that suit the diverse needs of fire departments. 7.7.2.5 Texas A&M Engineering Extension Services (TEEX) In 1929, the State Firemen’s and Fire Marshals' Association of Texas (SFFMA) selected Texas A&M College as the site for a permanent firefighter training school. In 1931, the Texas Legislature authorized the creation of a Firemen’s training school by passing House Bill No. 921. This bill authorized Texas A&M to create, conduct and maintain a Firemen’s training school. A member of The Texas A&M University System, the Texas A&M Engineering Extension Service (TEEX) has more than 80 years of experience in providing professional services with expertise in national and industrial security, emergency preparedness and response, public infrastructure, occupational safety, economic development, and technology assessment and validation. TEEX employees nearly 1,000 experts in various fields and is able to develop training solutions for emergency responders across the state and nationwide. Funding for Texas agencies and fire departments is available from several sources to support TEEX tuition, fees, and other related expenses. TEEX encourages fire departments to take advantage of federal funding programs such as those in DHS FEMA as well as no-cost training in Texas through the fire extension services, NFA, area schools, and other assistance programs and associations.380 TEEX tailors need-specific services and training at a number of its facilities and also at customer-specified locations worldwide. TEEX has the ability to offer a full-range of services and delivery methods, including: • Course design and development. • Online course delivery. • Hosting services for eLearning courses. • Classroom-based instruction. • Hands-on skills-based instruction. • National certification testing. • Technical assistance and technology validation. • Bilingual training and translation services. TEEX collaborates with resources within The Texas A&M University System to provide a unique blend of research and technical expertise. The TEEX Emergency Services Training Institute’s (ESTI) main training facility is the Brayton Firemen’s Training Field. Adjacent to this facility is Disaster City®, which is comprised of 296 acres in College Station, Texas, making it the world’s largest, most comprehensive campus for first responders. Each year thousands of students participate in ESTI’s hands-on training in firefighting, emergency medical services, hazardous materials, rescue, Incident Command, and

380 See: https://teex.org/Pages/about-us/funding-grants.aspx (accessed on November 6, 2015).

West Fertilizer Company Final Report January 2016 161 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

specialized programs. ESTI offers over 200 different courses in more than 130 specialty areas to students from across Texas, the United States and around the world.381 In FY15 TEEX/ESTI provided training for some 96,364 students in 3,670 separate classes which accounted for 1.625 million man contact hours. During the course of FY15 training, all 254 Texas Counties were served including 92% of all Texas Communities. TEEX/ESTI also trained students from 81 foreign countries during FY15. TEEX receives General Revenue from the State of Texas to provide outreach or extension training to the States Emergency Responders. In FY15, more than 20,000 responders of the State trained through this program at no cost to them or their department. Through its accreditation with the National Professional Qualification System (NPQS), or ProBoard, TEEX/ESTI is authorized to offer certification training in compliance with National Fire Protection Association (NFPA) standards.382ESTI is currently accredited to provide certifications in 46 individual disciplines. TEEX/ESTI currently leads the nation in the number of ProBoard certifications issued on an annual basis. The certification levels TEEX/ESTI offers include: • NFPA 1001 Fire fighter I & II. • NFPA 1002 Driver/Operator Pumper, Aerial, ARFF, Mobile Water Supply. • NFPA 1003 Airport Firefighter. • NFPA 1006 Rescue Technician - Rope Rescue I, II; Trench Rescue I, II; Confined Space Rescue I, II; Wilderness Rescue I, II; Vehicle & Machinery I, II; Structural Collapse I, II. • NFPA 1021 Fire Office I – IV. • NFPA 1031 Fire Inspector I & II, Plans Examiner I. • NFPA 1041 Fire Instructor I & II. • NFPA 1061 Public Safety Telecommunicator I & II. • NFPA 1081 Fire Brigade - Incipient, Advanced Exterior, Interior Structural, Leader. • NFPA 472 Hazardous Materials - Awareness; Operations Core; Operations Mission Specific: PPE, Product Control, Air Monitoring & Sampling, Response to Illicit Laboratory Incidents; Technician; Technician w/ Tank Car Specialty; Technician w/ Cargo Tank Specialty; Technician w/ Intermodal Tank Specialty; Technician with Flammable Liquids Bulk Storage Specialty; Incident Commander. ESTI supports FEMA’s HSNTP with the delivery of over twenty different courses across the nation with topics that range from tactical level, Wide Area Search and WMD Defensive Operations to simulation- driven incident management courses to executive-level workshops and seminars. In addition, ESTI provides technical assistance, exercise planning expertise and event review and After-Action Report support to organizations across the nation. Throughout the year, TEEX hosts full-scale operational readiness exercises (OREs) that test a team’s entire response capabilities.

381 See: https://teex.org/Pages/about-us/disaster-city.aspx (accessed on December 31, 2015). 382 See: https://teex.org/Pages/Program.aspx?catID=613&courseTitle=Pro%20Board (NPQS) (accessed on December 31, 2015).

West Fertilizer Company Final Report January 2016 162 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

TEEX/ESTI provides many DHS FEMA funded training programs that can be delivered online, face to face, or in a combination format. One such training program funded by DHS FEMA involves HAZMAT response; this training is geared toward emergency responders and focuses on the special challenges of dealing with WMDs or a terrorist incident, including knowledge of CBRNE events and responses to incidents involving CBRNE materials. The Standardized Awareness Training course focuses on training responders to meet competency requirements established in NFPA 472, Chapter 4, and in OSHA 29 CFR 1910.120. The course takes an all-hazards approach to HAZMAT incidents and gives participants the knowledge needed to recognize the hazardous material, protect themselves, notify others, and secure the scene. Another training program funded by DHS FEMA addresses incident management and response. These courses facilitate the implementation of the all-hazards multidisciplinary team-based approach outlined in the DHS National Response Framework, which is designed to respond to large-scale or expanding incidents, including those involving HAZMAT.383 In addition to the in-person training, ESTI offers a variety of web-based training, such as awareness-level courses and those within the innovative Online Recruit Academy. These interactive courses provide emergency responders with a convenient way to complete knowledge-based training at their own pace. There is an increasing need to provide training to responders who have the potential and will be expected to respond to Industrial Facilities/Industrial Emergencies in their area. There are multitudes of newly- introduced specialized hazards across the United States that First Responder communities have the potential to respond to. The increased potential for incidents to occur in these areas further highlights the need for all response and emergency management personnel be trained on how to properly preplan for, respond to, and mitigate these specialized incidents. Components of this training should address the preplanning, command, safety, operational, logistical, and local resource coordination and public information areas and should focus on assisting local responders in addressing key priorities and a safe outcome for their personnel. These hazards include emergencies that result from drilling and fracking operations, flammable liquid bulk storage facilities, transportation emergencies (pipelines, rail384, trucking, maritime, and air), and warehousing or storage of hazardous chemicals and materials such as FGAN. In light of these potential exposures to the response community, TEEX has developed a course entitled, “Industrial Emergencies for Municipal Based Responders” (IEMBR). This is a two-phased course with the awareness-level information contained in Phase I and the hands-on (firefighting and Hazardous Materials Response) contained in Phase II. TEEX is currently reaching out across the State of Texas and providing Phase I IEMBR training to first responders. Due to the complexity of the Phase II response scenarios and the

383 See: https://teex.org/Pages/Program.aspx?catID=469&courseTitle=Response- Hazardous%20Materials%20and%20Search%20and%20Rescue (accessed on November 6, 2015). 384 TEEX has also developed and is currently delivering a 24-hour Crude by Rail course. TEEX worked in corporation with rail service providers, owning companies and the response community to develop this course. It provides a detailed look at rail car construction, hazards associated with rail car emergencies, response plans, resource management and responder safety.

West Fertilizer Company Final Report January 2016 163 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

need for realistic training props, all Phase II training is conducted at the TEEX/ESTI Brayton Firemen’s Training Field. Phase II of the IEMBR course is more costly than Phase I due to the flammable liquid fuels, LPG and firefighting foams that are used as part of the training.385 There is a critical need to establish a funding mechanism for First Responders to attend IEMBR Phase II training. 7.7.3 National Membership Firefighter Associations Although several bodies represent the interests of firefighters and emergency responders, the three most prominent labor unions and associations for firefighters in the United States are the International Association of Fire Fighters (IAFF), NVFC, and IAFC. Combined, these three associations have more than a million members across the United States.386 An important aspect of the mission of each association entails providing training information and resources to members. 7.7.3.1 International Association of Fire Fighters (IAFF) The IAFF387 is a labor union that represents career firefighters in the United States and Canada. Established in 1918, the IAFF currently represents a membership of more than 300,000 professional firefighters in more than 3,200 fire departments. The IAFF acts to ensure that adequate resources and tools, including the development and implementation of new training and equipment, are provided to career firefighters and paramedics in all member fire departments. 7.7.3.2 National Volunteer Fire Council (NVFC) The NVFC is a nonprofit association that represents the interests of fire and emergency services at the national level by providing advocacy, information, resources, and programs to support volunteer first responders. The NVFC serves as the voice of the volunteer firefighter in the national arena and supplies tools, resources, programs, and advocacy for first responders nationwide. The NVFC also conducts national advocacy for first responders, including promoting legislation that benefits the fire and emergency medical services. The NVFC offers information, education, and training for volunteer fire and EMS organizations throughout their respective states.388 7.7.3.3 International Association of Fire Chiefs (IAFC) The IAFC represents the leadership of firefighters and emergency responders worldwide.389 With a network of more than 10,000 fire chiefs and emergency personnel, IAFC members include experts in firefighting, EMS, terrorism responses, HAZMAT spills, natural disasters, search and rescue operations, and public safety policy. The IAFC was established in 1873 to provide a forum for fire and emergency

385 See: https://teex.org/Documents/2014-04-firetalk.pdf (accessed December 31, 2015). 386 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 387 See: http://client.prod.iaff.org/#page=AboutUs (accessed on December 28, 2015). 388 NVFC. See: http://www.nvfc.org/ (accessed on December 28, 2015). 389 IAFC. See: http://www.iafc.org/About/?navItemNumber=537 (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 164 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

service leaders to exchange ideas, develop professionally, and identify the latest products and services available to first responders, including career and VFD chiefs.390 8.0 Regulatory Analysis Multiple federal, state, and local agencies regulate FGAN storage and handling, depending on statutory requirements, which can address worker safety, environmental protection, public safety, national security, and transportation. Requirements for reporting bulk quantities of FGAN also vary. CSB reviewed FGAN safety-related requirements in the United States and found differences in how FGAN facilities are identified and regulated. This section includes a discussion of the requirements for FGAN safety and security as well as voluntary efforts by industry, including: • President Obama’s Executive Order (EO) 13650 (Section 8.1). • OSHA Explosives and Blasting Agents standard (Section 8.2). • DHS Chemical Facility Anti-Terrorism Standards (CFATS) (Section 8.3). • OSHA Process Safety Management (PSM) standard (Section 8.4.1). • EPA Risk Management Program rule (Section 8.4.2). • EPA Emergency Planning and Community Right-to-Know Act (EPCRA) regulations (Section 8.5). • National fire protection standards and Texas fire codes (Section 8.6). • Post incident state and local regulatory developments (Section 8.7). • Voluntary industry initiatives (Section 8.8). Each of these sections includes background and analysis. The sections provide supporting information for the CSB recommendations in Section 11, which includes recommendations to regulatory agencies to revise existing standards so that they include FGAN-specific requirements. 8.1 President Obama’s Executive Order 13650 In the aftermath of the West Fertilizer Company (WFC) incident, President Barack Obama issued EO 13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013.391 The EO states that “…measures can be taken by executive departments and agencies with the regulatory authority to further improve chemical facility safety and security in coordination with owners and operators.”392 The EO established the Chemical Facility Safety and Security Working Group, which is co-chaired by the

390 According to its website, the mission of the IAFC is to provide leadership to current and future career, volunteer, fire rescue, and EMS chiefs; chief fire officers; and company officers and managers of emergency service organizations throughout the international community, using vision, information, education, services, and representation to enhance their professionalism and capabilities. See: http://www.iafc.org/About/index.cfm?navItemNumber=537 (accessed on December 28, 2015). 391 Executive Order 13650. “Improving Chemical Facility Safety and Security.” August 1, 2013. 392 Ibid.

West Fertilizer Company Final Report January 2016 165 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Secretary of Homeland Security, the EPA Administrator, and the Secretary of Labor.393 Working with multiple governmental agencies, the EO Working Group was tasked with improving operational coordination with state, local, and tribal partners; enhancing federal coordination regarding chemical facility safety and security; improving information collection and sharing; modernizing key policies, regulations, and standards; and identifying best practices.394 One of the group’s first deliverables, issued in August 2013, was the document, “Chemical Advisory: Safe Storage, Handling, and Management of FGAN.”395 The advisory summarized best practices for AN storage, lessons learned from past AN incidents, hazard information, hazard reduction options, emergency planning activities, emergency response operations, and information resources.396 In June 2015, the advisory was reissued as “Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills.”397 This advisory includes a more detailed and reorganized regulatory information section.398 It has been distributed by government agencies such as EPA and OSHA and by the two U.S. manufacturers of FGAN, CF Industries and EDC. In addition, in June 2014, the EO Working Group published “Actions to Improve Chemical Facility Safety and Security—A Shared Commitment: Report for the President.”399 That report summarized the EO Working Group’s progress, focusing on actions to date, findings and lessons learned, challenges, and high-priority next steps.400 The report includes an aggressive action plan that details specifically how the EO Working Group has begun to, or will, tackle each of its aforementioned tasks.401 8.2 OSHA Explosives and Blasting Agents Standard The 1971 OSHA Explosives and Blasting Agents standard (29 CFR 1910.109) regulates, in part, the storage, use, and transportation of explosives and blasting agents and specifies safety requirements for various grades of AN. The standard was based on two national consensus standards—NFPA402 495 (Code for the Manufacture, Transportation, Storage, and Use of Explosives and Blasting Agents, 1970

393 Ibid. 394 Ibid. 395 See: http://www.ctif.org/sites/default/files/news/files/fed_an_advisory-083013.pdf (accessed on December 28, 2015). 396 Ibid. 397 See: http://www.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on December 28, 2015). 398 Ibid. 399 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 28, 2015). 400 Ibid. 401 See: https://www.osha.gov/chemicalexecutiveorder/ (accessed on December 28, 2015). 402 NFPA codes, standards, and guides are voluntary consensus products that are not enforceable unless adopted into law.

West Fertilizer Company Final Report January 2016 166 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Edition), and NFPA 490 (Code for the Storage of Ammonium Nitrate, 1970 Edition).403 The first nine sections of OSHA’s Explosives and Blasting Agents standard, (a) through (h), cover the storage and transportation of explosives and blasting agents. The last two sections, (j) and (k), address small arms ammunition and the manufacture of explosives and pyrotechnics. AN is covered in the middle of the standard, under section (g) when it is used as a blasting agent404 and under section (i) when it is stored in the form of crystals, flakes, grains, or prills, including fertilizer grade, dynamite grade, nitrous oxide grade, technical grade, and other mixtures containing 60 percent or more AN by weight.405 Included in 29 CFR 1910.109(i) are requirements for storage, building construction, ventilation, and fire protection associated with bulk and bagged AN. These requirements cover facilities that store more than 1,000 pounds of AN.406 At the time of the incident, the WFC facility stored FGAN well in excess of 1,000 pounds. The standard includes various requirements for the bulk storage of AN.407 For example, the standard mandates that warehouses have “adequate ventilation or be capable of adequate ventilation in case of fire.”408 Also, storage bins must “be clean and free of materials which may contaminate AN.”409 Bins storing bulk quantities of AN may not be constructed with galvanized iron, copper, lead, or zinc “unless suitably protected,” and wooden bins “protected against impregnation by AN” are permitted.410 The partitions dividing AN storage from other products that would contaminate the AN must be of “tight construction.”411 To avoid potentially dangerous contamination, AN must be in a separate building or must be separated by “approved type firewalls of not less than 1 hour fire-resistance rating from storage of organic chemicals, acids, or other corrosive materials, materials that may require blasting during processing or handling, compressed flammable gases, flammable and combustible materials or other contaminating substances.”412 While CSB found no evidence to suggest that any detonation of AN in the United States has occurred at a facility compliant with OSHA’s 1910.109(i) standard, CSB does find that these requirements do not offer sufficient safeguards concerning the bulk storage of FGAN. This conclusion is evidenced best by the

403 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=19509 (accessed on December 28, 2015). The NFPA 490 standard went through several updates. The most recent edition was issued in 2002. In 2010, NFPA incorporated NFPA 490 into a more recently developed standard, NFPA 400 (Hazardous Materials Code) (discussed in detail in Section 8.6.1). OSHA, however, has not updated its Explosives and Blasting Agents standard to incorporate the provisions of NFPA 400 because OSHA’s legal authority to adopt consensus standards expired in the mid-1970s. 404 Because it was not pertinent to this investigation, 29 CFR 1910.109(g) is not discussed. 405 29 CFR 1910.109(i)(1)(i)(a). 406 29 CFR 1910.109(i)(2)(i). 407 Because bulk storage of FGAN was primarily at issue at the WFC facility, bagged storage is discussed only briefly for the sake of comparison. 408 29 CFR 1910.109(i)(4)(i)(a). 409 29 CFR 1910.109(i)(4)(ii)(a). 410 Ibid. 411 Ibid. 412 29 CFR 1910.109(i)(5)(i)(a).

West Fertilizer Company Final Report January 2016 167 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC incident, in which the use of wooden bins (albeit not untreated wooden bins) to store FGAN was allowed under the 1910.109(i) standard. The CSB found that such construction likely facilitated the fire’s spread between storage bins.413 Moreover, the CSB found that even if the wooden bins had been treated (e.g., with coated or clad materials), the incident may have still occurred. This is because, as discussed previously, although coated or clad materials may protect wood against AN impregnation, they are not fire resistant and will still burn. Accordingly, CSB issued public comments on March 31, 2014 when OSHA released a Request for Information (RFI) to CSB and other stakeholders on its Explosives and Blasting Agents standard.414 The comments made by CSB pertained in part to the weakness of the provisions in 29 CFR 1910.109(i), particularly with respect to the bulk storage of FGAN.415 Specifically, CSB expressed concern that, because of certain gaps in 1910.109(i), users are left to decide appropriate safety measures without proper instruction.416 For example, 1910.109(i) permits the use of wooden bins “protected against impregnation of AN” without defining the word “impregnation.”417 Furthermore, even if the word had been defined, CSB noted that the use of wooden bins is not recommended in other countries, such as the United Kingdom (U.K.), which recommend the use of concrete for bulk AN storage.418 Moreover, CSB noted in its RFI comments that 1910.109(i) does not provide sufficient fire protection measures with respect to the storage of bulk quantities of FGAN because it requires sprinklers only for bagged AN in amounts exceeding 2,500 tons.419 CSB concluded that the requirement for sprinklers (or other fire suppression methods) as well as fire detection equipment likely would have helped minimize the severity of the impact of the WFC fire and explosion on the facility and on the surrounding community.420 In addition, CSB commented that the title of the standard, “Explosives and Blasting Agents,” should be revised so that it is clear that FGAN not used as a blasting agent or explosive is also covered under the standard.421 As currently titled, the name of the standard might mislead readers to believe that the standard applies only to the explosives industry. Accordingly, CSB recommended that the title be revised to clearly indicate that the standard also applies to the fertilizer industry. Similarly, CSB noted that no scope describing the purpose and application of the standard is listed at the beginning of the standard.422 Rather, the scope of 29 CFR 1910.109(i) that applies to FGAN appears in the middle of the standard.

413 It should be noted, however, that 29 CFR 1910.109(i) did prohibit the configuration and contents of the seed room adjacent to the AN bin. 414 On December 9, 2013, OSHA issued an RFI on 17 issues regarding revision to the agency’s regulatory standards. CSB commented on 15 of the 17 issues in a public comment dated March 31, 2014. The CSB comments are posted on the OSHA website; see: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 415 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 416 Ibid. 417 Ibid. 418 Ibid. 419 Ibid. See: 29 CFR 1910.109(i)(7)(i). 420 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 421 Ibid. 422 Ibid.

West Fertilizer Company Final Report January 2016 168 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB recommended changing this organization so that the scope is specified early in the document and is easy to locate. CSB concluded that the implementation of such recommendations regarding the standard’s title and scope would likely make the standard easier to understand. In addition to providing comments in response to the OSHA RFI, CSB reviewed guidance documents on FGAN from government and industry sources, finding that the only pre-WFC incident reference to the OSHA standard was in an EPA Chemical Safety Alert, “Explosion Hazard from AN,” from December 1997.423 In a letter to EPA, The Fertilizer Institute (TFI), a major trade association composed of fertilizer industry representatives, contended that the reference was inaccurate and that EPA therefore should remove it from its alert.424 Specifically, TFI said that the standard “was not applicable to facilities handling AN, unless the facility also handles an explosive or blasting agent.”425 This assertion, however, is incorrect; no part of the standard supports such a reading. As previously mentioned, 29 CFR 1910.109(i) clearly states that it applies to “. . . the storage of AN in the form of . . . prills including fertilizer grade . . .”426 Nonetheless, CSB finds that additional and well publicized guidance is needed to explain the applicability and provisions of the standard. Fertilizer industry representatives reported to the Government Accountability Office (GAO) that it was not well known that 1910.109(i) applies to FGAN.427 While conducting interviews with WFC management and employees, CSB found that WFC personnel knew little about the pertinent section. During these interviews, CSB learned that OSHA conducted its last inspection of the WFC plant428 in 1985, when the facility was cited for various violations concerning anhydrous ammonia, respiratory protection, and recordkeeping. CSB found no evidence that OSHA cited the WFC for violating any requirement of 1910.109(i) before the April 2013 fire and explosion. It is unknown whether OSHA inspected the facility against this section of the standard. CSB found that, in addition to WFC personnel, others who would reasonably be expected to know about 29 CFR 1910.109(i) might not have had such knowledge. After the current owners acquired the facility in 2004, third-party safety consultants who visited the facility never referenced 1910.109(i) in their final inspection reports. In fact, in reviewing documentation provided by the WFC, CSB identified only one mention of 1910.109(i)—in a Safety Data Sheet (SDS) provided by one of the WFC’s FGAN suppliers, CF Industries, which the WFC received in 2012. The GAO confirmed this observation, noting in its May

423 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on December 28, 2015). 424 The Fertilizer Institute. “Fertilizer Grade Ammonium Nitrate: Properties and Recommended Methods for Packaging, Handling, Transportation, Storage and Use.” 425 Leason, Chris S., counsel to TFI. Letter to Tawai-David Chung, EPA OSWER, CEPPO, June 27, 1997. At the request of CSB, EPA conducted a search to find its final signed response to TFI’s letter. Because of the age of the document, it would only exist in paper form; however, EPA no longer has paper files from that time frame. Thus, EPA’s response to this letter is unknown. 426 29 CFR 1910.109(i)(1)(i)(a). 427 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 428 Certain structures of the WFC plant had not yet been built at the time of the 1985 OSHA inspection.

West Fertilizer Company Final Report January 2016 169 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2014 report that it reviewed four SDSs from producers of solid FGAN fertilizer and only one mentioned the pertinent section of the OSHA standard.429 CSB notes as a concern the fact that the fertilizer industry, as recently as 2014, reported that personnel exhibited little recognition of the applicability of 1910.109(i) to FGAN.430 With respect to enforcement, CSB found very little history of OSHA using 29 CFR 1910.109(i) to cite fertilizer facilities. Table 11 shows OSHA’s record of 1910.109(i) citations and also the citation that OSHA issued against the WFC by Standard Industrial Classification (SIC)431 code. Table 11. OSHA 29 CFR 1910.109(i) Citation History No. Facility Inspection Year Standard Industrial Classification 1. Coshocton Farm Bureau (Coshocton, OH) 1974 5083: Farm and Garden Machinery 2. Smith-Douglass Chemical Div. Bo. (Clayton, DE) 1975 5191: Farm Supplies 3. Jr. Simplot Co. (Bartley, NE) 1975 2875: Fertilizers, Mixing Only 4. Farmers Union Cooperative Oil (Flandreau, SD) 1975 5541: Gasoline Service Stations 5. Old Fox Chemical Co, Inc. (East Providence, RI) 1976 2875: Fertilizers, Mixing Only 6. Drake Chemical Inc. (Lock Haven, PA) 1976 2865: Cyclic Crudes and Intermediates 7. IMC Chemical Group Inc. Trojan (New Tripoli, PA) 1976 2892: Explosives 8. Atlas Powder Co. Kinepak (Alvarado, TX) 1977 2892: Explosives 9. Jacklin-Plant Food Center (Post Falls, ID) 1977 5191: Farm Supplies

1. Genstar Chemical Inc.

(Presque Isle, ME) 1978 2873: Nitrogenous Fertilizers

1. Nipak Energy Corp.

(Krum, TX) 1979 2892: Explosives

1. Iuka Coop Exchange

(Iuka, KS) 1979 5153: Grain and Field Beans

1. Beaver Explosives Inc.

(New Castle, PA) 1980 2892: Explosives

1. Independent Explosives Co. of

Pennsylvania (Pittston Township, PA) 1987 2892: Explosives

429 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 430 Ibid. 431 SIC is a system for classifying industries according to industry-specific four-digit codes.

West Fertilizer Company Final Report January 2016 170 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Thermex Energy Corp.

(Parrish, AL) 1990 2892: Explosives

• Kesco, Inc.

(Kittanning, PA) 1994 2892: Explosives

• Howard Fertilizer Company, Inc.

(Orlando, FL) 1997 2875: Fertilizers, Mixing Only

• Hall Explosives Inc.

(Good Springs-Tremont, PA) 1998 1629: Heavy Construction, Nec.

• American East Explosives

(Mount Carmel, PA) 1999 2892: Explosives

• West Fertilizer Co.

(West, TX) 2013 5191: Farm Supplies As shown in Table 11, 19 inspections resulted in citations, excluding the citation against the WFC. The SIC code for 10 of these citations are clearly nonfarm, addressing mostly explosives; the nine remaining citations are related to farm supplies. It is important to note, however, that these data reflect citations only, not inspections. That is, although the facilities in Table 11 were inspected against, and cited for violations of, 1910.109(i), they do not represent all inspections conducted by OSHA against that section of the standard. It is impossible to determine whether OSHA inspected any other facilities for compliance, but did not cite them. CSB found no evidence of citations from 1999 to 2013. The OSHA 29 CFR 1910.109(i) citation history in Table 11 is also similar to that of more recent OSHA enforcement data from 2005 to 2013. These data show that no other facility with the same North American Industry Classification System (NAICS)432 code as the WFC (NAICS Code 424910) received a citation for violating 1910.109(i). The GAO May 2014 report similarly concluded that OSHA rarely issued citations for violations of the standard’s requirements for FGAN storage at fertilizer facilities.433 GAO found that “a citation for a violation of [OSHA’s] AN storage regulations was issued as a result of an inspection of a fertilizer facility only once before the explosion in West, Texas.”434 After the WFC explosion, OSHA issued 24 citations to the WFC on October 9, 2013, including nine citations for serious violations of 29 CFR 1910.109(i).435 These violations included lack of adequate ventilation, absence of fire-resistive construction, and improper storage and bin pile heights.436 The agency also cited the WFC for not ensuring that the wooden bins it used to store FGAN were treated to prevent FGAN impregnation.437 OSHA and the WFC ultimately settled, with the WFC agreeing to pay

432 NAICS is the standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy. 433 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” Washington, DC: GAO, May 2014. 434 Ibid. 435 OSHA. “Citation and Notification of Penalty to Adair Grain,” October 9, 2013. 436 Ibid. 437 Ibid.

West Fertilizer Company Final Report January 2016 171 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

penalties without admitting guilt about violating the standards under which it was cited, including 1910.109(i). There is evidence that the WFC owners made efforts to comply with regulations when notified of noncompliance. When the WFC owners acquired the facility in 2004, state and federal regulators found them to be noncompliant with environmental, product quality, and transportation regulations—issues that the owners promptly corrected. For example, Federal EPA inspectors cited the WFC for not refiling its Risk Management Plan (RMP) registration in 2004.438 This citation prompted the WFC to hire an insurance company to develop a comprehensive RMP for the safe storage of its anhydrous ammonia.439 Also, Texas Commission on Environmental Quality (TCEQ) inspectors issued a citation to the facility in 2006 for not having an air permit for anhydrous ammonia.440 The WFC subsequently developed maintenance and inspection programs to prevent anhydrous ammonia releases. As a result of these inspections and citations, the WFC took appropriate corrective actions. The importance of regulatory awareness and notification, therefore, cannot be overemphasized. 8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard In December 2014, the OSHA Directorate of Enforcement Programs issued investigatory and citation guidance to OSHA enforcement personnel on elements of 29 CFR 1910.109. The nine-page guidance document provides additional clarification of the scope of 1910.109(i) and its application to facilities that store FGAN. This document includes specific compliance guidance for the majority of standard provisions and describes conditions that would be considered in or out of compliance. This guidance further clarifies the application of the standard to facilities storing FGAN and provides a list of NAICS industry codes for facilities most likely to manufacture, use, store, handle, or possess FGAN. The list of NAICS codes includes facilities such as the WFC plant and states that particular attention to AN hazards is needed when inspecting these facilities. The guidance also clarifies the standard’s definition of “adequate ventilation” and includes the types of ventilation likely to be unacceptable under the regulations as well as a ventilation rate calculation to assess compliance. Furthermore, the guidance document provides additional clarification on the subject of wood protection against FGAN impregnation. As discussed previously, 1910.109(i) does not specifically define compliant approaches for the treatment of wood to protect against FGAN impregnation. The standard prohibits untreated wood bin construction for FGAN storage. Although OSHA does not recommend the use of treated wood bins, wood with impermeable coating and claddings (such as two-part epoxy coatings, steel sheet cladding, or sodium silicate) are considered acceptable means for protecting wood against FGAN impregnation. OSHA provides additional guidance for varying types of wood construction that might be encountered during field inspections, including citable conditions such as improperly treated wood and

438 EPA. “Enforcement Case Report to West Chemical & Fertilizer Company,” August 14, 2006. 439 Triangle Insurance Company. Anhydrous Ammonia Supplement for WFC, 2006. 440 TCEQ. “TCEQ Enforcement Referral to West Chemical & Fertilizer,” June 21, 2006.

West Fertilizer Company Final Report January 2016 172 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

treated wood that has not been maintained to protect the coating integrity. The guidance also addresses pile heights for clumping and caking conditions and fire prevention. The 2014 guidance document for 1910.109(i) addressed some of the issues with vague wording that CSB raised in the RFI comments. Some of the requirements listed under the standard, however, do not provide sufficient safeguards to a facility owner storing bulk quantities of FGAN. In the case of the WFC incident, the wood-constructed bins were made of combustible materials and likely facilitated the spread of a fire between storage bins. According to OSHA, AN impregnation of porous combustible materials, such as wood, can accelerate combustion in the event of a structural fire and increase the explosion risk.441 OSHA permits the use of wood bins and wood construction only if the wood is protected against impregnation. Although coated or clad materials can protect against AN impregnation, they are not fire resistant and will still burn, contributing to the generation of heat during a fire. CSB determined that the wood-constructed bins likely contaminated the AN, ultimately leading to the detonation by increasing AN energy and sensitivity (discussed in Section 4.2.1). Completely eliminating wood and other combustibles as materials for constructing FGAN bins and storage facilities greatly reduces the possibility of contaminating FGAN during a fire or smoldering event. Although OSHA enforcement guidance and other efforts have provided greater clarity on how 1910.109(i) applies to FGAN facilities, OSHA still needs to revise and update the standard to incorporate the most recent provisions in NFPA 400 (2016 Edition) that address the safe storage of FGAN. OSHA cannot enforce some of the regulations in the current 1910.109(i) because they contain requirements reserved for the authority having jurisdiction, such as the municipal or state code official for occupancy permits. Moreover, OSHA cannot cite the following requirements in the standard: • 29 CFR 1910.109(i)(2)(ii): Approval of large quantity storage shall be subject to due consideration of the fire and explosion hazards, including exposure to toxic vapors from burning or decomposing ammonium nitrate. • 29 CFR 1910.109(i)(2)(iii)(e): The continued use of an existing storage building or structure not in strict conformity with this paragraph may be approved in cases where such continued use will not constitute a hazard to life. Because the current version of 1910.109(i) has limited enforcement in some areas—and because NFPA 400 (2016 Edition) (discussed in Section 8.6.1.1) includes updated provisions, some in response to the WFC incident, for increasing the safety of AN storage facilities—OSHA should update 1910.109(i) to include requirements similar to the provisions in NFPA 400 (2016 Edition). It also should revise the rules that currently are enforceable only by municipal or state officials.

441 OSHA enforcement directive on 1910.109(i).

West Fertilizer Company Final Report January 2016 173 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 2.2 Need for an Emphasis Program

Unfortunately, only after the WFC incident was more attention focused on the hazards of FGAN and the role of applicable regulations. Since the explosion and issuance of the EO, OSHA has worked to increase awareness of FGAN and the scope of 29 CFR 1910.109(i) through the joint agency advisory on safe storage of FGAN, the letter to the fertilizer industry, and the guidance document for compliance officers to assist in enforcing the 1910.109 standard for FGAN facilities. However, enforcement guidance does not provide the resources needed by OSHA to increase the frequency of inspections, although such guidance may help ensure that 1910.109(i) is applied appropriately when OSHA compliance officers happen to inspect facilities that fall under the rule. A more realistic and immediate approach to confirm that FGAN facilities are complying with the standard would be for OSHA to launch a regional emphasis program (e.g., in Regions IV, VI, and VII442) where these types of facilities are more common. A regional emphasis program would include a certain number of annual inspections per year, which would facilitate bringing FGAN facility operators into compliance with both regulatory and industry standards and would reduce the potential for a future event similar to the WFC incident. Imposing stricter requirements on AN storage and handling could take several years before enactment into federal regulations. OSHA has initiated several national, regional, and local emphasis programs targeted at specific industries or located in specific geographical areas to help prevent hazards. Such emphasis programs have successfully focused inspection and enforcement efforts on specific industries. A 1910.109(i) emphasis program can include NFPA 400 (2016 Edition) as a guidance document for compliance officers to support recognition of hazardous conditions or issuance of violations when found. It would also prompt improvement of safe FGAN storage and handling practices through increased awareness and would allow OSHA to collect information and data that could support future revisions to current regulations on FGAN. 8.3 Chemical Facility Anti-Terrorism Standards (CFATS) DHS promulgated the CFATS in 2007 to address security issues at high-risk chemical facilities, including those that store certain quantities of FGAN. The rule establishes risk-based performance standards for chemical facility security and requires facilities to prepare vulnerability assessments and security plans to protect the public from a breach of security or an intentional release. Under CFATS, DHS collects information from facilities that possess designated quantities of chemicals of interest (COIs).443 In creating the COI list, DHS referenced other established lists that regulate

442 These regions include the following states: Alabama, Florida, Georgia, North Carolina, South Carolina, Tennessee, Mississippi, Kentucky, Nebraska, Kansas, Missouri, Iowa, Texas, Oklahoma, Arkansas, Louisiana, and New Mexico. 443 CFATS § 27.210(a)(1)(i).

West Fertilizer Company Final Report January 2016 174 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

chemicals—including the list of chemicals covered under the EPA Risk Management Program, the Chemical Weapons Convention, and DOT—and a list of chemicals with known inhalation hazards. The COI list includes 322 chemicals and also screening threshold quantities for each chemical as it relates to each of the three defined security hazards (release, theft, and sabotage). Chemical facilities that meet the COI criteria listed in Appendix A of the CFATS rule must complete and electronically submit a Chemical Security Assessment Tool (CSAT) Top-Screen form to DHS. Using the information collected from facility Top-Screen information, DHS assigns a preliminary risk-based tier— from the highest (tier 1) to the lowest “high-risk” level (tier 4) and the “not high-risk” level (tiered out)— based on a basic assessment of the potential consequences in association with the chemical holdings at each facility.444 Once a preliminary tier is assigned, each facility in tiers 1 through 4 must submit a CSAT Security Vulnerability Assessment to DHS, and DHS uses that assessment to make a final determination of the facility’s assessed level of risk. If DHS retains the facility in one of the four high-risk tiers, the facility must submit a site security plan. DHS reviews the plan, conducts an onsite inspection of the facility, and approves the plan if it is deemed adequate relative to the risks inherent in the facility, its chemical holdings, and potential consequences of a security breach. Since publication of the CFATS rule, DHS has received more than 50,000 Top-Screen forms submitted by chemical facilities. As of September 2015, DHS covers 3,182 high-risk facilities nationwide, and 2,607 of those sites have undergone onsite authorization inspections. 8.3.1 AN Screening Thresholds FGAN is listed in CFATS Appendix A as a DHS COI. A facility reports to DHS based on possession of AN under three conditions:

1. If a facility possesses 5,000 pounds or more of FGAN with more than 0.2 percent combustible

substances, including any organic substance calculated as carbon, to the exclusion of any other added substance in bulk storage, the facility must report. Facilities meeting this threshold must also submit information to DHS on quantity and on method of storage or packaging.

1. If a facility possesses 400 pounds or more of FGAN with more than 0.2 percent combustible

substances, including any organic substance calculated as carbon, to the exclusion of any other added substance in transportation packaging, the facility must report.

1. If a facility possesses 2,000 pounds or more of solid FGAN with a nitrogen concentration of 23

percent or higher in transportation packaging, the facility must report.

CSB requested and reviewed CFATS data from all facilities in the United States that submitted information to DHS for storage of FGAN as of March 2014. According to the DHS data, 1,351 facilities in the United States store AN in quantities that exceed the screening thresholds. The majority of those

444 When determining whether a facility is high risk, DHS primarily focuses on the potential consequences associated with a successful terrorist attack on the facility (including the use of stolen or diverted materials in a separate attack offsite). A threat factor also is incorporated into the risk assessment for facilities with release hazards.

West Fertilizer Company Final Report January 2016 175 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facilities store FGAN for agricultural uses (Figure 73). Based on the NAICS codes submitted with Top- Screen information, 46 percent of the facilities that report to DHS stock FGAN for agricultural purposes such as farm merchandising and wholesale or crop preparation. An additional 6 percent store FGAN for fertilizer mixing.

Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS) In 2008, DHS filed a reporting extension to agricultural facilities meeting screening thresholds of FGAN for farmers and agricultural end users of FGAN, such as the preparation and application of crops, feed, land, or livestock.445 However, this extension does not apply to chemical distribution facilities or to commercial chemical application services, such as the WFC. At the time of the April 2013 explosion, the WFC possessed an estimated maximum of 120,000 pounds of FGAN, about 60 times the screening threshold of 2,000 pounds, but did not submit Top-Screen information to DHS as required under the CFATS. Consequently, DHS was unaware that the WFC possessed FGAN until the 2013 explosion. After the incident, the WFC retroactively submitted a Top Screen to DHS upon notification that it was not compliant with the rule, and DHS did not issue a citation to the WFC for originally failing to submit the form. If the WFC had complied with the CFATS, a CFATS inspection or assistance visit might have noted the storage conditions at the WFC facility and prompted change. In addition, DHS engagement

445 73 Federal Register 1640.

West Fertilizer Company Final Report January 2016 176 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with facility management might have prompted greater engagement by local law enforcement, which in turn might have supported greater involvement by other community emergency services. 8.4 Safety Management Programs Following a number of major chemical accidents in the United States and abroad in the 1970s and 1980s, Congress amended the Clean Air Act (CAA) in 1990 to require both OSHA and EPA to publish new regulations to help prevent similar accidents. Through Section 304 of the CAA Amendments, Congress directed the Secretary of Labor, in coordination with the EPA Administrator, to promulgate, pursuant to the Occupational Safety and Health Act of 1970, a chemical process safety standard to prevent accidental releases of chemicals that could pose a threat to employees.446 Also, through CAA Amendments Section 112(r), Congress required EPA to publish regulations and guidance for chemical accident prevention at facilities using substances that posed the greatest risk of harm from accidental releases.447 The following sections focus on the intertwined regulations that OSHA and EPA developed – the OSHA Process Safety Management of Highly Hazardous Chemicals standard and the EPA Risk Management Program rule. 8.4.1 OSHA Process Safety Management Standard OSHA’s Process Safety Management of Highly Hazardous Chemicals standard (29 CFR 1910.119) (known as the PSM standard) became effective in May 1992.448 The standard contains requirements for preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals.449 It includes the following 14 elements: 1. Employee participation. 2. Process safety information. 3. Process hazard analysis. 4. Operating procedures. 5. Training. 6. Contractors. 7. Pre-startup safety review. 8. Mechanical integrity. 9. Hot work permits. 10. Management of change. 11. Incident investigation. 12. Emergency planning and response. 13. Compliance audits.

446 See: https://www.osha.gov/Publications/osha3132.html (accessed December 28, 2013). 447 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed December 28, 2015). 448 OSHA. “Process Safety Management.” OSHA 3132, 2000. 449 29 CFR 1910.119.

West Fertilizer Company Final Report January 2016 177 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Trade secrets.450 The PSM standard states that it applies, in part, to “a process which involves a chemical at or above the specified threshold quantities listed in Appendix A [List of Highly Hazardous Chemicals, Toxics and Reactives] to this section.”451 Notably, FGAN is not on this list. In deciding which chemicals to regulate under the PSM standard, OSHA reviewed potential “highly reactive and explosive substances,” as required by Section 304(b) of the CAA Amendments.452 OSHA considered information drawn from multiple sources, including EPA, DOT, World Bank, NFPA, the Health and Safety Commission of the U.K., and the states of Delaware and New Jersey.453 With respect to reactives, OSHA chose to include only those chemicals with the two highest (i.e., most dangerous) reactivity ratings under NFPA 490 because of the significant risk that they posed to workers.454 These chemicals had reactivity ratings of 3 or 4.455 FGAN, however, was left off the PSM list, despite having a reactivity rating of 3.456 Although the agency did consider adding FGAN to the PSM list in the late 1990s, this effort failed due to “resource constraints and other priorities.”457 Thus, FGAN has yet to be regulated under the PSM standard. Anhydrous ammonia, on the other hand, is on the List of Highly Hazardous Chemicals, Toxics and Reactives, with a threshold quantity of 10,000 pounds. CSB found that, at the time of the incident, the WFC was storing the equivalent of 34,000 pounds of anhydrous ammonia, more than three times the threshold quantity that triggers PSM coverage. CSB also discovered that the WFC had previously stored 54,000 pounds of anhydrous ammonia in 2006 and 2011. Given these facts, the WFC should have complied with the PSM standard because the company stored anhydrous ammonia, at least in 2006, 2011, and 2013, in quantities that exceeded its threshold quantity. However, CSB learned that the PSM standard did not apply to the WFC at the time of the incident because the facility qualified under OSHA’s interpretation of the standard’s retail facilities exemption. At the time of the incident, a facility qualified under the retail facilities exemption if the following conditions were met: (1) the facility contained a highly hazardous chemical in a quantity that met or exceeded the threshold quantity for the chemical; (2) the facility used a process458 covered by the PSM

450 Ibid. 451 29 CFR 1910.119(a)(1)(i). 452 CONSAD OSHA Report, 1988. 453 55 Federal Register 29150. 454 CONSAD OSHA Report, 1988. 455 Ibid. 456 Federal OSHA in discussion with CSB, May 14, 2015. 457 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed December 28, 2015). 458 The PSM standard defines “process” as any activity involving a highly hazardous chemical, including any use, storage, manufacturing, handling, or onsite movement of such chemicals (or any combination of these activities). It also states that, for purposes of this definition, any group of vessels that are interconnected—and separate vessels

West Fertilizer Company Final Report January 2016 178 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard; and (3) more than 50 percent of the facility’s income was derived from direct end users.459 The WFC facility met all three conditions for its storage of anhydrous ammonia. It stored anhydrous ammonia, a highly hazardous chemical, in quantities that exceeded its threshold quantity. Also, the facility used a process because it stored the anhydrous ammonia, and storage meets the PSM standard definition of a “process.” Because the WFC primarily sold its products, including anhydrous ammonia, to farmers (i.e., direct end users), the company met the third condition as well. Thus, the WFC qualified under the PSM standard’s retail facilities exemption and was not required to comply with the standard. If the PSM standard had applied to the WFC for its storage of anhydrous ammonia however, the WFC would have been required to conduct a process hazard analysis (PHA). A PHA must address the following: • Hazards of the process. • Identification of any previous incident that had a potential for catastrophic consequences in the workplace. • Engineering and administrative controls applicable to the hazards and their interrelationships, such as appropriate application of detection methodologies to provide early warning of releases, with acceptable detection methods that might include process monitoring and control instrumentation with alarms and also detection hardware such as hydrocarbon sensors. • Consequences of a failure of engineering and administrative controls. • Facility siting. • Human factors. • Qualitative evaluation of a range of the possible safety and health effects on employees in the workplace if a failure of controls occurs.460 The WFC would have had to address facility siting as part of its PHA. Facility siting refers to the location of the covered process and its proximity to various other components within the facility’s property.461 It does not refer to the site of the facility in relation to the surrounding community.462 A facility siting analysis at the WFC likely would have identified the close proximity of the facility’s FGAN storage warehouse and its anhydrous ammonia storage tanks, thus triggering implementation of necessary safeguards to mitigate the possibility of potentially catastrophic successive incidents involving the two hazardous chemicals. This observation was a critical element of CSB’s investigation because evidence indicated that the FGAN explosion damaged the facility’s anhydrous ammonia tanks. If more force had been applied to the tanks, their contents could have been released into the neighboring community and

that are located so that a highly hazardous chemical could be involved in a potential release— must be considered a single process. 459 OSHA interpretation letter. See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=23885 (accessed December 28, 2015). 460 See: https://www.osha.gov/Publications/osha3132.html (accessed on December 28, 2015). 461 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=1558 (accessed on December 28, 2015). 462 Ibid.

West Fertilizer Company Final Report January 2016 179 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caused even more fatalities and injuries. However, the WFC was not required to conduct facility siting because it qualified for the PSM standard’s retail facilities exemption. CSB communicated its concern about the retail facilities exemption in its March 31, 2014, comments to OSHA’s December 9, 2013 RFI.463 CSB asked OSHA to consider whether the retail facilities exemption should be revised in order to cover facilities such as WFC, which stored bulk quantities of chemicals covered by the PSM standard.464 8.4.1.1 Revised Interpretation of the PSM Retail Facilities Exemption On July 22, 2015, OSHA issued a memorandum, “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption” (Retail Exemption Memorandum).465 OSHA noted in the memorandum that the PSM exemption for retail facilities does not define the term “retail facility.”466 However, the agency also said that the preamble to the PSM standard does explain that chemicals in retail facilities are generally sold in “small volume packages, containers, and allotments.”467 OSHA pointed out that the preamble gives an example of a gasoline station as a type of facility that would fit within the definition of a retail facility and thus qualify for the exemption.468 OSHA also mentioned in the Retail Exemption Memorandum that other federal agencies define the term similarly.469 In particular, it states that the U.S. Department of Commerce, which develops NAICS codes, characterizes retail trade as follows (emphasis added): The Retail Trade sector comprises establishments engaged in retailing merchandise, generally without transformation, and rendering services incidental to the sale of merchandise. The retailing process is the final step in the distribution of merchandise; retailers are, therefore, organized to sell merchandise in small quantities to the general public. 470 However, this is not how OSHA had always interpreted its PSM retail exemption. After promulgation of the PSM standard, OSHA issued a series of letters of interpretation471 and a PSM compliance directive472 that interpreted the retail exemption more broadly than originally intended.473 Under these interpretations, a facility was considered exempt from the PSM standard if it derived “more

463 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 464 Ibid. 465 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 466 Ibid. 467 57 Federal Register 6356, 6369. 468 Ibid. 469 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 470 U.S. Department of Commerce. NAICS Manual, Sector 44–45: Retail Trade. 471 OSHA letters of interpretation explain OSHA requirements, which are set by statute, standards, and regulations. 472 OSHA. Compliance Directive (CPL) 02-03-045. 473 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015.

West Fertilizer Company Final Report January 2016 180 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

than 50 percent of its income from direct sales of highly hazardous chemicals to the end user” (the 50 percent test).474 This rationale is how the WFC claimed the retail exemption for its storage of anhydrous ammonia. If FGAN had been covered under the PSM standard before the WFC incident, the retail exemption, as it had been interpreted, would have precluded PSM coverage at the WFC and similar facilities. In addition, this 50 percent test allowed employers that sold or distributed large bulk quantities of highly hazardous chemicals directly to end users to claim the exemption, even if the end users were themselves commercial establishments.475 This reasoning led to confusion about the definition of the term “end user.” In its Retail Exemption Memorandum, OSHA said that it did not intend either of these outcomes. OSHA’s Retail Exemption Memorandum rescinded all previous documents, letters of interpretation, and memoranda related to the retail exemption and the 50 percent test.476 OSHA states that its interpretation of the exemption is now more consistent with the standard’s original intent.477 In reference to the NAICS Manual, OSHA states that: Only facilities, or the portions of facilities, engaged in retail trade as defined by the current and any future updates to sectors 44 and 45 of the NAICS Manual may be afforded the retail exemption at 29 CFR 1910.119(a)(2)(i).478 Facilities that fall within Sectors 44–45: Retail Trade, consist of a number of subsectors. These facilities are now (or are still) considered retail facilities eligible for the retail exemption. Notably, NAICS codes typically used for FGAN bulk storage and sales do not fit into one of these classifications. As such, facilities that store or sell bulk FGAN do not qualify for the retail exemption. If OSHA’s new interpretation were in effect before the incident, the WFC could not have claimed the retail exemption for its storage of anhydrous ammonia. Furthermore, it could not have claimed the exemption for its storage of FGAN had FGAN been included on the PSM list pre-incident. If this new interpretation had been in effect before the incident, the WFC might have recognized that its storage of anhydrous ammonia was covered by the PSM standard. Although compliance efforts would have focused on this potential hazard, the WFC might have learned about FGAN-related hazards as well. As previously discussed, if the WFC had conducted a facility siting analysis, it could have identified the close proximity of its FGAN storage warehouse to its anhydrous ammonia pressure tanks. This may have

474 Ibid. 475 Ibid. 476 Ibid. 477 Ibid. According to a December 23, 2015, OSHA memorandum, through September 30, 2016, OSHA will not cite employers for violations of the PSM standard at facilities that it would not have cited applying the interpretation of the term “retail” that was in place prior to July 22, 2015. 478 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption (29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. Facilities that fall under Sectors 44–45: Retail Trade consist of a number of subsectors, including Motor Vehicle and Parts Dealers (NAICS 441), Building Material and Garden Equipment and Supplies Dealers (NAICS 444), Gasoline Stations (NAICS 447), and General Merchandise Store (NAICS 452).

West Fertilizer Company Final Report January 2016 181 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

led the WFC to explore the potential for FGAN to catch fire and detonate under certain conditions. It also may have caused the WFC to implement safeguards to prevent hazards associated with the two different chemicals. OSHA’s revised interpretation of the retail exemption would mean that facilities such as the WFC would be covered for their use of anhydrous ammonia. According to the fertilizer industry, more than 3,800 U.S. retail facilities previously exempted by the older interpretation of the retail exemption would be covered under the requirements of the PSM standard because of anhydrous ammonia storage. 479 WFC use of FGAN could also be regulated directly in the future, but only if FGAN were added to PSM’s List of Highly Hazardous Chemicals, Toxics and Reactives. CSB recommends that OSHA consider including FGAN for coverage under the PSM standard.480 CSB supports OSHA’s revised interpretation of the retail exemption to guarantee that potential changes to the PSM standard will apply to facilities like the WFC that store anhydrous ammonia as well as FGAN, which would provide the basis for the CSB’s proposed recommendation to add FGAN to the PSM list. 8.4.1.2 Guidance on Recognized and Generally Accepted Good Engineering Practices Under the PSM Standard OSHA also recently addressed its reference to the common industry term, “recognized and generally accepted good engineering practices” (RAGAGEP), under its PSM standard. This term is often used in performance-based standards like PSM. Generally, standards can be either prescriptive or performance based. As its name suggests, a prescriptive standard sets rigid compliance specifications. A performance- based standard, on the other hand, simply delineates the expected performance outcome or end result, without specifying how the outcome or result is to be achieved. In other words, a prescriptive standard describes how something is to be achieved, but a performance-based standard only specifies what is to be accomplished. For example, OSHA’s Explosives and Blasting Agents standard (Section 8.2) is a prescriptive standard that contains FGAN-specific provisions. That part of the standard is prescriptive because its provisions set out how to handle FGAN; the provisions are inflexible. In contrast, OSHA’s PSM standard is performance-based. It employs a broad approach to materials and applications and enables incorporation of current industry practices. As a performance-based standard, it allows employers to select the RAGAGEP that they choose to apply to their facilities.481 These chosen RAGAGEP are the ones that employers must follow at their facilities so that they are deemed compliant. Although the PSM standard does not define RAGAGEP, OSHA’s Petroleum Refinery PSM National

479 TFI/ARA Hearing Statement: “Examining the Use of Agency Regulatory Guidance.” See: http://www.mo- ag.com/uploaded/Senate%20HSGAC%20RFAM%20Hearing%209-23-15.pdf (accessed December 1, 2015). 480 OSHA has initiated a Small Business Regulatory Enforcement Fairness Act panel on its PSM standard, after issuing an RFI in November 2013 seeking public comment on ways to improve the standard. ATF/OSHA/EPA. “Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 2015. 481 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015.

West Fertilizer Company Final Report January 2016 182 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emphasis Program references the definition established in the Center for Chemical Process Safety’s Guidelines for Mechanical Integrity Systems: Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) are engineering, operation, or maintenance activities based on established codes, standards, published technical reports or recommended practices or a similar document. RAGAGEP detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a vessel, inspecting a storage tank, or servicing a relief valve.482 This is the definition OSHA references in addressing its use of the term under the PSM standard. Following the WFC incident, OSHA provided guidance on its use of the term RAGAGEP under its PSM standard in a June 8, 2015, memorandum, “RAGAGEP in Process Safety Management Enforcement” (PSM RAGAGEP Memorandum). As noted by OSHA in its PSM RAGAGEP Memorandum, the PSM standard directly references or implies the use of RAGAGEP in three provisions:

1. 29 CFR 1910.119(d)(3)(ii): Employers must document that all equipment in PSM-covered

processes complies with RAGAGEP.

1. 29 CFR 1910.119(j)(4)(ii): Inspections and tests are performed on process equipment subject to

the standard’s mechanical integrity requirements in accordance with RAGAGEP.

1. 29 CFR 1910.119(j)(4)(iii): Inspection and test frequency follows manufacturer’s

recommendations and good engineering practice, and more frequently if indicated by operating experience.483 Accordingly, RAGAGEP under the PSM standard apply to process equipment design, installation, operation, and maintenance; inspection and test practices; and inspection and test frequencies.484 The PSM RAGAGEP Memorandum notes the following primary sources of RAGAGEP: (1) published and widely adopted codes, (2) published consensus documents, and (3) published nonconsensus documents.485 Published and widely adopted codes are those consensus standards that have been widely adopted by federal, state, or municipal jurisdictions.486 Published consensus documents are identified as those published by certain organizations which must follow the American National Standards Institute (ANSI) “Essential Requirements: Due process requirements for American National Standards” (ANSI Essential Requirements).487 Published nonconsensus documents include publications that do not conform to the ANSI Essential Requirements and peer-reviewed technical articles.488 It is important to note that

482 OSHA. Compliance Directive (CPL) 03-00-010. 483 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015. 484 Ibid. 485 Ibid. 486 Ibid. Examples of published and widely adopted codes include NFPA 101 (Life Safety Code) and NFPA 70 (National Electric Code). 487 Ibid. Examples of published consensus documents include the ASME B31.3, “Process Piping Code,” and the International Institute of Ammonia Refrigeration (IIAR) ANSI/IIAR 2-2008, “Equipment, Design, and Installation of Closed-Circuit Ammonia Mechanical Refrigerating Systems.” 488 Ibid. Examples of published nonconsensus documents include the Chlorine Institute “pamphlets” focusing on chlorine and sodium hypochlorite safety and the Design Institute for Emergency Relief Systems guideline book addressing technology for reactive and multiphase relief systems design.

West Fertilizer Company Final Report January 2016 183 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

while OSHA generally accepts published and widely adopted codes and published consensus documents as RAGAGEP, published nonconsensus documents are not necessarily generally accepted. However, OSHA may choose to accept them if they are applicable and appropriate.489 The PSM RAGAGEP Memorandum also explains the difference between “shall” and “should” language. In particular, OSHA notes that positive and negative uses of “shall,” “must,” or similar language in published RAGAGEP reflect the developer’s view that the practice is a mandatory minimum to control a hazard.490 Thus, if an employer deviates from such RAGAGEP, OSHA will presume a violation.491 Where “should” language applies in RAGAGEP, OSHA presumes that employer compliance with the recommended approach is acceptable.492 If an employer chooses to deviate from the recommended approach, however, OSHA will evaluate whether the employer has determined and documented that its alternative approach is at least as protective as the recommended approach or whether the recommended approach does not apply to the employer’s operation.493 OSHA presumes a violation if employers act in a way that RAGAGEP deem they “should not.”494 These enforcement considerations emphasize that RAGAGEP are more than optional recommendations. Many RAGAGEP are mandatory standards based on scientific data and previous incidents and it is crucial that employers comply with them. If FGAN is added to the PSM list, the use of RAGAGEP will allow facilities to select and comply with FGAN-specific standards, such as NFPA 400, that have been recently updated to address and help prevent the conditions that led to the WFC explosion. 8.4.2 EPA Risk Management Program Rule The EPA Risk Management Program rule (40 CFR Part 68, Subparts A through H) is intended to prevent and minimize the consequences of accidental releases of toxic or flammable substances.495 Enacted in 1996, the regulation required facilities to be compliant by 1999.496 In general, covered facilities are those with a substance on one of the Risk Management Program rule’s two lists, one for toxic substances and one for flammable substances, in a quantity that meets or exceeds the threshold quantity for the substance.497 These facilities must perform a hazard assessment, consisting of worst case and alternative release scenarios as well as a five-year accident history; implement an accident prevention program (which is required for most facilities); establish an emergency response program; and develop an RMP

489 Ibid. 490 Ibid. 491 Ibid. 492 Ibid. 493 Ibid. 494 Ibid. 495 EPA. “Accidental Release Prevention Requirements: Risk Management Program Under the Clean Air Act.” RFI, July 31, 2014. 496 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/100038BD.PDF?Dockey=100038BD.PDF (accessed on December 28, 2015). 497 See: http://www.epa.gov/rmp/risk-management-plan-rmp-rule-overview (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 184 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

and submit it to EPA.498 Facility management must revise and resubmit its RMP to EPA at least every five years.499 EPA has developed three program levels for process classification to ensure that individual processes are subject to requirements that appropriately match their size and risks they pose.500 Program Level 1 applies to processes with lower risks that would not significantly affect the public in a worst case release scenario and that have had no accidents with specific offsite consequences in the last five years.501 These facilities have limited and/or minimal accident prevention requirements.502 Program Levels 2 and 3 cover higher-risk facilities that must meet more stringent accident prevention requirements.503 A Program Level 3 facility is not eligible for classification under Program Level 1 and is either (1) subject to OSHA’s PSM standard or (2) classified in one of 10 specified NAICS codes.504 Program Level 3 requires implementation of an accident prevention program that is virtually equivalent to the one required under the PSM standard.505 Program Level 2 applies to facilities that are not eligible for classification in Program Level 1 or Program Level 3.506 Program Level 2 requires implementation of a streamlined accident prevention program.507 The WFC was a Program Level 2 facility under the Risk Management Program rule for its storage of anhydrous ammonia, a regulated substance, which the WFC kept in amounts that exceeded the substance’s threshold quantity. Program Level 2 facilities must conduct hazard reviews.508 For this requirement to be satisfied, facilities must conduct a review and identify the following: • Hazards associated with the Program 2 process and regulated substances. • Opportunities for equipment malfunction or human error that could cause a release. • Safeguards that will control the hazards or prevent the malfunction or error. • Steps to detect or monitor releases.509

498 Ibid. 499 Ibid. 500 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on December 28, 2015). 501 Ibid. 502 Ibid. 503 Ibid. 504 Ibid. These 10 manufacturing NAICS codes are (1) 32211 pulp mills; (2) 32411 petroleum refineries; (3) 32511 petrochemical manufacturing; (4) 325181 alkalis and chlorine manufacturing; (5) 325188 all other basic inorganic chemical manufacturing; (6) 325192 cyclic crude and intermediate manufacturing; (7) all other basic organic chemical manufacturing; (8) plastics material and resin manufacturing; (9) nitrogenous fertilizer manufacturing; and (10) pesticide and other agricultural chemical manufacturing. See: http://www2.epa.gov/sites/production/files/2013- 11/documents/cd-chap-02.pdf (accessed on December 28, 2015). 505 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on December 28, 2015). 506 Ibid. 507 Ibid. 508 See: http://www.epa.gov/sites/production/files/2013-11/documents/chap-06-final.pdf (accessed on December 28, 2015). 509 Ibid.

West Fertilizer Company Final Report January 2016 185 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB discovered that the WFC implemented a prevention program that included a hazard review. In its most recent RMP from 2011, the WFC identified major hazards, which included toxic releases, equipment failure, and earthquakes, but did not include fire or explosion.510 The facility also indicated that it did not use mitigation systems, such as sprinklers, for its storage of anhydrous ammonia.511 Clearly, this hazard review did not provide the type of protection needed to address the fire and explosion that occurred on the day of the WFC incident. Because FGAN is not a regulated substance, the WFC was not required to conduct such a hazard review for its storage of FGAN. Accordingly, CSB recommends that FGAN be added to the Risk Management Program list.512 CSB contends that EPA should consider adding FGAN to the list of regulated substances, taking into account the more recent recognition of the unpredictable explosive hazards of FGAN, better awareness of the location of FGAN facilities across the United States, greater knowledge of the quantity of FGAN normally stored at these facilities, and continuance of FGAN-related incidents since the issuance of the final Risk Management Program list. As demonstrated in Appendix B, FGAN-related incidents continue to occur, domestically and abroad. Despite tremendous property damage and economic cost, the most devastating result of these incidents is the immeasurable loss of human life. CSB found that a likely cause of such loss of life is the alarming number of FGAN facilities located in communities—next to schools, hospitals, residences, and businesses (discussed in Section 9). Another cause, as determined by CSB, is the tendency of these facilities to store FGAN in large quantities. Coupling these factors with the more recent recognition that FGAN is susceptible to unstable detonation under certain conditions, CSB recommends that FGAN be listed under the Risk Management Program rule. Moreover, CSB reviewed original listing criteria and found that inclusion of FGAN on the Risk Management Program list is warranted. 8.4.2.1 Risk Management Program Rule Listing Criteria Background Under CAA Section 112(r)(4), the factors to be considered in listing substances for Risk Management Program rule coverage are (1) the severity of acute adverse health effects associated with accidental releases of the substance, (2) the likelihood of accidental releases of the substance, and (3) the potential magnitude of human exposure to accidental releases of the substance.513 When EPA first promulgated its Risk Management Program list of chemicals and threshold quantities in 1994, it reviewed 11 different lists, including three EPA lists.514 The criteria used for development of these lists were reviewed to determine whether the criteria were related to the factors mandated by Congress for list development

510 WFC 2011 RMP submission to EPA. 511 Ibid. 512 EPA has issued a RFI and worked on a Notice of Proposed Rulemaking for its Risk Management Program rule. ATF/OSHA/EPA. “Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 2015. 513 58 Federal Register 5102 (January 19, 1993). 514 Ibid.

West Fertilizer Company Final Report January 2016 186 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

under CAA Section 112(r).515 Acute toxicity was generally considered in developing these lists of chemicals, but some also used flammability and explosivity as criteria for regulating chemicals.516 As part of its review of the first factor to be considered for listing substances under the Risk Management Program rule, EPA reviewed chemicals that could cause severe acute adverse health effects. EPA found that the severity of acute adverse health effects can be related to the inherent hazards (i.e., hazardous material properties that cannot be changed) of the substances of interest, such as the toxicity of a substance resulting in lethal effects.517 EPA noted that acute adverse health effects also could result from other inherent hazards, such as the flammability or high reactivity of the substance.518 Importantly, it stated that the phenomena associated with these hazards could be, for example, radiant heat from a chemical fire or blast waves from an explosion of a chemical.519 In reviewing the second Risk Management Program listing criteria factor, EPA stated that the likelihood of an accidental release of a chemical can be related to typical usage and handling scenarios, such as equipment commonly used in typical facility operations.520 EPA stated that ubiquitous substances, because of greater handling and use, might have a greater potential for an accidental release.521 The agency observed that a history of a large number of accidents in the past, for example, might be an indicator of an existing hazard related to a particular substance and its potential to be involved in accidental releases in the future.522 Notably, EPA stated that chemicals that are found in large volumes at many locations and chemicals that are particularly prevalent (e.g., commodity chemicals, like chlorine and ammonia) might be more likely to be involved in accidental releases than small-volume, less commonly used chemicals.523 With respect to the last factor to be considered for Risk Management Program listing, EPA found the magnitude of human exposure associated with accidental releases to be related to the severity of the health effects (hazards) and the likelihood of a release (the chance that a release will have an effect on the population of environment beyond the facility fenceline).524 The agency noted that this definition was somewhat different from the traditional risk assessment definition of human exposure, which relates magnitude of exposure to the population and sensitive environments that might be affected by a release from a specific site.525 It recognized that factors that might affect the magnitude of human exposure could be site specific or accident specific and could vary widely by location and incident.526 Significantly, EPA

515 Ibid. 516 Ibid. 517 Ibid. 518 Ibid. 519 Ibid. 520 Ibid. 521 Ibid. 522 Ibid. 523 Ibid. 524 Ibid. 525 Ibid. 526 Ibid.

West Fertilizer Company Final Report January 2016 187 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

also contended that proximity to population centers, for example, might play a role in the magnitude of accidental releases.527 8.4.2.2 Risk Management Program Rule Listing Criteria and Coverage for FGAN CSB reviewed the original listing criteria to determine their application to FGAN and found support for inclusion of FGAN on the Risk Management Program list. First, CSB found a high severity of acute adverse health effects related to accidental releases of FGAN because one of the phenomena associated with the hazards of FGAN as a reactive and as an explosive is blast waves from an FGAN explosion. Acute adverse health effects from blast waves can include not only major injuries (such as fractures and injuries to the head, ears, and eyes), but also death. All of these were reported after the WFC incident. As stated previously, EPA specifically deemed blast waves to be considered in assessing the severity of acute adverse health effects related to accidental releases of the substance. CSB concluded that FGAN meets the second criteria for listing under the Risk Management Program rule because the likelihood of accidental releases of FGAN is high. Before assessing the merits of this listing factor, CSB sought to define such accidental releases and ultimately found that they can be described as emissions of blast waves and thermal energy from FGAN explosions. An accidental release is defined by the CAA Amendments of 1990 as “an unanticipated emission of a regulated substance or other extremely hazardous substance into the ambient air from a stationary source.”528 In general, this definition has been interpreted to apply only to gases and liquids, not to solids such as FGAN.529 However, in its original Risk Management Program rule listing notice, EPA determined the proposed threshold quantity for high explosives530 based on the quantity that could produce potentially lethal blast waves from an explosion at a distance of 100 meters.531 This determination is significant because it supports the conclusion that EPA envisioned blast waves as qualifying as unanticipated emissions when it considered explosives for addition to the Risk Management Program list. CSB also conducted its own research on explosions and emissions. An explosion involves a sudden release of large amounts of energy. This energy release can be dissipated as blast waves, propulsion of

527 Ibid. 528 40 CFR 68.3 529 ARA. “Re: Accidental Release Prevention Requirements: Risk Management Programs under the Clean Air Act, Section 112(r)(7); Request for Information; Docket # EPA-HQ-OEM-2014-0328; FRL-9911-61-OSWER.” October 29, 2014. 530 High explosives represent the category of explosives that might most easily detonate. 59 Federal Register 4487 (January 31, 1994). They are likely to cause severe impacts in detonation scenarios. These explosives were subsequently deleted from coverage in 1998 due to settlement of litigation with the Institute for Manufacturers of Explosives. 63 Federal Register 640 (January 6, 1998). It is important to note, however, that this was not due to any potential misinterpretation of the term “accidental release” (as discussed in the Explosive Substances Section). 531 58 Federal Register 5102 (January 19, 1993).

West Fertilizer Company Final Report January 2016 188 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

debris, or the emission of thermal and ionizing radiation.532 Furthermore, the term “emissions” is not strictly limited to the release of toxic or flammable liquids and vapors. It can refer to the generation of hot gases and overpressures that result from explosions. This interpretation aligns with EPA’s reasoning that explosives can produce accidental releases, as demonstrated by EPA’s original inclusion of high explosives on the Risk Management Program list and by its associated determination of the appropriate threshold quantity for such explosives. CSB supports EPA’s original reasoning that blast waves are emissions for purposes of listing substances under the Risk Management Program rule. In particular, CSB supports that this reasoning should apply to FGAN. CSB concluded that there is a reasonable likelihood of an accidental release of FGAN because FGAN is a ubiquitous commodity chemical that is stored in large volumes at many locations. CSB found that this was true not only at the WFC facility (where the WFC stored 80,000 to 120,000 pounds of FGAN), but also at domestic fertilizer facilities throughout the South and the Midwest where Alabama, Missouri, Tennessee and Texas make up more than 50 percent of FGAN consumption in the United States.533 FGAN also has been involved in a large number of accidents in the past (described in Appendix B). It has been at the center of major disasters such as the Oppau, Germany, incident in 1921 and the Texas City, Texas, incident in 1947; each caused more than 500 fatalities. EPA considered these exact factors (i.e., ubiquity, commodity, volume, and past accident history) to be indicative of whether an accidental release of a substance is likely. Finally, CSB determined the magnitude of human exposure associated with accidental FGAN releases is significant because FGAN storage is commonly located close to many population centers. This was clearly the case in West, Texas, where a playground, four public school buildings, a nursing home, and an apartment complex all surrounded the WFC facility. It is also the case throughout Texas, where many fertilizer facilities are in communities and downtown neighborhoods (noted in Section 5.4). Because of the WFC investigation and other CSB investigations that identified offsite consequences from chemical releases, land use planning and siting of chemical facilities remain important issues for CSB. As discussed previously, EPA considered the proximity of facilities to population centers as a significant determinant of potential impact. The WFC incident demonstrates the validity of this conclusion. After finding that all three listing criteria were satisfied, CSB concludes that FGAN warrants listing under the Risk Management Program rule.

532 Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on November 14, 2015). 533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 2015). Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on November 14, 2015). 533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 2015).

West Fertilizer Company Final Report January 2016 189 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.2.3 Additional Support for Risk Management Program Rule Coverage for FGAN

Besides considering the three listing criteria factors mandated under the CAA, EPA identified other substances based on similarities with the mandated substances and selection criteria.534 EPA considered options that accounted for the inherent hazards of the substances to be listed and for the potential of these hazards to affect the community if an accidental release occurred.535 In particular, EPA analyzed hazards such as toxicity, flammability, reactivity, explosivity, and radioactivity, stating that all of them can result in acute effects after short-term exposure.536 EPA identified substances associated with each of these hazards, but also considered the potential impact that the identified substances would have on the community if a release took place.537 It evaluated each hazard independently, as well as each hazard’s potential to pose a threat to the community.538 Ultimately, a group of toxic substances, a group of flammable substances, and a group of explosive substances were proposed in the January 19, 1993, rule for addition to the 16 mandated substances in the CAA.539 Because they pertain to FGAN, CSB conducted further research on explosives and on reactive substances. Explosive Substances With respect to the group of explosive substances, EPA proposed to focus on physical hazards because of their ability to impact communities beyond the fenceline in the event of an accidental release.540 EPA viewed commercial high explosives, which have the potential to detonate, as the explosive substances with the greatest potential to affect such communities and therefore proposed commercial high explosives as a category for listing.541 In determining the threshold methodology, EPA indicated that a blast wave overpressure of 3.0 psi from a detonation could have potentially lethal effects in communities beyond the fenceline.542 The agency noted that this overpressure level could cause serious structural damage to buildings, lead to serious wounds from flying glass, and potentially cause eardrum rupture.543 The agency also considered reactive substances that have explosive properties, including oxidizers (e.g., pure AN), for listing.544 In its final decision however, EPA deferred listing these types of substances for lack of an adequate technical basis upon which to evaluate offsite consequences from unstable and reactive substances.545 Nonetheless, EPA concluded in its response that “this decision does not preclude the

534 58 Federal Register 5102 (January 19, 1993). 535 Ibid. 536 Ibid. 537 Ibid. 538 Ibid. 539 Ibid. 540 Ibid. 541 Ibid. 542 Ibid. 543 Ibid. 544 Ibid. 545 EPA. “Proposed List of Substances and Thresholds for Accidental Release Prevention: Summary and Response to Comments,” January 14, 1994: 146.

West Fertilizer Company Final Report January 2016 190 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Agency from revisiting this issue in the future, in response to a petition to list, or when the list is reviewed and the listing criteria modified.”546 For several decades, a number of agencies and organizations have regulated materials with explosive potential. ATF regulates the manufacture, processing, use, distribution, and storage of explosive materials; ATF regulations include requirements for licensing, permitting, and recordkeeping and for storage of explosives.547 DOT regulates the transportation of explosives, and other agencies, such as OSHA, Mine Safety and Health Administration (MSHA), Department of Defense (DOD), and International Maritime Organization, regulate certain aspects of the explosive industry.548 In its 1993 Federal Register notice, however, EPA stated that although explosives are regulated by federal, state, and local governments, these regulations do not uniformly address the issue of using appropriate hazard assessment techniques to identify hazards, designing and maintaining a safe facility, and minimizing the consequences of accidental releases when they do occur.549 EPA noted that all of these elements were to be addressed in the Risk Management Program regulations, which it described as “intended to help focus on accident prevention.”550 The agency therefore asserted that these substances should be considered for purposes of list development and accidental release prevention regulations, and for some time, high explosives (classified as Class 1, Division 1.1 on DOT’s Hazardous Materials Table) were included on the final 1994 Risk Management Program list.551 However, DOT Division 1.1 explosives were delisted four years later.552 After promulgation of the Risk Management Program list, the Institute of Makers of Explosives (IME) petitioned against EPA for judicial review, challenging the listing of high explosives.553 IME objections included the contention that existing ATF, DOT, MSHA, and OSHA regulations already adequately controlled DOT Division 1.1 explosives.554 EPA and IME ultimately settled, with EPA agreeing to delist the explosives in exchange for IME’s promise to undertake specific measures to enhance local emergency response.555 CSB found this information important with respect to its investigation because FGAN has explosive properties under certain conditions. Accordingly, CSB conducted research to determine whether FGAN was listed and then delisted along with these DOT Division 1.1 explosives. CSB found that DOT Division 1.1 explosives include one less common form of AN (classified by the United Nations as UN0222) containing more than 0.2 percent carbonaceous material. However, this form of AN is not commercially used or manufactured. Importantly, CSB discovered that FGAN has never

546 Ibid. 547 58 Federal Register 5201 (January 19, 1993). 548 Ibid. 549 Ibid. 550 Ibid. 551 Ibid. 552 79 Federal Register 44607 (July 31, 2014). 553 61 Federal Register 16598 (April 15, 1996). 554 Ibid. 555 Ibid. See also: 63 Federal Register 640 (January 6, 1998).

West Fertilizer Company Final Report January 2016 191 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

been explicitly regulated under the Risk Management Program rule because it is not a DOT Division 1.1 explosive. Furthermore, even if FGAN were a DOT Division 1.1 explosive, the DOT Division 1.1 explosives were never specifically identified by name on the Risk Management Program list. Therefore, AN has never explicitly been listed under the Risk Management Program rule. Nonetheless, CSB found it significant that EPA evaluated explosives, and the effects they can have upon communities in detonation scenarios, when determining the substances to include on the Risk Management Program list.556 Because FGAN can detonate under certain conditions, CSB recommends that FGAN be included for coverage under the Risk Management Program rule. Further support for including FGAN on the Risk Management Program list can be found in EPA’s original inquiry into reactive substances and in CSB’s past work on reactives. Reactive Substances At the time of its 1993 Federal Register notice, EPA was attempting to evaluate the hazards of reactive and unstable chemicals and to develop an adequate technical basis for determining the potential effects on the community.557 For example, EPA investigated computer models that estimate heats of reaction and also the possible use of heats of reaction to compare the effects of an explosion of an unstable substance to the effects of an explosion of TNT.558 EPA stated that this method would only be appropriate for substances that detonate, an outcome that appeared to be unlikely for many unstable substances.559 Ultimately, EPA contended that unstable and reactive substances would be considered for listing for accidental release prevention if the evaluation indicated potential community consequences.560 On the basis of the WFC investigation and on the CSB’s “Improving Reactive Hazard Management” study, CSB recommends that FGAN be added to the Risk Management Program list. In the early 1990s, EPA considered listing reactive substances, such as AN, on the Risk Management Program list.561 Specifically, EPA assessed whether to include chemicals whose reactive properties could cause impacts on nearby communities in the event of an accident.562 In December 2002, CSB issued the study, “Improving Reactive Hazard Management,” which examined reactive hazard management across the United States.563 The study found regulatory coverage of reactive hazards to be a key issue.564 As a result of the study, CSB issued several regulatory recommendations, including the following recommendation to EPA: Revise the Accidental Release Prevention Requirements, 40 CFR 68, to explicitly cover catastrophic reactive hazards that have the potential to seriously impact the public, including

556 58 Federal Register 5102 (January 19, 1993). 557 Ibid. 558 Ibid. 559 Ibid. 560 Ibid. 561 Ibid. 562 Ibid. 563 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001. 564 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 3.

West Fertilizer Company Final Report January 2016 192 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

those resulting from self-reactive chemicals and combinations of chemicals and process-specific conditions. Take into account the recommendations of this report to OSHA on reactive hazard coverage. Seek congressional authority if necessary to amend the regulation.565 Unfortunately, EPA has not initiated rulemaking consistent with CSB’s recommendation more than 10 years since its issuance.566 Therefore, CSB has categorized the status of this recommendation as “Open— Unacceptable Response.”567 Since issuing its reactive hazard investigation study in 2002, CSB has investigated several industrial accidents involving reactive chemicals.568 These are summarized in Table 12. Table 12. CSB Investigations Involving Reactive Chemicals Since 2002 Incident Date Location Severity First Chemical Corp.: Reactive Chemical Explosion October 13, 2002 Pascagoula, MS • 3 injured MFG Chemical Inc.: Toxic Gas Release April 12, 2004 Dalton, GA • 154 hospitalized Synthron Chemical: Explosion July 31, 2007 Morganton, NC • 1 fatality • 12 injured T2 Laboratories Inc.: Reactive Chemical Explosion December 19, 2007 Jacksonville, FL • 4 fatalities • 13 hospitalized Bayer CropScience: Pesticide Waste Tank Explosion August 28, 2008 Institute, WV • 2 fatalities West Fertilizer Company: Explosion and Fire April 17, 2013 West, TX • 15 fatalities • More than 260 injured

It is important to note, however, that Table 12 depicts only those incidents involving reactive chemicals that CSB investigated since 2002. That is, these incidents do not represent the universe of reactive chemical accidents, which is much larger.

565 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 102. 566 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014. 567 See: http://www.csb.gov/recommendations/?F_RecipientId=8 (accessed on December 17, 2015). OSHA’s associated recommendations are also categorized as “Open—Unacceptable Response.” See: http://www.csb.gov/UserFiles/file/CSB-OSHACorrespondence.pdf (accessed on January 15, 2016). 568 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014.

West Fertilizer Company Final Report January 2016 193 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 4.2.3.1.1 General Duty Clause

After the incident, CSB referenced its reactives study in “Preliminary Findings of the CSB from its Investigation of the West Fertilizer Explosion and Fire.”569 With respect to the EPA Risk Management Program rule, CSB specifically stated: In developing the RMP regulation, the EPA did not explicitly include explosives or reactive chemicals in the list of covered chemicals. In 2002, the CSB issued a study on reactive hazards, identifying 167 prior reactive incidents (including a 1994 explosion at an AN manufacturer). The Board recommended that . . . EPA expand [its] standard[] to include reactive chemicals and hazards. However, [EPA has not] yet acted upon the recommendation[].570 On June 6, 2014, after learning the Open—Unacceptable Response status of its recommendation, EPA raised, in a letter to CSB, its concern that CSB had mischaracterized in its reactives study the scope and history of EPA’s use of the CAA Section 112(r)(1), General Duty Clause (GDC).571 Because the GDC is a provision which CSB believes likely could have been used to cite the WFC facility, but was not, CSB conducted further research into the requirement. The GDC is a statutory obligation that makes owners and operators of facilities that possess regulated and other extremely hazardous substances responsible for ensuring that their chemicals are managed safely.572 In CAA Section 112(r)(1), the GDC states: The owners and operators of stationary sources producing, processing, handling or storing such substances [i.e., a chemical in 40 CFR Part 68 or any other extremely hazardous substance] have a general duty [in the same manner and to the same extent as the general duty clause in the Occupational Safety and Health Act] to identify hazards which may result from (such) releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.573 Accordingly, EPA has the authority to apply the GDC to facilities not only after incidents, but also before incidents to prevent them. The GDC is a broad provision with great potential to enhance safety measures at facilities that contain certain hazardous substances. In addressing the hazards associated with reactive substances and application of the GDC, CSB has stated that “many substances are unlikely to be considered ‘extremely hazardous’ since they do not present an inherent catastrophic reactive hazard until combined with other chemicals or under process-specific conditions.”574 This circumstance should not preclude, and EPA affirms has not precluded, such

569 CSB. “Preliminary Findings of the U.S. Chemical Safety Board from its Investigation of the West Fertilizer Explosion and Fire,” June 27, 2013. 570 Ibid. 571 EPA letter to CSB, June 6, 2014. 572 See: http://www2.epa.gov/sites/production/files/2013-10/documents/gdc-fact.pdf (accessed on December 29, 2015). 573 42 U.S.C. § 7412(r)(1). 574 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. March 11, 2014.

West Fertilizer Company Final Report January 2016 194 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

substances from enforcement under the GDC. EPA referenced a 1989 Report of the Senate Environment and Public Works Committee, which stated that the presumption should be that a substance is extremely hazardous if it causes significant adverse impacts by acute toxic effect or “by blast, fire, corrosion or other reaction.”575 The report also states that “extremely hazardous substances” would “include other agents which may or may not be listed” that “as the result of short-term exposures associated with [accidental] releases to the air cause death, injury or property damage due to their toxicity, reactivity, flammability, volatility, or corrosivity.”576 According to this report, therefore, EPA could apply the GDC to reactive substances. However, EPA did not use the GDC to cite the WFC after the incident for its unsafe storage of FGAN. Considering the totality of the EPA regulatory landscape, CSB determined that requirements for facilities to safely store and handle FGAN are insufficient. As discussed, the Risk Management Program rule does not regulate FGAN because FGAN is not on the list of regulated substances. Furthermore, while EPA could use the GDC to impose requirements on facilities to ensure the safe management of FGAN as a reactive substance, EPA does not contend that the GDC is as easy to apply as a regulation. EPA may have been able to apply the GDC against the WFC after the incident, but it did not. Therefore, without more from the GDC, it is the recommendation of CSB that FGAN be included on the Risk Management Program list, especially in light of the fatal incident in West, Texas. 8.4.2.4 Risk Management Program Rule and Coverage of Anhydrous Ammonia As previously discussed, although the WFC was not covered under the Risk Management Program rule for its storage of FGAN, it was covered under Program Level 2577 of the rule for its storage of more than 10,000 pounds, the threshold limit, of anhydrous ammonia. The facility submitted its RMP registration in 1999, 2006,578 and 2011.579 The WFC’s 2006 RMP for anhydrous ammonia included important safety elements to prevent, control, and respond to an anhydrous ammonia release.580 For example, the insurance company conducted a hazard review to identify major release scenarios and address actions that would prevent or mitigate a release.581 Another important feature of the RMP was development of an emergency action plan with step-by-step procedures, detailing how employees should respond to an anhydrous ammonia release.582 Other program elements included operating procedures, maintenance and

575 EPA letter to CSB, June 6, 2014. 576 Senate Committee on Environment and Public Works, CAA Amendments of 1989, Senate Report No. 228, 101st Congress, 1st Session 211 (1989). 577 The WFC fell under Program 2 requirements for its storage of anhydrous ammonia because it did not meet the requirements for Program Level 3 and was not eligible for Program Level 1 coverage. 578 The WFC did not resubmit its RMP registration as it was supposed to in 2004 because of a change in ownership. EPA cited the company in 2006 for failing to refile its RMP in a timely manner. The WFC refiled it in 2006. 579 WFC RMP submissions to EPA. 580 Ibid. 581 Ibid. 582 Ibid.

West Fertilizer Company Final Report January 2016 195 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

inspection programs, training programs, incident investigations, offsite consequence analyses, and compliance audits.583 The Risk Management Program rule also required the WFC to comply with RAGAGEP for anhydrous ammonia, such as ANSI K61.1, “Safety Requirements for the Storage and Handling of Anhydrous Ammonia,” and OSHA’s Storage and Handling of Anhydrous Ammonia regulation (29 CFR 1910.111).584 As previously mentioned, the Risk Management Program list does not include FGAN, so the WFC was not required to take related Risk Management Program safety measures for FGAN. Of course, FGAN coverage under the Risk Management Program rule likely would have increased awareness of the explosion hazards of FGAN, leading to better management of the substance through compliance with federal safety regulations and best industry practices. If EPA had included FGAN under the Risk Management Program rule, the WFC would have been required to apply it for its storage of FGAN and perhaps could have reduced the risk of catastrophic accidents like the one that occurred at the WFC. 8.5 Emergency Planning The CSB investigation of the WFC incident identified the explosive potential of FGAN. CSB further found that no immediate evacuation at the first sign of fire occurred, in part because no in-place emergency plan addressed response specifically to an incident at the WFC warehouse. This situation left emergency responders and the West community unaware of the urgent need to evacuate. For FGAN facilities, there must be a well-exercised local emergency plan that emphasizes immediate notification to emergency responders and the community at the first sign of fire, as well as evacuation protocols. If there was an immediate evacuation once the fire was detected at the WFC, the number of fatalities and injuries likely would have been lower. Emergency planning is part of emergency management, which includes four different stages: (1) mitigation, (2) planning, (3) response, and (4) recovery. The nation’s emergency management system is intended to prepare communities for all types of hazards, including natural disasters, terrorism, and hazardous materials (HAZMAT) incidents. The responsibilities of emergency management personnel are shared among federal agencies that provide assistance through funding and training. For example, DHS primarily focuses its efforts on terrorism and natural hazards and also serves as the umbrella organization for other agencies that supply assistance to state and local authorities. Other federal agencies such as EPA and OSHA have emergency planning regulations for environmental and occupational accidents involving HAZMAT. The next sections discuss these regulations at the federal, state, and city levels and discuss their relevance to the WFC incident.

583 Ibid. 584 40 CFR 68.48(b).

West Fertilizer Company Final Report January 2016 196 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5.1 Federal Emergency Planning

In response to growing concerns about the safety and health of people and the environment after releases of hazardous substances in the U.S. in the 1970s and 1980s and the disaster in Bhopal, India, Congress passed new laws authorizing EPA and OSHA to regulate these risks. One was the Emergency Planning and Community Right-to-Know Act (EPCRA) of 1986, which was intended to address concerns about local preparedness for chemical emergencies and to ensure public access to information. EPCRA established a framework for states to organize resources to pre-plan for chemical accidents. EPCRA requirements include: (1) emergency planning (SARA Title III, Sections 301–303); and (2) emergency and hazardous chemical inventory reporting (SARA Title III, Sections 311 and 312).585 Each section of EPCRA covers a subset of chemicals and the statute and EPA regulations specify quantities that trigger reporting requirements (Table 13).586 Because they are pertinent to the WFC incident, requirements for emergency planning and hazardous chemical inventory reporting are discussed in greater detail. Table 13. EPCRA Chemicals and Reporting Thresholds

Section 302 Sections 311 and 312 Chemicals Covered 355 extremely hazardous substances (EHSs) Approximately 500,000 hazardous chemicals Thresholds Threshold planning quantity (TPQ): 1 to 10,000 lbs. onsite at any one time 500 lbs. or TPQ, whichever is lower, for EHSs; 75,000 gallons for gasoline; 100,000 gallons for diesel; and 10,000 lbs. for all other hazardous chemicals

EPCRA emergency planning establishes, in part, requirements for sharing information among industry and state, tribal, and local governments. As shown in Table 13, under Section 302, a facility that has an extremely hazardous substance (EHS) at or above its specific threshold planning quantity (TPQ) must report the substance. Reporting of EHSs, as well as other hazardous chemicals under Sections 311 and 312, must be made to the State Emergency Response Commission (SERC), Local Emergency Planning Committee (LEPC), and local fire department.587 State governors designated the SERCs which then designated roughly 3,500 local emergency planning districts and LEPCs for each district.588 At minimum, LEPCs must be composed of elected state and local officials; police, fire, civil defense, public health, transportation, and environmental professionals; representatives of facilities subject to EPCRA emergency planning requirements; community groups; and

585 Regulations implementing EPCRA are codified at 40 CFR Parts 350–372. 586 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 587 The local fire department receives only inventory information under Sections 311 and 312. 588 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 197 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the media.589 SERCs are supposed to supervise and coordinate the activities of LEPCs, establish procedures for receiving and processing public requests for information, and review local emergency response plans.590 LEPCs are supposed to develop emergency response plans, review the plans annually, and provide information to the public.591 EPCRA emergency planning also requires LEPCs to develop and update emergency response plans. LEPCs are supposed to use information reported by facilities to develop these plans, which cover procedures that describe how emergency responders should respond to chemical releases.592 The plans must (1) identify EHS facilities and transportation routes; (2) describe emergency response procedures, onsite and offsite; (3) designate a community coordinator and facility coordinators to implement the plan; (4) outline emergency notification procedures; (5) explain the means to determine the probable area and population affected by chemical releases; (6) describe local emergency equipment and facilities and the people responsible for them; (7) outline evacuation plans; (8) provide a training program for emergency responders (including schedules); and (9) detail methods and schedules for exercising emergency response plans.593 Importantly, EPCRA emergency planning requirements mandate the identification of facilities with EHSs only; identification of facilities without EHSs is not required. Thus, although facilities must report EHSs and certain non-EHSs (i.e., other hazardous chemicals under Sections 311 and 312), only facilities with EHSs trigger EPCRA emergency response plan requirements.594 For purposes of the WFC investigation, CSB determined that while anhydrous ammonia is on the EHS list, FGAN is not. CSB found, however, that AN is on the list of hazardous chemicals under Sections 311 and 312 that triggers emergency and hazardous chemical inventory reporting requirements. EPCRA emergency and hazardous chemical inventory reporting requires reporting of certain quantities of EHSs and hazardous chemicals. As shown in Table 13, under Sections 311 and 312, an EHS must be reported if it is held at the lower of 500 pounds or the substance’s TPQ, gasoline must be reported at 75,000 gallons, diesel must be reported at 100,000 gallons, and all other hazardous chemicals must be reported at 10,000 pounds.595 These reporting requirements are tied to OSHA’s Hazard Communication Standard (29 CFR 1910.1200). This standard requires employers to maintain SDSs for all hazardous chemicals in the workplace.596 SDSs contain crucial information, including chemical and hazard

589 Ibid. See also: 42 U.S.C. §11001(c). 590 Ibid. See also: 42 U.S.C. §11001(a). 591 Ibid. See also: 42 U.S.C. §11001(c). 592 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 593 Ibid. See also: 42 U.S.C. §11003(c). 594 It should be noted that EPA has suggested, through guidance to SERCs and LEPCs (including the most recent fact sheet to these entities), that they include Sections 311 and 312 facilities in their planning process. 595 See: http://www.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 596 Ibid.

West Fertilizer Company Final Report January 2016 198 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

identification; ingredient composition; first aid measures; firefighting measures; accidental release measures; handling and storage precautions; exposure controls and personal protection; physical and chemical properties; stability and reactivity properties; toxicological information; ecological concerns; disposal considerations; transport information; regulatory requirements; and other information.597 Facilities must maintain SDSs onsite and submit copies of them (or a list of SDS-covered chemicals) to their SERCs, LEPCs, and local fire departments.598 Facilities covered by Section 311 must also submit Emergency and Hazardous Chemical Inventory forms to their SERCs, LEPCs, and local fire departments annually.599 Facilities provide either a Tier I or Tier II inventory form.600 Tier I inventory form include the following aggregate information for each applicable hazard category: • An estimate (in ranges) of the maximum amount of hazardous chemicals for each category present at the facility at any time during the preceding calendar year. • An estimate (in ranges) of the average daily amount of hazardous chemicals in each category. • The general location of hazardous chemicals in each category.601 The Tier II inventory form contains basically the same information as the Tier I, but it must list the specific chemicals. Tier II inventory form provide the following for each chemical: • The chemical name or the common name as indicated on the SDS. • An estimate (in ranges) of the maximum amount of the chemical present at any time during the preceding calendar year and the average daily amount. • A brief description of the manner of storage of the chemical. • The location of the chemical at the facility. • An indication of whether the owner elects to withhold location information from disclosure to the public.602 Information submitted under Sections 311 and 312 is available to the public from SERCs and LEPCs.603

597 See: https://www.osha.gov/Publications/HazComm_QuickCard_SafetyData.html (accessed on December 29, 2015). OSHA does not enforce the ecological information, disposal considerations, transport information, and regulatory information sections of SDSs because other agencies regulate this information. 598 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 29, 2015). 599 Ibid. 600 Ibid. 601 Ibid. 602 Ibid. It is important to note that under Section 312(f), upon request by the fire department with jurisdiction over the facility, owners/operators must provide fire departments with location information. They must also allow fire departments to conduct onsite inspections. 603 Ibid.

West Fertilizer Company Final Report January 2016 199 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 5.2 State Emergency Planning in the State of Texas

Texas has suffered some of the worst disasters in U.S. history, both in kind and magnitude. One of the first was the devastating hurricane in Galveston in 1900, which almost destroyed the city and killed thousands. In 1937, in New London, a gas leak explosion destroyed a school and killed approximately 300 students and teachers. Ten years later, the FGAN explosion in Texas City inflicted an enormous loss of life and property that remains unknown to this day; it is ranked as one of the worst industrial accidents in U.S. history.604 As a result of these disasters, Texas enacted statutes to address all-hazard emergency management.605 The Texas Disaster Act of 1975 requires local jurisdictions to designate an emergency management coordinator to develop an emergency operations plan composed of a basic plan with 22 annexes.606 The basic plan and its annexes outline guidance for emergency management activities and assign roles and responsibilities to local agencies.607 Although the basic plan offers general guidance, the annexes provide more detail.608 For example, Annex Q, “Hazardous Materials and Oil Spill Response,” identifies the HAZMAT incidents that could occur in a specific community and how such an incident would likely affect nearby populations.609 Once a hazard is identified, appropriate response actions must be planned, including timely notification, identification of evacuation routes, and assignment of roles and responsibilities.610 Training exercises and drills must also test response effectiveness.611 When Congress enacted EPCRA in 1986, its provisions were incorporated into Texas’s existing emergency planning framework and into state codes.612 The SERC is the Emergency Management Council of Texas and includes participation from multiple state agencies.613 Within that group of agencies, 10 are considered to be SERC members with specific roles in emergency response and planning. For example, the TCEQ is responsible for receiving reports about accidental spills and releases;614 the Texas Department of State Health Services is designated to receive the Tier I or Tier II Emergency and Hazardous Chemical Inventory forms submitted electronically by facilities;615 and the Texas Department of Public Safety, Division of Emergency Management, is tasked with overseeing the

604 Texas Emergency Management Executive Guide (FY 2014 Edition). 605 Ibid. 606 Texas Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 607 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 608 Ibid. 609 See: McLennan County. Annex Q: Hazardous Materials & Oil Spill Response. Version 2.4, July 2009. 610 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 611 Ibid. 612 Texas Health and Safety Code, Title 6, Subtitle D, “Hazardous Substances,” Chapters 505 through 507. Texas Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 613 Texas Department of Public Safety. See: https://www.txdps.state.tx.us/dem/stateLocalOrganizations.htm#EMC (accessed on December 29, 2015). 614 See: https://www.tceq.texas.gov/response/spills (accessed on December 29, 2015). 615 This designation has changed since the date of the WFC incident. The Tier II Chemical Reporting Program has moved to the TCEQ. See: https://www.dshs.state.tx.us/tiertwo/ (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 200 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

all-hazard emergency management program and providing guidance and funding for cities, counties, and state agencies so that they can develop their own programs.616 8.5.3 City Emergency Planning in the City of West To fully understand the WFC incident, this section reviews emergency planning and management in West and at the WFC facility. West is located in McLennan County, which is West’s local emergency management district and which formed an LEPC in 1992. The McLennan County LEPC meets four times per year.617 Its members are nominated by the county judge and approved by the SERC.618 The LEPC membership consists of city, industry, hospital, and emergency response officials.619 CSB found that the WFC, however, was not listed on the attendance roster for any LEPC meeting for more than 21 years. As required by both state and federal regulations, the McLennan County LEPC prepared an emergency response plan (ERP) in accordance with guidance from the Texas Department of Public Safety, Division of Emergency Management.620 As discussed previously, this consisted of a basic plan with 22 annexes. It described in part McLennan County’s approach toward emergency planning, response, and notification. McLennan County officials review the plan annually and officially revise or update it every 5 years, as required by Texas law.621 Prior to the WFC incident, McLennan County last formally reviewed its ERP in 2010.622 The McLennan County ERP includes procedures on how to alert the public when natural or human- initiated disasters occur. ERP annexes describe actions to take in various scenarios, such as how to disseminate information quickly,623 how to warn special facilities (e.g., hospitals and schools) and populations of a hazard,624 and how to use alert systems to activate immediate evacuation.625 A vital component of ERPs and ERP annexes is LEPC engagement and communication. Without these, community members might not have the necessary information to respond appropriately to a specific type of incident. For example, on February 12, 2013, WIS was temporarily evacuated because of a controlled burn at the WFC facility. Before the evacuation, the school principal alerted 911 of the fire, but the 911 dispatcher did not acknowledge a coordinated burn. Students and staff were evacuated for approximately 30 minutes to WMS, using coordinated transportation. The WFC did not notify the WISD or WIS in advance that the

616 See: https://www.txdps.state.tx.us/internetforms/Forms/TDEM-10.pdf (accessed on December 29, 2015). 617 McLennan County LEPC Bylaws, Article II, Section 5, “Meetings.” 618 McLennan County LEPC Bylaws, Article II, Section 1, “Membership.” 619 Ibid. 620 State of Texas. Local Emergency Planning Committee (LEPC): A Primer for Local Planning for Hazardous Materials, July 2006. 621 Texas Administrative Code, Title 37, Part 1, Chapter 7, Subchapter B, Rule 7.12. 622 CSB reviewed the 2010 McLennan County ERP for this investigation report. 623 McLennan County Basic Plan, Annex I. 624 McLennan County Basic Plan, Annex E. 625 Ibid.

West Fertilizer Company Final Report January 2016 201 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facility was conducting a controlled burn of pallets and brush. After this incident, the WISD asked the emergency service providers and the WFC to provide advance notice of future burning activities. The WFC could have communicated its plans to the WISD or WIS through LEPC activities. The McLennan County ERP specifically includes Annex Q, “Hazardous Material and Oil Spill Response,” which requires identification of all regulated facilities within the county.626 Such facilities are those that are regulated by EPCRA. In particular, a regulated facility is: A plant site where handling/transfer, processing, and/or storage of chemicals is performed. For the purposes of [Annex Q], regulated facilities (1) produce, use, or store EHSs in quantities which exceed threshold planning quantities or (2) hold one or more hazardous chemicals in a quantity greater than 10,000 pounds at any time.627 Because the WFC was regulated by EPCRA, it would follow that Annex Q might list the WFC. However, the WFC was not listed. EPCRA covered the WFC for at least two reasons. First, the WFC stored anhydrous ammonia in quantities that exceeded the anhydrous ammonia TPQ of 500 pounds. Specifically, CSB found that the WFC reported holding 34,000 pounds of anhydrous ammonia at the time of the incident. Clearly, the WFC had onsite sufficient amounts of an EPCRA Section 302 EHS. This triggered not only reporting requirements, but also emergency response planning requirements.628 Thus, the WFC should have been listed in Annex Q for its EPCRA-regulated storage of anhydrous ammonia. Second, the WFC stored FGAN, a hazardous chemical under EPCRA Sections 311 and 312, in quantities that exceeded the AN threshold quantity of 10,000 pounds. In particular, CSB found that the WFC reported 80,000 to 120,000 pounds of FGAN onsite at the time of the incident. As such, the WFC was required to report its quantities of FGAN under EPCRA. CSB obtained WFC Tier II form documents, dated from 2000 to 2012, and found that the WFC annually reported its quantities of anhydrous ammonia to the WVFD, McLennan County LEPC, and Texas Department of State Health Services, but reported its FGAN only in its 2012 Tier II report. Ideally, under the best set of circumstances, the WFC should have been listed in Annex Q for its storage of FGAN. The WFC was not listed in Annex Q, however, due to a misunderstanding of EPCRA’s agricultural use exemption. EPCRA’s agricultural use exemption is a statutory exemption to the definition of “hazardous chemical.” It reads: Hazardous Chemical Defined. For purposes of this section, the term “hazardous chemical” has the meaning given such term by section 1910.1200(c) of title 29 of the Code of Federal

626 McLennan County Basic Plan, Annex Q. 627 Ibid. 628 The WFC was also expected to develop an emergency response plan for its storage of anhydrous ammonia, as required by the Risk Management Program rule. According to EPA, the EPCRA plan and the RMP must be coordinated. See: http://www2.epa.gov/sites/production/files/2013-11/documents/chap-08-final.pdf (accessed on December 29, 2015). However, no evidence indicated that the WFC RMP was shared with the LEPC or the WVFD.

West Fertilizer Company Final Report January 2016 202 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Regulations, except that such term does not include the following: . . . Any substance to the extent it is used in routine agricultural operations or is a fertilizer held for sale by a retailer to the ultimate customer.629 It is important to note that this exemption may apply only to Sections 311 and 312 reporting requirements; it does not apply to emergency planning requirements under Section 302. Furthermore, the agricultural use exemption applies directly to the hazardous chemical itself, not the specific individual or entity holding the chemical. That is, the exemption does not relieve an individual or entity of its responsibilities; rather, the individual or entity is exempt from EPCRA reporting requirements if the chemical in question is exempt. Where individuals or entities hold multiple chemicals, each chemical must be assessed individually to determine exemption status. The agricultural use exemption impacts those who use substances in “routine agricultural operations” and retailers who hold substances as fertilizer for sale to the ultimate customer. With respect to those who use substances in routine agricultural operations, CSB referred to guidance on EPA’s website that, in response to a question asking which hazardous chemicals are reportable for farmers under Sections 311 and 312, states: Under Section 311(e)(5), any substance when used in routine agricultural operations is exempt from reporting under Section 311 and 312. This exemption is designed to eliminate the reporting of fertilizers, pesticides, and other chemicals when stored, applied, or otherwise used at the farm facility as part of routine agricultural activities. . . . Thus, the storage and use of a pesticide or fertilizer on a farm would be considered the use of a chemical in routine agricultural operations and is, therefore, exempt under Sections 311 and 312.630 The belief is that minimal risk is involved when farmers use a substance in routine agricultural operations because farmers promptly apply those substances to their crops. Therefore, the exemption eliminates EPCRA reporting requirements under Sections 311 and 312 for at least certain farmers. However, for retailers who hold a substance as fertilizer for sale to the ultimate customer, CSB found that although EPA has published several hypothetical-based questions and answers on its website, it offers little general guidance. CSB discovered that the McLennan County LEPC reported that the WFC’s storage of anhydrous ammonia and FGAN appeared to qualify under EPCRA’s agricultural use exemption, a conclusion which the county stated was also confirmed by the SERC. The WFC’s anhydrous ammonia and FGAN were erroneously considered exempt from both emergency planning and hazardous chemical inventory reporting requirements because of the phrase “fertilizer held for sale by a retailer631 to the ultimate customer” and because the main WFC customers who bought fertilizer were nearby farmers (ultimate

629 EPCRA, Section 311(e)(5). 40 CFR 370.66. 630 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/211416278-What-hazardous-chemicals-are- reportable-for-farmers-under-311-and-312- (accessed on December 29, 2015). It should be noted, however, that although farmers may be exempt under Section 311(e)(5) from reporting these fertilizers in their Sections 311 and 312 reports, they are still required to notify the SERC (or TERC), LEPC (or TEPC), and local fire department under Section 302 if they have an EHS at or above its TPQ. 631 There is no definition of “retailer” under EPCRA.

West Fertilizer Company Final Report January 2016 203 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

customers / end users). This reason likely explains why the McLennan County LEPC ERP did not include the WFC for its storage of anhydrous ammonia, despite the fact that the exemption does not relieve reporting requirements for EHSs under Section 302. Because the WFC facility not only sold pure fertilizer but also blended chemicals to make fertilizer (e.g., for custom orders), CSB also examined how the agricultural use exemption applies to blends. EPA states that chemicals “held for the purpose of producing fertilizer” are “starting materials used to make a fertilizer,” not the fertilizer itself, so the retailer therefore should report them.632 EPA recognizes, however, that if those chemicals are not blended but rather sold individually to the end customer, then those chemicals are exempt.633 EPA confirmed this position in a September 3, 2010, letter to TFI, stating that the “mixing of fertilizers” must be reported and reiterating that “fertilizer held for sale by a retailer to the ultimate customer . . . is one that is merely held for sale, not one that is mixed or formulated.”634 To bolster its reasoning, EPA further explained: Congress’ intent was to focus Section 311/312 reporting on manufacturers and wholesalers— those are facilities that typically have large quantities of fertilizer, and that use and manufacture a wide range of chemical compounds. Congress appreciated that such manufacturers and wholesalers presented significant risks that needed to be addressed by emergency response authorities, but that mere retailers did not. Assuming arguendo that Congress’ intent is ambiguous, the above interpretation is one that EPA adopts as being the most reasonable interpretation of the statute. Therefore, consistent with the Agency’s prior Q&A guidance, the amount of chemicals intended for blending and the new product should be reported under Section 311 and 312 if the reporting thresholds are exceeded.635 On this basis, facilities that blend chemicals to make fertilizer such as the WFC should not apply the agricultural use exemption to those chemicals meant for blending. However, there is confusion about both who specifically qualifies for the exemption as well as the issue of blending because, although hypothetical-based Q&As are available, limited general EPA guidance exists. Therefore, EPA should develop a general guidance document pertaining to EPCRA’s agricultural use exemption and make a widespread effort to communicate its contents to the fertilizer industry. Since the incident, the Agricultural Retailers Association (ARA), a nonprofit trade association that represents the interests of agricultural retailers and distributors on legislative and regulatory issues, issued an alert to its members on May 14, 2013, warning agricultural retailers that blend (i.e., use nonchemical reactions to mix) dry fertilizers to report those fertilizers on their annual Tier I or Tier II inventory reports submitted to SERCs, LEPCs, and local fire departments. The alert also warned members that EPA has

632 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/212089537-Are-hazardous-chemicals-blended- for-fertilizer-exempted-under-agricultural-use-exemption- (accessed on December 29, 2015). 633 Ibid. 634 Dana S. Tulis, EPA Acting Director Office of Emergency Management. Letter to Chris S. Leason, counsel to TFI, September 3, 2010. 635 Ibid.

West Fertilizer Company Final Report January 2016 204 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cited agricultural retailers for incomplete inventory forms.636 TFI further noted in a verbal statement on November 15, 2013, at the Washington, DC, “Listening Session Regarding President Obama’s Executive Order Improving Chemical Facility Safety and Security”: As most of you know, there is a fertilizer retail exclusion for reporting under EPCRA. TFI supports removal of this exclusion. We feel everyone should report hazardous chemicals stored on site to the LEPC and SERC and work with local fire departments without exception.637 Despite these post-incident efforts, the ARA and TFI cover only some of the thousands of FGAN facilities in the United States. Consequently, EPA should take steps to ensure that fertilizer facilities fully comply with EPCRA and do not mistakenly apply the agricultural use exemption. In fact, EPA already hosted, from May to September 2014, 32 workshops for members of Local Emergency Planning Committees, which were held in Texas, Arkansas, Louisiana, Oklahoma, and New Mexico and attended by 1,340 representatives from local, state, and federal government as well as industry.638 It also recently released an online training module of key requirements for SERCs and LEPCs and a factsheet, “How to Better Prepare Your Community for a Chemical Emergency: A Guide for State, Tribal, and Local Agencies.”639 While these efforts demonstrate progress, CSB believes the development of more general EPCRA guidance, as well as a guidance document on the agricultural use exemption, could help significantly improve emergency planning at all levels. 8.5.4 Other Emergency Planning Requirements During the course of its investigation, CSB also found issues in emergency planning related to FGAN training and compliance with OSHA’s Hazardous Waste Operations and Emergency Response (HAZWOPER) standard (29 CFR 1910.120). CSB determined that employees at the WFC had limited training on FGAN hazards. The agency learned through interviews that some WFC employees were unaware that the FGAN fertilizer stored onsite could explode. Many said the April 1995 Oklahoma City bombing was the only basis of their knowledge of this. Nonetheless, WFC employees generally understood FGAN security regulations so as to verify that customers buying FGAN were registered and were using it only for agricultural purposes. CSB found that the lack of formal training at the WFC was a central reason why employees were largely unaware of FGAN hazards. Some WFC employees recalled having discussions about avoiding FGAN contact with heat, fire, and moisture. However, CSB concluded that FGAN safety training was inconsistent and that no formal training addressed FGAN hazards or required discussion of the FGAN SDS. WFC employees also lacked formal training on the facility’s ERP for anhydrous ammonia. Employees informally shared information

636 Unfortunately, the alert, even if made before the date of the incident, would have had little impact on the WFC because the facility was not a member of the ARA. 637 See: http://www.tfi.org/media-center/news-releases/tfis-verbal-statement-presented-nov-15-washington-dc- listening-session-re (accessed on December 29, 2015). 638 See: https://www.osha.gov/chemicalexecutiveorder/EO13650FS-ImprovingChemicalFacilitySafety.pdf (accessed on December 29, 2015). 639 Ibid.

West Fertilizer Company Final Report January 2016 205 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

so that they knew to evacuate as far as possible if such a release occurred. They also knew which emergency numbers to call. However, much of the WFC employee training was hands on and job specific. Thus, a lack of comprehensive emergency planning and response training played a role in how the incident unfolded. In addition, CSB discovered issues with OSHA’s HAZWOPER standard, which too is an integral element of emergency planning. Under the HAZWOPER standard, the WFC was required to develop an ERP for all “hazardous substances.” As defined by the standard, hazardous substances include those covered by EPA or DOT.640 FGAN meets this definition because it is listed in DOT’s Hazardous Materials Table.641 The WFC was therefore required to develop a HAZWOPER ERP, or would be considered exempt if it met another OSHA standard, Emergency Actions Plans (29 CFR 1910.38).642 The HAZWOPER ERP should have addressed pre-emergency planning and coordination with outside parties, personnel roles, lines of authority, training and communication, emergency recognition and prevention, safe distances and places of refuge, site security and control, evacuation routes and procedures, decontamination, and emergency medical treatment and first aid.643 However, no evidence indicated that the WFC developed the HAZWOPER ERP or was considered exempt under the Emergency Action Plans standard for FGAN. Consequently, OSHA cited the WFC after the incident for not providing an FGAN-related HAZWOPER ERP. 8.6 Fire Protection Codes and Standards Fire protection codes and standards generally refer to the most recently developed practices to protect people and property from fire and natural disasters. When adopted by states or local jurisdictions, codes (including building, electrical, plumbing, mechanical, and other codes) represent mandatory regulations. Standards, on the other hand, provide methods to achieve compliance with codes. Both codes and standards must be adopted through some process, usually state-level fire or building codes. The legislature must enact that adoption before a fire protection (or prevention) code or standard applies. Because fire and building codes may also include references to many standards, such standards are generally not adopted separately but instead are included once the fire or building code is adopted. Fire codes specify practices that must be followed; that is, codes are mandatory only if adopted. In contrast, fire protection standards typically refer to practices that, despite their mandatory language, are voluntary unless adopted into law (e.g., as a state fire code). The nation’s leading fire protection codes and standards are issued by the NFPA and the International Code Council (ICC). Both employ a public consensus process to produce model codes and standards that jurisdictions can adopt into law. The NFPA updated its current code for FGAN, NFPA 400 (Hazardous Materials Code) Chapter 11, after the WFC

640 29 CFR 1910(a)(3). 641 49 CFR 172.101. 642 29 CFR 1910.120(q)(1). 643 29 CFR 1910.120(q)(2).

West Fertilizer Company Final Report January 2016 206 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incident to address the conditions that likely led to the FGAN detonation. The ICC’s International Fire Code (IFC) also addresses storage and handling of oxidizing materials. Texas does not have a state-wide fire code and as a result, most fire departments in the state have no authority to inspect facilities against, or compel them to follow the safe practices outline in these codes, unless a fire code is adopted at the county or city level. In July 2015, the Texas Department of Insurance did adopt NFPA 1 (Fire Code) for inspections by the Texas State Fire Marshal’s office on the complaint of any person. However, even if fire protection standards are incorporated into state and local fire codes, catastrophic incidents can occur when such standards are deficient. CSB reviewed the ICC IFC and NFPA 1 (Fire Code). The IFC is in use or adopted in 42 states,644 and NFPA 1 is adopted statewide in 19 states. CSB also researched fire protection codes on the state, county, and city levels—specifically, in the state of Texas, in McLennan County, and in the city of West. The first part of this section describes the NFPA, with details on the NFPA standard for FGAN. The second part of this section describes the ICC, with details on how it addresses HAZMAT. The third and last part of this section describes fire code regimes on a more local level and analyzes codes in Texas, which can be improved to better protect emergency responders and the public from fire events. 8.6.1 National Fire Protection Association The NFPA is an international nonprofit organization that develops and publishes industry consensus codes and standards, guides, and recommended practices associated with fire prevention and related hazards. Companies can voluntarily comply with NFPA codes and standards or can be required to follow a standard if it is adopted by reference in local, state, or federal laws (e.g., in a local or state fire code). Many of the NFPA codes and standards are also incorporated in OSHA regulations. The EPA Risk Management Program rule and OSHA PSM standard regulations require owners and operators of covered facilities to ensure that facility processes are designed to comply with RAGAGEP, which can include NFPA codes and standards. However, if these consensus codes and standards are deficient, they can lead to insufficient protections. 8.6.1.1 NFPA Code for FGAN AN requirements were first covered by NFPA 490 (Storage of Ammonium Nitrate), which was adopted in

1. In 2010, NFPA withdrew NFPA 490 when it was incorporated into NFPA 400 (Hazardous

Materials Code). NFPA 400 establishes provisions for the storage, use, and handling of a number of hazardous substances, using four broad categories addressing building construction, storage requirements, fire protection systems, and general protections against fire. The 2013 edition had been published and was in effect at the time of the incident. The code has a specific chapter on AN (Chapter 11, “Ammonium Nitrate Solids and Liquids”). This distinguishes AN from other chapters because other chapters of the code are organized by chemical

644 The IFC is also adopted in the District of Columbia, NYC, Guam and Puerto Rico.

West Fertilizer Company Final Report January 2016 207 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

properties (such as “oxidizers” or “unstable or water reactive materials”) that can each apply to several chemicals. The scope of Chapter 11 covers “the storage, use, and handling of solid or liquid AN” in quantities exceeding 1,000 pounds. The chapter does not include FGAN manufacturing operations or the composition of FGAN designated as DOT hazard Class 1 explosives. The NFPA 400 code includes provisions for indoor and outdoor storage, fire protection systems, and general use; annexes offer additional guidance. In addition, the maximum allowable quantity (MAQ) designation is used in building and fire codes when addressing the storage, handling, and use of HAZMAT. The MAQ is integral to the NFPA 400 approach. It includes provisions for classifying materials, determining their MAQs, and adding other protective features if the intention is to use greater quantities of material. When evaluating the provisions in NFPA 400 (2013 Edition) against the factors that likely contributed to the WFC incident, CSB found code deficiencies concerning scope, building design, storage practices, and fire prevention and firefighting response for facilities that store bulk FGAN. However, it is important to note that the WFC would not have been required to comply with the code at the time of the incident unless the authority having jurisdiction enforced it retroactively. The WFC facility was constructed in 1962, so the requirements of NFPA 400 did not apply. Nonetheless, in response to some of the lessons learned from the WFC incident, CSB and other agencies and organizations participated in meetings with the NFPA Technical Committee on Hazardous Chemicals to provide input on the next revision of NFPA 400 (2016 Edition). A significant effort of the NFPA Technical Committee focused on addressing the requirements for existing FGAN storage facilities covered under NFPA 400 because the previous editions had primarily covered requirements for new facilities.645 As discussed, the wood construction of the WFC warehouse and bins that stored FGAN not only assisted in the rapid spread of the fire but also increased the sensitivity of the material that led to the detonation. In addition, the WFC warehouse had no installed fire detection or suppression systems, allowing the fire to spread through the building. If a building fire detection system had been operational, the early stages of the fire possibly could have been extinguished. Furthermore, sprinklers could have extinguished the fire before it could heat the FGAN pile sufficiently to produce a detonation. Similar to the OSHA Explosives and Blasting Agents standard, NFPA 400 (2013 Edition) allowed wood and combustible construction materials for bulk storage bins for FGAN as long as the bins were “protected against impregnation by FGAN.” The code noted in an annex that sodium silicate, epoxy coatings, or polyvinyl chloride (PVC) coatings were acceptable means to achieve this protection. However, the method used to coat the wood to resist FGAN impregnation does not prevent a fire. The presence of combustibles during a fire can create explosive conditions within a building that stores bulk FGAN. NFPA 400 (2016 Edition) now prohibits the use of combustible materials for all construction and bins at new facilities, even when coatings are applied to protect against FGAN impregnation.

645 Pearce, Nancy. “Safer Storage.” NFPA Journal, May 1, 2015.

West Fertilizer Company Final Report January 2016 208 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

However, the 2016 revisions to NFPA 400 do not apply the same requirements to prohibit combustible construction at existing facilities. The NFPA was challenged to reasonably specify construction requirements for facilities with combustible construction, which comprise the majority of FGAN storage facilities.646 To address existing facilities, NFPA 400 (2016 Edition) contains the new Section 11.1.5, “Protection of Existing Buildings.” This includes requirements that apply retroactively, where adopted, for existing buildings with combustible content. Facilities are required to install automatic fire sprinkler and detection systems. Activation of the fire detection system must automatically initiate an audible and visual alarm at the facility as well as a public notification or alert system to warn individuals located within one mile of the facility that they need to evacuate. Another shortcoming of NFPA 400 (2013 Edition) lies in Annex E, “Properties and Uses of Ammonium Nitrate and Fire-Fighting Procedures,” which called for large volumes of water to be applied as quickly as possible unless the fire reached “massive and uncontrollable proportions,” when responders were advised to evacuate and withdraw to a safe location. CSB found this guidance to be vague because the user had to determine when to categorize a fire as “massive and uncontrollable” and when to make the decision to evacuate rather than attempt to extinguish the fire. Because of FGAN’s unpredictable nature, immediate evacuation should be the first action for responders, using a minimum evacuation distance calculated in advance based on the quantity of FGAN stored. The 2013 edition of NFPA 400 did not require pre- planning, but given the events that unfolded during the WFC response, firefighters should also have a pre- incident plan to facilitate quick and effective decision making when responding to an FGAN fire. NFPA 400 (2016 Edition) now requires new and existing facilities to have emergency action plans that clearly state that “fire potentially affecting FGAN storage beyond the initial (incipient) stage shall not be approached by facility personnel.”647 The emergency plan must also specify whether the FGAN storage facility has a sprinkler system and whether it is constructed of combustible materials. For new facilities, the plan must establish a safe evacuation distance based on an approved648 analysis of potential offsite consequences. If no analysis has been performed, a distance of one mile should be used. The revised Annex E of NFPA 400 (2016 Edition) offers additional guidance to firefighters, including information on the conditions that cause FGAN explosions. The guidance states that only incipient fires in FGAN storage areas (or in vehicles transporting FGAN) should be attacked by using manual fire extinguishing methods that require a human operator.649 Firefighters should withdraw to a safe distance and allow the structural fire to burn to completion once it progresses beyond the incipient stage.650

646 Ibid. 647 NFPA. NFPA 400: Hazardous Materials Code, 2016 Edition. Quincy, MA: NFPA, 2016. 648 Plan approvals are performed by the authority having jurisdiction, such as the fire department or fire marshal. 649 NFPA. NFPA 400: Hazardous Materials Code, Annex E, 2016 Edition. Quincy, MA: NFPA, 2016. 650 NFPA 400 (2016 Edition) states that “responses to incipient releases of hazardous materials where the material can be absorbed, neutralized, or otherwise controlled at the time of release by employees in the immediate release area, or by maintenance personnel, shall not be considered emergency responses as defined within the scope of this code.”

West Fertilizer Company Final Report January 2016 209 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Following the WFC incident, the NFPA-sponsored Fire Protection Research Foundation651 (the Foundation) conducted a study652 to determine the adequacy of the separation distances prescribed for hazardous materials in NFPA 400, with a greater focus on FGAN. NFPA 400 specifies separation and clearance distances for newly constructed hazardous chemical storage from other on-site equipment and occupied buildings. The Foundation’s technical committee was made up of industry representatives, and research and engineering organizations that conducted literature reviews of existing methodologies to determine safe separation distances and testing to characterize the effect of AN detonations on personnel and processes near an explosive event. The study included reviews of various sources for risk-based and consequence- based methodologies for determining the safe distances as well as established distance tables. To study the adequacy of the existing separation distances in NFPA 400, the Foundation commissioned explosive testing to characterize the effects of nearby processes and personnel using a 3,000 pound ANFO donor charge to simulate an explosion. As part of the analysis, blast consultants compared the blast pressures and data recorded at various distances from the donor charge and compared the effects to the recommended distances for Class 3 Oxidizers in detached unsprinklered storage prescribed in NFPA 400 Chapter 15 (Oxidizer Solids and Liquids). The study concluded that the process-to-process separation distances for solid AN may be inadequate to provide protection against blast effects, but the process-to-personnel separation distances may be acceptable if personnel are inside buildings located at prescribed distances. However, the study concluded that additional testing and analysis is necessary to validate the absolute safety of personnel based on variations in processes, design, and potential reactants. The purpose of the project was to provide guidance to the NFPA technical committee for the development of technically-based separation distances for storage. Thus, the Foundation recommends a technical- based approach to establish safe separation distances that takes into account the risks associated with a known material and process, as well as the potential consequences of a catastrophic event involving that material. 8.6.2 International Code Council Like the NFPA, the ICC is an international nonprofit organization that develops and publishes consensus codes and standards. In addition to publishing the IFC, the ICC also produces the International Building Code (IBC), which is in use or adopted in 50 states. Jurisdictions can adopt the model codes by reference. The ICC views its codes as “companion” documents that work across disciplines (e.g., building construction, fire protection, mechanical systems, plumbing, zoning). Thus, a regulation for HAZMAT storage will affect building code requirements for construction, mechanical code requirements for

651 The Fire Protection Research Foundation is an affiliate of NFPA and plans, manages, and communicates research on fire safety issues in collaboration with academics, laboratories, and industry. 652 See: http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 210 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ventilation, plumbing code requirements for drainage, and fire code requirements for operations and handling. The codes are cross-referenced for ease of use. The ICC requirements for protecting AN from fire exposure and explosion are based on material properties, quantities stored, and storage and handling conditions. The ICC defines storage as “the keeping, retention or leaving of hazardous materials in closed containers, tanks, cylinders, or similar vessels; or vessels supplying operations through closed connections to the vessel.”653 Therefore, despite common references to the WFC FGAN as “in storage,” the IFC would interpret this application as “handling,” which it defines as “the deliberate transport by any means to a point of storage or use,” or as “use,” which it defines as “placing a material into action, including solids, liquids and gases.”654 The IFC does not have a separate chapter for AN. The IFC refers to NFPA 400 when AN intended for explosive materials is stored, handled, or used. Otherwise, AN is treated as an oxidizing agent, subject to the general requirements for each oxidizer class in IFC Chapter 63 (Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids) and Chapter 50 (Hazardous Materials). 8.6.3 State Fire Codes Without a comprehensive federal standard, states must rely on their own regulations to oversee HAZMAT storage. Most states have enacted fire codes or have adopted model fire codes. These codes typically include HAZMAT storage and emergency planning provisions. However, at the time of the incident, Texas had no state fire code, and the state still has no such code as of publication of this report. The majority of states have adopted model fire codes through referencing them into law.655 Two recognized model fire codes are the IFC and NFPA 1. Both establish minimum requirements for fire prevention and protection systems. Some states and municipalities have developed their own fire codes, using model codes as a guide. New York City updated its fire code in December 2007, marking its first major revision since 1913.656 After investigating an industrial waste explosion and fire in 2001 in the Chelsea district of Manhattan, CSB issued a recommendation to the Mayor and City Council to better address HAZMAT.657 The city developed its own code, borrowing heavily from the IFC (2003 Edition) but requiring some more stringent provisions. States could potentially apply other IFC chapters for storing bulk FGAN. For example, IFC Chapter 63 (Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids) includes provisions for storage and use of oxidizing materials, such as FGAN. This chapter says that indoor storage of oxidizers should be located in a detached building with an automatic sprinkler system and smoke detection systems. Additional

653 ICC. Chapter 50, Section 5002.1. International Fire Code, 2015 Edition. Washington, DC: ICC, 2015. 654 Ibid. 655 ICC. “International Code Adoption.” International Fire Code. Washington, DC: ICC, 2014. See: http://www.iccsafe.org/gr/Pages/adoptions.aspx (accessed on November 6, 2014). 656 Cassono, Salvatore. “A New Fire Code for New York City.” Building Safety Journal (July–August 2008). 657 CSB. “Chemical Waste-Mixing Incident: Kaltech Industries Group, Inc.” CSB Investigation Report, April 25, 2002.

West Fertilizer Company Final Report January 2016 211 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

requirements for storage configuration, separation barriers, and explosion control depend on the class of oxidizer, of which the IFC names four. NFPA 1 includes similar requirements for oxidizers in Chapter 70 (Oxidizer Solids and Liquids). This chapter directs users to follow NFPA 400, which also incorporates similar building and fire protection requirements for indoor storage of oxidizers. The WFC did not voluntarily implement any of the provisions from the oxidizer chapters of the IFC or NFPA 1, nor were they required to do so by the authority having jurisdiction. The WFC did not install an automatic sprinkler or smoke detection system in the fertilizer warehouse, nor did it store its FGAN in a separate building, away from combustibles. The location where the fire originated was adjacent to the FGAN bin, and no fire-rated wall separated the rooms. The WFC was not subject to code provisions because none of the relevant jurisdictions—not the state of Texas, McLennan County, or the city of West—had adopted a fire code. Texas affords counties and municipalities the discretion to adopt or develop fire codes. However, state law limits which counties can adopt such codes. Only a county with a population of more than 250,000 (and counties adjacent to a county with a population of more than 250,000) may adopt a fire code. Moreover, even if such a county does adopt a fire code, that code applies only to the unincorporated areas of the county. Cities within the county can adopt the county fire code, not adopt a fire code, or develop their own fire codes. Adoption of a city fire code does not affect any unincorporated areas outside the city. Although many major Texas cities have adopted fire codes, the pattern is inconsistent. As of September 2014, 43 facilities stored FGAN in 36 Texas counties. Only one of those 36 counties has a population of more than 250,000 people,658 and only six of those counties are adjacent to counties with populations that equal or exceed 250,000. Consequently, 79 percent of the 43 FGAN storage facilities are located in Texas jurisdictions that, under state law, cannot adopt a fire code. According to the 2010 census, the population of McLennan County was 241,281. Thus, the county fell below the population threshold. However, one of the seven adjacent counties had a population of more than 250,000. Accordingly, McLennan County had the authority to adopt a fire code, but this was not required. It is also important to note that the WFC facility was only partially within city limits. The fertilizer warehouse was located in an unincorporated area of West. If McLennan County had adopted a fire code, it would have applied to the WFC fertilizer warehouse only. Furthermore, if West had decided to adopt its own fire code, it would have applied to the entire WFC facility except for the warehouse. Although efforts have been made to make a state fire code in Texas mandatory, such endeavors have not been successful. The Texas Legislature debated the issue of adopting a state fire code at least as far back as 1978. Legislative committee reports between 1978 and 1984 from the Texas House of Representatives and the Texas State Senate identified the severe fire problem, and one report contended that the losses from fires exceeded “loss of life and property” from “all natural disasters combined” in the state.659 After

658 U.S. Census Bureau. 2010 U.S. Census. Washington, DC: U.S. Census Bureau, 2011. 659 Texas House of Representatives Committee on Business and Industry. “Interim Report,” October 13, 1978.

West Fertilizer Company Final Report January 2016 212 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

hearing multiple testimonies in public hearings across the state, a committee report concluded that Texas was “one of the leading states in property loss and lives lost because of fire.”660 This same committee report also found that such major losses occurred not in the most populated municipalities that had adopted fire and building codes, but in the unincorporated areas where fire codes did not apply.661 It stated that unincorporated areas were particularly problematic when annexed into a municipality because the city assumed responsibility for fire-prone buildings that were not built to code specifications.662 Because growth areas in counties are inevitable targets for municipal annexation, if counties are not granted proper regulatory authority, cities inevitably inherit the problems thus created. The Texas legislative committee reports also identified that without a state fire code, the State Fire Marshal cannot fulfill the duty of minimizing fire risks. One report noted that the State Fire Marshal has no authority to adopt a fire code, despite holding responsibility for the inspection of state-owned and state-leased buildings. Without a code, the State Fire Marshal is unable to set criteria to assess a fire hazard and enforce corrective actions. Moreover, although the local fire marshals hold authority to inspect facilities in their jurisdictions, without a fire code, they cannot enforce safety measures that are not legally required. The Texas Fire Protection Standard Committee, a special interim legislative committee, studied the fire problem and issued an interim report to the 69th session of the Texas Legislature in December 1984.663 This committee confirmed many of the findings above.664 In addition, the committee analyzed NFPA national fire data from 1978 to 1982.665 These data indicated that the per capita number of fires, deaths, and injuries and the dollar loss resulting from fire were all lower in states with fire codes than in those without them.666 The data also suggested that education alone to minimize human errors was insufficient to reduce fire loss because fire causation was mostly attributable to improper structural design and equipment malfunction.667 This committee also received extensive testimony from around the state indicating that the loss of life in the volunteer firefighter service was primarily “because there were no codes.”668 Over the years, proposed bills in the Texas Legislature for adoption of a fire code failed to gain support. In 1977, the Texas House of Representatives addressed a proposed bill to enforce a “fire prevention code” that would apply only to unincorporated areas and would be enforced by the state and county fire

660 Texas Senate Subcommittee on Consumer Affairs. “Final Staff Recommendations,” December 1980. 661 Ibid. 662 Ibid. 663 Texas Fire Protection Standards Committee. “Interim Report to the 69th Texas Legislature.” December 1984. 664 Ibid. 665 Ibid. 666 Ibid. It was noted in the report that the fire loss data had limitations because mandatory reporting requirements were not consistent throughout the nation. This limited statistical analysis nonetheless pointed out principal causes of fires. 667 Ibid. 668 Ibid.

West Fertilizer Company Final Report January 2016 213 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

marshals.669 In 1997, 20 years later, another proposed Texas House bill sought adoption of a code that would apply to (1) buildings located in unincorporated areas that have not adopted a fire code, (2) municipalities that did not adopt a fire code, (3) public assembly buildings in municipalities that have not adopted either model code, and (4) state-owned buildings.670 Neither bill progressed out of committee. In 1989, the Texas Legislature granted limited authority to counties with a population of 250,000 or more to adopt and enforce a fire code.671 This authority was later amended in 1997 to address growing populations and include counties adjacent to those with a population of at least 250,000.672 The failure to mandate a statewide fire code left some counties such as McLennan County without minimum fire protection measures. The absence of a state-wide fire code and the local population restrictions for code adoption remain an important issue for CSB. However, since the WFC incident, Texas has amended the administrative code to provide the State Fire Marshal with greater authority to enforce some NFPA codes at FGAN storage facilities, as well as to enter, upon complaint, and inspect facilities against the provisions of NFPA 1. Though the adoption did not create a state-wide fire code, it allows for the State Fire Marshal to inspect against a more comprehensive standard than NFPA 101 (Life Safety Code) that Texas previously adopted.673 Additional changes to the Texas State Fire Marshal’s authority to inspect FGAN facilities were enacted as part of House Bill 942 (described in Section 8.7.2). In addition, the Texas Agriculture Code was amended to impose additional requirements on FGAN retailers (described in Section 8.7.1). 8.7 Post-Incident State and Local Regulatory Developments Since the 2013 WFC incident, state and local legislators in Texas have attempted to improve FGAN safety through regulatory change. These efforts represent important first steps in recognizing the potential catastrophic hazards of FGAN under certain conditions. However, they are not entirely adequate. For example, when Texas House Bill (HB) 942 became law, it simply codified existing state hazardous chemical reporting requirements. Also, although the revised Texas Commercial Fertilizer Rules establish requirements for FGAN to be separated by at least 30 feet from combustible and flammable materials,674 this requirement is much less restrictive than the newly revised NFPA 400

669 65th Texas Legislative Session. House Bill (HB) 325, “An act relating to the promulgation and enforcement of a state fire prevention code for unincorporated areas of the state by the State Board of Insurance.” 670 75th Texas Legislative Session. HB 2922, “An act relating to a statewide building and fire code.” 671 71st Texas Legislative Session. HB 2252, “An act relating to the authority of the commissioners courts of certain counties to adopt a fire code for certain buildings in unincorporated areas.” 672 75th Texas Legislative Session. State Bill (SB) 10, “An act relating to the authority of certain counties to adopt and enforce a fire code.” 673 See: https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1 &p_tac=&ti=28&pt=1&ch=34&rl=303 (accessed on December 30, 2015). 674 Texas Administrative Code, Title 4, Chapter 65, Section 65.6(d)(3). See: http://otscweb.tamu.edu/Laws/PDF/CommercialFertilizerRules.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 214 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard and might not fully eliminate the risk of molten FGAN contamination during a fire. This section includes a discussion of the Texas Commercial Fertilizer Rules, a general analysis of HB 942 as well as a comparison of HB 942 to other legislation pending in committee as of this report’s publication date, and a review of an Athens, Texas, ordinance that mandates a ban on the bulk storage of FGAN. 8.7.1 Texas Commercial Fertilizer Rules The Office of the Texas State Chemist (OTSC) regulates the sale of FGAN and FGAN-containing materials. Enacted by 2007 amendments to the Texas Agricultural Code Section 65.6, the law places limits on FGAN sales. It establishes requirements for registration certificates issued by the Texas Feed and Fertilizer Control Service as a condition of selling (or offering to sell) FGAN.675 To reduce theft or terrorism, the requirements focus on security measures for FGAN storage and on recordkeeping to identify people who purchase FGAN. In June 2014, Texas revised the provisions of its Commercial Fertilizer Rules.676 The revised rules require FGAN facilities to file Top-Screen information under the federal CFATS rule as well as EPCRA Tier II information with the Texas Department of State Health Services as a condition for receiving an annual certificate of registration to sell FGAN. The 2014 revisions also require OTSC to inspect FGAN storage areas. Such inspections are to confirm that combustible and flammable materials, such as potential sources of ignition—fuels, oils, hay, or other organic materials—are separated from FGAN by at least 30 feet. If facilities do not comply with these requirements, OTSC can deny, suspend, or revoke annual certificates to sell (or offer to sell) FGAN. 8.7.2 Texas House Bill 942 The summary of Texas HB 942 says that it is an “act relating to the storage of certain hazardous chemicals; transferring enforcement of certain reporting requirements, including the imposition of criminal, civil, and administrative penalties, from the Department of State Health Services to the Texas Commission on Environmental Quality.” It became law on June16, 2015.677 The law bars facilities from storing FGAN with any nonfertilizer materials, requires that FGAN be stored at least 30 feet away from combustible materials, moves FGAN regulation from the Department of State Health Services to the TCEQ, allows the State Fire Marshal to inspect FGAN facilities, gives fire departments access for pre-fire planning assessments, and requires correction of hazardous conditions within 10 days.678 Although this law is an effort by state legislators to better regulate FGAN, it is not entirely adequate. For example, the requirement that FGAN storage be at least 30 feet from combustible materials was already required by the Texas Commercial Fertilizer Rules, as amended in June 2014 (and discussed in Section

675 See: http://www.tlc.state.tx.us/pubssoe/80soe/80soe.pdf (accessed on December 29, 2015). 676 See: http://otscweb.tamu.edu/Risk/AmNitrate/PDF/AN-Compliance-Guide.pdf (accessed on December 29, 2015). 677 Ibid. 678 See: http://kwbu.org/post/abbott-signs-bill-tackles-ammonium-nitrate-storage (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 215 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 7.1), a year before HB 942 became law. During a May 2015 meeting of the Texas Senate Committee

on Natural Resources and Economic Development, Senator Brian Birdwell, who sponsored the bill, affirmed this fact. He said, “To be clear this is not a new regulatory scheme. HB 942 simply codifies existing regulations regarding reporting of hazardous chemicals. These are existing regulations which 100 percent of FGAN storage facilities in this state [must currently comply with].”679 A related bill, HB 417, would impose penalties for improper FGAN storage and would create rulemaking authority over FGAN facilities.680 The bill states, “The commissioner of insurance, after consultation with the state fire marshal, by rule shall adopt fire protection standards for FGAN storage facilities, including standards for the storage of FGAN at those facilities.”681 State Representative Joe Pickett, the author of HB 417, told the Texas House Committee on Environmental Regulation in April 2015 that “the rulemaking authority is a way to make changes without the Legislature being in session,” explaining that the Commissioner of Insurance would work with state agencies.682 This regulatory authority distinguishes HB 417 from HB 942. Although HB 417 does not necessarily establish new regulations, it gives the Commissioner of Insurance an opportunity to do so. As of December 2015, however, this bill remains pending in committee.683 8.7.3 Athens City Ordinance After the May 29, 2014, FGAN-related fire at the East Texas Ag Supply facility in Athens, Texas (discussed in Section 7.4), the city of Athens initiated efforts to prevent similar events. On May 29, 2015, Athens passed an ordinance that banned bulk storage of FGAN and anhydrous ammonia.684 The ordinance (No. O-24-14) states in simple terms, “Commercial Fertilizer Storage or Manufacturing Facilities used to produce, transfer, store, or offer for sale Bulk FGAN, Bulk FGAN Material and/or Anhydrous Ammonia shall not be allowed in any zoning district in the City.” A “commercial fertilizer storage or manufacturing facility” is defined as one that “stores, mixes, or manufactures 10,000 or more pounds of FGAN and/or anhydrous ammonia and/or is required to register with the Texas Feed and Fertilizer Control Service.” The ordinance also streamlines chemical reporting and allows volunteer fire departments to inspect facilities.685 However, this ordinance does not apply retroactively to the facilities that existed when the ordinance was enacted.

679 Ibid. 680 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on December 29, 2015). 681 Texas HB 417, “An act relating to information regarding the storage of certain hazardous chemicals; providing penalties.” 682 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on December 29, 2015). 683 See: http://txlege.texastribune.org/84/bills/HB417/ (accessed on December 29, 2015). 684 See: http://www.kltv.com/story/29192400/one-year-after-fire-city-of-athens-state-make-changes-in-ammonium- nitrate-storage (accessed on December 29, 2015). 685 Ibid.

West Fertilizer Company Final Report January 2016 216 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 8 Industry Standards

Since the WFC incident, the fertilizer industry has implemented initiatives to prevent such an incident from reoccurring. In February 2014, TFI and the ARA, two primary agricultural trade associations, developed and issued Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Fertilizer Retail Facilities (or Safety and Security Guidelines).686 This public document explains the OSHA Explosives and Blasting Agents standard, but also provides more specific guidance. In March 2014, TFI and the ARA initiated an FGAN stewardship program. Participation involves a voluntary assessment every three years of facility safety and security, focusing on FGAN and anhydrous ammonia. 8.8.1 The Fertilizer Institute (TFI) TFI is a major trade association for the fertilizer industry.687 TFI members include BP Energy Company, Dow AgroSciences, DuPont Sulfur Products, JP Morgan, Mitsubishi International Corporation, Shell Sulphur Solutions, and Union Pacific Railroad.688 TFI lists security, energy, the environment, and worker health and safety as concerns to its members.689 It also lists product safety stewardship as one of its key issues.690 TFI offers tools to enhance the safety and security of products and equipment (discussed in Appendix E) across the supply chain.691 Post-WFC incident tools include the Compliance Assessment Tool, the Safety and Security Guidelines, and the ResponsibleAg program. Each of these is discussed in the next sections. 8.8.1.1 Compliance Assessment Tool The Asmark Institute, a private not-for-profit educational organization that is a resource center for the agricultural retail industry, developed the web-based Compliance Assessment Tool.692 With regulatory compliance consistently cited during the last 18 years as one of the top 10 threats to the long-term viability of agricultural retail facilities, the Compliance Assessment Tool is meant to assist the agricultural retail industry.693 This tool helps personnel at facilities, terminals, warehouses, and farm equipment dealers in identifying the regulations that apply to their specific sites. 694 The Compliance Assessment Tool evaluates onsite compliance efforts.695 Through accessing the website, entering facility

686 ARA, TFI. “Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Fertilizer Retail Facilities,” February 2014. 687 See: http://www.tfi.org/about (accessed on December 29, 2015). 688 See: http://www.tfi.org/about/membership-list (accessed on December 29, 2015). 689 See: http://www.tfi.org/about (accessed on December 29, 2015). 690 See: https://www.tfi.org/advocacy/stewardship (accessed on December 29, 2015). 691 See: http://www.tfi.org/safety-and-security-tools (accessed on December 29, 2015). 692 See: http://www.tfi.org/compliance-assessment-tool (accessed on December 29, 2015). 693 See: https://www.asmark.org/Compass/ComplianceAssessmentTool/ (accessed on December 29, 2015). 694 Ibid. 695 Ibid.

West Fertilizer Company Final Report January 2016 217 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information, and describing scope of operations, the user can download a specific compliance assessment document and then complete a worksheet.696 Periodic use of the tool is encouraged to help control risk and to support compliance efforts.697 8.8.1.2 Safety and Security Guidelines for the Storage and Transportation of FGAN at Fertilizer Retail Facilities TFI and the ARA created the Safety and Security Guidelines.698 TFI’s website notes that “the document was created to fill the void in emergency response guidelines specific to FGAN fertilizer at retail fertilizer facilities.”699 The guidelines outline best practices for safe and secure storage and transport of FGAN.700 They also summarize storage and handling regulations for FGAN facilities as well as recommendations for first responders.701 Moreover, they provide rules for transporting FGAN via truck, highway, rail, and barge.702 8.8.1.3 ResponsibleAg Created by TFI and the ARA in 2014, ResponsibleAg is a third-party auditing program for fertilizer retailers.703 Although any business that stores or handles fertilizer product is eligible to participate in the ResponsibleAg Certification Program, the first three years of the program focus on companies that store and handle AN and/or anhydrous ammonia fertilizer.704 Using federal requirements for the storage and handling of fertilizer products, ResponsibleAg has compiled a checklist of more than 320 questions for auditing each participating facility.705 The participating facility determines the audit scope; however, all participants must have a “base audit.”706 A participating facility may become ResponsibleAg certified only if it passes the initial audit or if it takes all necessary steps to correct the issues identified during the audit and documented in the facility’s corrective action plan.707 ResponsibleAg also allows its participating suppliers to access the list of participating facilities that have successfully completed the assessment and earned certification.708 This is important because it allows suppliers to determine whether prospective buyers have successfully completed the ResponsibleAg assessment, which thereby promoted federal regulatory compliance. This approach enables

696 Ibid. 697 Ibid. 698 See: http://www.tfi.org/ammonium_nitrate_guidelines (accessed on December 29, 2015). 699 Ibid. 700 Ibid. 701 Ibid. 702 Ibid. 703 Ibid. 704 See: http://www.responsibleag.org/About.cgi (accessed on December 29, 2015). 705 Ibid. 706 Ibid. 707 These corrective actions must be certified by ResponsibleAg, usually during a verification audit. 708 See: https://www.responsibleag.org/FAQ.cgi#Link02 (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 218 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ResponsibleAg members to engage in some elements of product stewardship (as discussed in Section 8.8.3). Notably, CF Industries and EDC, the only AN fertilizer manufacturers in the United States, are listed as ResponsibleAg participants.709 Appendix F includes additional information on the ResponsibleAg program process. 8.8.2 Agricultural Retailers Association (ARA) The ARA is also a major trade association for the fertilizer industry.710 It represents agricultural retailers and distributors across the United States on legislative and regulatory issues.711 ARA members represent the majority of agribusinesses in the United States.712 The ARA works with Congress to create legislation, and updates federal agencies and legislators on important issues affecting the industry.713 The ARA offers programs and services to keep its members informed of important industry issues.714 8.8.3 Product Stewardship As of this report’s publication, only two companies in the United States, CF Industries and EDC, manufacture FGAN.715 Fertilizer manufacturers can promote the safe storage and handling of FGAN by distributors and retailers by implementing product stewardship programs. According to the Center for Chemical Process Safety, product stewardship encourages safety and health in the design, manufacture, marketing, distribution, handling, use, and disposal of chemical products.716 Responsibility for safely managing the product is shared throughout the supply chain and the product life cycle. Because it is a self-regulated program, product stewardship can only be as effective as industry intends and allows. CSB determined that components of an effective product stewardship program should generally include the following elements for each product: • Identifying and communicating all product hazards among manufacturers, distributors, and retailers. • Providing supplemental technical information on safe handling practices for the product (furnished by manufacturers and/or distributors) to other distributors and/or retailers. • Establishing accountability for distributors and retailers to promote safe handling of a product throughout the chain of customers. • Performing monitoring and auditing, such as onsite visits to the locations where the product will be stored or used.

709 See: https://www.responsibleag.org/ParticipantList.cgi (accessed on December 29, 2015). 710 See: http://www.aradc.org/ARADC/About/About/ (accessed on December 29, 2015). 711 See: http://www.aradc.org/becomeamember/ (accessed on December 29, 2015). 712 Ibid. 713 Ibid. 714 See: http://www.aradc.org/about/about (accessed on December 29, 2015). 715 The WFC also reported receiving imported AN from foreign manufacturers between 2006 and 2013. 716 Center for Chemical Process Safety. Guidelines for Safe Handling of Powders and Bulk Solids. New York: Center for Chemical Process Safety/AIChE, 2005: 521.

West Fertilizer Company Final Report January 2016 219 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Developing mechanisms for outreach to communities near the facilities where the products are stored or used. Information sharing is an important component of product stewardship. When information about product hazards or details about the storage practices of a certain facility are known, people and companies dealing with the product or with the facility have the opportunity to effectively manage the risks associated with that product. The same logic applies to the management of FGAN. The WFC incident highlighted the need for greater awareness of the unpredictable nature of AN and the conditions under which it can detonate. Two industry programs, Responsible Care and ResponsibleAg, both advocate information sharing. Accordingly, the programs have serious product stewardship potential. As described in Section 8.8.1.3, the joint TFI-ARA ResponsibleAg program currently addresses some aspects of product stewardship. In particular, fertilizer sellers (i.e., manufacturers and/or distributors) may elect to access the list of ResponsibleAg-participating facilities to determine assessment completion and certification of prospective buyers (i.e., distributors and/or retailers). By doing so, the seller verifies that the buyer safely stores fertilizer (or at least has a record of safely storing fertilizer). Similarly, the American Chemistry Council’s (ACC) Responsible Care initiative includes information sharing in its product stewardship program. Participation in Responsible Care is a condition of membership for ACC members.717 The program specifies 11 management practices and focuses on leadership commitment, accountability and management, prioritization of products, product information, risk characterization, management of new information, product safety management, product design and improvement, value chain communication, cooperation and outreach, information sharing, and performance assessment and continual improvement.718 Serious participation in product stewardship programs such as ResponsibleAg and Responsible Care can promote the safe handling and storage of domestically manufactured FGAN. This is especially true for FGAN because there are only two companies, CF Industries and EDC, that manufacture FGAN in the United States. As such, domestically manufactured FGAN product can be linked to one of these two companies. CF Industries and EDC are already members of ResponsibleAg. Product stewardship programs such as ResponsibleAg can ensure that FGAN management practices, starting with FGAN manufacturers CF Industries and EDC, are subject to greater scrutiny. However, it is also important to make sure that distributors and retailers handle and store the product safely. Because responsibility for a chemical product does not always end after it is manufactured, it is important that manufacturing companies know how the product is handled and stored once it leaves the production site. In other words, a manufacturer cannot simply confirm that its direct buyer safely stores and handles the manufacturer’s product because that buyer may in turn sell to another buyer that does not store or handle the product safely. The same reasoning applies to communicating product hazards. Of course, requiring the manufacturer to communicate the hazards of its product to its buyer is surely a step in the

717 See: http://responsiblecare.americanchemistry.com/ (accessed on November 30, 2015). 718 See: http://responsiblecare.americanchemistry.com/Responsible-Care-Program-Elements/Product-Safety- Code/Responsible-Care-Product-Safety-Code-PDF.pdf (accessed on November 30, 2015).

West Fertilizer Company Final Report January 2016 220 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

right direction, but the buyer must also communicate the same hazards to its buyers, if any. Otherwise, catastrophic incidents can occur. Importantly, therefore, these distribution chains must not break; effective communication must endure from top to bottom. To ensure continuity of communication throughout the supply chain, industry should voluntarily take an active role. Because government agencies cannot reasonably be expected to routinely inspect every FGAN facility, industry’s product stewardship programs must play a significant role in making sure that this top-to-bottom approach is implemented. Product stewardship offers an important opportunity for industry to further manage risk, beyond providing SDSs to retailers. Although CF Industries and EDC use different business models, both have executed initiatives that ascribe to product stewardship elements post-incident. 8.8.4 Efforts to Address FGAN Hazards Post-Incident Since the WFC incident, both CF Industries and EDC have made additional efforts to make sure that their FGAN product is stored and handled safely as it moves out of their manufacturing facilities. CF Industries has implemented a certification process for its customers (purchasing organizations as well as facilities that receive FGAN deliveries) to confirm that customers communicate both the hazards and safe storage and handling practices of FGAN. As of December 31, 2014, CF Industries requires existing facilities to certify through a signed certification letter that they are in compliance with applicable guidelines and regulations before they can receive FGAN product. All new purchasing organizations and sites must also return the signed certification letter before receiving FGAN from CF Industries. Specifically, the letter requires senior responsible officials at both the purchasing organization and the delivery facility to certify that they are either in compliance with, or legally exempt from, 17 items. These items include, for example, attestations that: • The purchasing organization provided the FGAN SDS developed by CF Industries to all of its sites. • The purchasing organization and site provided copies of the CF Industries FGAN SDS to all employees. • The site complies with OSHA requirements for FGAN storage. • The site filed EPCRA and SARA Tier II Chemical Inventory Reports with appropriate emergency response organizations. • The site maintains and follows an emergency response plan and written procedures for the safe handling of AN. By signing the certification statement, officials at the purchasing organization certify that all relevant personnel at the site are aware of FGAN safety handling requirements and that adequate procedures are in place to comply with all 17 listed items. The certification packet also includes an up-to-date FGAN SDS developed by CF Industries and the TFI-ARA guidance for FGAN. CSB determined that this process could provide a reasonable degree of assurance that FGAN product hazards are being communicated as the product is delivered to new and existing customers and, most important, that those customers comply

West Fertilizer Company Final Report January 2016 221 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with applicable regulations and practices in order to receive product. If CF Industries does not receive a completed and signed certification statement, it will not sell FGAN product. Although not in the form of a certification statement program, EDC also took steps to enhance the safety of its FGAN product post-incident. EDC updated its SDS for FGAN to include more information regarding firefighter precautions and added a reference to NFPA 400.719 Moreover, EDC developed a product information bulletin to accompany its SDS to emphasize FGAN hazards and safety measures.720 To better communicate FGAN hazards in response to the WFC incident, EDC conducted mass mailings to all of its customers. The mailings included the following: • EDC’s revised SDS (September 2013 and November 2014 versions). • TFI-ARA Safety and Security Guidelines for Ammonium Nitrate. • OSHA Guidance on Ammonium Nitrate Storage Requirements in 29 CFR 1910.109(i). In addition, EDC repaired and replaced wooden bins at its own owned-and-operated retail site locations to ensure compliance with OSHA requirements regarding the protection of bins against AN impregnation. In gathering information regarding these post-incident safety initiatives, CSB found that CF Industries and EDC operate under different business models, despite their status as the only two manufacturers of FGAN in the United States. CF Industries does not directly sell to retailers, but may deliver directly to retailers at the instruction of a direct customer. It delivers FGAN only to independently owned and operated distributors or their retail customers. CF Industries does not own any of the distribution facilities to which it ships product, and it does not sell directly to retailers, although it might deliver directly to retailers at the instruction of a direct customer. Unlike CF Industries, EDC delivers some FGAN product to its own owned-and-operated distribution sites. In this regard, the business models of CF Industries and EDC differ. EDC produces FGAN in El Dorado, Arkansas, which is shipped by rail or truck to either (1) its own distribution sites, which operate under the name EDC Ag Products Company, LLC (EDC Ag Products),721 or (2) its larger customers. Approximately 40 percent of the FGAN produced at the EDC Arkansas manufacturing facility is shipped to its 11 EDC Ag Products distributor locations (most in Texas), and approximately 60 percent is sold directly to customers. From the EDC Ag Products distributor locations, FGAN may be sold to other distributors or to retailers or farmers. All of the FGAN sold directly from the EDC manufacturing facility in Arkansas is delivered mainly to dealers, with a small quantity to brokers.

719 See: http://eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No v_2014.pdf (accessed December 29, 2015). 720 Ibid. 721 At the time of the incident, the distribution sites operated under the name El Dorado Chemical. El Dorado Chemical Company and EDC Ag Products Company, LLC are subsidiaries of LSB Industries, a manufacturing and marketing company.

West Fertilizer Company Final Report January 2016 222 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the time of the WFC incident and as long ago as 2004, EDC sold products to International Chemical Company (Inter-Chem), which acted as a trader or supplier of FGAN, among other fertilizer products. Through its Domestic Plant Foods Group, Inter-Chem is a distributor of phosphate, nitrogen, and potash products in the United States.722 Essentially, Inter-Chem served as a broker and consignee of finished fertilizer products to the WFC. Although Inter-Chem did not produce or manufacture the fertilizer product that was sold to the WFC, its role as a broker was significant. Importantly, Inter-Chem functioned as another link in the chain of commerce as the FGAN traveled from manufacturer to retailer through the broker. To better understand the chain of hazard communication involved in this investigation, CSB started at the top with the manufacturers and analyzed the pre-incident SDSs and hazard communication practices of both EDC and CF Industries. Before the WFC incident, EDC provided a copy of its SDS to its customers and to Inter-Chem. The EDC SDS in use at the time of the 2013 WFC incident was last revised in 2011. CSB reviewed the SDS and found that it lacked certain safety information, specifically related to firefighting measures. The 2011 EDC SDS included warnings about the hazards of AN, such as its capability to support combustion and become explosive in the presence of contaminants or when under confinement. Under the firefighting measures section, the SDS instructed firefighters to “flood with water” but did not address the proper way to handle massive and uncontrollable fires, the need to extinguish such fires from a distance, or the possible need for evacuation. In addition, the SDS lacked references to applicable AN safety standards, such as the OSHA Explosives and Blasting Agents standard and NFPA 400 (2010 Edition). On the other hand, the CF Industries pre-incident SDS included a comprehensive list of AN hazards and firefighting measures. Nonetheless, both CF Industries and EDC made changes to enhance the safe handling of their products after the WFC incident. As previously discussed, both U.S. FGAN manufacturers have improved communications with their customers about FGAN hazards and safe storage practices since the WFC incident. CF Industries implemented a program to certify compliance with applicable standards and guidelines as a condition of sale. In contrast, EDC conducted hazard communication in the form of mass mailings, replaced and repaired its own wooden bins at EDC Ag Products facilities, and continues to audit and inspect its retail sites (which it can readily do because EDC owns and operates these retail divisions) to make sure that about 40 percent of its manufactured FGAN is stored in compliance with applicable standards. These efforts represent a step in the right direction. However, because both EDC and CF Industries sell significant quantities of FGAN through brokers or through independent warehouses or distributors, whose direct customers may be unknown to EDC and CF Industries, it might not be possible in certain situations for the manufacturers to always ensure that their product is handled and stored in accordance with safety guidelines as the product moves downstream. At the very least, however, the certification statement program implemented by CF Industries attempts to ensure compliance with applicable regulations by causing its customers to attest to having knowledge of them.

722 See: http://www.ictulsa.com/domestic_fert.html (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 223 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

As previously discussed, the CF Industries certification program strives to certify compliance by requiring purchasing organizations to affirm that their customers are in compliance with the CF Industries certification program elements. CSB found no evidence of such a program at EDC. Because EDC also sells product through wholesalers and distributors, a similar certification program, if implemented properly in conjunction with other components of product stewardship, will ensure that EDC product is handled safely throughout by its chain of customers. In concert with CF Industries’ efforts, this can effectively promote the safety of all domestically manufactured FGAN. 9.0 Land Use The West Fertilizer Company (WFC) incident led many observers to ask a seemingly simple question: Why would a community be located so close to a facility storing a potentially dangerous chemical? Although the question might be simple, the answer is not. In fact, the city of West, Texas, was so near the WFC facility primarily because of the following factors: • The city “came to” the WFC facility over the years. • There was a lack of zoning regulations. These factors are interrelated. The growth of the community near the WFC facility made it difficult for the city to later enact zoning regulations to require risk mitigating actions such as a buffer zone between the facility and the community. This is not to say that West is an anomaly. Many communities in Texas and nationwide are located too close to facilities resembling the WFC plant.723 This reality highlights the need to explore why communities live with these hazards so that authorities can better mitigate the offsite consequences from incidents such as the fire and explosion at the WFC plant in West. In this section, CSB seeks to explain the previously mentioned factors, providing insights into the proximity of the WFC facility to the West community. Following that discussion, other CSB investigations involving offsite consequences are highlighted to emphasize the scope of the problem. International land use perspectives also are provided to compare various approaches to the issue. In addition, efforts to address land use planning after the WFC incident are discussed. 9.1 Land Use Planning: An Introduction Land use planning is a complex and controversial topic. It provides a framework for limiting private land use when necessary for the public benefit. However, economic, social, safety, and environmental interests must be effectively balanced to achieve this benefit. Such competing interests generate highly emotional and contentious debates. Ultimately, however, the decision is political in nature. The community must decide on the best use of land for its development and growth. Urban sprawl,

723 As of December 6, 2013, Texas had 104 facilities storing 10,000 pounds or more of FGAN.

West Fertilizer Company Final Report January 2016 224 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

environmental concerns, and hazardous conditions are just some of the issues that land use planning addresses. The United States takes a decentralized approach to land use planning; that is, states are largely vested with the authority to regulate and enforce the private use of land. In turn, the states delegate this authority to local governments. This approach generally results in municipalities establishing land use regulations for various areas within their respective jurisdictions. The federal or state government has asserted authority in some areas of land use planning, but the majority of land use planning authority in the United States lies with local governments. The benefits of such an approach stem from the regulatory flexibility to address issues of land use. The judiciary resolves any potential conflicts. Land use planning cannot be said to solve all developmental issues that a community encounters. Land use regulation does give the community a control mechanism to reduce the consequences of an incident but does not eliminate the need for preventive controls. Rather, the mitigative control of land use planning must be combined with preventive controls employed by a variety of different stakeholders. Land use planning is a critical control to foster community development, but it must be integrated with other complementary approaches. At its heart, land use planning offers the means for dealing with development and growth. However, many interests must be taken into account when attempting to effectively ensure a safe and satisfying community. Land use planning considerations can offer insights into the issues evident in the WFC incident. The location of the city of West near the WFC facility produced numerous benefits for the community; however, as the WFC fire and explosion revealed, such siting also had deadly consequences. 9.2 The City That “Came to” the WFC Over the Years The WFC facilities were constructed and began operations in 1962.724 At the time, the facilities were largely surrounded by open fields, raising little concern about any potential offsite consequences. Furthermore, no zoning regulations existed when the WFC began business.725 Over the years, however, the city of West began to slowly develop around the WFC property. As the WFC was grandfathered into West ordinances and the city was subsequently zoned residential, little attention was paid to the city’s slow but steady encroachment toward the WFC facility.

724 Crain, Zac. “Love and Loss in a Small Texas Town.” D Magazine (July 2013). See: http://www.dmagazine.com/Home/D_Magazine/2013/July/West_Texas_Love_and_Loss_in_a_Small_Town.aspx?p age=1 (accessed on November 25, 2014). 725 According to the West Code of Ordinances, the earliest zoning regulation was adopted on March 21, 1967. City of West. Chapter 14, Section 14.01.001. Code of Ordinances. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014).

West Fertilizer Company Final Report January 2016 225 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

West was officially incorporated as a city in 1892, and with the help of a railroad track and fertile land for farming, it thrived.726 Before construction of the WFC plant, the area north of the city was largely open fields used for agriculture and ranching. At the time that the WFC began operations, the area maintained the same character except for a residence located approximately 250 feet north of the WFC property line.727 The location was ideal for such a business—just outside of the city, next to a railroad track, and within a convenient distance for local farmers. West lacked zoning regulations when the WFC completed its construction, and there appeared to be little need for such regulations as the WFC facilities were far removed from the city. Furthermore, the portion of the WFC property where fertilizers and pesticides were stored was outside of the West city limits and thus outside of its jurisdiction.728 Within this framework, the city of West began to expand and grow around the WFC facility. As shown in Figure 74, the city began developing further north over the years. This growth continued until the community was adjacent to the WFC property. Parks, subdivisions, nursing homes, schools, and an apartment complex sat within a 600-foot radius of the facilities. Furthermore, as the city continued to build its infrastructure near the WFC facility, the area became an even more attractive target for development. The community hardly noticed the WFC facility. It was only aware of the risk of accidental releases of anhydrous ammonia but viewed such events with little concern. Figure 75 shows the WFC facility before and after the incident.

726 City of West. “City of West, Our History.” See: http://www.cityofwest.com/our-history (accessed on November 25, 2014). 727 Determined by using the December 14, 1964, aerial photograph of West, Texas, and employing Google Earth. 728 McLennan CAD. “Property Search Results: Property ID 2013357, Adair Grain, Inc. for Year 2013.” See: https://propaccess.trueautomation.com/Map/View/Map/20/201357/2013 (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 226 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 74. Progressive Development of West (Source: GeoSearch)

West Fertilizer Company Final Report January 2016 227 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: NBC News) This lack of proper foresight played a significant role in explaining why West came to be located so close to the WFC plant. Unfortunately, as the WFC was grandfathered into the city’s Code of Ordinances,729 the city was not required to address the risks involved in this encroachment. Not that West is a peculiar case; in many instances across the country, similar problems exist.730 9.3 Lack of Zoning Regulations Both the federal government and Texas have failed to issue regulations relating to siting facilities that store and distribute FGAN near communities such as West. If a regulation had addressed issues such as buffer zones, barricades, or other techniques to mitigate consequences, the severity of the casualties and damage experienced in West could have been significantly reduced. Moreover, although regulation cannot solve all problems, it serves as a mechanism to compel all industries to adopt and implement safer operations. Ultimately, the failure to mitigate the consequences of incidents such as the WFC fire and explosion in West exists at all levels of government. U.S. law largely assigns the authority to regulate private land use to the individual states.731 In turn, the states generally assign this authority to individual municipalities. It is important to note, however, that

729 City of West. Chapter 14. Code of Ordinances. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014). 730 For example, CSB reports on NDK, DPC, Concept Sciences, and the Caribbean Petroleum Refining tank explosion and fire. 731 Because the Federal government is only vested with the powers delegated to it through the Constitution—such as the power to regulate interstate commerce, coin money, and so forth—it is limited in its capability to regulate issues

West Fertilizer Company Final Report January 2016 228 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the state’s authority can be preempted by the federal government in certain instances, and two of the main instances are matters concerning interstate commerce732 and international treaties.733 This dual sovereignty can allow for greater flexibility in resolving land use issues that affect the public. Over time, the federal government has assumed an increasing role in the regulation of land use issues, including those relating to storing chemicals such as FGAN. ATF, the U.S. Department of Housing and Urban Development (HUD), the Pipeline and Hazardous Materials Safety Administration (PHMSA), OSHA, and EPA have all promulgated regulations or recommendations relating to the siting of explosives, reactives, oxidizers such as FGAN, and flammable cryogenics such as liquefied natural gas (LNG) near populated areas. Table 14 briefly lists the relevant regulations issued by these agencies. Table 14. Relevant Siting Regulations Agency Regulation CFR ATF Commerce in Explosives 27 CFR Part 555 DOT Liquefied Natural Gas Facilities: Federal Safety Standards 49 CFR Part 193 HUD Environmental Criteria and Standards 24 CFR Part 51 OSHA Occupational Safety and Health Standards 29 CFR Part 1910 EPA Chemical Accident Prevention Provisions 40 CFR Part 68 Standards for Owners and Operators of Hazardous Waste Treatment, Storage, and Disposal Facilities 40 CFR Part 264

ATF holds the authority to require setting off stored explosive materials and low-explosive materials from inhabited buildings, public highways, public railways, and magazines.734 Although explosive grades of FGAN are currently listed as explosive materials, the FGAN stored at the WFC facility is not categorized as an explosive material or a low-explosive735 material.736 Therefore, WFC storage of FGAN was not

related to land use. See: 10th Amendment, U.S. Constitution. However, state zoning regulations are subject to Federal preemption in areas where the use of land affects interstate commerce, international treaties, and Federal government spending powers. 732 U.S. Constitution, Article I, Section 8. 733 U.S. Constitution, Article VI. 734 27 CFR 555.218–219: “Explosive materials” are defined as explosives, blasting agents, water gels, and detonators. 27 CFR 555.11: “Explosives” are defined as any chemical compound, mixture, or device, the primary or common purpose of which is to function by explosion. 735 Low explosives are defined as “explosive materials which can be caused to deflagrate when confined. See: http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 29, 2015). 736 See: http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 28, 2015). See also: 27 CFR 555.220 Note (1), which states: “FGAN, by itself, is not considered to be a [explosive or blasting

West Fertilizer Company Final Report January 2016 229 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

subject to ATF set-off distances.737 However, ATF has the authority to require a minimum separation distance between the FGAN stored at the WFC facility and certain blasting agents.738 DOT received Congressional authorization to “prescribe minimum safety standards for deciding on the location of a new liquefied natural gas [LNG] pipeline facility,” which it oversees through PHMSA.739 In turn, PHMSA has promulgated a series of recommendations concerning siting requirements for LNG facilities.740 The regulations are based on NFPA 59A concerning the production, storage, and handling of LNG.741 The siting requirements address issues such as thermal radiation protection, flammable vapor- gas dispersion protection, and wind forces. PHMSA applies the regulations to LNG facilities “designed, constructed, replaced, relocated or significantly altered after March 31, 2000,” thereby grandfathering LNG facilities that existed before the March 31 date.742 However, PHMSA has no regulations concerning the siting of AN facilities. HUD requires projects receiving its assistance to be separated by an acceptable distance from specific stationary hazardous operations that store, handle, or process hazardous substances.743 Hazardous substances are defined as “petroleum products (petrochemicals)” and other hazardous chemicals identified by HUD that can produce blast overpressure or thermal radiation levels in excess of HUD standards.744 FGAN is not identified as a hazardous substance for the purposes of this standard.745 In addition, the city of West would not qualify for HUD assistance as it does not meet HUD eligibility requirements.746

agent].” See also: 72 Federal Register 18792, 18796, which states: “[A]lthough FGAN is a component of certain explosives such as ANFO, by itself, it is not an explosive. Therefore, it is not regulated by these ATF regulations.” 737 The purpose behind regulating the siting of ANFO was “to protect interstate and foreign commerce against interference and interruption by reducing the hazard to persons and property arising from misuse and unsafe or insecure storage of explosive materials.” Section 1101, Public Law 91-452, reprinted in: U.S. Code Congressional and Administrative News 1109 (1970). 738 27 CFR 555.220. 739 49 U.S.C. § 60103 (2014). 740 49 CFR 193 Subpart B (2014). 741 65 CFR 10950 (2000) and 69 Federal Register 11330 (2004). 742 49 CFR § 193.2051(2014). 743 24 CFR Subpart C; specifically 24 CFR 51.204 and 24 CFR 51.205. See: http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/environment/training/guidebooks/hazfa cilities (accessed on December 28, 2015). The intent in creating these regulations was “to encourage improvements in housing standards and conditions.” “The National Housing Act.” See: http://portal.hud.gov/hudportal/documents/huddoc?id=HUD-Guidebook.pdf (accessed on December 28, 2015): 3–4. 744 24 CFR 51.201, 203. 745 24 CFR Part 51, Appendix I to Subpart C. Anhydrous ammonia is also not listed as a hazardous substance; however, under special circumstances, the Secretary may require the application of a substance not listed in Appendix I to Subpart C. See: 24 CFR 51.207 (2014). 746 See: http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/communitydevelopment/programs/entit lement (accessed on December 28, 2015). Eligible HUD grantees include (1) principal cities of metropolitan statistical areas, (2) other metropolitan cities with populations of at least 50,000, and (3) qualified urban counties with populations of at least 200,000 (excluding the population of entitled cities).

West Fertilizer Company Final Report January 2016 230 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

OSHA requires facilities handling highly hazardous chemicals to address facility siting issues; however, the requirement only deals with onsite consequences, not the issue of siting communities near highly hazardous chemical facilities.747 This requirement is part of the Process Safety Management (PSM) regulation, which seeks to prevent or minimize the consequences of catastrophic releases of “highly hazardous chemicals.”748 However, the PSM regulation does not include FGAN as a highly hazardous chemical.749 In addition, OSHA has the authority to require separation distances between FGAN and blasting agents,750 in the same manner as ATF.751 The federal agency concerned with offsite consequences, EPA, addresses the siting of hazardous facilities near population centers by issuing various regulations and guidance.752 For example, EPA regulates facility siting through its Risk Management Program rule, which calls on operators to address “stationary source siting” in its Program Level 3 process hazard analysis.753 However, EPA offers little to no guidance to operators on how to satisfy the “stationary source siting” requirement.754 The Risk Management Program rule also requires operators to conduct an offsite consequence analysis to provide government officials and the public with information about the potential consequences of an accidental release.755 However, as FGAN is not classified as a hazardous regulated substance under the Risk Management Program rule, the WFC was not required to conduct such an analysis for its stored FGAN. In addition, EPA is currently considering the inclusion of “facility and equipment siting factors” in the Risk Management Program rule.756 Furthermore, EPA addresses facility siting through regulation and guidance concerning the siting of hazardous waste management facilities near communities and sensitive environments.757 EPA also has issued guidelines relating to siting schools near potential environmental hazards, which could have proven

747 29 CFR 1910.119(e)(3)(vii). 748 29 CFR 1910.119. 749 29 CFR 1910.119, Appendix A. 750 29 CFR 1910.109, Table H-22. 751 27 CFR 555.220. 752 See: http://www.epa.gov/statelocalclimate/local/topics/land.html (accessed on December 28, 2015). 753 40 CFR 68.67(c)(5) (2014). 754 The only real guidance on these terms is found in API RP 752, “Permanent Building Siting”; API RP 753, “Portable Building Siting”; and API RP 756, Tent Siting (to be issued in 2014). However, these guidance documents have been developed without any regulatory guidance. Furthermore, the identified standards have nothing to do with the relationship of the facility to its surrounding community. See: http://www.absconsulting.com/webinars/facility-siting.cfm (accessed on December 28, 2015). 755 40 CFR 68.150–68.195 (2014). The analysis consists of two elements, a worst case release scenario and alternative release scenarios. 756 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 28, 2015): 36. 757 See: http://www.epa.gov/osw/hazard/tsd/permit/site/sites.htm (accessed on December 28, 2015); 42 U.S.C. § 6924 (2014); 40 CFR 264.18 (2014); 40 CFR 265.18 (2014); 40 CFR 270.14(b)(11) (2014); and 40 CFR 270.32(b)(2) (2014). See also: http://homer.ornl.gov/sesa/environment/guidance/rcra/locate.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 231 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

helpful to West and similarly situated communities.758 Moreover, EPA has recommended using information related to the Emergency Planning and Community Right-to-Know Act to inform a community’s decisions concerning zoning and land use planning.759 Thus, federal regulations and guidance on land use do exist and do give communities valuable information regarding various chemical hazards. However, because FGAN is not defined as an explosive or hazardous material, it is excluded from federal zoning regulations. Unfortunately, this situation allows fertilizer facilities to store FGAN onsite without any federal oversight to confirm that the associated risks of locating communities nearby are mitigated to sufficient levels. At the state level, Texas does little to oversee land use issues.760 Instead, Texas grants the most land use oversight authority to its municipalities.761 Texas has no regulation relating to siting hazardous facilities near communities.762 Moreover, no state administrative agency oversees hazardous facility siting.763 At the county level, regulatory authority is limited to zoning specific areas (such as Padre Island, Lake Tawakoni, and Falcon Lake), which results in a failure to approach county zoning from a general perspective.764 This observation does not indicate that a one-size-fits-all approach to zoning is always desired.765 In fact, in many instances, land use oversight needs to be tailored to specific political, social, economic, and environmental needs of the community.766

758 See: http://www.epa.gov/schools/siting/basic.html (accessed on December 28, 2015). 759 See: http://www.epa.gov/osweroe1/docs/chem/notice.pdf (accessed on January 6, 2016): 7; see also: http://www.nicsinfo.org/docs/LEPCStudyFinalReport.pdf (accessed on December 28, 2015): 7. 760 See: http://stateimpact.npr.org/texas/2013/04/22/after-west-fertilizer-explosion-concerns-over-safety-regulation- and-zoning/ (accessed on December 28, 2015). 761 Texas Statute, Local Government Code, Title 7, “Regulation of Land Use, Structures, Businesses, and Related Activities.” See: http://www.statutes.legis.state.tx.us/ (accessed on January 6, 2016). For instance, municipalities must adopt a zoning ordinance in accordance with a comprehensive plan; county zoning ordinances deal with specific areas such as military zones, Padre Island, and Amistad Recreation Area. See: http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015). 762 The Texas Administrative Code fails to address such siting issues. The Texas Department of Public Safety, Division of Emergency Management, holds responsibility for preparing the state emergency management plan, which may include “recommendations for zoning, building restrictions, and other land-use controls . . . to eliminate or reduce disasters or their impact . . . .” Texas Government Code, Title 4, Subtitle B, Chapter 418, Section 418.042. However, the state has not issued any such recommendations. See: https://www.txdps.state.tx.us/dem/downloadableforms.htm#stateplan (accessed on December 28, 2015). 763 See: http://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC (accessed on December 29, 2015). 764 See: http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015). Texas House of Representatives, Committee on County Affairs. “Interim Report to the 80th Texas Legislature,” December 2006: 7. See also: http://www.lrl.state.tx.us/scanned/interim/79/C832.pdf (accessed on December 8, 2014). 765 APA discussion on Growing Smart project with Stuart Meck. See: http://www.planning.org/growingsmart/background.htm (accessed on January 6, 2016). 766 See: http://www.planning.org/growingsmart/background.htm (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 232 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the local level, Texas municipalities are granted the authority to regulate private land, including the location of hazardous facilities.767 Among other requirements, the zoning regulations must be designed to ensure public safety from fires and other dangers.768 However, the municipality is not given the authority to remove the hazardous condition on the property that exists at the time the governing body implements zoning authority and that is used in a public service business.769 The municipality is allowed to impose zoning regulations relevant to the storage and use of hazardous substances.770 In the case of West, Texas, this arrangement led to the city being vested with the most authority in regulating public use. West exercised this authority through its Code of Ordinances.771 West had zoned all property within the city limits for residential purposes only. However, all real property that had been used for commercial purposes before 1987 could remain commercial in nature. Any future development with commercial intent required a rezoning procedure.772 This provision is consistent with West’s comprehensive plan to zone all property within the city limits as residential property. In essence, regulatory authority has been delegated to municipalities to oversee the siting of facilities storing and distributing FGAN near cities such as West. Neither the federal government nor the state of Texas takes any part in oversight. In many instances, however, municipalities are unable to adequately address this complex issue through regulatory mechanisms. For instance, facilities such as the WFC plant existed before promulgation of the city’s Code of Ordinances, posing an issue of grandfathered facilities. Many different economic, safety, environmental, and agricultural interests must also be balanced. Furthermore, municipalities already face a shortage of resources for other essential governmental functions. However, safety issues can be addressed through reasoned regulation, using a number of methods. For example, a regulation requiring separation distances between public receptors and facilities handling FGAN could help mitigate offsite consequences in cities such as West. At root, however, locating these facilities near communities represents a national concern; therefore, all levels of government should give consideration to developing land use regulations to counter this problem.

767 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.003. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 768 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.004. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 769 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.013. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 770 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.017. See: http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). The term “hazardous substances” is not defined in the chapter. 771 See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on December 28, 2015). 772 Section 14.01.002. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 233 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 3.1 Importance of Land Use Planning in Siting Communities Near Facilities

Storing FGAN and Other Hazardous Chemicals The issue of siting hazardous facilities storing FGAN near cities such as West is not an anomaly; it is a nationwide problem. In addition, although not directly associated with FGAN storage facilities, land use issues have been at the forefront of multiple CSB investigations. Furthermore, CSB has identified— multiple times—the risks of locating a hazardous chemical facility near public receptors. Table 15 lists CSB investigations that involved land use issues. Table 15. Investigations Involving Land Use Issues Investigation Public Receptors Chemical Involved Offsite Consequences NDK Crystal, Inc. Interstate commerce, businesses Synthetic quartz crystal (silica and NaOH) 1 fatality DPC (Festus, MO) Highways, railroads, residences, businesses, farms Chlorine 63 residents who sought medical treatment Concept Sciences Businesses, residences Hydroxylamine 5 fatalities, 14 injuries, significant damage to buildings and shattered windows at residences CAI/Arnel Businesses, residences Heptane, isopropyl alcohol, n-propyl alcohol 10 injuries, 24 houses and 6 businesses significantly destroyed DPC (Glendale, AZ) Residences Chlorine 14 injuries Freedom Industries Residences, businesses, drinking water supply MCHM, PPH 369 residents who sought medical treatment for exposure Millard Refrigerated Services Businesses, environment Anhydrous ammonia 150 people who sought medical treatment for ammonia exposure T-2 Laboratories Inc. Businesses, residences, railroads Methylcyclopentadienyl manganese tri-carbonyl 28 injuries, significant property damage to nearby businesses Silver Eagle Refinery Residences Hydrocarbons Damage to residences Kaltech Residences, businesses, public streets Chemical waste At least 36 injured people, damage to residences and businesses Chevron Refinery Residences, businesses, public streets Hydrocarbons Approximately 15,000 people who sought medical treatment

West Fertilizer Company Final Report January 2016 234 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Investigation Public Receptors Chemical Involved Offsite Consequences Caribbean Petroleum Residences, businesses, public streets Hydrocarbons Shutdown of major highways, evacuation of local residents Bayer CropScience Residences, college, businesses, interstate commerce, waterways Methomyl, methyl isobutyl ketone Property damage, community shelter-in- place activated

In light of this information, the WFC incident in West serves as yet another unnecessary and deadly reminder that little has been done to address the risks of locating communities near facilities handling hazardous chemicals such as FGAN. Furthermore, if the incident had occurred during school hours, many more adults and children could have been injured. This incident represents a microcosm of the potential harms that many communities across the nations could endure.773 9.3.2 International Perspectives Other countries have confronted problems similar to those in West, Texas, and have taken a variety of approaches to address them. The European and Australian strategies merit consideration given their sophistication relative to the current U.S. approach. The discussion in this section explores the approaches taken by the European Union (EU), the United Kingdom (U.K.), and Australia. 9.3.2.1 European Union Through its Seveso III Directive, the EU requires member countries to take land use planning policies “into account” as part of major accident prevention.774 The policy behind the requirement is designed to mitigate the consequences of major chemical accidents experienced by public receptors. The EU developed this requirement in the aftermath of major industrial incidents, including the FGAN explosion in Toulouse.775 In fact, the Seveso III Directive lists AN as a “dangerous substance,” classifying the chemical into four different categories, depending on whether it is FGAN, technical grade ammonium

773 See: http://news.yahoo.com/devastated-texas-town-ponders-schools-140711695.html (accessed on December 29, 2015). Jaeah Lee. “Map: Is There a Risky Chemical Plant Near You?” Mother Jones (April 17, 2014). See: http://www.motherjones.com/environment/2014/04/west-texas-hazardous-chemical-map (accessed on July 8, 2014). 774 Seveso III Directive, Article 13, “Land-use planning.” See: http://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November, 2, 2015). 775 G. Vierendeels, et al. “Modeling the major accident prevention legislation change process within Europe.” Safety Science. 516 (2010).

West Fertilizer Company Final Report January 2016 235 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

nitrate (TGAN), off-specification ammonium nitrate (AN), or AN capable of self-sustaining decomposition.776 Under the Seveso III requirements, member countries are to ensure that their policies address “appropriate distances” between covered facilities and residential areas. Furthermore, the countries must “set up appropriate consultation procedures” with competent authorities to “facilitate the implementation” of the land use planning policies. The Seveso III Directive applies to new facilities, facilities undergoing modifications, and new developments. Existing facilities must determine whether additional technical measures are required to avoid an increase in risk to the nearby community.777 The Seveso III Directive does not prescribe best practice guidance for its technical requirements (such as separation distances), consistent with its respect for each country’s political, cultural, technical, and economic differences. However, various entities such as the Institute for Systems and Informatics and Safety provide best practice guidance, which refers to the use of technical approaches and procedural issues.778 Although such guidance offers helpful insights to member countries, the appropriate response for a specific site is still recognized as a matter of interpretation for each country. Given the immense differences among the approaches to land use planning of the member countries, it is difficult to compare EU country land use policies. However, the establishment of groups such as the European Commission and the Committee of the Competent Authorities under the Seveso III Directive emphasizes the important role that land use planning issues play in the European community.779 Although issues still remain relating to each country’s practices and methodologies, the emphasis on siting of facilities storing hazardous materials near public receptors highlights the importance that the European community places on land use planning in major accident prevention. 9.3.2.2 United Kingdom The U.K. vests a hazardous substances authority with the power to administer and enforce land use planning as it relates to storing or using hazardous substances. The hazardous substances authority is generally an entity charged with dealing with land use planning and zoning issues, known as the local

776 Seveso III Directive, Notes Section, “AN compounds with more that 28% by weight and AN based fertilizers.” 2012/18/EU. See: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November 2, 2015). 777 Seveso III Directive, Article 13, “Land-use planning.” 2012/18/EU. See: http://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32012L0018 (accessed on November 2, 2015). 778 Christou, M.D., and S. Porter. “Guidance on Land Use Planning as Required by Council Directive 96/82/EC (Seveso II).” Institute for Systems Informatics and Safety, 1999. See: http://ipsc.jrc.ec.europa.eu/fileadmin/repository/sta/mahb/docs/LandUsePlanning/EUR18695EN_LandUsePlanning Guidance.pdf (accessed on December 28, 2015). 779 Major Accident Hazards Bureau. “Land Use Planning.” See: http://ipsc.jrc.ec.europa.eu/index.php/Land-use- planning/694/0/ (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 236 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

planning authority.780 Consequently, the U.K. takes an approach similar to that of the United States in decentralizing land use planning to allow a local authority to promulgate and enforce land use requirements.781 For the WFC incident in West, Texas, the West City Council would be the analogue to the U.K. hazardous substances authority. The U.K., however, requires land use policies to account for major accidents caused by hazardous substances.782 This responsibility is executed through a collaborative effort among the hazardous substances authority, U.K. Health and Safety Executive (HSE),783 U.K. Environment Agency,784 and other interested stakeholders. Essentially, organizers of a proposed development must seek a hazardous substances consent from the hazardous substances authority to establish a facility that will store or use hazardous substances785 within its jurisdiction.786 When the hazardous substances authority receives an application for consent, it must consult with the HSE and the U.K. Environment Agency for advice on whether consent to the proposed development is warranted. Other interested stakeholders are also consulted or given the opportunity to publicly comment on the proposed development.787 Using all of the relevant information provided, the hazardous substances authority weighs all competing interests and decides whether to grant a hazardous substances consent to the proposed development.788 The U.K. attempts to balance each local community’s interest in deciding the risks that it will tolerate, drawing on the expertise and resources of national governmental bodies. Such an approach makes it more likely that all relevant issues and concerns about locating a development that stores or uses hazardous substances near the public will be presented to the hazardous substances authority before a

780 See: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf (accessed on December 28, 2015). 781 The U.K. has experienced similar catastrophic incidents that had effects on the population, including the Flixborough (Nypro UK) Explosion in 1974 and the Buncefield incident in 2005. See: http://www.hse.gov.uk/comah/sragtech/caseflixboroug74.htm and http://www.buncefieldinvestigation.gov.uk/, respectively (accessed on December 28, 2015). 782 Seveso Directive II, Article 12, “Land Use Planning.” See: http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed on December 28, 2015). 783 The U.K. HSE is a governmental body responsible for enforcing health and safety at workplaces. See: http://www.hse.gov.uk/contact/authority.htm (accessed on December 28, 2015). 784 The U.K. Environment Agency is a governmental body responsible for protecting and improving the environment and for promoting sustainable development. See: http://www.environment-agency.gov.uk/aboutus/default.aspx (accessed on December 28, 2015). 785 FGAN is included within the definition of a “hazardous substance.” See: http://www.legislation.gov.uk/uksi/1999/981/schedule/1/made (accessed on December 28, 2015). 786 See: http://www.hse.gov.uk/landuseplanning/what.htm (accessed on December 28, 2015). 787 Other stakeholders include the local parish council, fire and civil defense authorities, and the governmental agency English Nature. 788 See: http://www.environment-agency.gov.uk/aboutus/default.aspx (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 237 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

decision is rendered. The U.K. thus believes that major offsite risks can be effectively managed before permitting a hazardous substance to be stored near a population in its vicinity.789 9.3.2.3 Western Australia Australia’s land use planning methods regarding hazardous substances vary across jurisdictions.790 Although each Australian state and territory applies varying regulations regarding land use planning of FGAN storage facilities, the Government of Western Australia employs an insightful and sophisticated approach to the issue. In essence, Western Australia uses a risk-based method that subjects FGAN storage facility siting to government approval.791 Western Australia legislatively addresses land use issues concerning FGAN through its Dangerous Goods Safety Act 2004 (the Dangerous Goods Act). This act places a duty on all people involved with dangerous goods to minimize risk associated with those goods.792 To minimize risk, the Dangerous Goods Act requires that “all reasonably practicable measures” be used. In determining whether a measure is “reasonably practicable,” consideration is given to issues such as the severity of the harm, severity of the risk to people, and suitability of the means in question.793 FGAN is treated as a dangerous good under the Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007 and the Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007, which both support the Dangerous Goods Act.794

789 See: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf (accessed on December 28, 2015). 790 See: http://www.chemicalspolicy.org/downloads/chemicals-plastics-regulation.pdf (accessed on December 29, 2015). 791 Dangerous Goods Safety Act 2004. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of- solid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). 792 Dangerous Goods Safety Act 2004, Part 2. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 2015). 793 Ibid. 794 Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of- solid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 238 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Land use planning as related to siting facilities storing FGAN near public receptors is implemented by applying separation distances. These distances are subject to acceptance by Resource Safety, a department of the Government of Western Australia.795 If it is determined that an FGAN facility is not satisfying the separation distance requirement, Resource Safety may limit the quantity of FGAN within the facility or require that other safety conditions be met.796 The New South Wales Department developed the required separation distances with the intent of reducing the risk of offsite consequences insofar as reasonably practicable.797 The distances were not designed to completely eliminate the risks associated with offsite consequences, nor were they intended to replace preventive controls.798 The separation distances are categorized by a threshold quantity (i.e., whether FGAN is stored in quantities greater than or less than 10 metric tons). For instance, if FGAN exceeding 10 tons is stored at a facility, it must be separated by at least 300 meters (985 feet) from critical infrastructure, 240 meters (790 feet) from residential buildings, and 140 meters (460 feet) from commercial buildings.799 Western Australia seeks to address land use planning through a risk-based scheme that requires government permission to site FGAN facilities near public receptors. Depending on the quantity of FGAN stored, each facility must be sited at a minimum distance from such public receptors. Furthermore, if the facility is not sited at the required minimum distance, it might have to limit the maximum quantity of FGAN that it can store. A study of the risk associated with a particular facility might be required to reach agreement between the government and the facility on appropriate separation

795 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). See also: http://www.dmp.wa.gov.au/6611.aspx (accessed on December 28, 2015). 796 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). 797 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solid- ammonium-nitrate-code-of-practice.pdf. Government of Western Australia. Code of Practice: Safe Storage of solid FGAN, 3rd Edition: 6-7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015). Hazardous Industry Planning Advisory Paper No. 4—Risk criteria for land use safety planning. HIPAP4. See: http://www.planning.nsw.gov.au/Policy-and- Legislation/~/media/0D39F08E7889409BBA1FA88D5FB859FD.ashx (accessed on January 7, 2014). 798 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid Ammonium Nitrate: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe- storage-of-solid-ammonium-nitrate-code-of-practice.pdf (accessed on January 6, 2016). Government of Western Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015). 799 Government of Western Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed on December 29, 2015).

West Fertilizer Company Final Report January 2016 239 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

distances. This approach gives Western Australia the capability to balance the risk associated with storing FGAN against the need for land development. 9.4 Efforts to Address Land Use Planning After the West Incident In the weeks, months, and years following the West incident, few inroads have been made to resolve land use issues. The federal government has developed a working group that is tasked with developing recommendations related to chemical facility safety and security; however, the timeline for delivery has been extended.800 At the state level, general opposition remains to any type of change in the Texas approach to land use planning.801 In fact, strong opposition has contested any regulation of FGAN facilities in Texas.802 The city of West is currently awaiting recommendations from state and federal officials; however, it does plan on siting any new fertilizer facilities away from the community.803 The Texas State Fire Marshal’s Office (SFMO) has taken a proactive approach by providing all counties with software demonstrations that estimate blast zones from facilities storing FGAN.804 In addition to assisting first responders, the software gives community leaders the opportunity to assess community impacts relating to the siting of a new FGAN facility. In addition, the SFMO will assist each county in reviewing best practices for dealing with the storage and handling of FGAN. At the county level, the McLennan County Local Emergency Planning Committee (LEPC) has emphasized the importance of land use issues in agreeing to focus on “upfront planning” when siting community buildings such as schools or hospitals near chemical facilities.805 The LEPC has agreed to continue to meet quarterly. The city of West has also committed to advising other communities about identifying the potential hazards that they might face in locating chemical facilities near their towns and citizens.806 Applied Research Associates, Inc. (Applied Research) has engaged in an effort to understand and validate the separation distances prescribed in NFPA 400. After completing a literature review, Applied Research selected a consequence-based case study and developed a test plan. The firm then carried out the case

800 See: https://www.osha.gov/chemicalexecutiveorder/index.html (accessed on December 28, 2015). 801 See: http://www.nytimes.com/2013/05/10/us/after-plant-explosion-texas-remains-wary-of-regulation.html?_r=0 (accessed on December 28, 2015). 802 Henry, Terrence, NPR. “Proposals to Prevent Another Fertilizer Explosion Immediately Meet Resistance,” July 2,

1. See: http://stateimpact.npr.org/texas/2014/07/02/proposals-to-prevent-another-fertilizer-explosion-

immediately-meet-resistance/ (accessed on December 8, 2014). The Associated Press. “New bill on West blast would delay new rules.” CBS DFW (August 5, 2014). See: http://dfw.cbslocal.com/2014/08/05/new-bill-on-west- blast-would-delay-new-rules/ (accessed on December 29, 2015). 803 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html (accessed on December 28, 2015). 804 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_assessment.html (accessed on December 28, 2015). 805 Ibid. 806 Ibid.

West Fertilizer Company Final Report January 2016 240 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

study test plan to assess the adequacy of the separation distance for safe storage of AN and the safe separation distance for personnel in a process building in the event of an explosion. Applied Research then developed a series of recommendations regarding separation distances in NFPA 400, including possible approaches for improving those distances, to guide NFPA and its affiliated Fire Protection Research Foundation project panel in future research efforts.807 The city of West is currently rebuilding. The blast substantially damaged more than 350 homes, completely destroying 150 of them, and caused approximately $100 million in damages.808 The West High School has been razed, and a new school will be constructed on the same site.809 The site of the accident will likely become an industrial park.810 10.0 Key Findings Technical Findings

1. The presence of combustible materials used for construction of the facility and the fertilizer grade

ammonium nitrate (FGAN) storage bins, in addition to the West Fertilizer Company (WFC) practice of storing combustibles near the FGAN pile, contributed to the progression and intensity of the fire and likely resulted in the detonation.

1. The WFC facility did not have a fire detection system to alert emergency responders or an

automatic sprinkler system to extinguish the fire at an earlier stage of the incident.

1. On the basis of interviews with eyewitnesses and supporting photographic evidence, the first

observed fire and smoke originated in and above the seed room and progressed throughout the northern half of the WFC facility. The radiant heat from the fire, fueled by the structure, flammable building contents, and the asphalt roof shingles, likely heated the surface of the FGAN pile. Contamination from soot, molten asphalt, and molten polyvinyl chloride (PVC) from an overhead conveyer produced a detonable mixture of combustibles and FGAN oxidizers. Increased ventilation generated a brighter and hotter flame, heating the FGAN-fuel mixture on the surface of the pile. Regulatory Findings

1. Occupational Safety and Health Administration (OSHA) efforts to oversee facilities that store and

handle FGAN fell short at the time of the incident.

807 Fire Protection Research Foundation. “Separation Distances in NFPA Codes and Standards, 2014.” See: http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf (accessed on September 25, 2015). 808 See: http://www.hazmatmag.com/news/in-harms-way/1002482923/ (accessed on January 6, 2016) and http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_whatwelearned.html (accessed on December 28, 2015). 809 CBS. “DFW, West Getting New Schools After Explosion,” October 30, 2014. See: http://dfw.cbslocal.com/2014/10/30/west-getting-new-schools-after-explosion/ (accessed on December 6, 2014). 810 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html (accessed on December 28, 2015).

West Fertilizer Company Final Report January 2016 241 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Section (i) of the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109(i), was not very well known among those in the fertilizer industry, likely due in part to the fact that (1) application of the section was unclear; and (2) the section had rarely been used previously to cite fertilizer facilities. b. OSHA inadvertently omitted ammonium nitrate (AN) from the List of Highly Hazardous Chemicals, Toxics and Reactives in its Process Safety Management (PSM) standard, 29 CFR 1910.119, even though AN possesses reactive characteristics that would have triggered its inclusion.

1. Because the WFC facility was covered under the U.S. Environmental Protection Agency (EPA)

Risk Management Program rule for its anhydrous ammonia tanks (but not for its FGAN), WFC employees and emergency responders demonstrated a greater awareness of the hazards associated with onsite storage of anhydrous ammonia than those associated with FGAN. AN is not on the EPA Risk Management Program list of chemicals, so the WFC was not required to take safety measures for FGAN similar to those for ammonia. Insurance Findings

1. WFC’s previous property and liability insurer, which provided insurance to WFC from 2006

through 2009, did not focus on FGAN hazards in its annual insurance inspections because it was not required to do so. However, the insurer did not renew WFC’s commercial property policy in 2010 because WFC repeatedly failed to comply with the insurer’s safety-related recommendations (e.g., to replace corroded electrical wiring), which were identified in loss control surveys. The CSB found little evidence of onsite activity or inspections by WFC’s subsequent insurer, U.S. Fire, which insured the facility at the time of the incident. Emergency Response Findings

1. The West Volunteer Fire Department (WVFD) did not conduct pre-incident planning or response

training at the WFC facility to address FGAN-related incidents because was no such regulatory requirement. Thus, the firefighters who responded to the WFC fire did not have sufficient information to make an informed decision on how best to respond to the fire at the fertilizer facility.

1. Federal and state of Texas curriculum manuals used for hazardous materials (HAZMAT) training

and certification of firefighters placed little emphasis on emergency response to storage sites containing FGAN. On the other hand, HAZMAT shipping and transportation were covered frequently in the courses. Many federal and state grants support the resource needs of firefighters and fire departments; however, these grants are used more often for resources such as personal protection equipment or firefighting equipment rather than for training.

1. Lessons learned from previous FGAN-related fires and explosions were not shared with volunteer

fire departments, including the WVFD. If previous lessons learned had been applied in West, the firefighters and emergency personnel who responded to the incident might have better understood the risks associated with FGAN-related fire.

West Fertilizer Company Final Report January 2016 242 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emergency Planning Findings

1. Despite WFC documentation of its FGAN in a 2012 Tier II report, the WVFD did not conduct

drills and exercises at the WFC facility before the 2013 fire and explosion.

1. The agricultural use exemption under the Emergency Planning and Community Right-to-Know

Act (EPCRA) is not clear about which facilities are covered under the exemption. Before the WFC fire and explosion, the state of Texas determined that the WFC was exempt under the EPCRA agricultural use exemption. Land Use Planning Findings

1. At the time of its construction, the WFC facility was surrounded by open fields, and no zoning

regulations existed when it began operations.

1. As the city of West developed over the years, it expanded toward the WFC facility.
2. The proximity of the city of West to the WFC facility magnified the offsite consequence impacts.
3. Other FGAN facilities throughout Texas are located in close proximity to schools, residences, and

care facilities. Of the 40 FGAN facilities in Texas as of October 2015, 48 percent are within 0.5 miles of a school, nursing home, or hospital while 83 percent are within 0.25 miles of a residence.

1. 0 Recommendations

U.S. Environmental Protection Agency (EPA) 2013-02-I-TX R1

Develop a guidance document on Emergency Planning and Community Right-to-Know Act (EPCRA) requirements that is issued annually to State Emergency Response Commissions (SERCs) and Local Emergency Planning Committees (LEPCs) and ensure that the guidance focuses on the following: a. Explains which chemicals are exempt and which must be reported. b. Describes how emergency responders should use Tier I and Tier II inventory reports and Safety Data Sheets, such as in safety training, practice drills, and for emergency planning. c. Includes comprehensive LEPC planning requirements, with an emphasis on annual training exercises and drills for local emergency response agencies.

2013-02-I-TX R2

Develop a general guidance document on the agricultural exemption under EPCRA Section 311(e)(5) and its associated regulation, 40 CFR 370.13(c)(3), to clarify that fertilizer facilities that store or blend fertilizer are covered under EPCRA. Communicate to the fertilizer industry publication of this guidance document as well as the intention of Section 311(e)(5).

West Fertilizer Company Final Report January 2016 243 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2013-02-I-TX R3

Revise the Risk Management Program rule to include fertilizer grade ammonium nitrate (FGAN) at an appropriate threshold quantity on the List of Regulated Substances. a. Ensure that the calculation for the offsite consequence analysis considers the unique explosive characteristics of FGAN explosions to determine the endpoint for explosive effects and overpressure levels. Examples of such analyses include that adopted by the 2014 Fire Protection Research Foundation report, “Separation Distances in NFPA Codes and Standards,” Great Britain’s Health and Safety Executive, and other technical guidance. b. Develop Risk Management Program rule guidance document(s) for regulated FGAN facilities. U.S. Occupational Safety and Health Administration (OSHA) 2013-02-I-TX R4

Develop and issue a Regional Emphasis Program for Section (i) of the Explosives and Blasting Agent standard, 29 CFR 1910.109(i), in appropriate regions (such as Regions IV, VI, and VII) where fertilizer grade ammonium nitrate (FGAN) facilities similar to the West Fertilizer Company facility are prevalent. Establish a minimum number of emphasis program inspections per region for each fiscal year. Work with regional offices to communicate information about the emphasis program to potential inspection recipients.

2013-02-I-TX R5

Implement one of the following two regulatory changes, either option (a) or (b) below, to address FGAN hazards: a. Add FGAN to the OSHA Process Safety Management (PSM) standard List of Highly Hazardous Chemicals, Toxics and Reactives in 29 CFR 1910.119, Appendix A, and establish an appropriate threshold quantity. Identify National Fire Protection Association (NFPA) 400 as a source of Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) for PSM-covered FGAN equipment and processes. b. Revise the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109, to ensure that the title, scope, or both make(s) clear that the standard applies to facilities that store bulk quantities of FGAN. Revise 1910.109(i), “Storage of Ammonium Nitrate,” to include requirements similar to those in NFPA 400, Hazardous Materials Code (2016 Edition), Chapter 11. Ensure the following elements are considered: i. For new construction, prohibit combustible materials of construction for FGAN facilities and FGAN bins. For existing facilities, establish a phase-in requirement for the replacement of wooden bins with bins made of noncombustible materials of construction within a reasonable time period (e.g., 3 to 5 years from the date standard revisions are enacted), based on feedback from the fertilizer industry. ii. Require automatic fire sprinkler systems and fire detection systems for indoor FGAN storage areas.

West Fertilizer Company Final Report January 2016 244 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

iii. Define adequate ventilation for FGAN for indoor storage areas. iv. Require all FGAN storage areas to be isolated from the storage of combustible, flammable, and other contaminating materials. v. Establish separation distances between FGAN storage areas and other hazardous chemicals, processes, and facility boundaries. International Code Council (ICC) 2013-02-I-TX R6

In a subsequent edition of the International Fire Code, develop a chapter or a separate section under Chapter 50 (“Hazardous Materials”) or Chapter 63 (“Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids”) that includes the following requirements for the storage and handling of ammonium nitrate (AN): a. Require automatic fire detection and suppression systems in existing buildings constructed of combustible materials b. Provide ventilation requirements in accordance with the International Mechanical Code to prevent the accumulation of off-gases produced during AN decomposition c. Provide smoke and heat vents to remove heat from AN during fire situations d. Establish minimum safe separation distances between AN and combustible materials to avoid contamination in the event of fire. e. Prohibit the use of combustible materials of construction. Department of Homeland Security, Federal Emergency Management Agency (FEMA) 2013-02-I-TX R7

Through a new or existing program and in conjunction with training partners, create and implement a competitive funding mechanism to provide training to regional, state, and local career and volunteer fire departments on how to respond to fire and explosion incidents at facilities that store fertilizer grade ammonium nitrate (FGAN). Continue to use available funding to ensure training effectiveness.

2013-02-I-TX R8

During the proposal review process for the program, ensure that the FGAN training includes multiple delivery methods to enable a broad reach. Training should allow for instructor-led, web- based, and train-the-trainer courses; initial orientation; and refresher training. Training also should accommodate both resident and mobile capabilities to facilitate flexible delivery.

Objectives of the selected training course should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals

West Fertilizer Company Final Report January 2016 245 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R9

Assist training partners to develop and provide continual oversight for an FGAN training program. In addition, evaluate the training curriculum to confirm that it adequately meets course objectives as well as the details of recommendation 2013-02-I-TX R8.

2013-02-I-TX R10

Develop an outreach program that notifies regional, state, and local fire departments about available FGAN training opportunities. The program should include the following: a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Details on how to obtain FGAN training by submitting a proposal in response to the funding opportunity c. Information on training partners and programs that provide FGAN training. Texas Commission on Fire Protection (TCFP) 2013-02-I-TX R11

Develop minimum standards for course curricula to include hazard awareness of fertilizer grade ammonium nitrate (FGAN) for those fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to other jurisdictions with FGAN facilities. In addition, develop a training program specific to FGAN.

Objectives of the program’s training course should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R12

Implement outreach to regional, state, and local fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to jurisdictions with FGAN facilities, informing them about the new FGAN training certification requirements and opportunities to receive training. Include the following in the outreach:

West Fertilizer Company Final Report January 2016 246 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Encouragement for fire departments in jurisdictions with FGAN facilities to become certified in FGAN training. State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA) 2013-02-I-TX R13

Develop a fertilizer grade ammonium nitrate (FGAN) training certification program for fire departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to other jurisdictions with FGAN facilities. The certification program should include multiple delivery methods to enable a broad reach. The certification program should allow for instructor- led, web-based, and train-the-trainer courses; initial orientation; and refresher training. The training also should accommodate both resident and mobile capabilities to facilitate flexibility in delivery.

The criteria for the certification program should address the following: a. Previous FGAN fire and explosion incidents, incorporating lessons learned b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN incompatibility with those materials and chemicals c. Pre-incident planning for fires involving FGAN d. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness e. National Incident Management System and Incident Command System.

2013-02-I-TX R14

Develop an outreach component for the training certification program that notifies regional, state, and local fire departments with FGAN facilities in their jurisdictions about the training certification opportunities available for FGAN. Ensure that the following items are included in the development of this program: a. Guidance for fire departments on how to identify FGAN hazards within their communities by engaging State Emergency Response Commissions and Local Emergency Planning Committees b. Encouragement for members in jurisdictions with FGAN facilities to become certified in FGAN training c. Information on training partners and programs that provide FGAN training. Texas A&M Engineering Extension Services (TEEX) 2013-02-I-TX R15

West Fertilizer Company Final Report January 2016 247 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Develop and administer a hazardous materials training module for career and volunteer fire departments that addresses fertilizer grade ammonium nitrate (FGAN) and other hazardous materials or chemicals that could pose new specialized hazards. Ensure that the training includes multiple delivery methods to enable a broad reach. The training should allow for instructor-led, web-based, and train-the-trainer courses; initial orientation; and refresher training. The training also should accommodate both resident and mobile capabilities to facilitate flexibility in delivery.

Objectives of the training course should address the following: a. How to respond to industrial fires involving FGAN and other hazardous materials or chemicals that could pose new specialized hazards to responding firefighters b. Previous FGAN fire and explosion incidents, incorporating lessons learned c. Hazards posed by other materials and chemicals stored near the FGAN, including FGAN incompatibility with those materials and chemicals d. Pre-incident planning for fires involving FGAN and other hazardous materials or chemicals that could pose new specialized hazards to responding firefighters e. On-scene emergency response and decision-making requirements for FGAN fires, including risk assessment, scene size-up, and situational awareness f. National Incident Management System and Incident Command System.

2013-02-I-TX R16

Develop an outreach program that notifies state, regional, and local fire departments about available FGAN training opportunities. The program should include the following elements: a. Guidance for fire departments on how to identify FGAN and other recognized hazards associated with other hazardous materials or chemicals within their communities by engaging with State Emergency Response Commissions and Local Emergency Planning Committees b. Promotion of use of the hazardous materials training module with TEEX training partners. Texas Department of Insurance (TDI) 2013-02-I-TX R17

For companies that provide insurance to agricultural facilities storing bulk fertilizer grade ammonium nitrate (FGAN) in Texas, including surplus lines insurers and Texas-registered risk retention groups, develop and issue guidance to assist in underwriting risk and conducting annual loss control surveys. Guidance should include the following: a. Combustible materials of construction for facilities and bins storing FGAN b. Storage of combustible materials near FGAN piles c. Adequate ventilation for indoor FGAN storage areas d. Automatic sprinklers and smoke detection systems for indoor FGAN storage areas e. Separation distances between FGAN and other hazardous materials onsite

West Fertilizer Company Final Report January 2016 248 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

f. Potential for offsite consequences from a fire or explosion, including the proximity of FGAN facilities to nearby residences, schools, hospitals, and other community structures. Provide references in the guidance document to existing materials from the following sources or to other equivalent guidance: a. National Fire Protection Association (NFPA), NFPA 400, Hazardous Materials Code, 2016 Edition, Chapter 11, “Ammonium Nitrate” b. FM Global, “Property Loss Prevention Data Sheet 7-89” c. U.S. Environmental Protection Agency, Occupational Safety and Health Administration, and Bureau of Alcohol, Tobacco, Firearms and Explosives; “Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills” d. TDI, “Best Practices for the Storage of Ammonium Nitrate” e. National Fire Protection Research Foundation, “Separation Distances and NFPA Codes and Standards.” West Volunteer Fire Department (WVFD) 2013-02-I-TX R18

Develop standard operating procedures for pre-incident planning for facilities that store or handle hazardous materials such as fertilizer grade ammonium nitrate (FGAN). El Dorado Chemical Company (EDC) 2013-02-I-TX R19

For all distributors and bulk retail sites (i.e., customers) that receive fertilizer grade ammonium nitrate (FGAN) manufactured by El Dorado Chemical Company (EDC) for storage, shipment, and sale: a. Encourage customers to conduct internal monitoring and auditing (in accordance with recent industry standards and guidelines) in locations where FGAN will be stored or used. Communicate that such internal monitoring and auditing may be conducted through established product safety programs, including ResponsibleAg. b. Develop a process to establish mutual product stewardship expectations for the downstream chain of customers. Communicate expectations to existing customers, and to new customers before their first shipment of FGAN. Include the following components: i. For all FGAN sold to distributors, encourage distributors to provide Safety Data Sheets and FGAN safety guidance to their customers and bulk retail sites to which FGAN is sold or shipped ii. For all EDC bulk retailers and non-EDC bulk retailers that store and sell FGAN, encourage bulk retailers to address, such as through certification checklists, the following: • Written procedures for the safe handling of FGAN, including employee training

West Fertilizer Company Final Report January 2016 249 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Emergency response plans to be sent to Local Emergency Planning Committees and local fire departments • Tier II Chemical Inventory Report submissions. This signature block is placed immediately after the last recommendation. By the U.S. Chemical Safety and Hazard Investigation Board

Vanessa Allen Sutherland

Chair

Kristen Kulinowski

Member

Manuel Ehrlich

Member

Richard Engler

Member

Date of Board Approval

West Fertilizer Company Final Report January 2016 250 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1. 0 Appendix A: Rebuilding of the West Independent School

District The West Independent School District (WISD) ultimately decided to demolish the West Intermediate School (WIS),1 West High School (WHS), and approximately half of West Middle School (WMS) based on the level of damage to these buildings. The WISD is rebuilding by constructing a combined middle school and high school consisting of a common entryway, cafeteria, and auditorium but separate offices and gymnasiums for each school. The left side of the structure will accommodate the middle school students (grades 6 through 8), and the right side will serve high school students (grades 9 through 12). Table 16 shows the distribution of grade levels within the old facilities and the new facilities. Groundbreaking took place on October 30, 2014, and construction began shortly thereafter; the WISD expects the school to open in September 2016. The new West Middle School/West High School will be located on the same site as the previous WHS campus. The site will house the WISD baseball field, softball field, eight-lane running track and facilities for field events, two practice fields, four tennis courts, and supporting concession and restroom facilities.2 Although the city demolished the WIS campus, the existing site paving remained in place so that it could serve as temporary parking for the WISD transportation department. The former WIS site currently houses a donated metal building used for agriculture shop for WHS students3 but could potentially become the final location of the WISD transportation, maintenance, and receiving facility.

1 WIS will not be rebuilt. 2 See: http://www.restorewestisd.com/assets/sd_west-hs-ms-final-web.pdf (accessed on December 30, 2015). 3 The donated metal building is approximately a block and a half from the temporary high school; however, it would take up too much instructional time for students to walk there, so buses take each class to the shop on days when students participate in agriculture class.

West Fertilizer Company Final Report January 2016 251 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 16. Distribution of Grade Levels at the Old and New WISD Schools School Old Facilities (Grades) New Facilities (Grades) West Intermediate School 4 and 5 Not rebuilt West Middle School 6 and 7 6 through 8 West High School 7 through 12 9 through 12 West Elementary School K through 3 K through 5

During the rebuild, the WISD created a temporary campus for middle and high school students, ultimately locating it on the existing middle school site. Students in grades pre-K through 5 attended school at West Elementary School, which sustained minimal damage in the explosion. Students in grades 6 through 12 were housed in temporary facilities at the existing WMS site.4 The sixth graders from WMS initially transferred to portable structures behind the elementary school until the end of the school year before moving to the middle school site for the 2013–2014 school year. The students in grades 7 through 12 moved to empty buildings owned by the Connally Independent School District,5 which is about 9 miles south of West, from April 17, 2013, until the end of the school year. Although the physical location of classes changed, WISD teachers still taught these students, who were still enrolled in the WISD. In August 2013, all of the students in grades 7 through 12 returned to West for classes in modular and portable buildings, and they eventually will transfer to the new school once the rebuild is complete. The temporary middle school and high school site consisted of 17 temporary portable facilities, 10 portable facilities donated by surrounding school districts that were leased by the WISD, and a temporary structure to cover the existing foundation and floor system saved from the original practice gymnasium.6 FEMA provided the WISD with a grant totaling nearly $20.8 million to assist in providing secure temporary classrooms and administrative buildings to replace those that were destroyed.7 The FEMA grant will pay the federal share, or 75 percent, of the eligible costs for the rebuild, and the WISD will

4 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 5 Connally Independent School District is a Texas public school district located in central McLennan County, serving the cities of Lacy, Lakeview, and Waco as well as the communities of Elm Mott, Chalk Bluff, and Gholson. 6 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 7 See: http://www.fema.gov/news-release/2013/08/01/fema-obligates-nearly-28-million-west-texas-independent- school-district (accessed on December 30, 2015). See: http://www.wfaa.com/story/local/2015/07/06/14167886/ (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 252 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cover the remaining 25 percent of the cost. The remaining cost to rebuild will be funded by the Texas Education Agency, which is providing the WISD with almost $10.3 million in Foundation School Program funds. At the time of the incident, the WISD was insured for $58 million. The school district received $30 million from the Argonaut Insurance Company, the WISD’s insurance carrier at the time of the explosion; however, WISD assessments indicate that the damage to its four schools far exceeded $30 million. Currently, the WISD is in litigation with Argonaut Insurance Company,8 Trident Insurance Services LLC,9and the Texas Association of Public Educators.10 Based on a district assessment and planning presentation to the WISD Board of Trustees on April 29, 2013, the proposed cost for rebuilding temporary facilities and renovating the facilities damaged by the explosion would amount to $16,562,706.11 This Phase One cost estimate for temporary facilities and renovations includes the following: • Existing administrative and office building renovations. • High school football stadium renovations. • Existing middle school site (1967 gymnasium repair, 1923 and 1957 building weatherization, maintenance and transportation building replacement). • Existing elementary school cafeteria additions and building renovations. • WISD-wide demolition and temporary classrooms. • Loose equipment moving and temporary storage. • WISD-wide technology connectivity. • Contingency funds. The initial proposed estimated cost for Phase Two rebuilding—including a new high school, new intermediate and middle school, new track and field facility, new maintenance and transportation permanent replacement building and contingency, and program financial audit—was $100,791,719.12 13.0 Appendix B: FGAN Incidents Tables Appendix B provides two tables, both depicting incidents involving FGAN. CSB listed only those incidents that it could confirm. As such, these lists are not meant to be comprehensive. The first table

8 Argonaut Insurance provides specialty property and casualty insurance and is a subsidiary of Argo Group International Holdings, Ltd. 9 Trident Insurance Services is a specialty commercial insurance provider for small- to middle-market public sector entities; it served as the administrator and adjustor for the insurance policy sold by Argonaut Insurance Company. 10 The Texas Association of Public Educators is a nonprofit organization managed by Argonaut Insurance Company to assist in the procurement of insurance and the administration of claims for school districts. 11 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015). 12 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 253 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

(Table 17) provides only those FGAN incidents that occurred at stationary sites. The second table (Table 18) shows all other FGAN incidents, many of which are transportation-related. The incidents are listed chronologically. Date, location, and a brief description of each incident are provided. For transportation incidents, the location given is the location where the incident occurred. An indication of whether the incident involved fire and/or explosion is also included. Quantity, or mass, of FGAN involved in each incident is provided as well. This information may or may not reflect the quantity of FGAN that actually caught fire and/or detonated. Where available, a description of casualties and property damage is given. Where information could not be found or determined, entries appear blank. Of the 32 total confirmed FGAN incidents researched by CSB, 22 occurred at stationary sites. At least 654 fatalities resulted from these stationary-site incidents. Thousands were injured and/or evacuated. Of the 10 FGAN incidents that occurred at non-stationary sites, at least 823 were fatally injured. Again, thousands were injured and/or evacuated.

West Fertilizer Company Final Report January 2016 254 Table 17. FGAN Incidents at Stationary Sites Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 14-Jan- 1916 Gibbstown NJ, USA Explosion occurred in evaporating pan

x 4K • One fatality • 12 injured Plant property heavily damaged 1 21-May -1921 Oppau, Germany Detonation involved FGAN and ammonium sulfate mixture or hidden explosives

x 900K • 561 fatalities • 2,000 injured Buildings flattened 2 1-Mar- 1924 New Brunswick (Nixon), NJ Explosion occurred at fertilizer building x x

• At least 20 fatalities • A dozen missing

3 5-Aug- 1940 Miramas, France Explosion of freight car launched explosive shell into burning mixture of FGAN and toluene at storage building x x 480K

4 26-Aug- 1947 Presque Isle, ME Fire involving fertilizers occurred

x

5

1 NFPA. Quarterly of the NFPA, Vol. 16, No. 1. July 1922. See: https://books.google.com/books?id=- MAdAQAAIAAJ&printsec=frontcover&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false (accessed on December 30, 2015). 2 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 3 See: http://query.nytimes.com/gst/abstract.html?res=9E05EEDD1E3CE733A25751C0A9659C946595D6CF (accessed on December 31, 2015). 4 See: http://www.societechimiquedefrance.fr/extras/Guiochon%20VO/exinvolontaireVO.htm (accessed on December 31, 2015). 5 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

West Fertilizer Company Final Report January 2016 255 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 1-Sep- 1947 St. Stephens, Canada Fire occurred in warehouse containing bagged FGAN

x

800K

6 14-Oct- 1949 Independence, KS Fire occurred in warehouse next to storage building containing FGAN piled in paper bags

x

1. 8– 5.4 million

7 9-Nov- 1966 Mt. Vernon, MO Explosion involving bagged FGAN occurred x x 100K

8 c. 1967 USA Screw conveyor shaft for FGAN burst after welding operation x x

9 c. 1973 Cherokee, OK Severe storage fire occurred in wooden FGAN storage area x x 28 million None injured

10 c. 1978 Rocky Mountain, NC Fire occurred at storage facility containing FGAN

x

1 million

Storage facility destroyed by fire 11

6 Ibid. 7 Ibid. 8 Ibid. 9 ABS Consulting. “West Fertilizer Incident Support Services Final Report.” August 28, 2015. 10 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 11 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

West Fertilizer Company Final Report January 2016 256 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References c. 1979 Moreland, ID Fire involved wood framework and belting of overhead conveyor system in fertilizer plant while being used to unload railroad car of FGAN

x

400K

Fire spread to roof 12 c. 1982 United Kingdom Fire in warehouse where wooden furniture stored near FGAN resulted in deflagration x x 6 million 750–1,000 evacuated

13 13-Dec- 1994 Port Neal, IA Two explosions occurred at the Terra Industries AN plant

x

• Four fatalities • 18 injured • Anhydrous ammonia released • Ground water under plant contaminated 14 6-Jan- 1998 Xingping, Shaanxi, China Explosions occurred at fertilizer company

x

• 24 fatalities • 56 injured

12 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013. 13 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 14 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 257 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 21-Sep- 2001 Toulouse, France Explosion occurred in warehouse containing FGAN and TGAN

x 400 – 600 K (TGAN+FGAN) • 29 fatalities • Nearly 2,500 injured, 30 of which severe Severe damage to plant and surrounding community 15 Jan- 2003 Cartagena, Murcia, Spain Fertilizer storage facility held self-sustained detonation fire x x

16 Oct- 2003 Saint-Romain- en-Jarez, France Fire occurred in end user storage facility containing FGAN in bags x x 10K Three heavily injured

17 30-Jul- 2009 Bryan, TX Fertilizer plant caught fire x

Over 80,000 evacuated

18

15 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 16 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013. 17 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 18 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 258 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 17-Apr- 2013 West, TX Fire and explosion occurred at fertilizer plant x x 80 – 100 K • 15 fatalities • Over 236 injured • Facility destroyed • Widespread damage to over 150 offsite buildings, including high school, middle school, intermediate school, apartment complex, and nursing home • Early estimates placed property damage at over $100 million

29-May- 2014 Athens, TX Fertilizer warehouse containing FGAN caught fire and burned x

19 12-Aug- 2015 Tianjin, China Hazardous materials storage warehouse containing AN* caught fire and exploded x x

Over 100 fatalities

20

19 Babrauskas, Vytenis. “Explosions of ammonium nitrate fertilizer in storage or transportation are preventable accidents.” Journal of Hazardous Materials (2015). 20 See: http://www.theguardian.com/world/2015/aug/18/tianjin-blasts-warehouse-handled-toxic-chemicals-without-licence-reports (accessed on January 19, 2016)

West Fertilizer Company Final Report January 2016 259 Table 18. Non-Stationary FGAN Incidents Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 16-Apr- 1947 Texas City, TX Fire occurred in hold of ship and detonated x x 4–11 million • Approximately 500 fatalities • Approximately 3,000 injured • 2,000 left homeless

• Commercial and residential buildings damaged or destroyed • Ships destroyed • Two planes knocked out of sky • Barge lifted out of water • Early property damage total estimated at approximately $40 million 21 23-Jan- 1953 Red Sea, Israel Spontaneous ignition of paper bags containing FGAN on ship x x 8–16 K

Ship destroyed 22 17-Dec- 1960 Traskwood, AR Explosion occurred in cars containing FGAN, petroleum, and paper x x 80—100 K

23

21 NFPA. “The Texas City Disaster.” The Quarterly. July 1947. 22 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 23 Ibid.

West Fertilizer Company Final Report January 2016 260 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References 1972 Taroon, Australia Transport of low density bagged AN prills involved in fire and explosion x x

Three fatalities

24 c. 1997 Brazil Delayed explosion occurred involving truck loaded with FGAN that caught fire due to nearby petrol tanker x x

25 c. 2000 FL Collision occurred between AN truck and gasoline tanker

x

26 18-Feb- 2004 Neyshabur, Khorasan, Iran Fire and explosion resulted from derailment of train containing bagged FGAN x x 840K 300 fatalities

27 Feb- 2004 Barracas, Spain Accident occurred during road transport of FGAN x x 50K • Two fatalities • Three injured

28

24 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28. 25 Ibid. 26 Ibid. 27 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 28 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3) (2005): 13–28.

West Fertilizer Company Final Report January 2016 261 Date Location Description Fire Explosion Quantity (lbs) Casualties Property Damage References May- 2004 Near Bucharest, Romania Truck accident occurred during road transport of bagged FGAN x x 50K At least 18 fatalities

29 17-Feb- 2007 Estaca de Bares, Spain Self-sustained decomposition fire of nitrogen, phosphorous, potassium (NPK) fertilizer occurred in cargo of ship x

1. 024

million (NPK)

30

29 Ibid. 30 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 2013.

West Fertilizer Company Final Report January 2016 262 14.0 Appendix C: TFI Safety and Security Tools The Fertilizer Institute (TFI) offers a wide variety of tools designed to support the fertilizer industry. Most of these tools are information based and readily accessible online; some of the tools, however, are also interactive, allowing for personalization and customization. These tools include the following: • Access to a new online Compliance Assessment Tool. • General fertilizer retail industry information resources, such as industry fact sheets, fertilizer product fact sheets, and infographics. • New fertilizer grade ammonium nitrate (FGAN) guidelines, “Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Retail Facilities.” • An educational brochure, “America’s Security Begins with You,” designed to alert the agriculture community of the dangers associated with ammonium nitrate (AN) if it ends up in the wrong hands. • A brochure, “Health Effects of Ammonia,” discussing the sources and uses of ammonia as well as how the body processes it. • Newly updated liquid fertilizer guidelines, “Aboveground Storage Tanks Containing Liquid Fertilizer–Recommended Mechanical Integrity Practices,” which provides recommended uniform industry inspection and maintenance procedures for aboveground storage tanks of liquid fertilizer.1 • An anhydrous ammonia brochure, “Recommended Practices for Loading/Unloading Anhydrous Ammonia Rail Tank Cars in North America–Reduce and Eliminate Non-Accidental Release,” accompanied by an associated DVD. • Access to a new nonprofit organization, ResponsibleAg, an industry-led stewardship2 initiative founded to promote the public welfare by helping agribusinesses comply with safety and security rules regarding the handling and storage of fertilizer products.3 • Access to a multimedia safety training program, the “Anhydrous Ammonia Training Tour,” developed through TFI sponsorship of the Transportation Community Awareness and Emergency Response and focused on the provision of pertinent information regarding the properties of ammonia, steps that should be taken to ensure safe transport of ammonia, appropriate emergency response measures in case of an ammonia release, and hands-on training.4 • Access to free web-based anhydrous ammonia safety training, composed of subject-based training modules on (1) properties of ammonia, (2) personal protective equipment, (3) transportation of ammonia to and from the field, (4) safe hook-up of ammonia tanks in the field, and (5) emergency response and first aid procedures.5

1 See: http://www.tfi.org/safety-and-security-tools/recommended-mechanical-integrity-guidelines-aboveground- storage-tanks-liqu (accessed on December 30, 2015). 2 Merriam-Webster defines a stewardship as “the activity or job of protecting and being responsible for something.” 3 See: http://www.responsibleag.org/FAQ.cgi (accessed on December 30, 2015). 4 See: http://www.tfi.org/safety-and-security-tools/transcaer%C2%AE-anhydrous-ammonia-safety-training (accessed on December 30, 2015). 5 See: http://www.tfi.org/safety-and-security-tools/web-based-anhydrous-ammonia-safety-training (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 263 • Access to a web-based compliance tool, myRMP Suite of Guidance Materials, a revised version of the Retail Guidance Document for Agricultural Retailers supported by the U.S. Environmental Protection Agency.6 • A new suite of second-generation web-based tools, mySPCC Suite of Guidance Materials Version 2.0, developed exclusively to assist agricultural retailers in implementing their Spill Prevention, Control, and Countermeasures (SPCC) plans, which enables the personalization of such plans to specific facilities and incorporates base information from the SPCC rule with accumulated knowledge gained by industry over the last 20 years.7

6 See: http://www.tfi.org/safety-and-security-tools/myrmp (accessed on December 30, 2015). 7 See: https://www.asmark.org/mySPCC/ (accessed on December 30, 2015).

West Fertilizer Company Final Report January 2016 264 15.0 Appendix D: ResponsibleAg As part of the ResponsibleAg program, participating facilities undergo an audit once every 3 years, and as many as 17 areas of a facility (e.g., dry fertilizer, liquid fertilizer, anhydrous ammonia, shop, office, and grounds) are assessed.1 Within 24 hours after completing the audit, the auditor enters findings into a secure portal on the ResponsibleAg website.2 Once the information is processed, the participating facility receives a corrective action plan if applicable, detailing any issues detected during the audit.3 This plan not only lists the issues discovered but also provides information on how to correct the issues and a recommended time frame for doing so.4 At the end of the recommended period of time, the auditor visits the facility again for a verification audit. The participating facility obtains certification only after all outstanding issues are addressed.5 To ensure a high level of reliability, a statistically valid sample of all participating facilities receives random verification from an independent auditor, approved by ResponsibleAg, every year.6 An annual accountability report includes the number of registered facilities, credentialed auditors, completed assessments, and random verifications.

1 See: http://www.responsibleag.org/About.cgi (accessed on December 30, 2015). 2 Ibid. 3 Ibid. 4 Ibid. 5 Ibid. 6 See: http://www.tfi.org/node/736 (accessed on January 6, 2016). See also: https://www.responsibleag.org/documents/RAHandout.pdf (accessed on December 30, 2015).

FD06460 ｜ 2013_美国_West_肥料_爆炸_与火灾-_West_Fertilizer_Explosion_and_Fire__最终报告_2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因：燃气/爆炸 ｜ 来源格式：pdf

1

Testimony of Rafael Moure-Eraso, Ph.D. Chairperson, U.S. Chemical Safety Board Before the U.S. Senate Committee on Environment and Public Works June 27, 2013

Chairman Boxer, Ranking Member Vitter, and distinguished members of the Committee – thank you for the opportunity to testify before you this morning. I am Dr. Rafael Moure-Eraso, and I am providing this testimony in my capacity as chairperson of the U.S. Chemical Safety Board, or CSB.

The CSB is an independent federal agency that investigates major chemical accidents and hazards, and develops safety recommendations to prevent their recurrence in the future. The Board is a non-regulatory, scientific, investigative agency. It has an annual budget, after the sequester, of $10.6 million and approximately 42 employees. In addition to investigations, safety studies, and recommendations, we do extensive outreach to companies and other organizations to inform them of our findings. Companies throughout the U.S. and the world use the information and recommendations developed by the CSB to help create what we hope are safer workplaces.

Congress frequently calls upon the CSB to investigate the root causes of some of the most complex and tragic industrial accidents across the country. Currently the CSB is involved in investigations of the Deepwater Horizon blowout in the Gulf of Mexico, the 2010 Tesoro refinery fire in Washington State, the 2012 Chevron refinery fire in California, and many other cases. Over the past two months, the CSB has begun investigations of the devastating explosion at West Fertilizer in West, Texas, on April 17, and the June 13 explosion at Williams Olefins in Geismar, Louisiana.

I will summarize the status of these two investigations and our preliminary findings, and then present some general thoughts on how the oversight of chemical safety might be improved.

West Fertilizer

West Fertilizer was a small retail distribution center that served farmers in the surrounding community and had approximately 15 employees. The facility was built in 1961, and at the time of the incident had a handful of buildings, including a warehouse where fertilizers and other materials were stored. The current owner, who operated an adjacent seed business, purchased the facility from liquidation in 2004.

No manufacturing occurred at the site, only blending of fertilizers for retail customers. Fertilizers such as ammonium nitrate and anhydrous ammonia were delivered to the site by rail car or truck. The ammonium nitrate, a granular solid, was stored in the facility’s fertilizer warehouse building in wood-framed bins with wooden walls. Both the warehouse building and the bins were constructed of combustible wooden material, and the building also contained significant quantities of combustible materials such as seeds stored near the bins of ammonium nitrate. The building had no automatic sprinkler or fire suppression features.

2

The facility straddles the city limit in the northeast section of West, Texas. When it was first built, the area was rural and there were few other structures nearby. Over time, many residences, a nursing home, an apartment complex, a high school, and an intermediate school were constructed within a 2000-foot radius of West Fertilizer.

On the evening of April 17, a fire of undetermined origin broke out at the facility, which had already closed for the day and was unattended. At 7:30 p.m. the fire was observed and reported to 9-1-1 dispatchers, who deployed the community’s volunteer firefighting force with four pieces of equipment. Firefighters found the warehouse building in flames and were in the process of extending hoses to fight the fire, and were applying some water to the blaze. Although the firefighters were aware of the hazard from the tanks of anhydrous ammonia as a result of previous releases, they were not informed of the explosion hazard from the approximately 60 tons of fertilizer grade ammonium nitrate inside the warehouse.

At about 7:50 p.m., while firefighters were positioned nearby, the ammonium nitrate suddenly detonated. A shock wave, traveling faster than the speed of sound, crushed buildings, flattened walls, and shattered windows. Innumerable projectiles of steel, wood, and concrete – some weighing hundreds of pounds – were hurled into neighborhoods. Twelve firefighters and emergency responders were killed. At least two members of the public died as well. More than 200 were injured. If this incident had occurred earlier in the day, many more people might have been killed or injured.

Residents of the West Rest Haven nursing home were severely affected, and according to nursing home officials 14 patients have passed away since the April 17 explosion, dying at twice the expected rate. The nursing home itself was destroyed, as was the apartment complex across the street. Two large schools – the high school and the intermediate school – were structurally damaged beyond repair and will be torn down, and a third school was also badly damaged. Because of the hour of day, all the schools were unoccupied. Had the explosion taken place during the day, severe casualties could have occurred in the intermediate school, which was devastated by both blast and fire. Post-explosion damage assessments indicate that it would have been difficult for children and others to escape from the building. The CSB is currently evaluating the vulnerability of this structure, to understand the potential consequences if the explosion had occurred when children were present and to inform future siting decisions.

Nearly 200 homes were severely damaged or destroyed, a sizeable fraction of all the houses in West. Financial damage is still being assessed, but the cost to rebuild the schools alone will reportedly approach $100 million. Some reports suggest total damages to the town may exceed $230 million, an unimaginable blow to a town of just 2800 residents – more than $80,000 for each man, woman, and child living in West.

CSB Investigation

A large CSB investigation team was assembled in West the day after the incident, on April 18. To date the CSB has conducted detailed interviews of about 30 witnesses, and has issued approximately 13 document requests to West Fertilizer, contract firms, hospitals, and regulators.

3

The CSB has also engaged external experts in blast reconstruction, fire codes and fire protection, and explosion mechanisms.

West Fertilizer and other companies have cooperated fully with the investigation. The CSB has also received outstanding cooperation from the mayor of West and its police and fire departments, and from other local agencies. The investigation has faced significant challenges as well, since the accident site was treated as a criminal scene for approximately five weeks after April 17 and was extensively altered during that time period, including the removal of most surviving physical evidence.1

I visited West, Texas, on May 2, just a couple of weeks after the explosion. The damage to homes, schools, and businesses was almost beyond imagination – even by the standards of large- scale chemical disasters. My heart goes out to the people of West, as they work to rebuild their proud and historic community. But I can assure you that it will be years before even the physical scars of this terrible explosion begin to fade.

Ammonium nitrate (AN) is a crop nutrient that represents about 2% of the total applied nitrogen fertilizer in the U.S. It is used primarily on pasture and citrus; its use has been declining in recent years as security concerns have increased since the Oklahoma City bombing in 1995. Ammonium nitrate is a strong oxidizer that reacts energetically with organic materials; it is also reactive by itself and capable of a runaway decomposition reaction and detonation under certain conditions.

Ammonium nitrate has historically been involved in some of the most severe chemical accidents of the past century, including disastrous explosions in the United States, Germany, and France. Two of these accidents – in Oppau, Germany, in 1921 and in Texas City, Texas, in 1947 – each killed 500 or more people. Additional safeguards were adopted following the Texas City disaster, such as avoiding contamination with petroleum-based materials that sensitize AN. These changes are credited with reducing the risk of a mass explosion of AN, but the risk of detonation was not eliminated. In September 2001, for example, a large AN explosion occurred at a factory in Toulouse, France, killing 30, injuring thousands of others, and damaging up to 30,000 buildings. Other serious AN-related accidents have occurred in the U.S. and other countries over the years.

Heat, fire, shock, confinement, and contamination are all factors that can sensitize ammonium nitrate to detonation. To quote from a comprehensive 1985 review of the hazards of AN:

The main thrust of the safety precautions recommended in most literature is the minimization of the most likely hazard, namely, the risk of fire. Ammonium nitrate should not be stored where it can be affected by any source of heat or by combustible materials.2

1 Within the past three weeks, the ATF has begun producing records and evidence from its investigation to the CSB. The ATF released the remains of the West site from its control back to the company on May 24. 2 Shah, K.D.; Roberts, A.G.; “Safety Considerations in the Processing, Handling, and Storage of Ammonium Nitrate;” In Keleti, C. (ed.); Nitric Acid and Fertilizer Nitrates; New York: Marcel Dekker Inc., 1985.

4

As simple as this sounds, this principle has not been fully adopted across the U.S., and was not implemented at West Fertilizer.

The CSB has made the following observations and preliminary findings to date, which are subject to further revision and development as the investigation unfolds:

1) The explosion at West Fertilizer resulted from an intense fire in a wooden warehouse building that led to the detonation of approximately 30 tons of AN stored inside in wooden bins. Not only were the warehouse and bins combustible, but the building also contained significant amounts of combustible seeds, which likely contributed to the intensity of the fire. According to available seismic data, the explosion was a very powerful event. 2) Whether additional factors such as material characteristics, shock, or contamination contributed to the incident remains to be determined. Company employees described a PVC plastic pipe that was located directly above the AN bin that detonated, and likely would have been melted by the fire. Additionally, large amounts of potentially flammable anhydrous ammonia were stored along the southern edge of the warehouse building. 3) The building lacked a sprinkler system or other systems to automatically detect or suppress fire, especially when the building was unoccupied after hours. By the time firefighters were able to reach the site, the fire was intense and out of control. Just 20 minutes after the first notification to the West Volunteer Fire Department, the detonation occurred. 4) Both National Fire Protection Association (NFPA) and the International Code Council (ICC), private organizations that develop fire codes that are widely applied across the U.S., have written code provisions for the safety of ammonium nitrate. Many of these safety provisions are quite old3 5) The existing fire codes do contain some useful provisions; for example the codes do require a fire resistant barrier between AN and any stored flammable or combustible materials and have provisions to avoid AN confinement and promote ventilation during fire conditions. However, even the most current NFPA 400 standard allows AN to be stored in wooden buildings and in wooden bins, and does not mandate automatic sprinkler systems unless more than 2500 tons of AN is being stored – vastly more than the approximately 30 tons that was sufficient to devastate much of the town of West. In addition, the standard contains a “grandfathering” provision that allows existing buildings that were constructed prior to code adoption – and fail to meet all of its provisions – to continue in use. and appear to be confusing or contradictory, even to code experts, and are in need of a comprehensive review in light of the West disaster and other recent accidents. For example the ICC’s International Fire Code directs users to a defunct code for ammonium nitrate (NFPA 490, last issued in 2002) rather than the current code, known as NFPA 400.

3 NFPA 400 refers users to a 1953 publication by the U.S. Bureau of Mines for information on the explosive properties of AN.

5

6) Texas has not adopted a statewide fire code, and state law actually prohibits most smaller rural counties from adopting a fire code. McLennan County, where the West facility was located, had not adopted a fire code, although it technically had the authority to do so because of its proximity to the more populous Bell County. The West Fertilizer facility was thus not required to follow any NFPA or ICC recommendations for the storage of AN. 7) Although some U.S. distributors have constructed fire-resistant concrete structures for storing AN, fertilizer industry officials have reported to the CSB that wooden buildings are still the norm for the distribution of AN fertilizer across the U.S. 8) Industry has developed other forms of ammonium nitrate that are reported to reduce or eliminate the risk of accidental detonation. For example, compounding the ammonium nitrate with calcium carbonate (limestone) “practically eliminates any risk of explosion in its storage, transportation, and handling,” while preserving the AN’s nutritive value.4 Calcium ammonium nitrate fertilizers have been widely used in Europe. Ammonium sulfate nitrate also has been found to be non-explosive provided the percentage of AN is held below about 37%.5 9) The federal OSHA standard for “Explosives and Blasting Agents” (29 CFR 1910.109) does have requirements for ammonium nitrate fertilizer; its provisions are similar to the NFPA codes. Unlike the NFPA codes – which West was not legally required to follow under any fire code – the OSHA standard would have applied. Like NFPA, however, the OSHA standard does not prohibit wooden bins or wooden construction, and does not require sprinklers unless more than 2500 tons of AN is present. However, OSHA public records indicate that OSHA last inspected the facility in 1985, and no citations were issued under the “Explosives and Blasting Agents” standard.

10) OSHA’s Process Safety Management standard (29 CFR 1910.119) or PSM was adopted in 1992 and is designed to prevent catastrophic workplace incidents involving highly hazardous chemicals. PSM requires companies to have a variety of management elements to prevent catastrophic incidents, such as conducting hazard analyses and developing emergency plans. Ammonium nitrate is not, however, one of the listed chemicals that triggers PSM coverage. The PSM standard also contains an exemption for retail facilities. 11) The EPA’s Risk Management Program rule (40 CFR Part 68) or RMP was adopted in 1996 and is designed to prevent catastrophic offsite and environmental damage from extremely hazardous substances. As the name suggests, the rule requires covered facilities to develop a Risk Management Plan, implement various safety programs, and analyze offsite consequences from potential accidents. Once again, however, ammonium nitrate is not one of the listed chemicals that triggers RMP coverage. West Fertilizer was RMP-covered due to its stored ammonia, and the company’s offsite consequence analysis considered only the possibility of an ammonia leak, not an explosion of ammonium nitrate.

4 Calcium ammonium nitrate (CAN) must still be protected from contamination with other chemicals that can re- sensitize it to detonation. See Popovici Ipochim, N.N.; Icechim, M.M.; “Other Ammonium Nitrate Fertilizers;” In Keleti, C. (ed.); Nitric Acid and Fertilizer Nitrates; New York: Marcel Dekker Inc., 1985. 5 Ibid.

6

12) OSHA considered adding ammonium nitrate along with other highly reactive chemicals to its list of PSM-covered substances in the late 1990’s. However, this proposal was shelved in 2001. In developing the RMP regulation, the EPA did not explicitly include explosives or reactive chemicals in the list of covered chemicals. In 2002, the CSB issued a study on reactive hazards, identifying 167 prior reactive incidents (including a 1994 explosion at an ammonium nitrate manufacturer). The Board recommended that both OSHA and EPA expand their standards to include reactive chemicals and hazards. However, neither agency has yet acted upon the recommendations. 13) No federal, state, or local standards have been identified that restrict the siting of ammonium nitrate storage facilities in the vicinity of homes, schools, businesses, and health care facilities. In West, Texas, there were hundreds of such buildings within a mile radius, which were exposed to serious or life-threatening hazards when the explosion occurred on April 17. 14) West volunteer firefighters were not made aware of the explosion hazard from the AN stored at West Fertilizer, and were caught in harm’s way when the blast occurred. NFPA recommends that firefighters evacuate from AN fires of “massive and uncontrollable proportions.” Federal DOT guidance contained in the Emergency Response Guidebook, which is widely used by firefighters, suggests fighting even large ammonium nitrate fertilizer fires by “flood[ing] the area with water from a distance.” However, the response guidance appears to be vague since terms such as “massive,” “uncontrollable,” “large,” and “distance” are not clearly defined. All of these provisions should be reviewed and harmonized in light of the West disaster to ensure that firefighters are adequately protected and are not put into danger protecting property alone. 15) While U.S. standards for ammonium nitrate have apparently remained static for decades, other countries have more rigorous standards covering both storage and siting of nearby buildings. For example, the U.K.’s Health and Safety Executive states in guidance dating to 1996 that “ammonium nitrate should normally be stored in single storey, dedicated, well-ventilated buildings that are constructed from materials that will not burn, such as concrete, bricks or steel.”6 16) CF Industries, a principal manufacturer of AN that was one of the suppliers to West, also recommends more rigorous safeguards in its Material Safety Data Sheet (MSDS) for the chemical. In the section entitled “Handling and Storage,” CF recommends that “Storage construction should be of non-combustible materials and preferably equipped with an automatic sprinkler system.” The U.K. guidance calls for storage bays “constructed of a material that does not burn, preferably concrete.” 7 17) The Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) has regulations for ammonium nitrate used as an explosive but these do not apply to ammonium nitrate used as fertilizer. The U.S. Department of Homeland Security has reporting Although companies are required to issue MSDS’s, the recipients of this information like West Fertilizer are not obligated to follow the recommended safety precautions. West lacked these safeguards.

6 U.K. Health and Safety Executive; “Storing and Handling Ammonium Nitrate;” Available from http://www.hse.gov.uk/pubns/indg230.pdf 7 http://www.cfindustries.com/pdf/Ammonium-Nitrate-Amtrate-MSDS.pdf

7

requirements for companies that have a threshold amount of fertilizer grade ammonium nitrate. However, the authority of DHS is to require security measures to protect against theft, diversion, or other intentional acts; DHS does not regulate the safety of ammonium nitrate to prevent conditions leading to accidental detonation. 18) The Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA) contains an exemption from hazardous chemical reporting for “fertilizer held for sale by a retailer to the ultimate customer.” The EPA has interpreted this provision as not applying to firms, like West, that make custom blends of bulk fertilizer for customers’ use. In 2012, West Fertilizer filed an EPCRA Tier II report with the McLennan County Local Emergency Planning Committee (LEPC). West reported the presence of up to 270 tons of ammonium nitrate, as well as anhydrous ammonia, at the site. The company did not provide the LEPC or the West Fire Department with an ammonium nitrate MSDS indicating the material’s hazards, nor does EPCRA automatically require that information to be provided. There is no indication that West’s filing with local authorities resulted in an effort to plan for an ammonium nitrate emergency. It is important to bear in mind the limitations on Local Emergency Planning Committees that operate in communities around the country. While these committees are required to exist under EPCRA, they are largely staffed by either volunteers or local officials who likely have many collateral duties. The law did not establish any funding stream for the LEPC’s, and they do not have any regulatory authority over chemical facilities. Their fundamental role is in emergency preparedness and coordination. The primary responsibility for developing and enforcing safety standards belongs to other federal and state agencies.

To summarize, the safety of ammonium nitrate fertilizer storage falls under a patchwork of U.S. regulatory standards and guidance – a patchwork that has many large holes. Specifically, the CSB has not identified any U.S. standards or guidance that prohibit or discourage many of the factors that likely contributed to the West disaster. Combustible wooden buildings and storage bins are permitted for storing AN across the U.S. – exposing AN to the threat of fire. Sprinklers are generally not required unless very large quantities of AN are being stored or fire authorities order sprinklers to be installed. Federal, state, and local rules do not prohibit the siting of AN storage near homes and other vulnerable facilities such as schools and hospitals.

The CSB has had a number of discussions with fertilizer industry representatives since April 17, including officials from The Fertilizer Institute and the Agricultural Retailers Association. We believe the industry has a strong and sincere interest in learning from the tragedy in West and taking steps to prevent future incidents involving ammonium nitrate, including the development of new audit tools and product stewardship programs. I applaud these efforts and encourage these organizations to draw upon the best science as well as the strongest safety recommendations from the U.S. and overseas, to ensure that U.S. fertilizer firms are applying the highest safety standards available anywhere in the world.

These voluntary programs should complement a thorough effort by the federal government to review and improve the comprehensive safety oversight of ammonium nitrate fertilizer distribution. The time for that effort is now.

8

Williams Olefins Explosion

On June 13, an explosion and fire occurred at the Williams Olefins plant in Geismar, Louisiana. This plant produces ethylene and propylene, which are raw materials for common plastics, and employs over one hundred workers. At the time of the incident, hundreds of contract workers were also present at the site for a major expansion project.

The CSB deployed a team of seven to the site, and CSB investigators have had a continuous presence in Geismar since June 15. The team has interviewed at least 28 witnesses and has reviewed documents and other information obtained from the company. Williams Olefins and other companies at the site have provided excellent cooperation with the investigation.

The incident involved a large distillation tower that processes propylene, propane, and other highly flammable hydrocarbons. The equipment was in normal operation on June 13. At 8:36 a.m. there was a sudden catastrophic failure involving a heat exchanger and associated piping attached to the distillation tower. The steel shell of the heat exchanger ripped open, and piping detached where it connected to the tower. The exact sequence and cause of these events remains to be determined.

In any event, there was a large-scale release of propylene, propane, and other hydrocarbons from multiple release points, forming a vapor cloud more than 200 feet high that is visible in surveillance video from the site. Within four seconds the vapor cloud ignited. Two Williams employees were fatally burned and approximately 105 other Williams employees and contractors were injured. The resulting fire burned for over four hours.

All of us at the CSB offer our deepest condolences and prayers for the families of the victims and for the injured. We are committed to a thorough investigation to determine why this horrible accident occurred.

CSB investigators have surveyed the scene from ground level and from the air, but currently the immediate area of the ruptured equipment remains too hazardous for entry due to overhanging debris. During the course of this week the area will be made safe for human entry, and this will allow investigators to observe the positions of key valves and obtain other important information. In addition we plan to recover and perform metallurgical tests on the heat exchanger and other piping. This testing will help determine whether the equipment that failed had weakened or deteriorated prior to the rupture, or some other factors were at play.

We are also working with the company to recover electronic control system data that will reveal process conditions at the time of the incident, such as material flows, pressures, and temperatures as well as valve positions. These data will also be important to understanding what occurred.

The assessment of the site and equipment is occurring in close coordination with federal OSHA inspectors. Within a few days of the incident, the CSB, OSHA, and the company entered into a written site and evidence control agreement to ensure that the evidence at the site is properly preserved in as-found condition, and all parties participate in the identification and testing of evidence. So far it has been a good model for how all incident sites should be handled.

9

CSB Investigative Capacity

The recent tragedies in West and Geismar have further taxed the CSB’s already overstretched staffing and resources. When the Congress requested that the CSB conduct a root-cause investigation of the Deepwater Horizon blowout, we informed Congress that this vital work would have unavoidable adverse effects on many other cases the CSB had already begun. The CSB already faced a record backlog of cases in 2010, when I became the chair. Not only have these adverse effects occurred, but Transocean – the operator of the Deepwater Horizon – has engaged in a lengthy legal challenge to the CSB’s authority to investigate the incident. On April 1, 2013, a federal district court in Houston ruled completely in the CSB’s favor and confirmed our offshore jurisdiction, but Transocean has indicated its intention to appeal the decision and seek a stay of enforcement. This unfortunate legal situation has continued to delay the CSB’s access to many documents and witnesses relevant to the investigation of the blowout.

The West and Geismar investigations have very significant financial costs associated with them and West in particular has required the diversion of a very large percentage of CSB’s investigators, who already had many months of work in the pipeline ahead of them when the tragedy struck. I would like to engage in a discussion with the Committee over the coming weeks about the impact of these new investigations on the CSB’s capacity to finish existing investigations – many of which have important stakeholders who have already been waiting a long time for answers. I also wish to notify the Committee that I believe the CSB has no capacity at this point to undertake any new investigative work, beyond what has already been promised and begun.

Possible Approaches for Reducing Risk

Since the CSB was established in 1998, the Board has made a number of safety recommendations for improving the oversight of facilities that handle hazardous substances. The CSB has made a number of recommendations to the Environmental Protection Agency, including the above-mentioned recommendation to broaden the application of the Risk Management Program to encompass reactive hazards that could have an impact on communities. The CSB has also recently recommended that the EPA strengthen the safety provisions for disposing of hazardous waste; this followed a recent tragedy in Hawaii where five federal subcontractors were killed disposing of illegal fireworks seized by the government.

In another recent case, the CSB urged the EPA to make greater use of its general duty clause authorities under the Clean Air Act by warning operators of their responsibility to safeguard remote oil and gas production sites; the CSB investigation found that 44 members of the public – children and young adults – died in explosions at these unsecured hazardous sites.

The Board has made a number of safety recommendations to OSHA as well. Among the improvements we have sought are a new regulatory standard for combustible dust; broadening the PSM standard to cover reactive chemicals and atmospheric storage tanks and to require more effective management of change reviews; modernization of standards for acetylene and compressed gases; and developing a new safety standard for fuel gases.

10

The majority of the CSB’s recommendations have not been directed to federal regulators but rather to other organizations around the country, including state and local governments, labor unions, trade associations, and the bodies like the ICC and NFPA that are responsible for developing consensus standards. The overall acceptance rate for CSB recommendations now exceeds 70%, and we track all recommendations to completion.

Improved enforcement efforts are just as important as having effective standards. In the CSB’s 2007 report on the explosion at BP’s Texas City refinery, the Board called for OSHA to expand its enforcement of process safety requirements by “hiring or developing a sufficient cadre of highly trained and experienced inspectors.” The Board report observed that there were few comprehensive OSHA inspections of refineries and other chemical sites, and OSHA had only a handful of inspectors with industrial process experience. By comparison, other countries like the U.K. had developed large bodies of specialized inspectors to perform ongoing, detailed safety inspections of hazardous facilities. OSHA responded in part to the recommendation by creating a new National Emphasis Program for refineries; the program was considered very effective by OSHA leaders, uncovering many safety problems in refineries. Unfortunately, OSHA did not have adequate resources to continue the program for more than a temporary period.

The EPA has also lacked the dedicated resources to conduct extensive enforcement of RMP program requirements. When this Committee conducted oversight of the program in 2007, the EPA told the late Senator Lautenberg that the total RMP-related fines collected for the entire country over nearly a four-year period (from fiscal year 2004-2007) were just over $3.5 million,8

a modest sum for a program that covers over 12,000 facilities. The CSB believes there are a number of serious challenges for improving industrial process safety in the U.S. As noted above, both OSHA and EPA process safety standards rely heavily upon list-based approaches for determining which facilities and companies have to comply with the most rigorous requirements. This concept of a hazardous chemical list was largely borrowed from environmental statutes of the 1970’s and 1980’s. However, process safety experts generally recognize that process hazards are a function of chemistry itself, and it makes little sense to assert that the overall risks from chemical processing and handling can be adequately captured using small lists of chemicals. Time and again the CSB has found large chemical hazards – capable of causing major disasters – residing in facilities that have largely escaped regulatory scrutiny. These facilities – of which West Fertilizer is but one example – fall outside the scope of existing regulatory standards, which were developed in the 1990’s and have seen few updates since then. All too often, a tragedy like the one at West suddenly exposes the hazards of a chemical or process that had somehow been overlooked.

The effects of these regulatory and enforcement challenges are evident in the accident rates for U.S. refineries and petrochemical sites. In 2008, a leading reinsurance company, Swiss Re, told the CSB and federal regulatory agencies that property losses from U.S. refinery accidents were occurring at approximately four times the rate of the rest of the world. In a follow-up briefing, Swiss Re officials asserted the gap between refinery safety performance in the U.S. and in the

8 Christopher P. Bliley, Associate Administrator, EPA; Letter to Senator Barbara Boxer, Chairman, Committee on Environment and Public Works, August 22, 2007.

11

rest of the world was continuing to widen. Many developed nations have adopted a different approach for controlling major process hazards. For example, nations in Europe and elsewhere have implemented a “safety case” regime, that requires hazardous facilities to continuously meet higher standards and reduce risk. Companies work directly with the regulator to identify the most appropriate safety standards from around the world, which they then are required to follow as a condition of operating. The focus is on preventing accidents in highly complex, technological systems rather than post-accident punishment.

Implementing an effective regulatory regime such as the safety case, with the ability to manage and regulate high hazard industries and prevent serious accidents, requires a number of inter- dependent features. First, the regulatory regime must be truly goal-setting in nature; another term for this is a performance-based regulatory regime. This approach provides industry the opportunity to tailor the regulations to its specific facilities with the goal of continuous risk reduction and incident prevention. The safety case regime also imposes a general duty on industry to reduce all risks in its operations to as low as reasonably practicable (ALARP). Such an approach places the impetus on industry to evolve with current best safety practices, wherever they have been developed anywhere in the world, to ensure that process hazards have been adequately identified, evaluated, and controlled. Furthermore, this regime requires industry to utilize leading and lagging indicators to drive risks involved in major hazard facilities to as low as reasonably practicable. Finally, for effective implementation, this type of regime requires an independent, competent, and well-funded regulator. Experience and competence in technical areas such as chemical engineering, human factors, and process safety management are necessary to provide effective auditing and regulatory oversight for prevention. In a recent federal OSHA forum on reforming process safety regulations, noted safety expert Andrew Hopkins pointed out that all of these elements are essential for an effective major accident prevention regime. Dr. Hopkins emphasized that the whole package of the safety case system needs to be introduced to make it work, including a competent, well-funded regulator.9

The CSB has begun to examine these alternative regulatory systems in the context of investigating the recent Chevron refinery fire in California and the Deepwater Horizon blowout in the Gulf. This April, the CSB issued its interim report on the Chevron refinery fire, which sent over 15,000 Richmond residents to the hospital in August 2012. California legislators have responded proactively to the accident and to the CSB’s recent findings and recommendations. A bill now before the California governor for signature would effectively triple the number of dedicated process safety inspectors in the state. This expansion will be funded by fees collected from the industry, and will not significantly burden taxpayers. And state legislators as well as leaders from Contra Costa County, where the refinery is located, have been working to implement other CSB recommendations for safer equipment designs and materials, reporting of process safety indicators, and improved maintenance procedures. California’s actions should be closely examined, we believe, as a potential model for other states and the federal government to follow.

Thank you again, Chairman Boxer and Ranking Member Vitter, for the opportunity to testify today.

9 OSHA Expert Forum on the Use of Performance-Based Regulatory Models in the U.S. Oil and Gas Industry, Offshore and Onshore; Texas City, Texas; September 20, 2012.

12

13

FD06461 ｜ 2013_美国_Williams_Olefins_工厂_爆炸_与火灾-_Williams_Olefins_Plant_Explosion_and_Fire__最终报告.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所：厂房/车间 ｜ 起火原因：燃气/爆炸 ｜ 来源格式：pdf

CSB · Williams Geismar Case Study 1

Published October 2016

Williams Geismar Olefins Plant Reboiler Rupture and Fire Geismar, Louisiana

Incident Date: June 13, 2013 Two Fatalities, 167 Reported Injuries No. 2013-03-I-LA

KEY ISSUES:

• Overpressure Protection • Process Hazard Analysis • Management of Change • Pre-Startup Safety Review • Operating Procedures • Hierarchy of Controls • Process Safety Culture

2 CSB · Williams Geismar Case Study

The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency whose mission is to drive chemical safety change through independent investigations to protect people and the environment. The CSB is a scientific investigative organization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for determining the root and contributing causes of accidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety. More information about the CSB is available at www.csb.gov. The CSB makes public its actions and decisions through investigative publications, all of which may include safety recommendations when appropriate. Examples of the types of publications include: CSB Investigation Reports: formal, detailed reports on significant chemical accidents and include key findings, root causes, and safety recommendations. CSB Investigation Digests: plain-language summaries of Investigation Reports. CSB Case Studies: shorter than a full investigative report, case studies present investigative information from specific accidents and include a discussion of relevant prevention practices. CSB Safety Bulletins: short, general-interest publications that provide new or timely information intended to facilitate the prevention of chemical accidents. CSB Hazard Investigations: broader studies of significant chemical hazards. Safety Videos: high-quality outreach products that result in improved worker and environmental protection. CSB publications can be downloaded at www.csb.gov or obtained by contacting: U.S. Chemical Safety and Hazard Investigation Board Office of Congressional, Public, and Board Affairs 1750 Pennsylvania Ave NW, Suite 910 Washington, DC 20006 (202) 261-7600 No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident may be admitted as evidence or used in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G).

CSB · Williams Geismar Case Study 3

DEDICATION This CSB Case Study is dedicated to the two men, listed below, who lost their lives as a result of this incident, as well as to the numerous workers injured on June 13, 2013.

Zach Green, 29

Scott Thrower, 47

4 CSB · Williams Geismar Case Study

This page is intentionally blank.

CSB · Williams Geismar Case Study 5

1. 0 INTRODUCTION

This case study examines the June 13, 2013 catastrophic equipment rupture, explosion, and fire at the Williams Olefins Plant in Geismar, Louisiana, which killed two Williams employees. The incident occurred during nonroutine operational activities that introduced heat to a type of heat exchanger called a “reboiler” which was offline, creating an overpressure event while the vessel was isolated from its pressure relief device. The introduced heat increased the temperature of the liquid propane mixture1 confined within the reboiler shell, resulting in a dramatic pressure rise within the vessel due to liquid thermal expansion. The reboiler shell catastrophically ruptured, causing a boiling liquid expanding vapor explosion (BLEVE)2 and fire. Process safety management program weaknesses at the Williams Geismar facility during the 12 years leading to the incident caused the reboiler to be unprotected from overpressure. These weaknesses include deficiencies in implementing Management of Change (MOC), Pre-Startup Safety Review (PSSR), and Process Hazard Analysis (PHA) programs. In addition, the company did not perform a hazard analysis or develop a procedure for the operational activities conducted on the day of the incident. This incident illustrates the importance of: • Using the hierarchy of controls when evaluating and selecting safeguards to control process hazards; • Establishing a strong organizational process safety culture; • Developing robust process safety management programs; and • Ensuring continual vigilance in implementing process safety management programs to prevent major process safety incidents. Following the incident, Williams implemented improvements in managing process safety. To prevent future incidents and further improve process safety at the Geismar plant, the U.S. Chemical Safety and Hazard Investigation Board (CSB) recommends that Williams strengthen existing safety management systems and adopt additional safety programs. The CSB also issues recommendations to the American Petroleum Institute (API) to help prevent future similar incidents industry-wide.

1 The process fluid in the reboiler contained an estimated 95% propane, with the balance composed mostly of propylene and C4 hydrocarbons, such as butane. 2 See section 4.0 for a technical explanation of the BLEVE mechanism, and a detailed sequence of events leading to the explosion. TABLE OF CONTENTS 1.0 Introduction 2.0 Background 3.0 The Incident 4.0 Technical Analysis 5.0 Analysis of Williams Geismar Process Safety Management Programs 6.0 Hierarchy of Controls 7.0 Industry Codes and Standards 8.0 Williams Geismar Post-incident Changes 9.0 Strategies for Improving Safety Culture 10.0 Key Lessons 11.0 Conclusions 12.0 Recommendations Appendix A – Causal Analysis AcciMap Appendix B – Failure Scenario Analysis Appendix C – Metallurgical Analysis Report “We would never knowingly tolerate a situation in which accidental operation of a valve resulted in the overpressuring of a vessel. We would install a relief valve. In the same way, accidental operation of a valve should not be allowed to result in explosion […].” Trevor Kletz, What Went Wrong? – Case Histories of Process Plant Disasters and How They Could Have Been Avoided, 5th ed., 2009

6 CSB · Williams Geismar Case Study

1. 0 BACKGROUND
2. 1

WILLIAMS BACKGROUND The Williams Companies, Inc. (“Williams”) is an energy infrastructure company headquartered in Tulsa, Oklahoma. Founded in 1908, Williams owns interests in natural gas and natural gas liquid (NGL) pipeline and processing facilities throughout North America, and conducts most of its operations through subsidiary companies. One of its subsidiary companies is Williams Olefins LLC, which owns and operates the Williams Geismar Olefins Plant. 2.2 GEISMAR OLEFINS PLANT The Williams Geismar Olefins Plant, which employs approximately 110 people, is located in Geismar, Louisiana, approximately 20 miles southeast of Baton Rouge. The Lummus Company designed and built the olefins plant in 1967, and Allied Chemical first operated it. In 1985, Union Texas Petroleum purchased the plant from Allied Chemical and sold it to Atlantic Richfield Company (ARCO) in 1998. Williams then purchased the facility in

1. At the time of the incident, Williams Olefins LLC and Saudi Basic Industries Corporation (SABIC) jointly

owned the plant, and Williams Olefins was the sole operator. The Williams Geismar Olefins Plant produces ethylene and propylene for the petrochemical industry.3 The plant originally produced 600 million pounds of ethylene annually. Over the years, the production capacity increased to 1.35 billion pounds of ethylene and 80 million pounds of propylene per year. At the time of the incident, approximately 800 contractors worked at the Williams Geismar facility on an expansion project, with an end goal of increasing the production of ethylene to 1.95 billion pounds per year. 2.3 PROCESS OVERVIEW The June 13, 2013 incident occurred when a reboiler, a heat exchanger that supplies heat to a distillation column,4 catastrophically ruptured. The reboiler that failed, EA-425B (“Reboiler B”) was one of two reboilers (Reboiler A and Reboiler B) that supplied heat to the propylene fractionator—a distillation column that separates propylene and propane. The process fluid on the shell-side5 of these reboilers is heated by hot “quench water,” 6 flowing through the tubes. Reboiler B had been offline for 16 months while Reboiler A was in operation, but was clean and available for use when Reboiler A eventually fouled (see Section 2.4).7 Figure 1 is a simplified flow diagram highlighting the location of the propylene fractionator relative to the overall olefins production process.

3 Williams corporate website. https://co.williams.com/operations/ngl-petchem/olefins/ (accessed August 17, 2016). Olefins, also known as “alkenes,” are hydrocarbons that contain a carbon-carbon double bond. The primary olefins produced by the Williams Geismar facility are ethylene (H2C=CH2), and propylene (CH3CH=CH2). Ethylene is a basic chemical used in the production process of a variety of products including plastics, soaps, and antifreeze. A primary use of propylene is the manufacturing of plastic materials and antifreeze. 4 A distillation column is a type of process equipment that separates a feed mixture based upon the mixture components’ boiling point temperatures. Components with lower boiling point temperatures, the more volatile components, leave the upper portion of a distillation column, while components with higher boiling point temperatures, the less volatile components, leave the lower portion of a distillation column. 5 The propylene fractionator reboilers are shell and tube heat exchangers. This type of heat exchanger has a large cylindrical exterior or “shell,” with a bundle of tubes inside of the shell. 6 “Quench water” is water that is used to cool furnace effluent gases through direct contact with the gases. It is a “process water” stream because it directly contacts and often contains residual material from the furnace effluent gases. 7 Fouling historically occurred on the process water (quench water) side of the reboilers. Fouling is a term used to describe a buildup on equipment surfaces of undesired material that has an adverse impact such as reducing heat transfer efficiency.

CSB · Williams Geismar Case Study 7

1. 3.1 OLEFINS PRODUCTION PROCESS DESCRIPTION

At the beginning of the olefins production process, ethane and propane enter “cracking furnaces”8 where they are converted to ethylene and propylene, as well as several byproducts including butadiene, aromatic compounds,9 methane, and hydrogen (Figure 1). The furnace effluent gases leave the cracking furnaces and enter heat exchangers that reduce the temperature of the gases. The furnace effluent gases then enter the quench tower for further cooling by direct contact with quench water, which is sprayed downward from the top of the tower. After additional processing, the cooled gases go to a series of distillation columns, such as the propylene fractionator, which separate the reaction products into individual components. The ethylene, propylene, butadiene, and aromatic compound products are then transported and sold to customers. Unreacted ethane and propane are recycled back to the beginning of the process. The quench water that directly contacts the heated furnace effluent gases is part of a closed-loop water circulation system. As the heated furnace effluent gases are cooled in the quench tower, heat transfers to the quench water. The heated quench water then serves as a heat source in various heat exchangers within the process, heating process streams while also reducing the temperature of the quench water. Finally, a cooling water system further cools the quench water before it circulates back to the quench tower (Figure 2).

8 “Cracking” is the breaking apart of molecules to form different molecules. 9 Examples of aromatic compounds, also called arenes, include benzene and toluene. FIGURE 1 Simplified flow diagram of the olefins process. The incident occurred when a propylene fractionator reboiler that had been offline for 16 months catastrophically ruptured. The propylene fractionator is highlighted in yellow.

8 CSB · Williams Geismar Case Study

Because the quench water directly contacts process gases, oily tar products10 contained in the gas condense into the quench water. The quench water settler removes most of the tar material (Figure 2); however, some oily material remains in the quench water. Over time, some of this material adheres to and builds up on the inside of process equipment such as heat exchanger tubes, resulting in a decrease in both heat transfer efficiency and quench water flow rate. The buildup of such material is called “fouling.” When quench water flow through the process periodically decreased due to fouling, Williams operations personnel would evaluate the quench water system by analyzing, among other things, flow rates through pumps and heat exchangers to identify the fouled piece of equipment likely causing the decrease in quench water flow. Williams personnel were performing this type of nonroutine operational activity when the incident occurred on June 13, 2013.

10 The tar products form in the cracking furnaces. FIGURE 2 Quench water system. The propylene fractionator Reboilers A and B are highlighted in yellow. The reboiler that ruptured, Reboiler B, is indicated with the red outline.

CSB · Williams Geismar Case Study 9

1. 4

PROPYLENE FRACTIONATOR REBOILERS The propylene fractionator Reboilers A and B are shell and tube heat exchangers,11 where tube-side hot quench water vaporizes shell-side hydrocarbon process fluid, which is approximately 95% propane with the balance composed mostly of propylene and C4s12 (Figure 313 and Figure 4). (This report refers to the propane mixture as “propane.”) Quench water enters the propylene fractionator reboilers at approximately 185 °F and partially vaporizes the shell-side propane, which enters the reboiler at a temperature of approximately 130 °F. The original propylene fractionator design had both reboilers continuously operating. This process design required periodic propylene fractionator downtime when the reboilers fouled and required cleaning. In 2001, Williams installed valves on the shell-side and tube-side reboiler piping to allow for continuous operation with only one reboiler operating at a time. The other reboiler would be offline but ready for operation (see Section 5.1), isolated from the process by the new valves. This configuration allowed for cleaning of a fouled reboiler while the propylene fractionator continued to operate. Unforeseen at the time due to flaws in the Williams process safety management program (discussed in subsequent sections in this report), these valves also introduced a new process hazard. If the new valves were not in the proper position (open or closed) for each phase of operation, the reboiler could be isolated from its protective pressure relief valve located on top of the propylene fractionator (Figure 4).

11 The heat exchangers are 24 feet 8 inches long end-to-end. Each exchanger shell (the portion of the heat exchanger that holds the tube bundle) is approximately 18.5 feet long and over 5 feet in diameter. The tubes are each ¾-inch in diameter, and each heat exchanger contains 3,020 tubes. To put this in perspective, if one were to lay each tube from one heat exchanger end-to-end in a straight line, the tubes would span over 10.5 miles. 12 C4s are hydrocarbon molecules that contain four carbon atoms. For example, butane (C4H10) is a C4 molecule. 13 Depicted in Figure 3 as a two-pass heat exchanger for purposes of simplicity, the reboilers were six-pass heat exchangers. FIGURE 3 Propylene fractionator reboiler.

10 CSB · Williams Geismar Case Study

FIGURE 4 Propylene fractionator schematic. This schematic represents the equipment configuration at the time of the incident. The valves (gate valves) isolating the reboilers from the pressure relief valve at the top of the propylene fractionator were not part of the original design, and were installed in 2001. Section 5.1 provides additional information about these valves.

CSB · Williams Geismar Case Study 11

1. 0 THE INCIDENT

On June 13, 2013, during a daily morning meeting with operations and maintenance personnel, the plant manager noted that the quench water flow through the operating propylene fractionator reboiler (Reboiler A) had dropped gradually over the past day (Figure 5). The group then analyzed plant data and noticed the entire quench water circulation rate seemed to be impaired. An operations supervisor, who Williams often relied on to troubleshoot and mitigate operational problems, informed the group that he would try to determine what caused the drop in flow. After evaluating the quench water system in the field, the operations supervisor informed several other personnel that fouling within the operating reboiler (Reboiler A) could be the problem and they might need to switch the propylene fractionator reboilers to correct the quench water flow. The operations supervisor attempted to meet with the operations manager to discuss switching the reboilers—a typical chain of communication—so that they could begin getting the necessary maintenance and operations personnel involved who needed to perform the work. The operations manager was not available, however, and the operations supervisor decided to return to the field and continue evaluating the quench water system.

The CSB determined that at 8:33 am, the operations supervisor likely opened the quench water valves on the offline reboiler, Reboiler B, as indicated by the rapid increase in quench water flow rate shown in Figure 6. Approximately three minutes later, Reboiler B exploded (Figure 7). Propane and propylene process fluid erupted from the ruptured reboiler and from the propylene fractionator due to failed piping. The process vapor ignited, creating a massive fireball. The force of the explosion launched a portion of the propylene fractionator reboiler piping into a pipe rack approximately 30 feet overhead (Figure 8). FIGURE 5 Graph of quench water flow rate through propylene fractionator Reboiler A prior to incident. Williams personnel identified that quench water flow rate had dropped.

12 CSB · Williams Geismar Case Study

FIGURE 7

Post-incident photo of the ruptured Reboiler B. A Williams operator working near the propylene fractionator at the time of the explosion died at the scene. The operations supervisor succumbed to severe burn injuries the next day. The explosion and fire also injured Williams employees and contractors who were working on a Williams facility expansion project—167 personnel reported injuries.14 The fire lasted approximately 3.5 hours, and Williams reported releasing over 30,000 pounds of flammable hydrocarbons during the incident.15 The plant remained down for 18 months and restarted in January 2015.

14 Of the 167 workers who reported injuries, three were Williams employees and 164 were contractors. 15 Louisiana Department of Environmental Quality Incident Report. See http://edms.deq.louisiana.gov/app/doc/view.aspx?doc=8925500&ob=yes&child=yes at p 2 (accessed August 28, 2016). FIGURE 6 Graph of quench water flow rate immediately prior to incident. Quench water flow rate rises when Reboiler B tube- side quench water valves are opened. Reboiler B ruptures approximately three minutes later.

CSB · Williams Geismar Case Study 13

FIGURE 8 Post-incident photo of the propylene fractionator reboilers and surrounding area. The Reboiler B vapor return piping can be seen overhead in the pipe rack (red circle). The approximate original configuration of the piping and equipment is shown in Figure 9 and Figure 14.

14 CSB · Williams Geismar Case Study

1. 0 TECHNICAL ANALYSIS

The CSB commissioned metallurgical testing of the ruptured Reboiler B by agreement among Williams, OSHA, and the CSB.16 The metallurgical testing found that the propylene fractionator Reboiler B failed, resulting in the formation of a crack, at a high internal pressure estimated to be between 674 and 1,212 pounds per square inch gauge (psig). The CSB concluded that a pressure of this magnitude was likely the result of liquid thermal expansion in the liquid propane-filled and blocked-in Reboiler B shell, which overpressured the heat exchanger while it was isolated from its pressure relief device.17 The initial crack formation quickly progressed to catastrophic vessel failure, which resulted in a boiling liquid expanding vapor explosion (BLEVE) (see Section 4.2 for a technical description of the BLEVE mechanism). 4.1 FAILURE OF REBOILER B As explained above, following the 2001 valve installation, Williams Geismar operated one propylene fractionator reboiler at a time, keeping the other reboiler offline—in a configuration Williams called “standby.” After the operating reboiler fouled, Williams operations staff would put the standby reboiler online. They would then shut down, drain, blind,18 and clean the fouled reboiler. Next, they would remove the blinds and pressurize the reboiler with nitrogen,19 leaving the inlet and outlet block valves isolating the standby, nitrogen-filled reboiler shell from the propylene fractionator process fluid. The reboiler remained on standby, typically for a couple of years, until the second, now operating reboiler fouled. 4.1.1 STANDBY REBOILER B CONTAINED LIQUID PROPANE Williams performed maintenance on Reboiler B in February 2012. Following this maintenance activity, workers left Reboiler B on standby, reportedly filled with nitrogen and isolated from the process by a single closed block valve on the inlet piping and a single closed block valve on the outlet piping. The CSB determined that between the 2012 maintenance activity and the day of the incident—a period of 16 months—flammable liquid propane accumulated on the shell side of the standby Reboiler B (Figure 9).20 The propane could have entered the standby reboiler via a mistakenly opened valve, leaking block valve(s), or another unknown mechanism.21 (Depending on the scenario that allowed propane to enter the reboiler, the nitrogen could have compressed and/or been pushed from the reboiler into the process.) Williams had not installed instrumentation to detect process fluid within the reboiler. As a result, Williams personnel did not know that the standby Reboiler B contained liquid propane.22

16 The metallurgical report is located in Appendix C. 17 See Appendix B. 18 A blind is a metal plate inserted between flanges to ensure positive isolation of a vessel from the process. 19 Nitrogen is often used to fill a standby vessel because it is an inert gas. It is used to reduce the oxygen concentration in equipment in order to eliminate the possibility of a flammable mixture within the vessel or process. 20 Discussed in Appendix B, the reboiler was at least 65.5 vol% full of liquid propane. 21 Large gate valves such as the ones installed on the Williams reboilers are known to leak. The American Petroleum Institute (API) specifies allowable leakage rates through closed valves. For 16-inch and 18-inch valves such as the inlet valve and outlet valve on the propylene fractionator reboilers, API specifies an allowable leakage rate of 64 and 72 bubbles of gas per minute, respectively, during leak testing of the valves. (See API Standard 598, 9th ed. Valve Inspection and Testing, September 2009, p 10.) The reboiler block valves were leak tested following the incident. Their leakage rate was within that allowed by API Standard 598. While valve leakage likely allowed some process fluid to enter Reboiler B while it was on standby, a different mechanism could have introduced the bulk of the process fluid to the standby reboiler. 22 Records indicate that Williams filled the Reboiler B shell with nitrogen, to a pressure of approximately 50 psig, during a 2012 maintenance activity. Reboiler B did not have a pressure gauge installed on its shell to allow for periodic monitoring. A pressure gauge could have alerted the operations supervisor that the Reboiler B shell was at a pressure of at least 124 psig (the equilibrium vapor pressure of the process fluid at ambient temperature). This could have served as an indication that process fluid had entered the Reboiler B shell.

CSB · Williams Geismar Case Study 15

1. 1.2 FAILURE OF REBOILER B DUE TO LIQUID THERMAL EXPANSION

Post-incident field observations identified that the Reboiler B tube-side hot quench water valves were in the open position (Figure 10). The shell-side process valves were closed, which isolated the shell of Reboiler B from its protective pressure relief valve on the top of the propylene fractionator (Figure 4). This valve alignment shows that heat was introduced into a closed system (i.e., the blocked-in Reboiler B shell).

When the Reboiler B hot quench water valves were opened, the liquid propane within the standby Reboiler B shell began to heat up. This caused the liquid propane to increase in volume due to liquid thermal expansion,23 filling any remaining occupiable vapor space within the shell. When the liquid could no longer expand due to confinement within the blocked-in Reboiler B shell, the pressure rapidly increased24 until the internal pressure exceeded the shell’s mechanical pressure limit (Figure 11), and the reboiler shell failed.25

23 Thermal expansion is the increase in volume of a given mass of a solid, liquid, or gas as it is heated to a higher temperature. 24 The liquid propane expanded and pressurized the reboiler faster than the vessel contents could escape through the leaking block valves. 25 The 2008 Goodyear Tire and Rubber Company explosion, investigated by the CSB, also occurred when heat was introduced to a heat exchanger that did not have an open path to its pressure relief device. That incident killed one person and injured six others. See the CSB’s final investigation report on the incident: Chemical Safety Board Website. Heat exchanger rupture and ammonia release in Houston, Texas. http://www.csb.gov/goodyear-heat-exchanger-rupture/ (Accessed August 17, 2016). FIGURE 9 Propane process fluid mixture entered standby Reboiler B by a mistakenly opened valve, valve leakage, and/or another mechanism. ***Note: Tube side piping not illustrated KEY LESSON

Closed gate (block) valves leak, and they are susceptible to inadvertent opening. Both scenarios can introduce process fluids to offline equipment. More robust isolation methods, such as inserting a blind, can better protect offline equipment from accumulation of process fluid.

16 CSB · Williams Geismar Case Study

FIGURE 10 Post-incident, the Reboiler B quench water inlet ball valve was found partially open (left), and the Reboiler B quench water outlet ball valve was found fully open (right). When the position indicator is parallel to the pipe, the valve is open; when the position indicator is perpendicular to the pipe, the valve is closed. “Equipment or pipelines which are full of liquid under no-flow conditions are subject to hydraulic expansion due to increase in temperature and, therefore, require overpressure protection. Sources of heat that cause this thermal expansion are solar radiation, heat tracing, heating coils, heat transfer from the atmosphere or other equipment. Another cause of overpressure is a heat exchanger blocked-in on the cold side while the flow continues on the hot side.” Center for Chemical Process Safety (CCPS), Guidelines for Engineering Design for Process Safety, 2nd ed., 2012 FIGURE 11 Expanding shell-side liquid propane could not sufficiently increase in volume due to the lack of overpressure protection and the closed shell-side process valves. As a result, shell-side pressure increased until reboiler shell failed.

CSB · Williams Geismar Case Study 17

1. 2 BOILING LIQUID EXPANDING VAPOR

EXPLOSION (BLEVE) The high pressure generated from liquid thermal expansion of the propane cracked the reboiler shell. The shell contents began to vaporize near the crack opening, and a jet release of liquid and vapor accelerated out of the crack. The pressure loading on the open edges of the crack caused the crack to continue to grow along the vessel length. As the crack opening increased in size, the liquid and vapor jet release also rapidly grew. The continued internal pressure caused the reboiler shell to fail suddenly and catastrophically, splitting wide open (Figure 7 and Figure 12). With the shell confinement suddenly gone, the bulk of the shell contents abruptly lowered to atmospheric pressure. At atmospheric pressure, the liquid propane was above its boiling point (i.e. in a superheated state). (The atmospheric boiling point of the propane mixture was approximately -43 °F,26 and the liquid propane mixture was at a much higher temperature.) The propane explosively released into the surrounding area: propane vapor violently expanded and the superheated liquid rapidly vaporized. This type of explosion is known as a BLEVE.27 The propane then found an ignition source and ignited, creating a massive fireball. The blast effects flattened the reboiler shell (Figure 12).

26 Found using Aspen HYSYS simulation of Williams’ design composition of the propylene fractionator bottoms. 27 Center for Chemical Process Safety (CCPS). Guidelines for Vapor Cloud Explosion, Pressure Vessel Burst, BLEVE and Flash Fire Hazards, 2nd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 311. BLEVE, pronounced ‘blev-ē, stands for “Boiling Liquid Expanding Vapor Explosion.” A BLEVE is the explosive release of expanding vapor and boiling liquid when a container holding a pressure liquefied gas—where the liquefied gas is above its normal atmospheric pressure boiling point temperature at the moment of vessel failure— suddenly fails catastrophically.i This explosive release creates an overpressure wave that can propel vessel fragments, damage nearby equipment and buildings, and injure people. If the pressurized liquid is flammable, a fireball or vapor cloud explosion often occurs. BLEVEs often result in the failed vessel flattened on the ground.

Fireball from propane BLEVE experiment.ii

Vessel flattened on ground following BLEVE.iii i. Birk, A.M.; Davison, C.; Cunningham, M.; Blast Overpressures from Medium Scale BLEVE Tests. Journal of Loss Prevention in the Process Industries, 2007, vol. 20, pp 194-206. ii.http://me.queensu.ca/People/Birk/Research/ThermalHazards/bl eve/FieldTrials2000-2002.html (accessed August 17, 2016). iii. Birk, A.M.; VanderSteen, J.D.J.; Davison, C.; Cunningham, M.H.; Mirzazadeh, I.; PRV Field Trials – The Effects of Fire Conditions and PRV Blowdown on Propane Tank Survivability in a Fire, TP 14045E, Transport Canada, 2003. What is a BLEVE?

18 CSB · Williams Geismar Case Study

FIGURE 12 Post-incident photo of Reboiler B shell. The pressure forces during the event flattened the cylindrical steel reboiler shell.

CSB · Williams Geismar Case Study 19

1. 0 ANALYSIS OF WILLIAMS GEISMAR

PROCESS SAFETY MANAGEMENT PROGRAMS As will be explained in this section, the ineffective implementation of the Williams Geismar process safety management programs28 (Figure 13 shows a timeline of the program deficiencies during the 12 years leading to the incident), as well as weaknesses in Williams’ written programs themselves, were causal to the incident. Weaknesses in these programs resulted from a culture at the facility that did not foster and support strong process safety performance. Discussed in the following sections, Williams Geismar’s process safety management program deficiencies that contributed to the incident include: (1) Williams did not perform adequate Management of Change (MOC) or Pre-Startup Safety Reviews (PSSRs) for two significant process changes involving the propylene fractionator reboilers—the installation of block valves and the addition of car seals (see Section 5.1 and Section 5.2.2.1).29 As a result, the company did not evaluate and control all hazards introduced to the process by those changes. Not identifying and controlling the new process overpressurization hazard was causal to the incident; (2) Williams did not adequately implement action items developed during Process Hazard Analyses (PHAs) or recommendations from a contracted pressure relief system engineering analysis (see Section 5.2 and Section 5.4). Consequently, Williams did not effectively apply overpressure protection by either a pressure relief valve or by administrative controls to the standby Reboiler B; and (3) Williams did not perform a hazard analysis and develop a procedure prior to the operations activities conducted on the day of the incident (see Section 5.3).

28 Process safety management programs have been developed and described in industry good practice guidance (such as books published by the Center for Chemical Process Safety) and are required by both OSHA as part of its Process Safety Management (PSM) regulation and by the Environmental Protection Agency (EPA) as part of its Chemical Accident Prevention provisions (commonly referred to as its Risk Management Program (RMP) regulation). See 29 C.F.R. § 1910.119. Process Safety Management of Highly Hazardous Chemicals and 40 C.F.R. Part 68, Subpart D - Program 3 Prevention Program. 29 A car seal is a mechanical device that physically locks a valve in the open or closed position to prevent manipulation by an unauthorized person. A car seal is an administrative control. Nonmandatory Appendix M-5 of ASME Boiler and Pressure Vessel Code, Section VIII, Division 1, allows for the use of administrative controls such as car seals to ensure an open path between a pressure vessel and its pressure relief device(s). In recent years, process safety culture has been a topic of increased focus within the chemical process industry. “Safety Culture” is often simply described as “the way we do things around here,” or “how we behave when no one is watching.” The chemical process industry has defined process safety culture as “[t]he common set of values, behaviors, and norms at all levels in a facility or in the wider organization that affect process safety.”i A significant determinant of an organization’s process safety culture is the quality of its written safety management programs (e.g., process safety management procedures, including PHA, MOC, PSSR, operating procedures; and written corporate policies) and how well individuals within the organization, ranging from the CEO to the field operator, implement those programs. The Center for Chemical Process Safety has labeled these two facets as “Conduct of Operations” and “Operational Discipline,” respectively.ii Improving an organization’s process safety culture starts with management. Managers can help to set a high bar for the organization’s commitment to effectively implementing safety management programs and company expectations. i. Center for Chemical Process Safety (CCPS). Conduct of Operations and Operational Discipline—For Improving Process Safety in Industry; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2011. ii. Ibid. Process Safety Culture

20 CSB · Williams Geismar Case Study

When the quench water valves were opened, therefore, there were no safeguards to prevent high pressure on the shell side of the reboiler. Since the reboiler lacked adequate overpressure protection, introducing heat to the standby reboiler initiated the overpressure event that caused the reboiler to rupture catastrophically.

“The process safety culture of an organization is a significant determinant of how it will approach process risk control issues, and process safety management system failures can often be linked to cultural deficiencies. Accordingly, enlightened organizations are increasingly seeking to identify and address such cultural root causes of process safety performance problems.” CCPS, Guidelines for Risk Based Process Safety, 2007.

CSB · Williams Geismar Case Study 21

FIGURE 13 Timeline of events leading to the June 2013 incident.

22 CSB · Williams Geismar Case Study

1. 1

REBOILER VALVES INSTALLATION The original 1967 design of the propylene fractionator required both Reboiler A and Reboiler B in service at the same time. This design had no valves between the reboilers and the propylene fractionator, protecting the two reboilers from overpressure with the relief device located on top of the propylene fractionator. In subsequent years, Williams determined that the propylene fractionator could operate with only one reboiler in service. Operating with a single reboiler allowed continuous propylene fractionator operation and avoided shutdowns when the reboiler tubes fouled and required cleaning. To implement single reboiler operation, in 2000 Williams Geismar management approved a $270,000 investment to install valves on both the process side and quench water side of six of the quench water heat exchangers, including the propylene fractionator’s Reboiler A and Reboiler B. In 2001, Williams installed the valves (Figure 14); however, Williams did not identify the overpressure hazard that resulted from this change.

FIGURE 14 Illustration of the propylene fractionator reboilers prior to the incident, with shell-side piping shown. The four shell-side process valves were installed in 2001. ***Note: Tube-side piping not illustrated

CSB · Williams Geismar Case Study 23

1. 1.1

VALVE INSTALLATION MANAGEMENT OF CHANGE Industry good practice guidance advises—and the OSHA PSM regulation and the EPA RMP regulation require—chemical process facilities to conduct a Management of Change (MOC) review before making a change to a covered process, such as a change in equipment.30 Among other requirements, OSHA and EPA require that a facility’s MOC reviews consider the impact of the change on safety and health, and whether operating procedures need modifications. OSHA and EPA also require that companies train affected employees on the change prior to startup or implementation.31 In 2001, Williams performed one MOC to cover the installation of valves on the six quench water heat exchangers identified in the 2000 proposal, including the propylene fractionator Reboiler A and Reboiler B. The Williams MOC process required the Operations Department, Maintenance Department, Technical Department, Environmental Department, Safety Department, and Project Engineering Department to consider the potential safety implications of installing the valves. They did this by answering checklist questions used to prompt targeted analysis for each department. Department managers were required to respond to each prompt by checking “yes,” “no,” or “n/a” (not applicable). While MOC checklists can ensure consideration of common hazards and typical change requirements, the Williams MOC reviewers nevertheless did not identify the serious overpressure hazards introduced by installing valves on the reboilers.32

30 29 C.F.R. § 1910.119(l) and 40 C.F.R. § 68.75. 31 29 C.F.R. § 1910.119(l)(3) and 40 C.F.R. § 68.75. 32 Installing block valves into a process can introduce overpressure hazards to process equipment. The ASME Boiler and Pressure Vessel Code allows block valves to be installed in a relief path where there is normally process flow, as long as the user provides a method of overpressure protection, such as applying administrative controls, mechanical locking elements, valve failure controls, and valve operation controls to provide an open path between the vessel and its pressure relief device(s). See American Society of Mechanical Engineers. ASME Boiler and Pressure Vessel Code, 2015. Section VIII, Division 1, UG-135 and Nonmandatory Appendix M-5.7(3). KEY LESSON

Robust Management of Change (MOC) practices are needed to ensure the review analyzes hazards in the entire process affected by the change. Similar to PHAs, conducting MOC reviews as a multidisciplinary group— composed of individuals with different experiences and different areas of expertise—can assist in identifying hazards introduced by a process change. Companies must conduct MOCs before implementing a change in the field, and should not treat them as a paperwork or check-the-box exercise.

24 CSB · Williams Geismar Case Study

1. 1.1.1 MANAGEMENT OF CHANGE PERFORMED AFTER VALVE INSTALLATION

The MOC process at Williams intended to provide a method33 to identify and control34 all possible hazards presented by a process change before making the process change in the facility.35 Williams, however, did not perform an MOC before installing and commissioning the new block valves on the reboilers. In fact, Williams did not perform the MOC until after the plant was operating with the new valves.36 The MOC was an after-the- fact activity for Williams to address a regulatory requirement rather than an effective tool used to identify and control new process hazards prior to installing the new equipment.

1. 1.1.2 MANAGEMENT OF CHANGE DID NOT IDENTIFY SIGNIFICANT HAZARDS

Installing block valves into a process where they previously did not exist is a significant process change that needs careful safety analysis during the MOC review. But the Williams 2001 MOC review did not identify the significant overpressure hazard introduced by the valves. Figure 15 highlights portions of the Williams MOC that the CSB identified as ineffective assessment of the change presented by the new valves. These weaknesses include: (1) The Williams MOC failed to identify or control the overpressure hazard. The MOC reviewers indicated that the valves did not have to be car sealed open (Figure 15), which would have provided overpressure protection for the reboilers. The option of using a car seal was the only specified overpressure protection method on the MOC checklist, even though in this case installing pressure relief valves could be a better option. Nevertheless, the MOC reviewers did not identify that the reboilers required overpressure protection—through either an open path to a pressure relief device using a car sealed open valve, or by installing a pressure relief device on each reboiler;

33 The Williams Geismar MOC procedure states, “the purpose of the MOC review process is to include a safety/health, environmental, technical, mechanical, engineering, and operations review of the change. Changes shall be reviewed for impact on safeguards, critical instrument systems, pressure relief systems, equipment inspection programs, operability of equipment, constraints in currently approved process or mechanical design, and operating procedures.” 34 The OSHA PSM and EPA RMP regulations do not specify that the purpose of the MOC is to identify and control hazards introduced by the process change. Rather, the regulations specify that the “impact of change on safety and health” must be considered. Industry guidance publications, as well as Williams’ internal MOC procedure, specify that MOCs should identify and control hazards introduced by the change prior to startup. 35 OSHA PSM and EPA RMP regulations require MOCs prior to the change. See 29 C.F.R. § 1910.119(l)(2) and 40 C.F.R. § 68.75(b). 36 Plant data indicates the unit was shut down between January 4, 2001 and February 20, 2001. The valves were installed during this period. The PSSR for the valves’ installation was performed on February 1, 2001, but the MOC was not initiated until March 2, 2001, and was not approved until April 6, 2001. OSHA PSM requires the MOC prior to implementing the change. See 29 C.F.R. § 1910.119(l)(2). When “it is difficult to get all of the required authorizations prior to implementation of the change […] [a]bove all, this indicates that there is a potential process safety culture issue that must be addressed. Site management should not tolerate the startup of a change prior to obtaining the necessary authorizations.” CCPS, Guidelines for Management of Change for Process Safety, 2008.

CSB · Williams Geismar Case Study 25

FIGURE 15 Portion of the MOC performed by Williams for the installation of the valves on Reboilers A and B. Yellow highlights indicate weaknesses in MOC analysis. Note: Image of document is poor quality.

26 CSB · Williams Geismar Case Study

(2) The MOC reviewers incorrectly indicated that existing operating procedures were adequate to account for the new valves, even though there was no procedure specifically for switching the propylene fractionator reboilers. The CSB found that Williams Geismar had relied on its generic procedure, last revised in 1996, to start up any reboiler within the entire facility. Williams considered this generic procedure applicable to start up the propylene fractionator Reboiler B; however, Williams’ generic procedure was based on the assumption that all reboilers had the process fluid on the tube side of the reboiler (Figure 16), which was not the configuration of the propylene fractionator Reboiler B. As a result, attempting to use this generic procedure to start up Reboiler B could be confusing to workers and could result in initiating an overpressure scenario on the shell side of Reboiler B—a pressure vessel that was not equipped with a protective pressure relief device. A robust, equipment-specific procedure detailing the steps to switch the propylene fractionator reboilers should communicate the importance of opening the process valves (cold side) before opening the quench water valves (hot side), and should communicate the importance of overpressure protection. The MOC process is intended to trigger—and should have triggered—the development of such a procedure: a procedure that is equipment-specific and addresses the hazards of the operation; (3) The MOC reviewers improperly indicated that the change did not require a Process Hazard Analysis (PHA), a more robust hazard evaluation option performed at the discretion of the MOC reviewers. The installation of the valves introduced a serious overpressure hazard to the reboilers, and a formal PHA would have been the best opportunity to identify and control that hazard; and (4) The MOC reviewers selected incorrect responses regarding whether the new equipment met all applicable codes and standards. Reviewers indicated either the valves met all codes and standards, or that the question was not applicable. The addition of the valves without ensuring overpressure protection for the reboilers, however, does not meet requirements within industry codes and standards by the American Petroleum Institute (API), and the American Society of Mechanical Engineers (ASME).37

37 Louisiana has not adopted Section VIII of the ASME Boiler and Pressure Vessel Code; however, Williams Geismar specified in site policy documents that they will follow the Code’s requirements. “Overpressure” in equipment occurs when the equipment is subjected to a pressure that exceeds a pre-defined pressure limit, such as the maximum allowable working pressure (MAWP). Such defined pressure limits are used to prevent equipment mechanical failure due to excess pressure. There are several methods to protect equipment from overpressure. One is the use of a pressure relief valve. Pressure relief valves are designed to open and relieve excess pressure by releasing process fluids from equipment when the equipment reaches a specified pressure set point. They are an “active control” that requires no human activation to function.

Photo of a pressure relief valve

Overpressure protection can also be provided to equipment by ensuring an open path to pressure relief by a locked open block valve. Valves are commonly locked open by using a “car seal,” a mechanical device that physically locks a valve in the open or closed position to prevent manipulation by an unauthorized person. Car seals are “administrative controls” that rely on human operation. They can be more prone to failure than active controls.

Depiction of a Car Seali

i. Car seal depiction from Total Lockout Website. Car Seals. http://www.totallockout.com/online-store/car-seals-2/ (accessed November 19, 2015). Overpressure Protection Methods

CSB · Williams Geismar Case Study 27

FIGURE 16 Schematic from the Williams Geismar Generic Reboiler Startup Procedure. This was the applicable procedure to startup the propylene fractionator reboilers. Since the procedure uses the reverse of the Reboiler B configuration, it can be confusing, and workers could initiate a high-pressure scenario on the shell (process) side. Williams had not equipped this reboiler with a protective pressure relief device.

28 CSB · Williams Geismar Case Study

The selected responses in the MOC checklist indicate that the reviewers focused largely on managing documentation and maintenance requirements for the new valves, such as needed process safety information updates and inspection requirements, and not on how the addition of the valves could affect the operability and safety of the overall process. Not only does this “focus-on-the-new-equipment-only” approach to conducting Management of Change not meet the intent of regulatory requirements,38 it can be dangerous. Williams introduced hazards that it did not fully understand or control. 5.1.1.3 PRE-STARTUP SAFETY REVIEW WAS INEFFECTIVE Following the installation of the propylene fractionator Reboiler A and Reboiler B valves, Williams performed a Pre-Startup Safety Review (PSSR) as required by process safety management regulations.39 Conducting the Williams PSSR required filling out a 21-question form. The CSB found that Williams reviewers either did not answer or incorrectly answered key PSSR process safety questions. Figure 17 shows a selection of these questions and their responses. The Williams PSSR instructions directed the reviewer to “Circle the appropriate response.” But each PSSR prompt question did not have a circled answer in the completed and management-approved documentation. The PSSR questions that Williams reviewers did not answer or answered incorrectly were areas that played a direct role in the June 13, 2013 incident. For example: • No response was given to the question, “Has a process hazard analysis been completed, recommendations resolved, and incorporated in design as deemed appropriate?” A PHA was not conducted, which could have identified hazards introduced by the valves;

38 The OSHA PSM and EPA RMP regulations require that Management of Change procedures shall ensure that the “impact of change on safety and health” is considered and addressed prior to the change. See 29 C.F.R. § 1910.119(l)(2)(ii) and 40 C.F.R. § 68.75(b)(2). 39 The OSHA Process Safety Management (PSM) regulation requires that “[t]he employer shall perform a pre-startup safety review for new facilities and for modified facilities when the modification is significant enough to require a change in the process safety information.” See 29 C.F.R. § 1910.119(i)(1). The EPA RMP regulation requires that “[t]he owner or operator shall perform a pre-startup safety review for new stationary sources and for modified stationary sources when the modification is significant enough to require a change in the process safety information.” See 40 C.F.R. § 68.77. Both regulations also state that the pre- startup safety review shall confirm, “safety, operating, maintenance, and emergency procedures are in place and are adequate.” KEY LESSON

Management of Change (MOC) practices should ensure the review analyzes hazards in the entire process affected by the change. Similar to PHAs, conducting MOC reviews as a multidisciplinary group—comprised of individuals with different experiences and different areas of expertise—can assist in identifying hazards introduced by a process change. MOCs must be conducted prior to implementing a change in the field. KEY LESSON

Pre-Startup Safety Reviews (PSSRs) are key opportunities to verify effective implementation of design intent, accuracy of process safety information, and proper installation and configuration of field equipment. Companies should conduct thorough and effective PSSRs before placing equipment in service.

CSB · Williams Geismar Case Study 29

• No response was given to the questions regarding operator training, and PSSR reviewers incorrectly answered “yes” to the questions “Are all necessary operating procedures in place and current for safety, environmental, operating, emergencies, maintenance and technical?” and “Are procedures available for new and modified equipment?” Operations personnel were not effectively trained and procedures were not developed to address the new propylene fractionator reboiler startup requirements; and • No response was given to the question, “PRV’s [pressure relief valves] lined up and block valves car sealed open? Pressure release systems in place and operational and traced where appropriate?” The company did not provide effective overpressure protection for the propylene fractionator reboilers. When a company does not effectively implement its written safety management programs—such as only partially completing the PSSR document and incorrectly answering some of the document questions—it indicates a weakness in process safety culture (see Section 9.0). Management’s approval of incomplete documentation can lead to a culture of complacency and, therefore, subpar and incomplete process safety analyses. At a company with a strong commitment to effectively implementing process safety management programs, everyone—from the front line worker to company executives—should perceive incomplete documentation, such as this PSSR document, as unacceptable.

“[U]nauthorized shortcuts should not be tolerated, even if there are short-term benefits.[…] In the absence of [operational discipline], management personnel intentionally turn a blind eye toward what workers do because they are only interested in achieving the desired results.” CCPS, Conduct of Operations and Operational Discipline, 2011. FIGURE 17 Selection of responses on the checklist filled out during the PSSR performed following the 2001 reboiler valve installation. Several key process safety questions were not answered or were answered incorrectly.

30 CSB · Williams Geismar Case Study

1. 2 PROCESS HAZARD ANALYSES

Both OSHA PSM and the EPA RMP regulations require covered facilities to perform or revalidate a Process Hazard Analysis (PHA) at least every five years to identify, evaluate, and control the hazards involved in the process.40 Industry good practice publications provide guidance on how to conduct effective PHAs.41 Williams performed three PHAs following the installation of the valves on the propylene fractionator reboilers. Williams did not sufficiently implement the recommendations issued in those PHAs and did not effectively mitigate overpressure hazards in the propylene fractionator reboilers. This section analyzes the documented findings, recommendations, and actions taken pertaining to the propylene fractionator reboilers following the three PHAs, which Williams conducted in 2001, 2006, and 2011. 5.2.1 2001 PHA Williams performed a PHA on the process area that included the propylene fractionator reboilers in 2001—the year Williams installed valves on the propylene fractionator reboiler piping. The 2001 PHA evaluated possible consequences of closing the propylene fractionator reboiler process valves when they should be open. The PHA team did not identify reboiler overpressure as a possible safety consequence. Instead, the team identified a low-severity process upset. The CSB notes that an effective PHA should have identified the more serious safety consequence of reboiler overpressure, as it is a typical potential hazard for a pressure vessel. The PHA team correctly identified that the piping and instrumentation diagrams (P&IDs) did not show the new valves on the propylene fractionator reboilers. The PHA team recommended updating the relevant P&ID (Figure 18). The CSB notes that the P&ID update should have been required as part of the MOC process. In addition, the PSSR process should have reviewed a marked-up version of the P&ID showing the approved change. Such a review could have identified the significant error with the engineering drawing.

40 29 C.F.R. § 1910.119(e) and 40 C.F.R. § 68.67(f). 41 See CCPS publications including Center for Chemical Process Safety (CCPS). Guidelines for Hazard Evaluation Procedures. 3rd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2008 and Frank, Walter L. and Whittle, David K. Revalidating Process Hazard Analyses. American Institute of Chemical Engineers: New York, New York, 2001. KEY LESSON

Overpressure protection is an essential safeguard for all pressure vessels. PHA teams must ensure that all pressure vessels have effective overpressure protection. At a minimum, a pressure relief device is a necessary safeguard to protect process equipment from overpressure scenarios where internal vessel pressure can exceed design code limits.

CSB · Williams Geismar Case Study 31

1. 2.2 2006 PHA

During the 2006 review, the PHA team emphasized evaluating whether equipment had sufficient overpressure protection. The PHA team identified that the propylene fractionator reboilers “potentially don’t have sufficient relief capabilities – could overpressurize equipment” (Figure 19). As a result, the PHA team issued the following recommendation: Consider locking open at least one of the manual valves associated with each of the propylene fractionator reboilers (EA-425 A/B) so that the relief valves on top of the propylene fractionator can provide thermal relief protection for these reboilers. This 2006 PHA recommendation was marked “Complete” more than three years later in January 2010 in Williams’ action item tracking system. This action item, however, was not implemented as the PHA team had intended. The CSB found that only the shell-side outlet valve of the operating reboiler was car sealed open. The shell-side valves of the standby reboiler remained closed, with no car seals on the manual valves and no protective pressure relief device installed on the shell. This configuration isolated the standby reboiler from the relief device on top of the propylene fractionator, creating a high-risk scenario. This was an implementation error of the PHA recommendation. But as discussed in Section 5.2.2.1, the error remained unidentified because key process safety programs (i.e. MOC and PSSR), which could have identified the implementation error, were not performed. The CSB found that the contracted PHA facilitator was under the incorrect impression that both propylene fractionator reboilers operated at the same time. The CSB was not able to determine why the PHA team did not discuss that in practice only one reboiler operated at a time. This incorrect assumption likely contributed to the PHA team choosing car seals as the recommended overpressure protection strategy, as the shell-side valves would FIGURE 18 Excerpt from Williams Geismar 2001 PHA. The PHA recommended updating the applicable P&ID to indicate the valves installed on the propylene fractionator reboilers.

32 CSB · Williams Geismar Case Study

have to be open for both reboilers to operate. With the knowledge of the current practice—that only one reboiler operated at a time—a recommendation to car seal open both the operating and standby reboilers would be atypical; the standby reboiler would thus not be operating, but still open to the process and filled with process liquid. While unusual, this was a low corrosive and minimally fouling environment, and such a configuration would likely not harm equipment. This configuration, however, would have left an unnecessary inventory of hazardous chemicals in the process. An inherent safety review should identify the opportunity to minimize the hazardous chemical inventory by blinding the standby reboiler from the process.

The CSB notes that pressure relief valves (active safeguards) are a more robust safeguard compared to car seals (administrative safeguards), which are lower on the hierarchy of controls (Section 6.0). Administrative controls such as car seal programs fall low on the hierarchy of controls because of the many types of human factors42 that can reduce or eliminate their effectiveness. Misunderstanding of what equipment to car seal in order to satisfy the 2006 PHA action item likely contributed to only partial completion of the action item, resulting in only the active reboiler being car sealed open. This misunderstanding likely stemmed from the fact it would have been unusual to car seal open the standby reboiler, and the recommendation to car seal open the standby reboiler was a result of confusion by the PHA team. Had the 2006 PHA team instead recommended installing pressure relief valves on both propylene fractionator reboilers, that action item would have been more difficult to implement incorrectly, as the relief valves would be newly installed, fixed equipment.

42 “Human factors” are the environmental, organizational, or job factors, as well as a person’s individual characteristics, which can influence a person’s actions in a way that can affect health and safety. See Health and Safety Executive (HSE), Reducing Error and Influencing Behaviour, 2009, p 5. http://www.hse.gov.uk/pubns/priced/hsg48.pdf (accessed September 7, 2016). KEY LESSON

It is important to ensure that the final implementation of PHA action items addresses the original safety concerns identified by the PHA team. Companies should ensure that action items have been effectively implemented and field verified before closing them out. FIGURE 19 Excerpt from Williams Geismar 2006 PHA. The PHA recommended locking open at least one manual valve on each of the propylene fractionator reboilers to allow for thermal relief protection of the reboilers.

CSB · Williams Geismar Case Study 33

1. 2.2.1 MANAGEMENT OF CHANGE NOT PERFORMED FOR CAR SEAL INSTALLATION

The installation of a car seal to lock open a propylene fractionator reboiler process valve—as recommended by the 2006 PHA—was a significant process change that required an MOC and a PSSR. But Williams did not perform an MOC or a PSSR for the installation of the car seal.43 The field verification portion of the PSSR should have provided an opportunity to identify that the PHA action item to car seal open a process valve on both reboilers was not complete. Yet, the PSSR was never performed. The CSB determined that Williams did not perform an MOC for the car seal installation likely because key operations personnel did not understand that an MOC was required. Also, before the June 13, 2013 incident, although prohibited by OSHA PSM regulatory requirements and company policies, at times Williams began fieldwork on a process change without a completed and approved MOC. 5.2.3 2011 PHA The next PHA of the propylene fractionator was in 2011. This PHA relied on Williams’ action item tracking system and MOC database to identify changes made to the process since the last PHA. The Williams PHA action item tracking system incorrectly indicated as “complete” the 2006 recommendation to lock open at least one of the manual process valves on each reboiler. Therefore, the PHA facilitator documented as safeguards in the 2011 spreadsheet that valves on both reboilers were car sealed open to provide relief protection (Figure 20). Williams did not perform a field verification of the documented safeguards as part of the PHA. As a result, they did not identify the discrepancy between documentation and the actual equipment installed in the field.

43 Performing an MOC and PSSR for this type of process change was required by OSHA PSM, EPA RMP Regulation, and by the Williams Geismar internal site policy on Management of Change. FIGURE 20 Excerpt from Williams Geismar 2011 PHA. The PHA recommended updating the propylene fractionator P&ID to show that the reboilers were car sealed open.

34 CSB · Williams Geismar Case Study

Relying on erroneous documentation that the outlet valve for each propylene fractionator reboiler was car sealed open, the 2011 PHA team identified that the applicable P&ID did not show the car seals. Therefore, the PHA team recommended updating the relevant P&ID (Figure 20): Update P&ID 8F to indicate that one manual valve associated with each propylene fractionator reboiler (EA-425 A/B) is car sealed open to ensure that the relief valves on top of the propylene fractionator provide thermal relief protection for the reboilers. In a May 2012 email, the Engineering Records Coordinator communicated to the PSM Coordinator that “[a]ccording to the car seal list only the in service exchanger is to be car sealed open. I will put a note on the P&ID to reflect this.” The Engineering Records Coordinator added a note to the applicable P&ID: The in service EA-425A/B Exchangers 18” block valve will be tagged (CSO) in the field to insure that the reboiler gets thermal protection from SV-421QA/QB.44 (emphasis added). This P&ID change did not address the full intent of the recommendation issued in the 2011 PHA because the standby reboiler valve was not car sealed open. Williams management, however, approved this recommendation as complete without verifying that the recommendation was implemented as intended. The PSM Coordinator tracked the status of the 2011 PHA recommendation as “Complete” in the PHA action item tracking spreadsheet, and did not include the additional emailed information provided by the Engineering Records Coordinator in the PHA action item tracking documentation.

Williams did not perform an MOC and PSSR for the installation of the car seal on the in-service propylene fractionator reboiler (see Section 5.2.2.1). Effectively performing these process safety programs could have identified that both reboilers required car seals and ensured accurate process safety information.

44 “CSO” is an acronym for “car sealed open.” “SV-421QA/QB” is the tag number for the pressure relief valves on top of the propylene fractionator. “More than ever before, companies recognize that insufficient control of changes plays a major role in accidents. … Experience has demonstrated that inadvertent, unintended, erroneous, or poorly performed changes – changes whose risk is not properly understood – can result in catastrophic fires, explosions, or toxic releases.” CCPS, Guidelines for Management of Change for Process Safety, 2008

CSB · Williams Geismar Case Study 35

1. 3 LACK OF HAZARD ANALYSIS AND OPERATING PROCEDURE

On the day of the incident, a decreasing quench water flow through the propylene fractionator reboiler (Reboiler A) prompted the operations supervisor to enter the process unit to evaluate the cause of the decreased flow. During this evaluation, evidence indicates that the operations supervisor likely opened the quench water valves (hot side) on the standby reboiler (Reboiler B) while its shell-side process valves (cold side) remained closed, initiating the overpressure event. Prior to manipulating valves in the field, Williams did not conduct a hazard analysis and develop a procedure for the operations activity.45 The CSB could not conclusively determine the reason for opening these valves. As demonstrated by this incident, it can be hazardous to conduct field operations— both to personnel performing the operation and to personnel working in the vicinity—without first establishing procedures and evaluating and controlling hazards. As fouling in the quench water system was a known historical issue, Williams should have developed a procedure prior to the day of the incident detailing the method to assess the quench water system to identify the fouled heat exchanger. Furthermore, Williams could have better managed the heat exchanger fouling by establishing a routine maintenance schedule to take off-line and clean this equipment, which was known to foul, prior to the occurrence of any process deviations.

45 OSHA issued a “Willful” violation to Williams, with a proposed fine of $70,000, for not developing and implementing “written operating procedures that provide clear instructions for safely conducting activities…” This citation was contested by Williams, and was ultimately reduced to a “Serious” violation with a fine of $7,000. This resulted in a total fine amount of $36,000 for the violations identified by OSHA following the incident. (OSHA Inspection Number 915682). KEY LESSON

Operating procedures need sufficient detail to ensure effective performance of critical steps, including performing steps in the correct order. Affected employees such as operators must receive training on the procedures. Management must establish expectations to maintain and follow accurate procedures. “[T]reating procedures as if they were equipment (just like a pump, valve, reactor, or safety system), is fundamental for building a successful Process Safety Management system. Who would start up a new process without all of the pumps in place and tested? What craftsperson would tackle a pump seal replacement without the required tools and parts? By accepting this idea, that procedures are components, the [concept of requiring effective procedures] will naturally fall into place.” CCPS, Guidelines for Writing Effective Operating and Maintenance Procedures, 1996

36 CSB · Williams Geismar Case Study

Detailed written procedures can ensure that operations activities are safe and hazards are effectively controlled. In its book Guidelines for Writing Effective Operating and Maintenance Procedures, the Center for Chemical Process Safety (CCPS) states:

Procedures should identify the hazards presented by the process. Procedures should also state precautions necessary to prevent accidental chemical release, exposure, and injury. Process safety information is an important resource in developing procedures. Using this information ensures that the known hazards are addressed properly.46 When a process condition requires operator activity in the field, such as opening or closing valves, these operation activities can present hazards to workers. Before starting such field operations, a company’s process safety management system should ensure a procedure is developed and a thorough hazard evaluation is performed to identify and control hazards.

1. 4

RELIEF VALVE ENGINEERING ANALYSIS The ASME Boiler and Pressure Vessel Code requires that all pressure vessels “shall be provided with overpressure protection […].”47 Williams contracted an engineering services firm to perform a relief valve engineering analysis of the Williams Geismar facility in 2008 to ensure the valves were properly sized for the equipment they were designed to protect. The analysis identified that the propylene fractionator reboilers did not have sufficient overpressure protection. A finding listed in the contractor’s analysis states: There are block valves at the inlet and outlet to the shell side of [the propylene fractionator reboilers]. Because those valves are not [car sealed open], [the propylene fractionator relief valves] will not provide overpressure protection to the shell side of the reboilers in the event of a fire or in the event of liquid expanding/vaporizing due to heat input from the hot side. Unless these valves are car sealed open, additional overpressure protection will be needed for the shell side of [the propylene fractionator reboilers]. The engineer who performed the relief valve engineering analysis also directly emailed a Williams project engineer, alerting him of the lack of overpressure protection on the reboilers, and indicating the two options to provide overpressure protection to the reboilers. Figure 21 shows her email. The CSB learned that Williams did not develop an action item to address this relief valve engineering analysis for the propylene fractionator reboilers. Williams determined their existing plan to car seal open both reboilers, from the recommendation in the 2006 PHA, would address the hazard. Because the company did not fully implement the 2006 PHA action item, this overpressure hazard remained unmitigated (see Section 5.2.2.).

46 Center for Chemical Process Safety (CCPS). Guidelines for Writing Effective Operating and Maintenance Procedures; American Institute of Chemical Engineers: New York, New York, 1996; p 18. 47 American Society of Mechanical Engineers. ASME Boiler and Pressure Vessel Code, 2015. Section VIII, Division 1, UG-125.

CSB · Williams Geismar Case Study 37

FIGURE 21 Email from engineering services firm engineer to Williams employee alerting that the propylene fractionator reboilers were not protected from overpressure. In figure, “SV-421QA/QB” are the propylene fractionator relief valves. “DA-406” is the propylene fractionator column. “EA-425A/B” are the propylene fractionator reboilers.

38 CSB · Williams Geismar Case Study

1. 0 HIERARCHY OF CONTROLS

The Hierarchy of Controls48 is a method to provide effective risk reduction by applying, in order of robustness, inherently safer design, passive safeguards, active safeguards, and procedural safeguards (Figure 22).49 This strategy promotes a tiered or hierarchical approach to risk management. The higher in the hierarchy, the more effective the risk reduction achieved. Applying the hierarchy of controls at the design phase is the best opportunity to ensure that process hazards are properly analyzed and risks are effectively reduced, before the design is implemented in the field. After the design phase, when construction is complete and the process is operating, process safety management programs such as MOC and PHA are important opportunities to apply the hierarchy of controls to further reduce risk throughout the life of a process.

Williams did not effectively use the hierarchy of controls in the 2001 design change that added block valves to the propylene fractionator reboilers. Williams also missed key opportunities in its 2001, 2006, and 2011 PHAs to implement the hierarchy of controls when analyzing the risk of overpressure for the propylene fractionator reboilers.50 Instead of applying inherently safer design, passive safeguards, or active safeguards—design strategies that are higher on the hierarchy of controls—Williams relied upon administrative controls to mitigate a serious overpressure hazard. The use of a pressure relief valve is an “Active Safeguard”—a safeguard that requires a specific device to function when needed. Car seals, the safeguard chosen by Williams to provide a path to pressure relief for the reboilers, are

48 The CSB describes the concept of the “Hierarchy of Controls” in several previous investigation reports. See the CSB final reports on the Tesoro Anacortes Refinery investigation, the Chevron Richmond Refinery investigation, and “Key Lessons for Preventing Incidents from Flammable Chemicals in Educational Demonstrations.” (accessed August 17, 2016) 49 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2009; Section 2.1. 50 As a result of its investigation of the 2012 Chevron refinery pipe rupture and fire in Richmond, California, the CSB recommended that the State of California update its process safety regulations to require the use of the hierarchy of controls in establishing safeguards for identified process hazards. FIGURE 22 Hierarchy of Controls. The higher in the hierarchy (further to the left), the more effective the risk reduction achieved. KEY LESSON

PHA and MOC teams should effectively use the hierarchy of controls to the greatest extent feasible when evaluating safeguards. Pressure relief devices are typically more robust safeguards than car seals. Pressure relief devices (active safeguards) are higher on the hierarchy of controls than car seals (administrative controls).

CSB · Williams Geismar Case Study 39

“Procedural Safeguards,” also known as “Administrative Controls.” Procedural safeguards require an action by a person, and are lower on the hierarchy of controls than active safeguards because of the many types of human factors that can reduce or eliminate their effectiveness. During the 2011 PHA, Williams correctly identified the high potential severity from equipment rupture, but incorrectly assessed the likelihood of an overpressure incident (see severity (S) and likelihood (L) rating in Figure 20). The 2011 PHA team categorized the likelihood of a propylene fractionator reboiler overpressurization as “improbable.” Such a low frequency indicates a weak evaluation and poor understanding of the availability of procedural safeguards such as car seals. CCPS Layer of Protection Analysis guidance suggests that users consider pressure relief valves to have 99 percent availability,51 while car seal availability is only 90 percent.52 Therefore, installing a pressure relief valve on the shell side of each propylene fractionator reboiler, the design strategy Williams applied post-incident, is a more robust approach to reduce the likelihood of an overpressure event than the use of car seals, an administrative control that is more prone to failure, and in fact did fail in this case.

51 CCPS provides a value of 0.01 as the generic probability of failure on demand for spring-operated pressure relief valves. See Center for Chemical Process Safety (CCPS). Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis; Center for Chemical Process Safety / American Institute of Chemical Engineers: New York, New York, 2014; p 180. 52 CCPS provides a value of 0.1 as the generic probability of failure on demand for adjustable movement-limiting devices such as car seals. See Center for Chemical Process Safety (CCPS). Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis; Center for Chemical Process Safety / American Institute of Chemical Engineers: New York, New York, 2014; p 260. “Administrative controls provide another safeguard or layer of protection, but should not be relied on in lieu of practical engineered controls. Administrative approaches that require human action can increase the likelihood of human error.” CCPS, A Practical Approach to Hazard Identification for Operations and Maintenance Workers, 2010

40 CSB · Williams Geismar Case Study

1. 0 INDUSTRY CODES AND STANDARDS

The American Petroleum Institute (API), the American Society of Mechanical Engineers (ASME), and The National Board of Boiler and Pressure Vessel Inspectors develop codes and standards that detail requirements and recommended practices for overpressure protection of pressure vessels. 7.1 AMERICAN PETROLEUM INSTITUTE API is an industry trade association that develops standards and recommended practices for the oil and natural gas industry. These publications apply to petrochemical facilities, including the Williams Geismar Olefins Plant. At the time of the June 13, 2013 incident, the fifth edition (2007) of the API Standard 521, Pressure-Relieving and Depressuring Systems (“API 521-2007”) was the recognized and generally accepted good engineering practice (RAGAGEP) for pressure relieving and disposal systems. API 521-2007 divided guidelines into four main sections: causes of overpressure, determination of individual relieving rates, selection of disposal systems, and disposal systems. The CSB identifies below weaknesses and ambiguities in the “causes of overpressure” guidelines. API 521-2007 does not specifically address the hierarchy of controls; however, the standard does address the use of administrative controls and recommends the user apply “good engineering judgment” or “sound engineering judgment.”53 API 521-2007 provides guidance regarding inadvertent closure of a manual block valve on the outlet of an on-stream pressure vessel, which is applicable to the valves on the Williams propylene fractionator reboilers. The guidance presents users with a choice between two seemingly equivalent options: either install a pressure relief device or develop an administrative control. The API 521-2007 guidance states: The inadvertent closure of a manual block valve on the outlet of a pressure vessel while the equipment is on stream can expose the vessel to a pressure that exceeds the maximum allowable working pressure. If closure of an outlet-block valve can result in overpressure, a pressure-relief device is required unless administrative controls are in place.54 The API 521-2007 guidance cautions the user that catastrophic failure can occur when relying on administrative control, but the guidance is vague: If the pressure resulting from the failure of administrative controls can exceed the corrected hydrotest pressure55 […], reliance on administrative controls as the sole means to prevent overpressure might not be appropriate. The user is cautioned that some systems can have unacceptable risk due to failure of administrative controls and resulting consequences due

53 API does not define “good engineering judgment” or “sound engineering judgment;” however, it is generally taken to mean that users should apply their engineering knowledge when developing a qualitative basis for a design using the standard. 54 API Standard 521, 5th ed. Pressure-relieving and Depressuring Systems, January 2007, section 4.3.2. 55 API defines corrected hydrotest pressure as “hydrostatic test pressure multiplied by the ratio of stress value at design temperature to the stress value at test temperature.”

CSB · Williams Geismar Case Study 41

to loss of containment. In these cases, limiting the overpressure to the normally allowable overpressure can be more appropriate.56 Given the design of the Williams propylene fractionator reboilers, it was possible to exceed the corrected hydrotest pressure. (The maximum allowable working pressure was 300 psig, and the hydrostatic test pressure was 450 psig. Metallurgical analysis indicates the reboiler shell exceeded this pressure during the event, failing at a pressure of at least 674 psig.)57 The email shown in Figure 21 provides evidence that the API 521-2007 approach was applied during the relief valve engineering analysis at Williams. The engineering analysis performed on the propylene fractionator reboilers resulted in a choice between either installing car seals or adding pressure relief devices. Williams selected the car seal approach. In January 2014, seven months after the Williams incident, API published a new (Sixth) edition of API Standard 521, Pressure-relieving and Depressuring Systems (“API 521-2014”). The new version of the standard has significant improvements that address the gaps and ambiguities in API 521-2007 that contributed to the Williams incident. As shown below, when evaluating situations like the propylene fractionator reboilers at Williams, API 521-2014 requires a pressure relief device, prohibits reliance on administrative controls, and highlights the importance of the hierarchy of controls. The inadvertent closure of a valve on the outlet of pressure equipment while the equipment is on stream can expose the equipment to a pressure that exceeds the MAWP. Every valve (i.e. manual, control, or remotely operated) should be considered as being subject to inadvertent operation. If closure of an outlet valve can result in pressure in excess of that allowed by the design code, a PRD [pressure relief device] is required.58 (emphasis added) In the case of a manual valve, administrative controls can be used to prevent the closed outlet scenario unless the resulting pressure exceeds the maximum allowed by the pressure design code […].59 A hierarchy of measures should be used to ensure equipment is not subject to excess pressure. Such a hierarchy first involves avoiding or reducing risks, then providing engineering controls, and finally providing administrative controls. Avoiding risks includes, for example, setting the MAWP of the equipment above the maximum pressure of all possible sources. Engineering controls include providing pressure relief on the vessel. Administrative controls include provision of block valves of the locked-open design. The user is cautioned that some systems may have unacceptable risk due to failure of administrative controls and resulting consequences due to loss of containment.60 Although API 521-2014 made significant safety improvements that address API 521-2007 weaknesses revealed by the Williams incident, additional gaps still exist. For example, in one area of the standard that addresses hydraulic (thermal) expansion, the requirement to use a relief valve is not restated, and the language indicates that

56 API Standard 521, 5th ed. Pressure-relieving and Depressuring Systems, January 2007, section 4.3.2. 57 See Metallurgical Evaluation of Williams Olefins Ruptured Reboiler EA-425B in Appendix C. 58 API Standard 521, 6th ed. Pressure-relieving and Depressuring Systems, January 2014, section 4.4.2.1. 59 Ibid. 60 API Standard 521, 6th ed. Pressure-relieving and Depressuring Systems, January 2014, section 4.2.1.

42 CSB · Williams Geismar Case Study

administrative controls may be relied upon when a relief valve is not installed on a heat exchanger—even when the corrected hydrotest pressure can be exceeded. [C]losing the cold-fluid block valves on the exchanger unit should be controlled by administrative procedures and possibly the addition of signs stipulating the proper venting and draining procedures when shutting down and blocking in. Such cases are acceptable and do not compromise the safety of personnel or equipment, but the designer is cautioned to review each case carefully before deciding that a relieving device based on hydraulic expansion is not warranted because the corrected hydrotest pressure could be exceeded if the administrative procedures are not followed. 61 This language contradicts the language in the standard requiring a pressure relief device for scenarios that develop pressure greater than allowed by the design code. API should further enhance this standard to help prevent overpressurization incidents caused by failure of administrative controls by clearly requiring a pressure relief device for overpressure scenarios that can result in pressure greater than allowed by the design code. 7.2 AMERICAN SOCIETY OF MECHANICAL ENGINEERS The American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, Section VIII, provides requirements for pressure vessel construction, inspection, and testing, including requirements for overpressure protection. Section UG-135 “Installation” details the requirements for placement of pressure relief devices on pressure vessels. UG-135 directs users to Nonmandatory Appendix M for guidance on placement of stop (block) valves between a pressure vessel and its relief device. Nonmandatory Appendix M, Section M-5.7, states that, “Stop valve(s), excluding remotely operated valves and process control valves, may be provided in the relief path where there is normally a process flow [...].”62 In order to install a block valve in the path between a vessel and its pressure relief device, the appendix specifies management system and design guidance. In situations where the closure of the stop (block) valve could overpressure a vessel, the appendix allows the user to “apply administrative controls, mechanical locking elements, valve failure controls, and valve operation controls[.]”63 While Louisiana has not adopted the ASME Boiler and Pressure Vessel Code, Section VIII, Williams Geismar has chosen to comply with the Code’s requirements. The CSB encourages all companies to follow the more robust pressure relief requirements in API 521-2014 that require a relief device if the overpressure scenario can result in pressure greater than allowed by the design code.

61 API Standard 521, 6th ed. Pressure-relieving and Depressuring Systems, January 2014, section 4.4.12.1. 62 American Society of Mechanical Engineers. ASME Boiler and Pressure Vessel Code, 2015. Section VIII, Division 1, Nonmandatory Appendix M, Section M-5.7. 63 Ibid.

CSB · Williams Geismar Case Study 43

1. 3

THE NATIONAL BOARD OF BOILER AND PRESSURE VESSEL INSPECTORS The National Board Inspection Code (NBIC), developed by the National Board of Boiler and Pressure Vessel Inspectors, provides rules for installation, inspection, repair, and alteration of pressure vessels. Part 1, Section 4.5 Pressure Relief Devices details requirements for placement of pressure relief devices on pressure vessels.64 Section 4.5.3 Location states:

The pressure relief device shall be installed directly on the pressure vessel, unless the source of pressure is external to the vessel and is under such positive control that the pressure cannot exceed the maximum overpressure permitted by the original code of construction and the pressure relief device cannot be isolated from the vessel, except as permitted by NBIC Part 1, 4.5.6 e)2).65

That section states:

[W]hen necessary for the continuous operation of processing equipment … a full area stop valve between a pressure vessel and its pressure relief device should be provided for inspection and repair purposes only.66 (emphasis added)

At Williams, because the source of overpressuring the reboilers was internal to the vessel (i.e. hot quench water flowing through the vessel could cause the vessel to overpressure), the NBIC requires installing the pressure relief device directly on the vessel. The design of the Williams reboilers did not meet this design requirement. Louisiana, however, has not adopted this portion of the NBIC and Williams did not list the NBIC as a standard it would voluntarily follow.

64 Previous versions of the NBIC had similar requirements as the 2015 version. 65 The National Board of Boiler and Pressure Vessel Inspectors. National Board Inspection Code, 2015. Part 1-Installation, Section 4.5.3. 66 The National Board of Boiler and Pressure Vessel Inspectors. National Board Inspection Code, 2015. Part 1-Installation, Section 4.5.6, e2.

44 CSB · Williams Geismar Case Study

1. 0 WILLIAMS GEISMAR POST-INCIDENT CHANGES

Williams made positive changes to its Geismar facility process safety management programs following the incident. Williams personnel told the CSB that a significant cultural shift occurred after the incident in understanding the importance of process safety programs in key areas where weaknesses contributed to the incident. The following sections detail some improvements that Williams Geismar implemented following the incident. 8.1 NEW REBOILER DESIGN Following the June 13, 2013 incident, Williams redesigned the propylene fractionator reboilers to include a pressure relief valve on the shell side of each reboiler (Figure 23). Discussed in Section 6.0, this design strategy of using pressure relief valves, categorized as active safeguards, is higher on the hierarchy of controls than using administrative controls, such as a car seals. This practice also aligns with guidance published by the American Petroleum Institute in API 521-2014 (see Section 7.0), which cautions the user that failure of administrative overpressure protection controls can lead to unacceptable risks. The Williams post-incident design also aligns with guidance published by the NBIC, which requires a pressure relief device installed directly on the reboiler.

FIGURE 23 Post-incident, the Williams Geismar facility added pressure relief valves to the shell side of Reboiler A and Reboiler B.

CSB · Williams Geismar Case Study 45

1. 2

IMPROVED MANAGEMENT OF CHANGE PROCESS Before the incident, the Williams Geismar MOC reviews occurred in a sequential process, one person at a time, where the MOC document passed from reviewer to reviewer—a process that often occurred while the reviewers remained in their offices. Following the incident, Williams changed its MOC review to a more collaborative process, requiring an “MOC Review Team” to review every MOC in a group setting. Williams Geismar personnel informed the CSB that this new MOC process facilitates better identification of hazards introduced by proposed changes. An improved MOC process could have helped improve the hazard identification and evaluation process conducted in the 2001 MOC for the installation of the block valves on the propylene fractionator reboilers. A Williams technical employee described to the CSB the new MOC process: Pre-incident, an MOC was written, it was brought to [the PSM coordinator] for a number, it was put in a green folder, and it was passed from desk to desk or mailbox to mailbox. It was a fairly long process. If you had questions, you’d have to go track down who had seen that MOC so far and ask them those questions. […] Oftentimes that would result in a do- loop. You’d ask them a question, they’d answer it, that would spar off another question. Now [after the incident], by having everybody just come and sit around a table and discuss the MOC at once, if I ask you a question and you answer it, everyone else around the table that may have the same question hears that answer. And they don’t ask the same question, but it may spur another question. So I think we have a lot of really good conversation by having that process in place. It also makes it a lot easier to have broader employee involvement, because every department has to be represented. Because by having everybody sit around the table and everybody look at the form and discuss it at once, the [MOC] process doesn’t take place in a vacuum. It’s very transparent and very open and a very collaborative process. And so you do have some level of hazard analysis that takes place right there at that MOC review team meeting. And if it looks like we’re getting to the point of actually conducting a semi-HAZOP, then we can say, no, let’s refer this now to a PHA and let’s do a full-blown HAZOP on [the proposed change]. But I definitely think you get a much better hazard review in that collaborative [MOC] process. The CCPS book Guidelines for the Management of Change for Process Safety also advises readers that the team- based MOC approach can be a more effective MOC approach for identifying the potential safety and health effects of a proposed change (Figure 24).67

67 Center for Chemical Process Safety (CCPS). Guidelines for the Management of Change for Process Safety; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2008; p 157.

46 CSB · Williams Geismar Case Study

Following the incident, Williams Geismar identified methods to communicate the types of changes that require an MOC. Also, Williams personnel informed the CSB that workers have an increased focus in ensuring MOCs are complete before fieldwork begins. Williams began facilitating this verification by sending around a plant- wide email to communicate MOC approval. If implemented effectively, these cultural and procedural changes can strengthen process safety management at the Williams Geismar facility. The CSB recommends to Williams several processes to ensure that these positive changes continue (Sections 9.0 and 12.0). 8.3 IMPROVED PHA ACTION ITEM IMPLEMENTATION PROCESS Before the incident, the Williams Geismar PHA procedure did not specify a method to follow when the leadership team decided to reject a PHA recommendation or deviate from the proposed recommendation language. Identifying this gap after the incident, Williams Geismar updated the Geismar PHA procedure accordingly (Figure 25), requiring a more robust process when deviating from the proposed PHA recommendation.

FIGURE 24 CCPS book Guidelines for the Management of Change for Process Safety suggests a team-based review can benefit MOC processes by more effectively identifying and controlling important health and safety impacts. FIGURE 25 The Williams Geismar revised, post-incident PHA procedure now specifies a method the leadership team must follow to implement PHA recommendations differently than originally worded.

CSB · Williams Geismar Case Study 47

The post-incident procedure change highlighted in Figure 25 reflects good practice guidance presented in the CCPS book Guidelines for Process Safety Documentation:

Resolution [of PHA recommendations] is not synonymous with adoption; not all recommendations will eventually be implemented as originally proposed. Circumstances change, some recommendations may ultimately be seen to be inappropriate, or a better means of achieving the same results may become known. […] In any event, the method of final resolution of recommendations should be documented, either in the summary report, in an addendum to the report, or in a separate follow-up report. The rationale for not implementing the recommendation as originally proposed, as well as any alternative course of action intended to achieve the objective, should be clearly documented.68

This new procedure can aid management when implementing action items differently than originally recommended by the PHA team. Williams has also increased emphasis on verifying proper completion of PHA action items. Before the incident, simply communicating to the PSM Coordinator, who tracks action items, was sufficient to close an action. This practice led to the ineffective implementation of an action item to install car seals on both propylene fractionator reboilers, and it prevented Williams Geismar from identifying that an MOC was not conducted for the change. Now, more enhanced closure verification requirements associated with PHA action items—for example the MOC and PSSR documentation—link to the PHA action item tracking system. This approach can more effectively verify PSM element completion. Williams also developed a new field verification requirement to ensure accuracy of all P&IDs associated with each PHA before conducting the PHA.69 If effectively implemented, this practice can help to ensure accurate process safety information prior to conducting the PHA. 8.4 NEW DEFINITIONS FOR “STANDBY” AND “OUT-OF-SERVICE” EQUIPMENT Before the incident, the differences in definitions and pressure relief requirements for “standby” and “out-of- service” equipment likely were not fully understood by all Williams personnel. When Williams implemented the 2006 PHA action item to car seal open the reboiler shell-side valves, only the active reboiler outlet valve was car sealed open. Prior to the incident, some Williams personnel may have believed that standby equipment, such as the standby propylene fractionator reboiler, did not require overpressure protection because they perceived it as “out-of-service.” To clarify these definitions and prevent future misunderstandings, after the incident Williams Geismar developed definitions for the two categories. The company now emphasizes these definitions in training and in operating procedures to ensure standby equipment has adequate overpressure protection:

68 Center for Chemical Process Safety. Guidelines for Process Safety Documentation; American Institute of Chemical Engineers: New York, New York, 1995; pp 102-103. 69 Williams has not developed a procedure for this practice.

48 CSB · Williams Geismar Case Study

Standby Equipment is a term used to describe equipment available for active service with a minimum of interaction and under the control of the operations group [through] normal operating procedures. Pressure relief protection is required and is available without further interaction by operators. Out-of-Service Equipment is a term used for positive isolation of a piece of equipment from active service. This is accomplished when isolation is complete and the process fluids have been emptied. At this point relief protection is not needed. Williams more clearly specified pressure relief requirements for “Standby” and “Out-of-Service” equipment internally; however, the CSB found little industry guidance on the definitions and pressure relief requirements for the two categories of inactive equipment. API Standard 521, Pressure-relieving and Depressuring Systems is the applicable industry standard to provide guidance on pressure relief requirements for standby versus out-of-service equipment. The CSB found that this industry standard defined neither standby equipment nor out-of-service equipment. In addition, pressure relief requirements for these classifications of equipment are not explicitly stated. API can improve the clarity of overpressure protection requirements by defining these terms and stating whether overpressure protection is required for each classification. 8.5 IMPROVED TROUBLESHOOTING SUPPORT Since the incident, Williams Geismar improved information provided to operators during an event that may require troubleshooting, such as when a process alarm activates. Now, when board operators get an alarm on the distributed control system (DCS), they can right-click on the alarm and display troubleshooting guidance. The guidance includes directions on what to check in the field, what the field operators should look for, and the consequences of improper field actions. This information is also in the standard operating procedures, and operators receive training on this information. A Williams Geismar technical employee informed the CSB, “Although troubleshooting is still kind of beyond the standard operating procedure, I think [this new practice] gives us a more disciplined set of guidelines, and it gives the operators [better] access to that guidance.”

CSB · Williams Geismar Case Study 49

1. 6 IMPROVED FOCUS ON LEADING AND LAGGING INDICATORS

In recent years, both industry and the CSB have published guidance and conducted forums emphasizing the importance of collecting and analyzing leading70 and lagging71 indicators (metrics) to help prevent process safety incidents.72 The CSB conducted a 2012 public hearing and issued a recommendation to API to develop a consensus standard defining performance indicators for process safety for use in the refining and petrochemical industry. (In response, API developed API RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries.) The CCPS book Guidelines for Process Safety Metrics describes the purpose of process safety metrics succinctly: Process safety metrics are critical indicators for evaluating a process safety management system’s performance. More than one metric and more than one type of metric are needed to monitor performance of a process safety management system. A comprehensive process safety management system should contain a variety of metrics that monitor different dimensions of the system and the performance of all critical elements […]. Good process safety metrics will reinforce a process safety culture promoting a belief that process safety incidents are preventable, that improvement is continuous, and that policies and procedures are necessary and will be followed. Continuous improvement is necessary and any improvement program must be based on measureable elements. Therefore, to continuously improve performance, organizations must develop, implement, and review effective process safety metrics.73

70 Leading Indicators can help to predict future performance. API RP 754 provides leading indicator examples, including process hazard evaluations completion, process safety action item closure, training completed on schedule, procedures current and accurate, and MOC and PSSR compliance. See API Recommended Practice 754, 2nd ed. Process Safety Performance Indicators for the Refining and Petrochemical Industries, April 2016, Section 8.3. 71 Lagging Indicators are retrospective, based on incidents that have occurred. API RP 754 provides lagging indicator examples, including number of recordable injuries, loss of containment incidents, and pressure relief device discharge events. See API Recommended Practice 754, 2nd ed. Process Safety Performance Indicators for the Refining and Petrochemical Industries, April 2016, Section 5.2.2 and Section 6.2.2. 72 Publications and events include (1) CSB Public Hearing: Safety Performance Indicators, July 23-24, 2012, Houston, Texas, http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed August 17, 2016); (2) U.S. Chemical Safety and Hazard Investigation Board, Refinery Explosion and Fire, BP Texas City, REPORT NO. 2005-04-I-TX, (March 2007); (3) API Recommended Practice 754, 1st ed., Process Safety Performance Indicators for the Refining and Petrochemical Industries, April 2010; (4) International Association of Oil & Gas Producers Recommended Practice, Process Safety - Recommended Practice on Key Performance Indicators, Report No. 456, November 2011; (5) Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; among others. 73 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 30. KEY LESSON

“Good process safety metrics will reinforce a process safety culture promoting a belief that process safety incidents are preventable, that improvement is continuous, and that policies and procedures are necessary and will be followed.”i By measuring and analyzing process safety metrics, weaknesses in a company’s process safety management program can be identified. Finding these weaknesses and taking proactive steps to improve upon them can help to strengthen safety culture and prevent process safety incidents.

i. Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 30.

50 CSB · Williams Geismar Case Study

Williams Geismar did not effectively measure leading and lagging process safety indicators before the incident. Such a system could have identified the excessive time it was taking to implement PHA action items. For example, it took three and a half years to close the 2006 PHA action item to car seal open the propylene fractionator reboiler valves. Since the incident, Williams worked to develop a leading and lagging process safety metrics system. For example, Williams Geismar increased its focus on incident and near miss74 reporting, and these events are now valued as learning opportunities. Williams distributes incident and near miss reports to all facility leads, supervisors, engineers, and managers. In addition, the company now investigates high potential near miss incidents using a root cause methodology. Williams began performing statistical analyses on the incidents reported, and the trends and findings are distributed each month to Williams employees and senior managers (Figure 26). Williams also implemented electronic tools and databases to track PHA action items and preventive maintenance items— with the ability to report overdue items or upcoming due dates for action items to management. These efforts are just the beginning in the development of a robust leading and lagging process safety indicators program. CCPS developed example leading and lagging indicators that facilities can use in all areas of process safety management. Figure 27 shows an example list of indicators for Management of Change published by CCPS.75 Williams Geismar should expand its existing indicators program to ensure all facets of its process safety management systems, including MOC, PSSR, PHAs, and operating procedures, are effective.

74 CCPS defines a near miss incident as “The description of less severe incidents (i.e., below the threshold for inclusion in a lagging metric), or unsafe conditions that activated one or more layers of protection. Although these events are actual events (i.e., a “lagging” metric), they are generally considered to be a good indicator of conditions that could ultimately lead to a severe incident.” Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p xvii. 75 Table from Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 152. FIGURE 26 Sample indicators report circulated to Williams Geismar management.

CSB · Williams Geismar Case Study 51

1. 7

PROCESS SAFETY MANAGEMENT PROGRAM ASSESSMENTS Conducting in-depth assessments of a facility’s process safety management program is another way to proactively identify weaknesses in process safety programs including MOC, PSSR, PHA, and operating procedure programs. These assessments go beyond the requirements of the OSHA PSM Compliance Audit—which only requires basic compliance with the OSHA PSM regulation—to evaluate the quality of each process safety management program and the quality of implementation of those programs. Such an evaluation requires detailed analyses of historical process safety management documentation, including MOC and PSSR forms, PHA recommendations, PHA action item tracking systems, and written operating procedures. Process safety management program assessments that analyze a high percentage of historical process safety documentation can be used to identify systemic safety management program failures. The CSB found that process safety management program deficiencies spanning the 12 years leading to the incident were causal to the June 13, 2013 Williams Geismar reboiler rupture and fire. A robust process safety management program assessment—that analyzes years of historical process safety documentation—should be instituted by Williams to identify past safety management deficiencies that could cause future process safety incidents. To drive continual improvement, the CSB recommends to Williams Geismar to conduct such process safety program assessments at least once every three years. FIGURE 27 Example MOC indicators published in the CCPS book Guidelines for Process Safety Metrics

52 CSB · Williams Geismar Case Study

1. 0 STRATEGIES FOR IMPROVING SAFETY CULTURE

A sequence of process safety management deficiencies resulting in unmitigated hazards often precedes serious process safety incidents such as the June 13, 2013 Williams Geismar incident. Additionally, incidents often initiate when existing system gaps coincide with actions at the front line, where workers may not recognize the underlying hazards. To prevent process incidents, organizations must develop a culture that promotes effective process safety management systems. In recent years, the chemical process industry has increasingly focused on process safety culture (“safety culture”). An organization’s safety culture is determined by the quality of its written safety management programs (e.g., process safety management procedures, including PHA, MOC, PSSR, operating procedures; written corporate policies) and the quality of implementing those programs by individuals in the organization, ranging from the CEO to the field operator. The Center for Chemical Process Safety has labeled these two facets as “Conduct of Operations” and “Operational Discipline,” respectively.76 In the years leading up to the incident, Williams Geismar exhibited characteristics of a weak process safety culture. The weaknesses below contributed to the June 13, 2013 incident, reflecting both deficiencies in and poor implementation of the existing process safety management system: (1) Williams did not perform the 2001 MOC until after the plant was operating with the valves installed, and the associated PSSR was incomplete. These actions did not comply with facility (and regulatory) safety management system requirements; however, Williams management accepted both of these practices; (2) Car seals are low-level, administrative controls, but they were the favored safeguard in the 2006 PHA recommendation to prevent overpressure events. Williams Geismar did not have a policy requiring the effectiveness of safeguards to be analyzed; (3) Williams Geismar did not follow OSHA PSM regulatory requirements that operations activities have an associated procedure to safely conduct the work. For example, Williams did not create a procedure specifically for switching the propylene fractionator reboilers Such a procedure should have alerted the operations personnel of the overpressure hazard;

76 Center for Chemical Process Safety (CCPS). Conduct of Operations and Operational Discipline—For Improving Process Safety in Industry; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2011, pp 6-7. Improving an organization’s process safety culture starts with management. Managers can help to set a high bar for the organization’s commitment to implement effective safety management programs and company expectations (i.e., operational discipline) by:

Requiring the collection of key performance indicators for process safety and regularly reviewing them; Setting process safety performance expectations and providing the resources to achieve them; Looking for management system failures as root causes for incidents; Consistently identifying and correcting substandard actions or conditions during field walkthroughs; Completing management reviews and approvals related to work activities in a timely manner; Holding everyone (including themselves) accountable for commitments and ensuring that issues are resolved in a timely manner; Ensuring adequate staffing to operate units safely; and Ensuring adequate funding to maintain equipment and safety systems in good condition.

These are examples from the CCPS book Conduct of Operations and Operational Discipline—For Improving Process Safety in Industry, 2011, p 5.

Improving Process Safety Culture – Management’s Obligations

CSB · Williams Geismar Case Study 53

(4) The Williams PHA policy did not require effective action item resolution and verification, resulting in incorrect action item implementation in the field; (5) The Williams PHA policy did not require PHA teams to effectively evaluate and control risk; and (6) Operations personnel had informal authorization to manipulate field equipment as part of assessing process deviations without first conducting a hazard evaluation and developing a procedure. Lessons from the Williams Geismar incident have broad application to other organizations. The deficiencies listed above highlight that both a strong written safety management system and effective implementation of that system are required to have good process safety performance. Lessons to consider include: (1) Ensure company standards always meet or exceed regulations, industry codes and standards, and best practices; (2) Verify the facility complies with company standards and procedures through activities such as performing audits and tracking indicators; and (3) Assess and strengthen the organizational safety culture including the organization’s commitment to process safety.77 Item (3) above can be the most challenging to measure and to identify action items to improve performance. Areas to consider include: (1) Leaders create culture by what they pay attention to. Is management, from the top down, engaged in process safety? Do leaders require proof of safety rather than proof of danger? (2) Does the organization have a reporting culture? Is reporting of incidents, near misses, and unsafe conditions encouraged? Can personnel report such occurrences without fear of retaliation? Does the company / site proactively investigate worker safety concerns and implement timely and effective corrective actions? (3) Does the organization encourage a learning culture? Does it examine incidents outside of the organization? Does it apply relevant lessons broadly across the organization? (4) Are employees effectively involved in process safety decisions? Before making decisions, is there an open and collaborative process to evaluate problem areas?

77 “Process safety” refers to strategies to prevent chemical releases, fires, and explosions through process design and process safety management programs. KEY LESSON

It is essential to maintain a high level of vigilance when implementing process safety management programs. Only partially or ineffectively conducting elements of PSM programs such as MOCs, PSSRs, PHAs, safeguard evaluations, and procedure development programs can cause significant hazards to be overlooked, and this can lead to catastrophic incidents, sometimes years later.

54 CSB · Williams Geismar Case Study

(5) Are members of the organization overconfident, or do they maintain a healthy sense of vulnerability regarding safety? Are employees susceptible to normalization of deviance?78 In its book Guidelines for Risk Based Process Safety, the Center for Chemical Process Safety provides example methods a facility can employ to improve its process safety culture. These include: (1) Establish process safety as a core value; (2) Provide strong leadership [for process safety]; (3) Establish and enforce high standards of [process safety] performance; (4) Maintain a sense of vulnerability; (5) Empower individuals to successfully fulfill their process safety responsibilities; (6) Defer to expertise; (7) Ensure open and effective communications; (8) Establish a questioning / learning environment; (9) Foster mutual trust; (10) Provide timely response to process safety issues and concerns; and (11) Provide continuous monitoring of [process safety] performance.79 Another tool to evaluate a facility’s safety culture is the use of anonymous safety culture assessments of staff. These assessments have historically been conducted by surveying a site’s employees through multiple-choice questionnaires. Facilities may also use qualitative assessment practices that go beyond simple employee questionnaire surveys. Such safety culture assessments include personnel interviews, focus group discussions, and detailed document analyses. With qualitative assessments, workers interact with auditors, “using their own terms and concepts to express their point of view…. [I]ntensive and in-depth information can be obtained using the [workers’] own language.” 80

78 Normalization of deviance is the acceptance of events that are not supposed to happen. Objective outside observers view the given situation as abnormal or deviant, whereas those individuals on the inside become accustomed to it and view it as normal and acceptable. See Vaughan, Diane. Interview with ConsultingNewsLine, May 2008, http://www.consultingnewsline.com/Info/Vie%20du%20Conseil/Le%20Consultant%20du%20mois/Diane%20Vaughan%20%28 English%29.html (accessed August 17, 2016). 79 Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2007; pp 39-66. 80 Wiegmann, Douglas A.; Zhang, Hui; von Thaden, Terry L.; Sharma, Gunjan; Gibbons, Alyssa Mitchell. Safety Culture: An Integrative Review. The International Journal of Aviation Psychology, 2004, Vol 14, No 2, pp 117-134.

CSB · Williams Geismar Case Study 55

Guidance published in recent years describes how to conduct safety culture assessments of chemical process facilities. In 2011, Contra Costa County in California published a guidance document on conducting safety culture assessments.81 Also in 2011, CCPS released the second edition of its book Guidelines for Auditing Process Safety Management Systems. Chapter four of this book provides detailed guidance for auditors evaluating an organization’s safety culture.82 Such safety culture assessments are an additional tool for understanding the overall commitment to process safety at a facility, and facilities can use findings from the assessment to develop action items to continually improve the facility’s approach to safety. The CSB recommends that Williams begin implementing a process safety culture continual improvement program—using safety culture assessments—as another tool to improve overall safety at its Geismar facility.

81 Contra Costa Health Services. Industrial Safety Ordinance Guidance Document, Section F-Safety Culture Assessments; June 15,

1. http://cchealth.org/hazmat/iso/guidance.php (accessed August 17, 2016).

82 Center for Chemical Process Safety (CCPS). Guidelines for Auditing Process Safety Management Systems; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2011; pp 181-211. “Achieving and sustaining a positive [safety] culture is not a discreet event, but a journey. Organisations should never let their guard down. Healthy safety cultures result in high reliability organisations which are characterized by their “chronic sense of unease”. Organisations must ensure that senior management are committed to a journey of continuous improvement.” International Association of Oil & Gas Producers, A Guide to Selecting Appropriate Tools to Improve HSE Culture, 2010.

56 CSB · Williams Geismar Case Study

1. 0 KEY LESSONS

Overpressure protection is an essential safeguard for all pressure vessels. PHA teams must ensure that all pressure vessels have effective overpressure protection. At a minimum, a pressure relief device is a necessary safeguard to protect process equipment from overpressure scenarios where internal vessel pressure can exceed design code limits. 2. Closed gate (block) valves leak, and they are susceptible to inadvertent opening. Both scenarios can introduce process fluids to offline equipment. More robust isolation methods, such as inserting a blind, can better protect offline equipment from accumulation of process fluid. 3. It is important to ensure that the final implementation of PHA action items addresses the original safety concerns identified by the PHA team. Companies should ensure that action items have been effectively implemented and field verified before closing them out. 4. Robust Management of Change (MOC) practices are needed to ensure the review analyzes hazards in the entire process affected by the change. Similar to PHAs, conducting MOC reviews as a multidisciplinary group—composed of individuals with different experiences and different areas of expertise—can assist in identifying hazards introduced by a process change. Companies must conduct MOCs before implementing a change in the field, and should not treat them as a paperwork or check-the-box exercise. 5. Pre-Startup Safety Reviews (PSSRs) are key opportunities to verify effective implementation of design intent, accuracy of process safety information, and proper installation and configuration of field equipment. Companies should conduct thorough and effective PSSRs before placing equipment in service. 6. Operating procedures need sufficient detail to ensure effective performance of critical steps, including performing steps in the correct order. Affected employees such as operators must receive training on the procedures. Management must establish expectations to maintain and follow accurate procedures. 7. PHA and MOC teams should effectively use the hierarchy of controls to the greatest extent feasible when evaluating safeguards. Pressure relief devices are typically more robust safeguards than car seals. Pressure relief devices (active safeguards) are higher on the hierarchy of controls than car seals (administrative controls). 8. “Good process safety metrics will reinforce a process safety culture promoting a belief that process safety incidents are preventable, that improvement is continuous, and that policies and procedures are necessary and will be followed.”83 By measuring and analyzing process safety metrics, weaknesses in a company’s process safety management program can be identified. Finding these weaknesses and taking proactive steps to improve upon them can help to strengthen safety culture and prevent process safety incidents. 9. It is essential to maintain a high level of vigilance when implementing process safety management programs. Only partially or ineffectively conducting elements of PSM programs such as MOCs, PSSRs, PHAs, safeguard evaluations, and procedure development programs can cause significant hazards to be overlooked, and this can lead to catastrophic incidents, sometimes years later.

83 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 30.

CSB · Williams Geismar Case Study 57

1. 0 CONCLUSIONS

In the years leading up to the June 13, 2013 incident, significant weaknesses in the Williams Geismar process safety culture were evident in a series of deficiencies in implementing the site’s process safety management programs and in weaknesses in the written programs themselves. These deficiencies include a poorly conducted MOC and PSSR, ineffective safeguard selections and insufficient safeguard evaluation requirements, poor implementation of PHA action items, inadequate focus on developing and maintaining operating procedures, and allowing uncontrolled field equipment manipulations without first assessing the hazards and developing a procedure. Those deficiencies ultimately contributed to the reboiler rupture and the deaths of two employees. This incident highlights that maintaining process safety excellence at a facility requires consistent and organized effort by a company and its employees. Former CSB Chairperson John Bresland called on companies to strive for process safety excellence when he stated, “Operating hazard[ous] chemical plants need to have the highest level of chemical process safety possible to make sure they operate safely day in and day out. It requires constant diligence and constant attention to process safety management.”84 While Williams made safety improvements following the incident, the CSB has identified additional good practices Williams Geismar should implement for further improvement. These strategies, including conducting safety culture assessments, developing a robust indicators tracking program, and conducting detailed process safety program assessments, can aid in maintaining a consistent focus on process safety. The CSB also identified gaps in industry guidance provided by the American Petroleum Institute (API). Post- incident, API now requires relief devices for scenarios that generate pressure greater than what is allowed by the equipment design code; however, the CSB found the API guidance remains inconsistent, as API still specifies in some guidance that reliance on administrative controls is sufficient to prevent equipment from overpressuring. In addition, the CSB found limited guidance from API on definitions and pressure relief requirements for standby and out-of-service equipment. Further enhancing guidance in API publications can enable broader learning of the lessons from the Williams incident. Applying these lessons industry-wide can prevent future catastrophic incidents.

84 Walter, Laura; CSB Issues Urgent Safety Recommendations Following CITGO Refinery Accident. EHS Today [Online] 2009. http://ehstoday.com/safety/news/csb-issues-urgent-safety-recommendations-citgo-refinery-accident-1411 (accessed August 17, 2016).

58 CSB · Williams Geismar Case Study

1. 0 RECOMMENDATIONS
2. 1 WILLIAMS GEISMAR OLEFINS FACILITY

2013-03-I-LA-R1 Implement a continual improvement program to improve the process safety culture at the Williams Geismar Olefins Plant. Ensure oversight of this program by a committee of Williams personnel (“committee”) that, at a minimum, includes safety and health representative(s), Williams management representative(s), and operations and maintenance workforce representative(s). Ensure the continual improvement program contains the following elements: a. Process Safety Culture Assessments. Engage a process safety culture subject-matter expert, who is selected by the committee and is independent of the Geismar site, to administer a periodic process safety culture assessment that includes surveys of personnel, interviews with personnel, and document analysis. Consider the process safety culture audit guidance provided in Chapter 4 of the CCPS book Guidelines for Auditing Process Safety Management Systems as a starting point. Communicate the results of the Process Safety Culture Assessment in a report; and

b. Workforce Involvement. Engage the committee to (1) review and comment on the expert report developed from the Process Safety Culture Assessments, and (2) oversee the development and effective implementation of action items to address process safety culture issues identified in the Process Safety Culture Assessment report.

As a component of the process safety culture continual improvement program, include a focus on the facility’s ability to comply with its internal process safety management program requirements. Make the periodic process safety culture report available to the plant workforce. Conduct the process safety culture assessments at least once every five years. 2013-03-I-LA-R2 Develop and implement a permanent process safety metrics program that tracks leading and lagging process safety indicators. Consider available industry guidance, such as the guidance presented in the Center for Chemical Process Safety (CCPS) book Guidelines for Process Safety Metrics and the example metrics provided in the book’s accompanying CD. Design this metrics program to measure the effectiveness of the Williams Geismar Olefins Facility’s process safety management programs. Include the following components in this program: a. Measure the effectiveness of the Williams Geismar Management of Change (MOC) program, including evaluating whether MOCs were performed for all applicable changes, the quality of MOC review, and the completeness of the MOC review; b. Measure the effectiveness of the Williams Geismar Pre-Startup Safety Review (PSSR) program, including the quality of the PSSR review and the completeness of the PSSR review;

CSB · Williams Geismar Case Study 59

c. Measure the effectiveness of the Williams Geismar methods to effectively and timely complete action items developed as a result of Process Hazard Analyses (PHAs), Management of Change (MOC), incident investigations, audits, and safety culture assessments; and d. Measure the effectiveness of the Williams Geismar development and implementation of operating procedures.

Develop a system to drive continual process safety performance improvements based upon the data identified and analysis developed as a result of implementing the permanent process safety metrics program.

2013-03-I-LA-R3

Develop and implement a program that demands robust and comprehensive assessments of the process safety programs at the Williams Geismar facility, at a minimum including Management of Change, Pre- Startup Safety Review, Process Hazard Analyses, and Operating Procedures. Ensure that the assessments thoroughly evaluate the effectiveness of these important safety programs. To drive continual improvement of process safety programs to meet good practice guidance, ensure these assessments result in the development and implementation of robust action items that address identified weaknesses. Engage an expert independent of the Geismar site to lead these assessments at least once every three years.

1. 2 AMERICAN PETROLEUM INSTITUTE

2013-03-I-LA-R4 To help prevent future major incidents such as a rupture of a pressure vessel in a special operating status, strengthen API Standard 521, Pressure-relieving and Depressuring Systems, by defining the various types of equipment operating statuses. Include definitions for “standby” and “out-of-service.” Specify pressure relief requirements for each type of equipment operating status. 2013-03-I-LA-R5 To help prevent future major incidents such as pressure vessel rupture from ineffective or failed administrative controls, clarify API Standard 521, Pressure-relieving and Depressuring Systems, to require a pressure relief device for overpressure scenarios where internal vessel pressure can exceed what is allowed by the design code. Although some portions of API Standard 521 already require a pressure relief device for these scenarios, other areas, such as Section 4.4.12 Hydraulic Expansion, are not as protective. Section 4.4.12 Hydraulic Expansion (the failure mode that caused the Williams overpressure incident) permits omitting a pressure relief device and allows the exclusive use of administrative controls.

60 CSB · Williams Geismar Case Study

REFERENCES 29 CFR §1910.119 Process Safety Management of Highly Hazardous Chemicals. 40 CFR Chapter 1, Subchapter C, Part 68 – Chemical Accident Prevention Provisions. American Society of Mechanical Engineers. ASME Boiler and Pressure Vessel Code, 2015. Section VIII, Division 1. API Recommended Practice 754, 2nd ed. Process Safety Performance Indicators for the Refining and Petrochemical Industries, April 2016. API Recommended Practice 572, 3rd ed., Inspection Practices for Pressure Vessels, November 2009. API Standard 521, 5th Edition. Pressure-relieving and Depressuring Systems, January 2007. API Standard 521, 6th Edition. Pressure-relieving and Depressuring Systems, January 2014. API Standard 598, 9th ed. Valve Inspection and Testing, September 2009. Birk, A.M.; Davison, C.; Cunningham, M.; Blast Overpressures from Medium Scale BLEVE Tests. Journal of Loss Prevention in the Process Industries, 2007, vol. 20, pp 194-206. Birk, A.M.; VanderSteen, J.D.J.; Davison, C.; Cunningham, M.H.; Mirzazadeh, I.; PRV Field Trials – The Effects of Fire Conditions and PRV Blowdown on Propane Tank Survivability in a Fire, TP 14045E, Transport Canada, 2003. Center for Chemical Process Safety (CCPS). A Practical Approach to Hazard Identification for Operations and Maintenance Workers; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010. Center for Chemical Process Safety (CCPS). Guidelines for Auditing Process Safety Management Systems; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2011. Center for Chemical Process Safety (CCPS). Guidelines for Enabling Conditions and Conditional Modifiers in Layer of Protection Analysis; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2014. Center for Chemical Process Safety (CCPS). Guidelines for Engineering Design for Process Safety, 2nd ed.; American Institute of Chemical Engineers: New York, New York, 2012. Center for Chemical Process Safety (CCPS). Guidelines for Hazard Evaluation Procedures, 3rd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2008. Center for Chemical Process Safety (CCPS). Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2015.

CSB · Williams Geismar Case Study 61

Center for Chemical Process Safety (CCPS). Guidelines for Management of Change for Process Safety; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2008. Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010. Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2007. Center for Chemical Process Safety (CCPS). Guidelines for Writing Effective Operating and Maintenance Procedures; American Institute of Chemical Engineers: New York, New York, 1996. Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2009. Center for Chemical Process Safety (CCPS). Recognizing Catastrophic Incident Warning Signs in the Process Industries; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2012. Center for Chemical Process Safety (CCPS). Conduct of Operations and Operational Discipline—For Improving Process Safety in Industry; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2011. Center for Chemical Process Safety (CCPS). Guidelines for Vapor Cloud Explosion, Pressure Vessel Burst, BLEVE and Flash Fire Hazards, 2nd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010. Center for Chemical Process Safety (CCPS). Layer of Protection Analysis – Simplified Process Risk Assessment; American Institute of Chemical Engineers: New York, New York, 2001. Center for Chemical Process Safety. Guidelines for Process Safety Documentation; American Institute of Chemical Engineers: New York, New York, 1995. Chemical Safety Board Public Hearing: Safety Performance Indicators, July 23-24, 2012, Houston, Texas, http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (Accessed August 17, 2016). Chemical Safety Board Website. BP America Refinery Explosion. http://www.csb.gov/bp-america- refinery-explosion/ (Accessed August 17, 2016). Chemical Safety Board Website. Heat exchanger rupture and ammonia release in Houston, Texas. http://www.csb.gov/goodyear-heat-exchanger-rupture/ (Accessed August 17, 2016). Contra Costa Health Services. Industrial Safety Ordinance Guidance Document, Section F-Safety Culture Assessments; June 15, 2011. http://cchealth.org/hazmat/iso/guidance.php (accessed August 17, 2016). Frank, Walter L. and Whittle, David K. Revalidating Process Hazard Analyses. American Institute of Chemical Engineers: New York, New York, 2001.

62 CSB · Williams Geismar Case Study

Health and Safety Executive (HSE), Reducing Error and Influencing Behaviour, 2009. http://www.hse.gov.uk/pubns/priced/hsg48.pdf (accessed September 7, 2016). International Association of Oil & Gas Producers, A Guide to Selecting Appropriate Tools to Improve HSE Culture, Report No. 435, March 2010. International Association of Oil & Gas Producers, Process Safety - Recommended Practice on Key Performance Indicators, Report No. 456, November 2011. Kletz, Trevor. What Went Wrong? – Case Histories of Process Plant Disasters and How They Could Have Been Avoided, 5th ed.; Elsevier: Burlington, Massachusetts, 2009. The National Board of Boiler and Pressure Vessel Inspectors. National Board Inspection Code, 2015. Part 1-Installation. Queen’s University Website. Recent Fire Testing and BLEVE Research at Queen’s University. http://me.queensu.ca/People/Birk/Research/ThermalHazards/bleve/FieldTrials2000-2002.html (accessed August 17, 2016). Total Lockout Website. Car Seals. http://www.totallockout.com/online-store/car-seals-2/ (accessed November 19, 2015). U.S. Chemical Safety and Hazard Investigation Board, Catastrophic Rupture of Heat Exchanger (Seven Fatalities), Tesoro Anacortes Refinery; Anacortes, Washington; April 2, 2010. Report 2010-08-I-WA, May 2014. http://www.csb.gov/tesoro-refinery-fatal-explosion-and-fire/ (accessed August 17, 2016). Vaughan, Diane. Interview with ConsultingNewsLine, May 2008, http://www.consultingnewsline.com/Info/Vie%20du%20Conseil/Le%20Consultant%20du%20mois/Dian e%20Vaughan%20%28English%29.html (accessed August 17, 2016). Walter, Laura; CSB Issues Urgent Safety Recommendations Following CITGO Refinery Accident. EHS Today [Online] 2009. http://ehstoday.com/safety/news/csb-issues-urgent-safety-recommendations-citgo- refinery-accident-1411 (accessed August 17, 2016). Wiegmann, Douglas A.; Zhang, Hui; von Thaden, Terry L.; Sharma, Gunjan; Gibbons, Alyssa Mitchell. Safety Culture: An Integrative Review. The International Journal of Aviation Psychology, 2004, Vol 14, No 2. Williams Company Website. https://co.williams.com/operations/ngl-petchem/olefins/ (accessed August 17, 2016).

Appendix A Causal Analysis - AcciMap CSB · Williams Geismar Case Study 63

Appendix B – Failure Scenario Analysis

64 CSB · Williams Geismar Case Study

CSB ANALYSIS OF LIKELY REBOILER FAILURE SCENARIO

Williams Geismar, LA Investigation

Incident Date: June 13, 2013

Appendix B – Failure Scenario Analysis

CSB · Williams Geismar Case Study 65

Table of Contents

1. 0 Summary ……………………………………………………………………………………………………..66
2. 0 Failure Scenarios Evaluated ……………………………………..………………………………………….66
3. 1 Overpressurization Due to Equilibrium Vapor Pressure at Quench Water Feed Temperature ……….………67
4. 2 Explosion Due to High Concentrations of Methyl Acetylene and Propadiene ……………………………….68
5. 3 Overpressurization Due to Liquid Thermal Expansion………………………………………………………..69
6. 0 Boiling Liquid Expanding Vapor Explosion (BLEVE)………………………………………………...…..72

Appendix B – Failure Scenario Analysis

66 CSB · Williams Geismar Case Study

1. 0 SUMMARY

On June 13, 2013, a propylene fractionator reboiler (Reboiler B) catastrophically ruptured, resulting in the fatalities of two Williams employees. The reboiler had been offline, isolated from the propylene fractionator by a single valve on the inlet piping and a single valve on the outlet piping, when hot water was introduced to the tube side of the exchanger while the shell-side valves were still closed. Approximately three minutes after the tube- side hot water valves were opened, the reboiler ruptured. Post-incident analysis indicates the reboiler shell likely failed at an internal pressure estimated to be between 674 and 1,212 psig.85 The CSB determined that a pressure of this magnitude was likely generated by liquid thermal expansion in the liquid-filled, Reboiler B shell. The process liquid within the shell, which contained mostly propane with smaller amounts of propylene and C4 hydrocarbons, such as butane, likely entered the offline Reboiler B shell during the 16 months it was isolated from the process by at least one of the following: (1) a leaking process valve; (2) a mistakenly opened process valve; or, (3) another reason not identified. This report details the possible failure scenarios for the reboiler shell, which the CSB evaluated.

1. 0 FAILURE SCENARIOS EVALUATED

The following sections detail the CSB’s analysis of possible propylene fractionator reboiler (Reboiler B) failure scenarios. These include overpressurization due to an increase in the equilibrium vapor pressure as the reboiler temperature increased, detonation due to an accumulation of methyl acetylene and propadiene (MAPD), and vessel rupture due to liquid thermal expansion.

85 See Metallurgical Evaluation of Williams Olefins Ruptured Reboiler EA-425B in Appendix C.

Appendix B – Failure Scenario Analysis

CSB · Williams Geismar Case Study 67

1. 1 OVERPRESSURIZATION DUE TO EQUILIBRIUM VAPOR PRESSURE AT QUENCH

WATER FEED TEMPERATURE

The tube-side quench water was at a temperature of 187 °F. At equilibrium conditions at 187 °F, the shell-side propane mixture generates a vapor pressure of approximately 496 psig (Figure B-1). This pressure is not high enough to have ruptured the reboiler, which Finite Element Analysis predicts ruptured between 674 and 1,212 psig.86 The CSB concludes that the overpressurization of the Williams reboiler was likely not caused by an increase in vapor-liquid equilibrium pressure when heat was introduced to the closed shell side of the reboiler.

86 See Metallurgical Evaluation of Williams Olefins Ruptured Reboiler EA-425B in Appendix C. FIGURE B-1 Boiling Point Curve of Williams reboiler process fluid. Graph indicates process fluid could generate a vapor pressure of 496 psig at equilibrium conditions.

Appendix B – Failure Scenario Analysis

68 CSB · Williams Geismar Case Study

1. 2 EXPLOSION DUE TO HIGH CONCENTRATIONS OF METHYL ACETYLENE AND

PROPADIENE Mixtures of methyl acetylene and propadiene (MAPD) can decompose and ignite without the presence of oxygen, resulting in an explosion inside of equipment that can violently rupture process vessels. Heat input to the mixture could be sufficient to initiate the ignition of the materials.87 Experimental studies have found that hydrocarbon mixtures containing approximately 60 mol% MAPD can sufficiently decompose and propagate a flame.88 The CSB analyzed whether the decomposition and ignition of MAPD in the reboiler shell caused this incident. Williams regularly sampled the MAPD composition exiting the propadiene converter, which was immediately upstream of the propylene fractionator (Figure B-2). The propadiene converter was installed into the process specifically to prevent accumulation of MAPD in the process. Plant data indicates the propadiene converter was functioning normally between a February 2012 maintenance activity and the day of the incident. Between the time Reboiler B was last opened for maintenance (February 2012) and the incident, available composition data indicates that the process fluid entering the propylene fractionator did not exceed approximately 1.4 mol% MAPD. This concentration likely was not enough to accumulate a high percentage of MAPD in the standby reboiler, which was isolated from the propylene fractionator by closed valves. In a 2013 presentation by Dow at the AIChE Ethylene Producers’ Conference, two scenarios were identified that could result in accumulation of MAPD in a propylene fractionator: operating on total reflux or operating with a loss of bottoms flow.89 The propylene fractionator was not operated under either condition between February 2012 and the incident. The CSB concludes that this incident was likely not caused by the accumulation and detonation of MAPD in the offline Reboiler B.

87 Kuchta, J.M.; Spolan, I.; Zabetakis, M.G. Flammability Characteristics of Methylacetylene, Propadiene (Allene), and Propylene Mixtures. Journal of Chemical and Engineering Data, 1964, Vol. 9, No. 3, 467-472. 88 Yoshimine, M.; Kern, W.G.; Belfit, R.W. Stabilization of Methylacetylene and Propadiene Mixtures. Journal of Chemical and Engineering Data, 1967, Vol. 12, No. 3, 399-405. 89 Feld, Peter; MAPD Stability and Management in Ethylene Plants, 2013 AIChE Spring National Meeting; San Antonio, Texas; May 1, 2013; AIChE Paper Number 111b. FIGURE B-2 Simplified flow diagram of the olefins process. The propadiene converter and the propylene fractionator are highlighted in yellow.

Appendix B – Failure Scenario Analysis

CSB · Williams Geismar Case Study 69

1. 3

OVERPRESSURIZATION DUE TO LIQUID THERMAL EXPANSION Liquid expands as it is heated and has the ability to generate high pressures when the liquid is confined within a closed vessel. Based on equipment dimensions and the physical properties of the design composition of the propylene fractionator bottoms product, the CSB calculated the minimum quantity of process liquid required at ambient temperature (approx. 77 °F) to completely fill the propylene fractionator Reboiler B at the quench water temperature (187 °F). The following calculations were performed to determine the approximate quantity of liquid process fluid required on the shell side of the Williams reboiler and in connected piping to result in a liquid overpressurization of the reboiler shell. Total Volume Available Between Closed Valves 𝑉𝑉𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡= 289.93 𝑓𝑓𝑓𝑓3

Volume of Process Fluid Required to Fill Exchanger Shell at Quench Water Feed Temperature Williams Propylene Fractionator Bottoms Design Case: Component Flow Rate (lbmol/hr) Propylene 8.327 Propane 235.921 C4’s 2.831

The density of this liquid was evaluated at two conditions using Aspen HYSYS, SRK equation of state: (1) Ambient temperature (77°F): 𝜌𝜌𝑙𝑙,77°𝐹𝐹= 30.89 𝑙𝑙𝑙𝑙𝑚𝑚 𝑓𝑓𝑓𝑓3 (2) Quench water inlet temperature (187°F): 𝜌𝜌𝑙𝑙,187°𝐹𝐹= 20.22 𝑙𝑙𝑙𝑙𝑚𝑚 𝑓𝑓𝑓𝑓3 Mass of liquid required to fill shell side volume at 187°F: 𝑚𝑚𝑙𝑙= (𝑉𝑉𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡)൫𝜌𝜌𝑙𝑙,187°𝐹𝐹൯= (289.93 𝑓𝑓𝑓𝑓3)൬20.22 𝑙𝑙𝑙𝑙𝑚𝑚 𝑓𝑓𝑓𝑓3൰= 5,862.38 𝑙𝑙𝑙𝑙𝑚𝑚 Volume this mass occupies at 77°F: 𝑉𝑉𝑙𝑙,77°𝐹𝐹= 𝑚𝑚𝑙𝑙 𝜌𝜌𝑙𝑙,77°𝐹𝐹 = 5,862.38 𝑙𝑙𝑙𝑙𝑚𝑚 30.89 𝑙𝑙𝑙𝑙𝑚𝑚 𝑓𝑓𝑓𝑓3 = 189.78 𝑓𝑓𝑓𝑓3 Percentage total volume occupied at 77°F: 189.78 𝑓𝑓𝑓𝑓3 289.93 𝑓𝑓𝑓𝑓3 𝑥𝑥 100 = 65.5 𝑣𝑣𝑣𝑣𝑣𝑣% The piping and exchanger shell between the two closed reboiler process valves had to be at least 65.5 vol% full of the liquid propane mixture prior to the introduction of hot quench water to the tube side of the reboiler for liquid expansion to result in overpressurization of the exchanger shell and piping. A liquid inventory of at least this

Appendix B – Failure Scenario Analysis

70 CSB · Williams Geismar Case Study

minimum quantity of liquid is reasonable because (1) it would have resulted in a level in the reboiler below the liquid level in the propylene fractionator, and (2) this quantity of liquid would have had enough contact with the reboiler tubes to sufficiently heat and expand (Figure B-3). Reboiler B was likely between 65.5 vol% and 100 vol% full of the liquid propane mixture prior to the introduction of the 187 °F quench water.

FIGURE B-3 Depiction of minimum required liquid level in reboiler EA-425B (Reboiler B) to result in possible liquid overpressurization of reboiler shell.

Appendix B – Failure Scenario Analysis

CSB · Williams Geismar Case Study 71

Pressure Rise Due to Liquid Thermal Expansion The following equation was used to calculate the theoretical pressure that could be reached inside the Reboiler B shell due to liquid thermal expansion of the propane mixture. The calculation assumed that the reboiler was initially full of the liquid propane mixture. Assuming negligible leakage across the shell-side valves during the three minutes between the introduction of hot quench water and vessel failure:90 𝑃𝑃2 = 𝑃𝑃1 +

(𝑇𝑇2 −𝑇𝑇1)(𝛼𝛼𝑣𝑣−3𝛼𝛼|) 𝜒𝜒+ ൬ 𝑑𝑑 2𝐸𝐸𝛿𝛿𝑤𝑤൰(2.5 −2𝜇𝜇)

Where 𝑃𝑃2 is the final gauge pressure of blocked-in, liquid-full equipment, expressed in psig; 𝑃𝑃1 is the initial gauge pressure of blocked-in, liquid-full equipment, expressed in psig; 𝑇𝑇2 is the final temperature of blocked-in, liquid-full equipment, expressed in °F; 𝑇𝑇1 is the initial temperature of blocked-in, liquid-full equipment, expressed in °F; 𝛼𝛼𝑣𝑣 is the cubic expansion coefficient of the liquid, expressed in 1/°F;

𝛼𝛼| is the linear expansion coefficient of metal wall, expressed in 1/°F; 𝜒𝜒 is the isothermal compressibility coefficient of the liquid, express in 1/psi; 𝑑𝑑 is the internal pipe diameter, expressed in inches; 𝐸𝐸 is the modulus of elasticity for the metal wall at 𝑇𝑇2, expressed in psi; 𝛿𝛿𝑤𝑤 is the metal wall thickness, expressed in inches; 𝜇𝜇 is Poisson’s ratio, typically 0.3.

This calculation finds that the pressure inside of the Reboiler B shell could reach approximately 5,000 psig due to liquid thermal expansion of the propane mixture within the confined shell. Finite element analysis predicted the reboiler failed at an internal pressure between 674 and 1,212 psig.91 The pressure generated by liquid thermal expansion would be sufficient to achieve this failure pressure. The CSB concludes that liquid thermal expansion of the liquid-filled Reboiler B shell was the likely failure scenario that initiated the mechanical failure sequence resulting in the boiling liquid expanding vapor explosion (BLEVE).

90 Equation from API Standard 521, 6th ed. Pressure-relieving and Depressuring Systems, January 2014, section 4.4.12.4.1. 91 See Metallurgical Evaluation of Williams Olefins Ruptured Reboiler EA-425B in Appendix C.

Appendix B – Failure Scenario Analysis

72 CSB · Williams Geismar Case Study

1. 0 BOILING LIQUID EXPANDING VAPOR EXPLOSION (BLEVE)

When the reboiler shell failed locally (cracked) due to liquid thermal expansion of the shell contents, the shell contents began to flash near the failure opening and a two-phase (liquid and vapor) jet release would have accelerated out of the failure opening. The two-phase flow would have choked in the failure opening, maintaining the pressure in the vessel for a short period of time. The pressure loading on the open edges of the failure caused the crack to continue to grow along the vessel length and the failure opening rapidly increased in size. As this opening increased in size, the two-phase jet would have grown rapidly. At some point, the full opening of the vessel would have resulted in an explosive release of the remaining vessel contents. This explosive release is called a boiling liquid expanding vapor explosion (BLEVE).92 The pressure forces during this process usually flatten the vessel cylinder on the ground (Figure B-4). The escaping propane mixture then found an ignition source and ignited.

92 Center for Chemical Process Safety (CCPS). Guidelines for Vapor Cloud Explosion, Pressure Vessel Burst, BLEVE and Flash Fire Hazards, 2nd ed.; John Wiley & Sons, Inc.: Hoboken, New Jersey, 2010; p 311. FIGURE B-4 Post-incident photo of Reboiler B shell. The originally cylindrical shell was flattened during the event.

Appendix C – Metallurgical Analysis Report

CSB · Williams Geismar Case Study 73

Appendix C – Metallurgical Analysis Report

The Metallurgical Analysis Report is on the CSB website on the Williams Olefins Plant Explosion and Fire investigation page.

74 CSB · Williams Geismar Case Study

Members of the U.S. Chemical Safety and Hazard Investigation Board:

Vanessa Allen Sutherland, J.D. Chairperson

Manuel Ehrlich Member

Richard Engler Member

Kristen Kulinowski, Ph.D. Member

FD06462 ｜ 2013_美国_carbide-industries-fire-explosion.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

CSB • Carbide Industries Case Study 1 Carbide Industries Case Study Board Voting Copy February 2013 Case Study U.S. Chemical Safety and Hazard Investigation Board Carbide Industries, LLC, Louisville, KY Electric Arc Furnace Explosion March 21, 2011 2 Killed, 2 Injured No. 2011-05-I-KY On March 21, 2011, during calcium carbide production at the Carbide Industries plant in Louisville, KY, an electric arc furnace exploded, ejecting solid and powdered debris, flammable gases, and molten calcium carbide at temperatures near 3800°F (2100°C). Two workers died and two others were injured.

KEY ISSUES • Facility Siting • Normalization of Deviance • Consensus Standards INSIDE • Process Discussion • Incident Description • Emergency Response • Analysis • Key Findings • Recommendations

CSB • Carbide Industries Case Study 2 Carbide Industries Case Study Board Voting Copy February 2013 1.0 INTRODUCTION Two workers were killed and two were injured at the Carbide Industries, LLC facility in Louisville, KY, on Monday, March 21, 2011, when an electric arc furnace (EAF) overpres­ sured and emitted powdered debris, hot gases, and molten calcium carbide. The hot gases and debris blown from the furnace broke through the double-pane reinforced glass window of the control room, severely burning the two workers inside; they died within 24 hours from burn injuries. Carbide Industries, LLC is the larger of two North American producers of calcium carbide and supplies calcium carbide primarily to the iron and steel industry and to acetylene1 producers. The main Carbide Industries facility is adjacent to the Ohio River in the “Rubbertown” section of western Louisville, KY. The company employs about 160 workers in operations, maintenance, and administration. The Louisville site operated one 50-mega­ watt (MW) EAF with the capacity to produce 120,000 tons of molten calcium carbide per year. After draining the calcium carbide from the EAF and cooling it to a solid, the site grinds and packages the solid into multiple grades of calcium carbide for sale. Although the facility maintains an acetylene storage tank to collect fugitive acetylene gas from the calcium carbide plant, the operation does not produce acetylene gas to sell.2 TABLE OF CONTENTS 1.0 Introduction 2 2.0 Process Discussion 3 3.0 Emergency Planning

and Response 6 4.0 Incident Description 7 5.0 Analysis 8 6.0 Key Findings 13 7.0 Recommendations 14 8.0 References 15 9.0 Appendix A: Simplified

Diagram of Calcium

Carbide process 16

FIGURE 1 Satellite view of the Carbide Industries Louisville facility, with furnace building circled 1Adding water to calcium carbide produces acetylene gas and calcium hydroxide (lime). The acetylene gas is then purified to sell as welding gas and raw material for producing other chemicals. 2Carbide Industries burns the collected acetylene gas in a flare.

CSB • Carbide Industries Case Study 3 Carbide Industries Case Study Board Voting Copy February 2013 3According to the EPA, in 1999, there were 200 EAFs operated in US industry, 130 of which were used for steelmaking. 4Coke, a solid carbon that contains some hydrogen, is a black solid produced by high-temperature processing of high boiling petroleum- or coal-based process streams and residues in an oxygen-free environment. Only a few calcium carbide industry facilities operate in the United States. In addition to the Carbide Industries facility in Kentucky, Central Carbide Corporation in Pryor, OK, operates a 17-MW electric arc furnace. Central Carbide Corporation is under the same ownership as Carbide Industries, LLC. Although the majority of EAFs used in the U.S. are for steel manufacturing,3 similar chemical producing operations use EAFs in the ferrosilicon, silicon, and phosphorus industries. 2.0 PROCESS DISCUSSION 2.1. CHEMICAL PROPERTIES OF CALCIUM CARBIDE Pure calcium carbide (chemical formula CaC2) consists of two carbon atoms and one calcium atom; it melts at about 3500°F (1926°C). At room temperature, commercially produced calcium carbide is a gray to black solid that is typically supplied as granules or powder con­ taining about 75 to 85 weight percent calcium carbide with 15 to 25 weight percent calcium oxide and other impurities. Calcium carbide reacts with water, such as the humidity in air or the moisture in human tissues, to form acetylene gas (chemical formula C2H2) and calcium hydroxide (chemical formula Ca(OH)2). Acetylene is an extremely flammable gas. Calcium hydroxide is a caustic solid that can irritate the skin and eyes on contact and can lead to severe respiratory irritation and acute pulmonary edema when inhaled. 2.2. ELECTRIC ARC FURNACES FOR CALCIUM CARBIDE An EAF passes electricity through the air above a material to heat that material (indirect arc furnaces) and in some designs through the material as well (open arc and submerged arc furnaces). The electricity enters the EAF through large conductors called electrodes. Calcium carbide is manufactured in submerged arc EAFs through which electrodes protrude into the material to be heated. Radiative heating occurs from the arc in the air around the material, direct electrical resistance heating occurs as the electricity passes through the material, and convective heating occurs as the hot gases formed in the arc percolate through the material. EAFs can generate temperatures in the thousands of degrees centigrade. The calcium carbide process feeds coke4 pre-mixed with lime chunks (calcium oxide, (CaO)) to the EAF, and the electrodes protrude through the furnace cover into the pile of coke and lime. As the EAF provides electricity, heating the feed material to temperatures above 4100°F, the carbon in the coke reacts with the lime at high temperature to form liquid calcium carbide as a product and the toxic and flammable by-product carbon monoxide: CaO + 3C ∆→ CaC2 + CO Lime + carbon + heat → calcium carbide + carbon monoxide Since the coke contains some hydrogen atoms, the process also releases extremely flammable hydrogen gas (H2).

CSB • Carbide Industries Case Study 4 Carbide Industries Case Study Board Voting Copy February 2013 2.3 EQUIPMENT DESCRIPTION The EAF at Carbide Industries was located on the ground floor of the five-story furnace building (Figure 2). Due to the height of the furnace itself, the cover of the furnace was at the second floor level; the same level as the control room where the furnace operator controlled the chemical and electrical feeds to the furnace. The control room had a window made of dual-paned, one-half-inch thick, wire-reinforced glass. Figure 3 shows that the control room window was about 12 feet from the furnace cover. The furnace was a refractory-lined metal tank with three holes in the sidewall to drain the molten calcium carbide product. These three-hole positions were at the elevation of the mezzanine level, between the second and ground floor. The furnace cover was about four feet tall and made of refractory-lined metal that was water cooled. The refractory prevented the high-temperature materials in the furnace from contacting and melting the metal tank and cover. The furnace cover was fabricated in several sections and bolted together. Cooling water flowed through each hollow section as additional protection against overheating. Three electrodes protruded through the furnace cover. The electrodes extended from the fifth floor down to just below the second floor. Three transformers on the third floor supplied AC power to the electrodes. FIGURE 2 Cutaway view of the EAF building and location of victims at time of incident Location of victims

CSB • Carbide Industries Case Study 5 Carbide Industries Case Study Board Voting Copy February 2013 Tanks on the fourth level held pre-mixed feed until a conveyor system dispensed the material into chutes that distributed the feed around the furnace electrodes. The feed material flowed down into the furnace through the gaps between the electrode sheaths and the holes that the electrodes passed through in the furnace cover. 2.4. PROCESS DESCRIPTION The plant receives truck and rail deliveries of coke and lime respectively (Appendix A). An oven dries the coke and a weighing system mixes the coke with the lime in the desired weight ratio to feed the furnace. A system of tanks and chutes distributes the solid feed mixture (coke and lime) through the EAF cover and around the three electrodes. The furnace contains hot feed material, liquid calcium carbide, and flammable and toxic gases that are byproducts of the EAF, including hydrogen and carbon monoxide. The feed material falls through the feed chutes into the furnace and floats on the surface of the liquid calcium carbide, forming deep piles around each electrode. The furnace runs under slight pressure to prevent air from being drawn into the furnace and igniting the flammable gases. The gases produced in the furnace exit primarily through a vent system to a wet scrubber, a device that removes pollutants from gas through contact with liquid. Some of the gas exits into the second floor of the furnace building through the gaps between the electrode sheaths and the holes that the electrodes pass through in the furnace cover. In addition to monitoring electricity consumption, electrode consumption, FIGURE 3 Second floor of the furnace building and location of victims at the time of the incident Location of victims

CSB • Carbide Industries Case Study 6 Carbide Industries Case Study Board Voting Copy February 2013 and flowrates, workers look through the control room window to judge the process perfor­ mance by the appearance (volume, color, and motion) of the flames that the process gases create when they exit the furnace and auto-ignite on contact with the room air. Cooling wa­ ter exits the hollow furnace cover sections and returns to a trough before being recirculated. Molten calcium carbide exits the EAF at about 3800°F through the drain holes in the sidewall of the furnace. The operator uses a motorized train system to move a deep tray on wheels, called a chill mold, to a hole position and an electric arc device to tap a drain hole through the solidified calcium carbide and other materials that plug the hole in the side of the furnace. The molten calcium carbide inside the furnace then drains from the tap hole into the chill mold. After filling multiple chill molds, the calcium carbide in that section of the furnace is drained, and the flow from the tap hole slows significantly. Operators then plug the hole with a mixture similar to mud and clay and move to tap the next location. Downstream units on- site dump the chill molds, grind and screen the calcium carbide, and package the product. The calcium carbide remains in the molds until it cools to about 500°F. U.S. Chemical Safety Board (CSB) investigators interviewed Carbide Industries personnel regarding difficulties in operating the process. In addition to incidents of cooling water leak­ ing from the furnace cover into the furnace, workers described instances of excess pressure developing in the furnace. They called these excess pressure incidents “blows” because the excess pressure would blow hot gases, and sometimes coke and lime feed material, out of the furnace onto the second floor of the building. These blows occurred in the furnace a few times per year. After a furnace blow, the operators would remove the ejected material and restart the furnace. The effects of water leaks varied from no noticeable impacts to potential effects such as bridging,5 which ultimately led to blows. The CSB could not find, nor did Carbide provide in response to requests, any documentation to indicate that these incidents or “blows” were investigated to determine their root cause. However, accident/incident investi­ gations were completed when injuries not specifically related to the furnace “blows” occurred. For example, one accident/incident investigation report provided by Carbide indicated that the tap hole “blew hot carbide” causing burns to an employee. 3.0 EMERGENCY PLANNING AND RESPONSE 3.1. COMMUNITY NOTIFICATION The Rubbertown community includes homes and industrial facilities in close proximity, and in 2002, the Rubbertown Community Awareness Line (RCALL) notification system was established to alert residents of all natural and manmade disasters. For incidents at the surrounding industrial facilities, a company representative was responsible for calling into the RCALL system to leave a message for the public. In addition, emergency responders sounded a siren that prompted residents to call the RCALL system to hear the message from the company representative. 5Bridging, also called arching, is the formation of a hollow cavity under a pile of solids that would otherwise flow downward under the force of gravity. The hollow cavity forms due to the cohesiveness of the particles, which prevents flow and can be formed due to the presence of water or insufficient mixing of fine particles in the feed.

CSB • Carbide Industries Case Study 7 Carbide Industries Case Study Board Voting Copy February 2013 3.2. TRAINING FOR EMERGENCY RESPONDERS Carbide Industries trained some of its workers to act as on-site emergency responders and to provide general awareness training for contractors. The company also trained the Lake Dreamland6 Fire Department for occasions where they might be needed to respond to incidents at the facility. The training materials included a slide presentation and a video that focus on furnace area hazards such as: • Large amounts of electrical energy • Extremely hot substances and surfaces • Potential for high concentrations of carbon monoxide (CO gas) • Calcium oxide (lime) In 2006, Carbide Industries and the Lake Dreamland Fire Department collaborated to produce the training video “Carbide Industries LLC Fire Control Video.” The video shows Lake Dreamland Firefighters responding to calcium carbide acetylene fires in a controlled situation with Carbide personnel observing. The video narrator describes the hazards and issues involved in extinguishing calcium carbide acetylene fires. However, neither the slide show nor the video provide detailed information on the hazards of contacting chemicals such as calcium carbide or calcium hydroxide on site. 4.0 INCIDENT DESCRIPTION At about 5:40 pm on Monday, March 21, 2011, the EAF at the Carbide Rubbertown facility violently overpressured, ejecting solid and powdered debris, hot gases, and molten calcium carbide at temperatures near 3800°F (2100°C). Witnesses reported an initial overpressure event from the furnace, a large explosion, and two to three more overpres­ sure events. The cloud of debris and smoke traveled high enough to obscure the five-story furnace building (Figure 4). The hot gases and debris blown from the furnace broke through the double-pane reinforced glass window of the control room, severely burning the two workers inside; they died within 24 hours from their injuries. Hot material also was ejected from the active tap hole on the mezzanine level. One worker was in an operating shack about 30 feet from the tap hole. The door to the shack was ajar, and he crouched to the floor, seeking shelter from the hot gases and dust that engulfed him. He received a minor burn to the back of his neck, but did not seek medical treatment. Another worker was walking away from the furnace when the explosion knocked him to the ground and the hot gases and debris engulfed him. He was taken to a maintenance area, where he was given oxygen and his vital signs monitored. He was later taken to the hospital for observation and subsequently released. 4.1. EMERGENCY RESPONSE Carbide Industries Safety, Health and Environmental (SH&E) Manager and members of the Carbide emergency response team helped evacuate the two workers from the control room, provided oxygen, and monitored vital signs. 6The Lake Dreamland Fire District, located in southwestern Jefferson County, includes residential and commercial areas in addition to industrial facilities.

CSB • Carbide Industries Case Study 8 Carbide Industries Case Study Board Voting Copy February 2013 Incident command was established about two minutes after the event occurred. An Assistant Fire Chief of the Lake Dreamland Fire Department was driving by at the time of the incident and immediately responded by assuming the role of Incident Commander (IC) and activating response based on National Incident Management System (NIMS)7,8 protocols.9 Because of concerns of possible product contamination and the unknown conditions of the immediate location of the incident, the incident commander established a staging area about one-half mile upwind from the facility and a command post at the front gate and called ambulances to the staging area. The first ambulance was dispatched at 5:40 pm with two more dispatched shortly thereafter and arrived on scene within 15 minutes. Carbide personnel and Lake Dreamland Firefighters transported the injured employees to the main gate where they met emergency medical technicians (EMTs). The fire department decontaminated the injured employees with water while the Carbide emergency response team and a fire department paramedic provided oxygen and monitored vital signs. One victim went into cardiac arrest, and the paramedic began performing CPR on him. About 40 minutes after the initial incident, off-site EMS began transporting victims to the hospital. These victims arrived at the hospital about 12 minutes later, and succumbed to their injuries in less than 24 hours. A third ambulance transported the injured worker who had been knocked to the ground and injured by the blast. 5.0 ANALYSIS 5.1. PHYSICAL CAUSE OF THE INCIDENT The CSB was unable to determine the exact cause of the March 21 incident, but several plausible scenarios were developed through a review of plant records, interviews with em­ ployees, and reconstruction based on known characteristics of the calcium carbide process. FIGURE 4 (LEFT) Cloud of debris and smoke obscures the five- story furnace building (Photo courtesy Lake Dreamland FD) 7The Department of Homeland Security established the National Incident Management System as a uniform, scalable template to enable governments, nongovernmental organizations (NGOs), and the private sector to work together to prevent, protect against, respond to, recover from, and mitigate the effects of incidents. 8The community notification system in effect on the day of the incident was the Rubbertown Community Action Line (RCALL) system. Carbide personnel were focused on the victim rescue efforts and no one left information on the RCALL line for residents in the surrounding community. Because RCALL was the information conduit, the community had no updates on the incident for 90 minutes following the explosion. 9Lake Dreamland Fire Department’s jurisdiction includes 17 industrial and chemical facilities, and the incident commander reported being familiar with all of them through previous response efforts at those facilities. Lake Dreamland, Pleasure Ridge, and Dixie Suburban Fire Departments all responded to the incident. FIGURE 5 (RIGHT) Second floor of the EAF building after the explosion

CSB • Carbide Industries Case Study 9 Carbide Industries Case Study Board Voting Copy February 2013 Examination of the underside of the furnace cover revealed that much of the refractory lining was worn and identified holes where cooling water had leaked into the furnace. Figure 6 is a diagram of the furnace cover showing recent recurring water leaks in water cooling zones. The CSB considered several possible mechanisms that led to the tragic incident. Leaks begin due to thinning of the refractory lining, fouling,10 and the accumulation of solids inside the hollow chamber where water flows. Because the fouling insulates the metal on the under­ side of the furnace cover from the cooling water, the high temperature of the furnace softens the metal and the metal sags under its own weight (Figure 7). With continued exposure to the furnace temperatures, the sagging bulge cracks open, which led to the formation of a leak (Figures 7 and 8). Another possible cause of leaks is the sudden eruption of hot liquid from the furnace, which the operators call a boil-up. Repeated boil-ups of hot material from the furnace can cause a water leak by contacting the underside of the furnace cover, eroding its ceramic lining, and eventually melting a hole in the metal furnace cover causing a water leak. The presence of electric current requires that the furnace be shut down for workers to climb onto the furnace cover and repair water leaks. Carbide personnel described how they repair small holes by adding a mixture of oats and boiler solder, a commercially available powder used to repair leaks in steam boilers, to the cooling water. The cooling water flow pushes this mate­ rial to the leak, and as the water evaporates at the leak point, the oats and boiler solder form a plug. Carbide repairs larger leaks by welding metal plates on the inside of the hollow cavity through which the water flows to patch the hole; while this method prevents water from leaking 10Fouling is the accumulation of unwanted material on solid surfaces and decreases function. The fouling material can consist of either living organisms (biofouling) or a non-living substance (inorganic or organic). Fouling usually occurs on a surface of a component, system or plant performing a defined and useful function, and the fouling process impedes or interferes with this function. FIGURE 6 Diagram of the furnace cover showing areas of recent recurring water leaks

CSB • Carbide Industries Case Study 10 Carbide Industries Case Study Board Voting Copy February 2013 into the furnace, it leaves a lower layer of uncooled metal hanging beneath the now patched furnace cover. Maintenance records obtained by the CSB indicated 26 work orders to repair furnace cover water leaks in the four months prior to the March 2011 incident. As early as 1965, a publication by an EAF expert, G.W. Healy describes a similar sequence of overpressure events in calcium carbide furnaces and notes that fine particles in the feed material can possibly cause arching, even in the absence of water, and that insufficient mixing of the feed can cause the liquid to overheat. Healy also calculated that the temperature required to start an undesirable side reaction between calcium carbide and calcium oxide could be reached in as little as one minute after the feed arches. His calculations recognized that the reaction between calcium carbide and calcium oxide generates gas two and a half times as fast as the normal calcium carbide-forming reaction. Independent analysis performed for the CSB indicated that, based on the operating data from Carbide, operating conditions on the day of the incident would have generated sufficient energy to emit hot materials from inside the furnace. 5.2. NORMALIZATION OF DEVIANCE 5.2.1. Carbide Industries The Carbide Industries facility has operated for over 30 years, and had a history of low con­ sequence incidents in the furnace. The CSB interviews with operators indicated that smaller overpressure incidents (“blows”) occurred in the furnace for the last 20 years. In 1991 a large overpressure incident blew in the window to the control room; Carbide replaced the window glass with reinforced glass, which was damaged by a similar incident in 2004. After the 2004 incident, Carbide replaced the single pane reinforced glass with double pane reinforced glass, which was blown in by the March 2011 incident and which directly contributed to the fatal thermal injuries. Despite these previous incidents, Carbide’s response to the previous incidents did not sufficiently address the hazard nor prevent the events from escalating. The CSB requested investigation reports for the 1991 and 2004 incidents and engineering analyses for the modifications to the window, but Carbide was unable to provide any analyses, meeting summaries, or other documentation. Without a proper investigation of the incident, Carbide could not address the root causes to prevent future incidents, nor could the company perform a detailed hazard analysis that could have identified other potential incident scenarios. By failing to analyze these incidents further, Carbide did not identify and address the potential for even higher consequence incidents. Such an analysis would have likely identified the need to relocate the control room and install video cameras to monitor furnace operations. This would eliminate the need for a window and reduce personnel exposure to heat and overpressures produced by a furnace blow. FIGURE 7 (LEFT) Crack in furnace cover formed due to fouling FIGURE 8 (RIGHT) Cooling water leak in furnace cover with ceramic lining worn away

CSB • Carbide Industries Case Study 11 Carbide Industries Case Study Board Voting Copy February 2013 Furthermore, because Carbide did not thoroughly determine the root causes of the blows and eliminate them, the occurrence became normalized in the day-to-day operations of the facility, including a blow which occurred earlier during a shift on the day of the incident. This deficient approach to managing a process is termed by Diane Vaughn as, “normalization of deviance,” and is defined as the gradual shift in what is regarded as normal after repeated exposures to “deviant behavior.” In this instance, the behavior was a tolerance to what should have been abnormal events (the blows). The result was a new normal, in which a boom occurring in the furnace was routine. The CSB interviews verified that furnace blows were considered normal, as was revealed in the following information obtained during an interview with a Carbide employee: About 5:00 o’clock … we heard the – heard the furnace – you know – do a little booming – you know. And I didn’t think much – much of it, just the sound of it and stuff – you know. It – it sounded normal when it does it. And then, it was just a little while after that, it went off again, and it was – it wasn’t normal. Past Carbide incident investigations indicate that injuries occurred due to handling raw materi­ als, tapping holes, and blowing out lines at the furnace. These incidents speak to the hazards associated with the process of producing calcium carbide and further emphasize the need for additional analysis to determine the root causes. Normalization of deviance played a role in other major accidents investigated by the CSB such as the explosion at the BP refinery in Texas City, TX; the Imperial Sugar dust explosion in Port Wentworth, GA; and the fatal phosgene leak at the DuPont plant in Belle, WV. In spite of past warnings from alarms, near-misses, or lower severity incidents, each of these companies failed to control a hazard, and a high severity incident occurred later. 5.3. CODES AND STANDARDS 5.3.1. NFPA 86 Standard for Ovens and Furnaces The stated mission of the National Fire Protection Association (NFPA) is to reduce the worldwide burden of fire and other hazards on the quality of life by providing and advocat­ ing consensus codes and standards, research, training, and education. NFPA 86, Standard for Ovens and Furnaces, an industry consensus standard, applies to facilities with ovens and furnaces. The majority of the standard applies to new or significantly modified con­ struction, when the authority having jurisdiction adopts the standard into state or local codes, such as building codes and fire prevention codes. According to Section 3.3.25.3 of NFPA 86, Standard for Ovens and Furnaces (2011 ed.) a Class A furnace is, “An oven or furnace that has heat utilization equipment wherein there is a poten­ tial explosion or fire hazard that could be occasioned by the presence of flammable volatiles or combustible materials processed or heated in the furnace.” A Class B furnace is defined in the same standard as, “An oven or furnace that has heat utilization equipment wherein there are no flammable volatiles or combustible materials being heated.” While most EAFs are used for melting metals, and therefore are considered Class B furnaces, some products such as calcium carbide and ferrosilicon are produced in EAF processes that contain flammable gases and low oxygen atmospheres. The furnace involved in the March 21 incident is considered by definition a Class A furnace because it collects and vents flammable gases in a low oxygen environment that are a by- product of the chemical reactions that produce calcium carbide. Because NFPA 86 is silent on coverage for EAFs operating as Class A furnaces, there are no operational requirements

CSB • Carbide Industries Case Study 12 Carbide Industries Case Study Board Voting Copy February 2013 specifically directed to Class A EAFs for provisions such as safety devices, interlocks, and safe distances to occupied work areas. The NFPA 86 Section 11.7.1 for Class A furnaces includes specific requirements for operating “Low Oxygen Atmosphere Class A Ovens with Solvent Recovery.” The requirements contain specifications to ensure safe operation by urging: • Oven design that accommodates safe operating procedures (avoiding flammable atmospheres, purging with inert gas before start-up, shutdown procedures to avoid the flammable region of the solvent, and emergency shutdown procedures); • Oven construction and location that minimizes the exposure of people to possible injury from fire, explosion and hazardous materials, as found in the General Chapter, Chapter 5, Section 5.1.1.1 and 5.1.3; • Inert gas generation and storage, including compliance with ASME standard B31.3, and Section 11.7.8; • Continuous oxygen monitoring and control by inert gas addition as found in Section 11.7.2. 5.3.2. KENTUCKY STANDARDS OF SAFETY Kentucky Statute Section 227.300 created rules and regulations known as the “Standards of Safety,” which established requirements for design and construction of various facilities, including facilities with Class A furnaces. The State Fire Marshal is considered the authority having jurisdiction to enforce the standards, including approving new construction permits and conducting inspections. When Carbide Industries installed the EAF in 1968, adherence to NFPA 86 (1950 ed.) was required by the Kentucky Standards of Safety.11 The 1950 NFPA 86 definition of the Class A ovens and furnaces was similar to the definition in the current (2011) edition, but included an exclusion based on temperature, which the 1982 version eliminated. 5.4. FACILITY SITING In 1968, Carbide Industries installed the furnace 12 feet from the control room that served as a workstation for one employee continuously for each shift. As a result of the 2011 explosion, two employees in the control room at the time of the incident died from injuries sustained in the blast. Their injuries are attributed to their proximity to the furnace, and by the blast and thermal heat transfer when the incident occurred. The state fire prevention code, the Kentucky Standards of Safety (Section 4.5.4), required conformance to NFPA 86 at the time of furnace rebuild in 1982. The 2011 edition of NFPA 86, Standard for Ovens and Furnaces, lists the following requirements in Chapter 5, “Location and Construction”: Furnaces and related equipment shall be located so as to protect personnel and buildings from fire or explosion hazards. However, NFPA 86 does not provide specific requirements on determining the distances between occupied areas and processes capable of producing a fire, explosion or an overpressure event within the same building or enclosure. The CSB has noted the issue of siting hazardous processes near occupied areas in several of its investigations, including BP in Texas City, TX; Veolia Environmental Services in Carrollton, OH; First Chemical Corporation in Pascagoula, MS; and Sterigenics, Inc. in 11Kentucky Statute Section 227.300 established rules and regulations known as the “Standards of Safety.” The 1955 version, in effect at the time of the 1968 Carbide furnace construction, required conformance to the 1950 edition of NFPA 86, Standard for Class A Ovens and Furnaces.

CSB • Carbide Industries Case Study 13 Carbide Industries Case Study Board Voting Copy February 2013 Ontario, CA. In addition to the CSB, the American Petroleum Institute (API) and the Center for Chemical Process Safety (CCPS) have provided guidance for the proper siting of buildings near process units. NFPA codes, such as NFPA 30 and adopted building and fire codes, include considerations for location and construction of occupied areas near processes but do not give specified distances or a quantitative process for determining how far a control room, labo­ ratory, lunch area, or office should be located from a furnace, vessel, or chemical process with the potential for a fire or explosion. Little guidance exists in the public domain for the location of occupied areas within the same building or enclosure as a chemical process with deflagration or explosion potential. 5.5. REGULATORY OVERSIGHT 5.5.1. U.S. Occupational Safety and Health Administration (OSHA) The Process Safety Management Standard, 29 CFR 1910.119 (PSM), is an OSHA-enforceable regulation for processes that contain highly hazardous materials or significant quantities of flammables. The intent of PSM, as stated in the standard, is for “preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals. These releases may result in toxic, fire or explosion hazards.” PSM applies to processes using or producing any of the 137 listed toxic chemicals at or above threshold quantities and processes with flammable liquids or gases onsite in quantities of 10,000 pounds or more in one location. The EAF process at Carbide Industries did not contain chemicals in large enough quantity to be regulated by OSHA PSM. However, if applied to the Carbide Industries process, elements of PSM such as incident investigation, mechanical integrity, and training would have required prac­ tices and procedures that could have prevented or lessened the consequences of the explosion. Carbide Industries had scheduled to replace the furnace cover in May 2011, but the new cover was incomplete at the time of the explosion—it had been fabricated and was waiting for refractory lining. More important is that Carbide failed to implement a mechanical integrity program as would have been required under the PSM standard if it had applied; thus the company lacked a program to ensure the timely replacement of the furnace cover prior to failure. If Carbide had adhered to the standard, it could have systematically tracked the maintenance of the cover over time and predicted its safe service life. The Kentucky Labor Cabinet proposed penalties of $72,800.00 as a result of this incident. The Carbide facility received two citations—one willful, and one serious. As this case study went to publication, all penalties were being contested by Carbide, and the citations were unresolved. The citations alleged that employees worked in close proximity to electric arc furnaces that were not operated with a robust inspection and preventive maintenance program exposing them to serious or fatal injuries. The citations alleged that Carbide had knowledge of the hazards of furnace explosions and fires as documented in the plant’s 1998 Emergency Response Plan. The facility was also cited because emergency response team members allegedly had not received training with respect to response procedures for furnace explosions. 6.0 KEY FINDINGS During the investigation of the events at the Carbide Industries facility, the CSB found:

1. The force of an explosion in the EAF broke the reinforced control room window, killing

two workers.

1. Previous furnace overpressure events had broken the control room window but had not

caused fatalities.

CSB • Carbide Industries Case Study 14 Carbide Industries Case Study Board Voting Copy February 2013

1. Despite past incidents, neither the previous owners nor Carbide Industries identified that

the control room should be relocated and cameras installed to better protect workers while they remotely monitored the furnace.

1. Carbide Industries issued 26 work orders for leak repair for water leaks on the furnace cover

in the five months prior to the March 2011 incident, but continued operating the furnace despite the hazard from ongoing water leaks.

1. The company did not adequately address past explosive incidents, which normalized blows as

routine events.

1. Carbide Industries had a new furnace cover built, which was waiting for refractory lining at

the time of the incident.

1. The company did not have a process safety management program in place that required the

elimination of overpressure incidents in the furnace.

1. NFPA 86 does not specify safety requirements for electric arc furnaces operating as Class A

furnaces such as the one at Carbide Industries. 7.0 RECOMMENDATIONS 7.1. NATIONAL FIRE PROTECTION ASSOCIATION 2011-5-I-KY-R1 Establish a committee to evaluate and develop a standard that defines the safety requirements for electric arc furnaces operated with flamma­ ble materials and low oxygen atmospheres. At a minimum, establish requirements that electric arc furnaces containing flammables have:

• Adequate safety instrumentation and controls to prevent explosions and overpressure events;

• Mechanical integrity and inspection programs;

• A documented siting analysis to ensure that control rooms and other occupied areas are adequately protected. 7.2. CARBIDE INDUSTRIES 2011-5-I-KY-R2 Modify the design and procedures for the electric arc furnace and re­ lated structures including the control room to comply with the NFPA standard developed per R1 of this case study. 2011-5-I-KY-R3 Implement a mechanical integrity program for the electric arc furnace and cover, including preventive maintenance based on periodic inspec­ tions, and timely replacement of the furnace cover. At a minimum, the program should include factors such as leak detection and repair and refractory lining wear.

CSB • Carbide Industries Case Study 15 Carbide Industries Case Study Board Voting Copy February 2013 8.0 REFERENCES American Petroleum Institute (API). Standard RP-752: Management of Hazards Associated With Location of Process Plant Buildings. Publication 752. Washington DC, 2009. API. Standard RP-753: Management of Hazards Associated With Location of Process Plant Portable Buildings. Publication 753, Washington, DC, 2007. Babrauskas, V. Ignition Handbook, 1st ed. Issaquah, WA, Fire Science Publishers. 2003. Center for Chemical Process Safety (CCPS). Guidelines for Facility Siting and Layout, American Institute of Chemical Engineers, Center for Chemical Process Safety NY, NY. 2003. Healy, G. W. Why a Carbide Furnace Erupts: Proceedings of Electric Furnace Conference. 1965; pp 62-67. Kirk-Othmer Encyclopedia of Chemical Technology. 1st ed. John Wiley and Sons, Inc. NY: 1994; pp 228-242. Lewis, Sr., R. J., Sax’s Dangerous Properties of Industrial Materials. 9th ed. Van Nostrand Reinhold NY, 1996; p. 37. Pohanish, R. P., Sittig’s Handbook of Toxic and Hazardous Chemicals and Carcinogens. 4th ed. Noyes Publications / William Andrew Publishing. Norwich, NY. 2002. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, Catalyst Systems Inc. Reactive Chemical Explosion, in Gnadenhutten, OH, No. 2003-03-C-OH. 2003. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, DuPont Corporation Toxic Chemical Releases in Belle, WV. No. 2010-6-I-WV. 2010. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, BP America Refinery Explosion, in Texas City, TX; No. 2005-04-I-TX. 2005. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, First Chemical Corporation Reactive Chemical Explosion, in Pascagoula, MS; No. 2003-01-I-MS. 2003. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, Imperial Sugar Company Dust Explosion and Fire, in Port Wentworth, GA; No. 2008-05-I-GA. 2008. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, Sterigenics Ethylene Oxide Explosion in Ontario, CA; No. 2004-11-I-CA. 2004. U.S. Chemical Safety and Hazard Investigation Board Investigation Report, Veolia Environmental Services Flammable Vapor Explosion and Fire in West Carrollton, OH; No. 2009-10-I-OH. 2009. Urben, P.G., and Pitt, M.J. Bretherick’s Handbook of Reactive Chemical Hazards. 6th ed. Oxford: Butterworth Heinemann. 1999; p 254. Vaughn, D., Risky Technology, Culture, and Deviance at NASA. 1st ed. Chicago, IL University of Chicago Press. 1996.

CSB • Carbide Industries Case Study 16 Carbide Industries Case Study Board Voting Copy February 2013 APPENDIX A. SIMPLIFIED DIAGRAM OF CALCIUM CARBIDE PROCESS

CSB • Carbide Industries Case Study 17 Carbide Industries Case Study Board Voting Copy February 2013 CSB Investigation Reports are formal, detailed reports on significant chemical accidents and include key findings, root causes, and safety recommendations. CSB Hazard Investigations are broader studies of significant chemical hazards. CSB Safety Bulletins are short, general-interest publications that provide new or noteworthy information on preventing chemical accidents. CSB Case Studies are short reports on specific accidents and include a discus­ sion of relevant prevention practices. All reports may contain include safety recommendations when appropriate. CSB Investigation Digests are plain-language summaries of Investigation Reports. The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency whose mission is to ensure the safety of workers, the public, and the environment by investigating and preventing chemical incidents. The CSB is a scientific investigative orga­ nization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for determining the root and contributing causes of accidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety. No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident may be admitted as evidence or used in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G). The CSB makes public its actions and decisions through investigation re­ ports, summary reports, safety bulletins, safety recommendations, case studies, incident digests, special technical publications, and statistical reviews. More information about the CSB is available at www.csb.gov. CSB publications can be downloaded at www.csb.gov or obtained by contacting: U.S. Chemical Safety and Hazard Investigation Board Office of Congressional, Public, and Board Affairs 2175 K Street NW, Suite 400 Washington, DC 20037-1848 (202) 261-7600

FD06463 ｜ 2013_美国_donaldson-enterprises-inc-fatal-fireworks-disassembly-explosion-and-fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Analysis of Pyrotechnic Components Results of chemical, thermal and mechanical insult testing of components of four fireworks samples 31 December 2013 Amy J. R. Bauer

1

Table of Contents Table of Figures ............................................................................................................................................. 3 List of Acronyms ............................................................................................................................................ 4 1.0 Executive Summary ................................................................................................................................. 5 2.0 Introduction ............................................................................................................................................ 5 3.0 Approach and Objectives ........................................................................................................................ 7 4.0 Experimental Methods and Procedures ................................................................................................. 9 4.1 Handling Precautions .......................................................................................................................... 9 4.2 Sample Preparation .......................................................................................................................... 10 4.2.1 Sample Preparation for Mechanical Insult Testing .................................................................... 10 4.2.2 Sample Preparation for Chemical and Thermal Testing ............................................................ 11 4.3 Brief Test Descriptions of All Tests .................................................................................................... 12 4.3.1 Mechanical Insult Test – Impact. ............................................................................................... 12 4.3.2 Mechanical insult test – Friction ................................................................................................ 13 4.3.3 Electrostatic Discharge test........................................................................................................ 14 4.3.4 Scanning Electron Microscope – Energy Dispersive X-ray (SEM-EDAX) Analysis ....................... 14 4.3.5 Inductively Coupled Plasma Atomic Emissions Spectroscopic (ICP-AES) Analysis ..................... 15 4.3.6 Fourier Transform Infrared Spectroscopy (FTIR) Analysis ......................................................... 15 4.3.6 Differential Scanning Calorimetry (DSC) Analysis ...................................................................... 15 5.0 Data, Observations and Results ............................................................................................................ 16 5.1 O-Triple-C Results.............................................................................................................................. 22 5.1.1 Sample O-Triple-C, Sub-sample A .............................................................................................. 22 5.1.2 Sample O-Triple-C, Sub-sample ................................................................................................. 25 5.1.3 O-Triple-C, Sub-sample C ........................................................................................................... 27 5.2 Sky Festival Samples.......................................................................................................................... 28 5.2.1. Sky Festival Sub-sample A ......................................................................................................... 28 5.2.2. Sky Festival Sub-sample B ......................................................................................................... 30 5.2.3. Sky Festival Sub-sample C ......................................................................................................... 31 5.2.4. Sky Festival Sub-sample D ......................................................................................................... 33 5.2.5. Sky Festival Sub-sample E ......................................................................................................... 35 5.2.6. Sky Festival Sub-sample F ......................................................................................................... 36 5.2.7. Sky Festival Sub-sample G ......................................................................................................... 38

2

1. 3 Halawa Samples ................................................................................................................................ 39
2. 3.1. Halawa Sample A ...................................................................................................................... 39
3. 3.2. Halawa Sample B ....................................................................................................................... 40
4. 3.3. Halawa Sample C ....................................................................................................................... 42
5. 4 Krazy Kids Samples ............................................................................................................................ 43
6. 4.1. Krazy Kids Sample A .................................................................................................................. 43
7. 4.2. Krazy Kids Sample B .................................................................................................................. 45
8. 4.3. Krazy Kids Sample C .................................................................................................................. 47
9. 5 Standards .......................................................................................................................................... 48
10. 5.1. Potassium chlorate and aluminum homemade flash powder .................................................. 48
11. 5.2. Potassium perchlorate and aluminum homemade flash powder ............................................ 49
12. 5.3. Potassium perchlorate/chlorate mixed and aluminum homemade flash powder................... 50
13. 0 Discussion ............................................................................................................................................. 52
14. 1 Results Categorization ...................................................................................................................... 52
15. 1.1 Lift Charges................................................................................................................................. 53
16. 1.2 Flash Powder .............................................................................................................................. 53
17. 1.3 Stars/Comets .............................................................................................................................. 53
18. 1.4 Clay ............................................................................................................................................. 54
19. 2 Particle Size Effects ........................................................................................................................... 54
20. 3 Differential Scanning Calorimetry Observations............................................................................... 54
21. 0 Conclusion ............................................................................................................................................. 55
22. 0 References ............................................................................................................................................ 55
23. 0 Appendix .............................................................................................................................................. 55
24. 0 Acknowledgments ............................................................................................................................... 56

3

Table of Figures Figure 1 Components of a typical aerial firework1 ....................................................................................... 6 Figure 2. Photo of initial cutting procedure. ............................................................................................... 10 Figure 3. Initial processing of the larger samples; chopping with a razor blade. ....................................... 11 Figure 4. Completely processed powder. ................................................................................................... 11 Figure 5. MBOM Impact Testing Machine .................................................................................................. 12 Figure 6. ABL Friction Testing Machine ...................................................................................................... 13 Figure 7. ABL Friction Machine, showing a positive result ........................................................................ 13 Figure 8. Detail of electrode assembly of ESD testing machine. ................................................................ 14 Figure 9. ABL Electrostatic Discharge Testing Machine. ............................................................................. 14 Figure 10. Enlarged photograph of O-Triple-C, A........................................................................................ 22 Figure 11. 40x SEM image of O-Triple-C, A. ................................................................................................ 22 Figure 12. SEM and EDAX data of O-Triple-C, A. ......................................................................................... 23 Figure 13. DSC results for O-Triple-C, A, showing no thermal decomposition below 500 degrees C. ....... 24 Figure 14. Enlarged photo of O-Triple-C, B. ................................................................................................ 25 Figure 15. SEM and EDAX data, O-Triple-C B. ............................................................................................. 25 Figure 16. DSC data from O-Triple-C, B. Sample decomposition onset at 365 degrees C. ....................... 26 Figure 17. Enlarged photo of O-Triple-C, C. ................................................................................................ 27 Figure 18. SEM and EDAX data for O-Triple-C, C......................................................................................... 27 Figure 19. Enlarged photo of Sky Festival A sample. .................................................................................. 29 Figure 20. SEM and EDAX data of Sky Festival A. ....................................................................................... 29 Figure 21. Enlarged photo of Sky Festival B. .............................................................................................. 30 Figure 22. SEM and EDAX data for Sky Festival B sample. .......................................................................... 31 Figure 23. Enlargement of photo of Sky Festival Sub-sample C. ................................................................ 32 Figure 24. The EDAX analysis on this slide is of the whole image.............................................................. 32 Figure 25. Enlarged photo of Sky Festival sample D. .................................................................................. 33 Figure 26. SEM and EDAX data on Sky Festival D, note the predominance of the P peak. ........................ 34 Figure 27. SEM and EDAX data on Sky Festival D. ....................................................................................... 34 Figure 28. Enlarged photo of Sky Festival E ................................................................................................ 35 Figure 29. SEM image of Sky Festival E, scale on bottom ........................................................................... 35 Figure 30. EDAX results of Sky Festival E, S and K dominating ................................................................... 36 Figure 31. Enlarged photo of Sky Festival F ............................................................................................... 37 Figure 32. SEM image of Sky Festival F, showing texture of black particle ............................................... 37 Figure 33. EDAX results of Sky Festival F, showing a clay-like composition .............................................. 37 Figure 34. Photo of Sky Festival G sample ................................................................................................. 38 Figure 35. SEM image of Sky Festival G sample ......................................................................................... 38 Figure 36. EDAX results of Sky Festival G sample ...................................................................................... 38 Figure 37. Enlarged photo of Halawa sample A. ........................................................................................ 39 Figure 38. SEM and EDAX data for Halawa sample A. ................................................................................ 40 Figure 39. Enlarged photo of Halawa sample B .......................................................................................... 41 Figure 40. SEM and EDAX data for Halawa sample B ................................................................................. 41

4

Figure 41. Enlarged photo of Halawa C sample. ........................................................................................ 42 Figure 42. SEM and EDAX data for Halawa C sample. ................................................................................ 43 Figure 43. Enlarged photo of Krazy Kids sample A. .................................................................................... 44 Figure 44. SEM and EDAX data of Krazy Kids sample A. ............................................................................. 44 Figure 45. Enlarged photo of Krazy Kids sample B. ..................................................................................... 45 Figure 46. SEM and EDAX data of white regions of Krazy Kids sample B, Ba peaks dominating. .............. 46 Figure 47. Enlarged photo of Krazy Kids sample C. ..................................................................................... 47 Figure 48. SEM and EDAX data of Krazy Kids sample C............................................................................... 47 Figure 49. KClO3 crystal in homemade flash powder ................................................................................. 49 Figure 50. EDAX results for KClO3 flash powder......................................................................................... 49 Figure 51. SEM of KClO4 and Al flash powder standard ............................................................................. 50 Figure 52. EDAX results from KClO4 and Al flash powder .......................................................................... 50 Figure 53. SEM image of KP&KC + Al homemade flash powder ................................................................ 51 Figure 54. EDAX analysis of the mixed flash powder ................................................................................. 51 Figure 55. DSC run of mixed flash powder, showing that chlorate can be detected in a DSC endotherm 52 List of Acronyms ABL - Alleghany Ballistics Laboratory ATF - Bureau of Alcohol, Tobacco, Firearms and Explosives ATF-FTIR - Attenuated total reflectance Fourier-transform infrared spectrometry ARA - Applied Research Associates CSB - U.S. Chemical Safety Board DI - deionized water DSC - differential scanning calorimetry EDS - electrostatic discharge EDAX - energy dispersive X-ray spectrometry FTIR - Fourier-transform infrared spectrometry IC - ion chromatography ICP-AES - inductively coupled plasma atomic emission spectrometry LC/MS - liquid chromatography mass spectrometry MBOM - modified Bureau of Mines ml - milliliter MIL-STD - military standard NA - not applicable NCOI - non-conflict of interest PETN - pentaerythritol tetranitrate PPE - personal protective equipment RDX - cyclotrimethylenetrinitramine SEM - scanning electron microscopy TIL- threshold of initiation level

5

1. 0 Executive Summary

This document describes testing of the physical and chemical characteristics of component samples of four fireworks collected and provided by the CSB to determine whether these samples had chemical or physical characteristics that would potentially increase their susceptibility to unintentional or accidental initiation. This document contains a narrative that discusses the merged results of an extensive set of mechanical insult, thermal sensitivity and chemical composition testing. All the raw analytical data is present in the attached Appendices. Although no formal testing protocol exists to determine sensitivity of pyrotechnic materials, all analyses were performed with well-characterized, industry standard testing. Sensitivity to mechanical insult was evaluated through use of calibrated instruments and military-approved methods to establish response to impact, friction and electrostatic discharge. These mechanical insult tests showed that although some of the materials were indeed very sensitive, that appreciable similarity exists between samples of material having the same purpose within the firework (the components are discussed in the next section). It should also be noted at the outset that these materials are expected to be quite sensitive, and that our results are in agreement with the basic nature of all fireworks materials, especially flash powder mixtures. Elemental composition analysis was performed on the dry samples with scanning electron microscopy and x-ray elemental analysis (SEM-EDAX) and after partial dissolution in water, by inductively-coupled plasma spectrometry (ICP-AES). Anions were analyzed with liquid chromatography/mass spectrometry (LC/MS) (perchlorate) and ion chromatography (IC) (anions, in this case, chlorate and nitrate), and also by attenuated total reflectance Fourier- transform infrared spectrometry (ATF-FTIR) analyses. The results of the chemical analysis demonstrated no definitive unusual chemistry in any of the samples, and that the composition of different samples having the same purpose within the fireworks was relatively conserved. The likelihood of adverse reaction when exposed to high temperatures was evaluated with differential scanning calorimetry. None of the samples exhibited sensitivity to temperatures less than 350 °C. Key findings of the testing:  The presence of sensitizing chlorates was not established.  Thermal and testing regarding susceptibility to mechanical insult indicate that the flash powder type components are in general quite sensitive relative to standard reference material (military explosives and lab-generated flash powder), but that this sensitivity was expected by virtue of the chemical composition of the materials. 2.0 Introduction Fireworks are a class of explosive pyrotechnic devices used for aesthetic, cultural, and religious purposes. They are most commonly used as part of a fireworks display. Fireworks produce four primary effects: noise, light, smoke and floating materials (confetti, for example). They are designed to burn with flames and sparks of many colors. Displays are popular throughout the world and are the focal point of many cultural and religious celebrations, including Independence Day in the U.S.

6

Fireworks are generally classified as to where they perform, either as a ground or aerial firework. In the latter case they may provide their own propulsion (typically called a skyrocket) or be shot into the air by a mortar (aerial shell). The most common feature of fireworks is a paper or cardboard tube or casing filled with the combustible material, often pyrotechnic stars. The aerial shell is the backbone of today's commercial aerial display. A smaller version for consumer use is known as the festival ball in the United States. There are also ground fireworks; while less popular than aerial fireworks, they can produce various shapes like rotating circles, stars and 3D globes. Fireworks are composed of several types of materials that vary with their purpose in the overall device. Figure 1 shows the energetic material components of typical commercially-produced aerial display fireworks, consisting of an ignition fuse, lifting charge, time fuse, bursting charge and pyrotechnic “stars” or “comets.” These components, shown in Figure 1, each contain specific types of materials that enable that component to perform its established purpose.1

Figure 1 Components of a typical aerial firework1 Although there are numerous variations of actual fireworks construction, the lift and burst charges are propellants usually very similar to black powder (i.e. gun powder), comprised of mixtures of potassium nitrate (KNO3), charcoal and sulfur. Upon ignition, these materials generate the large quantities of gas needed to propel the rest of the device into the air. Flash powders, so named because of their initial use in early flash photography, are often used in fireworks to create a loud report and have compositions consisting of mixtures of potassium perchlorate, aluminum and magnesium powders and sulfur. The flash powder itself is often in the form of a very fine, silvery-colored powder, and in this powder form will react very quickly, especially when contained, to generate intense noises and brief, bright flash effects. The stars or comets are formed by blending variations of flash powder with binders so that they can be pressed or extruded into consolidated pellets. In pellet form, the stars or comets will burn relatively slowly to produce the aerial showers so popular in fireworks displays. Based on the literature, there are many types of stars and comets. A couple of well-represented recipes from Skylighter.com are shown here. The first type consists of a perchlorate/nitrate/gum rubber base which contains potassium perchlorate, a mix of finely divided aluminum and magnesium

7

powders, very fine charcoal powder, potassium nitrate, red gum, and powdered sulfur. In another major type, potassium perchlorate is substituted with potassium nitrate and blended with the fine charcoal powder, sulfur, dextrin, and flaked aluminum.2 Metal salts are added to create the colors associated with the fireworks. For example, strontium nitrate yields a bright red color, sodium nitrate is yellow and copper salts yield both blue and green, depending upon the anion associated with the copper. These components are assembled into a device as shown in Figure 1, and launched from a mortar to begin the processes that result in the display. As previously described, the lift charge propels the shell out of the mortar tube, and the time fuse ignites the burst charge at the correct altitude. The burst charge than creates the explosion of the shell and the release and ignition of the stars, causing the pattern that appears in the sky. One primary aim of the work was to test all the materials for the presence of chlorates, which used to be a common ingredient in flash powder mixtures. These compounds are recognized by the community to yield even more sensitive flash powder mixes than the more commonly used perchlorates. Chlorates are more dangerous in several ways. Firstly, they are known to be more inherently sensitive to mechanical insult. In addition, chlorates can react with sulfuric acid to form a highly reactive solution of chloric acid and potassium sulfate: 2 KClO3 + H2SO4 → 2 HClO3 + K2SO4 The products of the above reaction are sufficiently reactive that they will spontaneously ignite if combustible material (sugar, paper, etc.) is present.3 This is a particular problem when sulfur is present in the mixture, as almost all sulfur components will yield small amounts of sulfuric acid with time and exposure to humidity. The presence of chlorate compounds in fireworks is no longer common, but testing for this anion is important because of the additional danger in handling they represent. The results discussed in this report all indicate that the material submitted to us for testing is within the range of ordinary pyrotechnics recipes that can be discovered in literature and on the internet. This is not to say that the materials are not sensitive; they certainly are, as shown by the testing related to exposure to calibrated impact, frictional forces and electrostatic discharge. Quotations in the text describe that this degree of sensitivity is to be expected. 3.0 Approach and Objectives ARA received samples of 4 fireworks, each separated into subsamples by pyrotechnic component. These samples were chosen for analysis to determine if they were more sensitive to initiation than expected. This testing includes susceptibility to reaction by exposure to impact, frictional forces and exposure to electrostatic discharge, as well as chemical and thermal analysis. Altogether, 16 sampled materials were subjected to testing, along with five standard materials. Descriptions of all these materials are presented in Table 1.

8

Table 1. Samples and standards analyzed during this program Name of sample Physical Description Label markings Amount delivered O-Triple C #A fine gray sparkly powder

1. 157 g

O-Triple C #B small black pebbles

1. 294 g

O-Triple C #C round silver/gray balls about 0.25” in diameter

1. 241 g

Sky Festival #A large gray pellets w/ black & brown crumbs “sm” 2.473 g Sky Festival #B large gray pellets w/ black & brown crumbs

1. 482 g

Sky Festival #C fine gray sparkly powder “Lrg” 4.679 g Sky Festival #D fine gray sparkly powder “lrg tube” 5.063 g Sky Festival #E black particles, about 0 .5 mm across with copper colored dust “Large tube lift charge” 1.818 g Sky Festival #F copper-colored powder with black particles “Small ‘comet’ tube Lift Charge” 0.714 g Sky Festival #G grayish coarse powder “Small ‘Comet’ Tube Lift Charge Sample” 1.858 g Halawa #A small black pebbles “Lift charge” 6.680 g Halawa #B fine gray powder, with larger chunks

1. 656 g

Halawa #C fine gray powder

1. 706 g

Krazy Kids #A small black pebbles “Lift, 2 charges BSP” 8.178 g Krazy Kids #B 1 cm x 0.75 cm size silver/gray "pellets"

1. 248 g

Krazy Kids #C 1 cm x 0.75 cm size silver/gray "pellets"

1. 293 g

KP/Al standard fine gray powder

KC/Al standard fine gray powder

KP/KC/Al standard fine gray powder

RDX standard fine white powder

PETN standard fine white powder

The standards used in this work were of two distinct types. PETN (pentaerythritol tetranitrate) and RDX (cyclotrimethylenetrinitramine) are military grade explosives used to calibrate the instruments used to establish sensitivity to mechanical insult. It is a standard practice to compare the behavior of unfamiliar materials with those of PETN; PETN is considered to be either a relatively insensitive primary explosive, or one of the most sensitive secondary explosives, and is

9

thusly used to give a boundary between those two classes. PETN may be detonated by striking with a hammer on a hard steel surface, and is generally considered the least sensitive explosive with which this may be done. RDX is only slightly less sensitive to mechanical insult. By comparing the sensitivity of an explosive against the behavior of PETN, therefore, it may be determined whether or not the material can be classified as a primary or secondary explosive. This determination will impact the ability to safely handle the material, and give considerations on how this would be done. The second type of standards serves several purposes. The three homemade flash powders are stoichiometric mixtures of finely divided aluminum powder (Al) and potassium chlorate (Al + KClO3), potassium perchlorate (Al + KClO4) or a mix of the two (Al + KClO3 and KClO4). These materials are used to assure good detection of these important chemicals, which may be found in all the flash powder types of samples, to understand endothermic behavior in the thermal testing (as the oxidizers melt), to demonstrate the susceptibility to mechanical insult of sulfur-free flash powders, and to provide at least one sample that would analyze positively for chlorate. Other calibration verification standards were used in the chemical analysis and thermal testing. If those samples fell within appropriate limits, they are not discussed in this report. The primary objective of this work is to establish the relative sensitivity of each sub-sample as related to the chemistry of the material. Both the sensitivity to mechanical insult and the chemical composition were carefully evaluated, in comparison with the behavior of the standard materials and common recipes for amateur pyrotechnics production. Taken together, the measurements indicate that the samples provided are within the range of ordinary published formulations. 4.0 Experimental Methods and Procedures 4.1 Handling Precautions Fireworks components are known to be extremely sensitive to mechanical insult (i.e. impact, friction and electrostatic discharge). Flash powder, a mixture of finely divided metal powder and oxidizer, in particular is recognized by authors in the amateur pyrotechnics community, as being particularly dangerous: “The first rule of caution is to note that compositions are extremely hazardous when subjected to heat, friction, sparks, static electricity or a sharp blow. Mixing or manufacturing flash compositions is possibly more dangerous than attempting to manufacture black powder, improvised plastic or other nitrate type explosives.”4 Because flash powders are a component found in nearly every pyrotechnic device, all the samples were treated as a significant hazard. In spite of the limited amounts of material delivered as samples, an accident with any one of them could have resulted in disfiguring injuries for those involved. Therefore, we used all the normal safety precautions exercised in an explosives laboratory. The technicians performing the testing wore fireproof lab coats, laboratory glasses, nitrile gloves and grounding heel straps during the performance of this work. Additionally, when doing the sample processing, they were also wearing wrist grounding straps. When running the actual mechanical insult test series, they used hearing protection, in this case earplugs. No persons

10

uninvolved with the testing were permitted in the lab when the samples were not locked in storage. Normal safety precautions of banning spark-producing devices and cell phones from the lab were observed. The samples were stored in an ATF-approved explosives magazine. Chains of custody (included in the delivered materials) were utilized every time the samples were removed from the magazine, such that every usage of the material was documented. NCOI forms were signed by all technicians who took part in the program. A standard operating procedure including safety protocol and PPE requirements was written from the military standards and the samples were processed and tested for mechanical insult sensitivity at the ARA office in Panama City, FL. 4.2 Sample Preparation This section describes the preparation of all samples for each specific test. 4.2.1 Sample Preparation for Mechanical Insult Testing The samples with larger particle size distributions needed to be safely processed into a powder form prior to testing. The military standard specifies that the tests be performed on a particular sample quantity not possible on the large chunks present in some of the sub-samples. For the specimens not delivered as a fine powder, a processing technique was developed. To eliminate possible friction hazard, the process was performed on a plastic sheet over a paper towel, rather than on a metallic surface. This treatment provided an extra cushion that kept the applied impact to a minimum. Large sample particles were first cut into smaller pieces with a razor blade, and the resulting chunks crushed into a powder form with a non-sparking metal spatula. This process is shown in Figure 2 and the results in Figure 3. To keep the direct forces to a minimum, a small rolling action over the chunks generated a powder of more appropriate particle sizes. On every sample, this technique worked very well in producing a coarse powder (Figure 4). These powders, along with those samples that had arrived as powdered material, were submitted to the testing.

Figure 2. Photo of initial cutting procedure.

11

Figure 3. Initial processing of the larger samples; chopping with a razor blade.

Figure 4. Completely processed powder. 4.2.2 Sample Preparation for Chemical and Thermal Testing In preparations for SEM and EDAX, a small amount of the powder was removed from the container via spatula. Carbon tape was then lightly pressed against the powder, tapping off any loose power, leaving a thin monolayer of powder stuck to the tape. The carbon tape with the sample on it was then placed directly on the sample platform in the SEM. The carbon tape is composed largely of carbon and oxygen, and its use negates any information about these elements in the EDAX elemental composition data. The other reported elements come from calibrated signal channels. In the analysis of a single-phase, pure element, sample at 15 kV the smallest possible interaction volume is about 1 μm in diameter. Elements with atomic number higher than that of Na are well analyzed with this technique, and have detection limits in the range of 1/104 to 1/105. Actual interaction regions are slightly more diffuse with the real samples, which are heterogeneous in both composition and morphology. Regions where the electron beam is incident on the sample range from the very tightest focus (used to identify the composition of individual particles) to full-image (used to establish overall sample composition). Regions marked in some SEM images in the results section indicate the location of the interaction region, but not necessarily the size of the spot probed with EDAX. EDAX results are normally viewed as semi-quantitative, and are used in this work to establish presence or absence of certain materials, rather than the absolute concentration of them. Sample preparation for the ICP analysis consisted of 1 mg of sample being put into 10 ml of deionized water (DI). 1 ml of this slurry was then added to 10 ml of HNO3. Note that no sample

12

digestion was performed, as this data was viewed largely as a simple confirmation of EDAX results. In these results, scandium (Sc) was used as an internal standard, and several of the channels were not calibrated. This latter fact explains the presence of positive readings in the uranium channels, rather than the actual presence of uranium. Analysis of anions was performed by chromatographic techniques: Samples for the anion analyses were put into deionized water (DI), 0.25 g into 25 ml. Analyses were performed on filtered solution. No preservatives were used. IR spectroscopy was also used to analyze anions. This analysis was done with wetted samples largely to eliminate possible safety problems of squeezing the sample material between the sample holder and the pressure clamp. The sample holder allows the attenuated total reflectance to be measured through the sample. ATR-FTIR samples were generated by putting 1 mg of each sample into 10 ml of DI. This solution was thoroughly shaken and allowed to settle. 9 ml of liquid was removed, leaving behind a dense slurry of sample and DI. A disposable pipette was used to add 1 drop of the slurry to the diamond surface in the center of the metal sample holder on the FTIR and the IR tip was lowered onto the holder, pinning a thin layer of slurry between the tip and the holder. Blank backgrounds were collected prior to sample analyses. Thermal stability testing: Sample sizes of approximately 1 mg were directly put into sample pans and hermetically sealed before analysis in the differential scanning calorimeter (DSC). 4.3 Brief Test Descriptions of All Tests 4.3.1 Mechanical Insult Test – Impact. To establish sample sensitivities to initiation by impact, the Modified Bureau of Mines (MBOM) Impact test machine was used, shown in Figure

1. MBOM Impact test machine creates high impact forces on energetic materials. The machine’s

impacting mass (2.5 kg) is dropped from programmable heights (up to 100 cm) before striking a sample situated on a steel anvil. The combined effects of impact and confinement ignite the material at heights that provide energy above the reactive threshold. Reaction of the material is determined by observation and/or examination of the sample residue. In order to determine the relative impact sensitivity, the “Bruceton” or “Stair-step” method of initiation threshold identification is performed. A 25 ± 5 mg sample of material is placed on 1 inch square 180 grit sandpaper in a small pile under the striker. The drop weight of 2.5 kg is set at the determined height. While observing the sample area, the drop weight is released via Figure 5. MBOM Impact Testing Machine

13

electromagnet. After recording the reaction as a “go” or “no go”, the drop weight is removed from the striker and the anvil and striker faces are cleaned. A “go” is determined by the operators observing smoke, flash, flame, sparks, or a loud report to differentiate it from regular machine noise. As per the “Bruceton” testing method, when a “go” is recorded, the operator sets the next test height to the next lower log interval. If a “no go” is recorded, the operator sets the next test height to the next higher log interval. The operator repeats this process 25 times. These numbers yield a H50%, or height where the sample will react 50% of the time. Calibration standards of RDX and PETN were run in this machine, and results well within the accepted limits of the military method were obtained. Testing was conducted in accordance with MIL- STD 1751A Method 1021.5 4.3.2 Mechanical insult test – Friction ARA used an Allegheny Ballistics Laboratory (ABL) Friction Test Apparatus for conducting these tests, shown in Figure 6. The apparatus delivers a sliding friction input into a small sample (nominally 10 mg) of test material. The primary parts of the test apparatus are a friction wheel that applies a load to the sample and a friction plate upon which the test sample is placed. An explosive sample is positioned on the friction plate; the friction wheel is lowered onto the sample at a pre-determined load, such that the sample is pinched between the plate and the wheel. The pendulum weight is raised to the 8 feet per second height and locked in place by an electromagnetic brake. When ready to test, the brake is released, and the pendulum weight impacts the friction plate causing it to slide rearwards. Initiation of the sample is determined by production of an audible pop, flame or smoke, as shown in Figure 7. This test simulates potential initiation of explosive that may be caught in mechanical parts, which could apply a pinch or sliding load on the explosive. Solids, liquids, or powders can be tested with this apparatus. Testing was conducted in accordance with MIL-STD 1751A Method 1021.5

Figure 6. ABL Friction Testing Machine Figure 7. ABL Friction Machine, showing a positive result

14

1. 3.3 Electrostatic Discharge test

Total energy deposited in a human ESD event is reported to be tens of millijoules (mJ).6 Giving a safety factor of approximately 10x, any material initiated with discharges under 0.25 joules is normally classified as hazardous. Most explosives and pyrotechnics are hazardous to an electrostatically generated spark. A quantitative measure of sensitivity to spark is determined by the electrostatic discharge (ESD) test. The ABL ESD machine operates by generating an electric charge in a bank of capacitors across an electron gap at 5,000 VDC (Figure 8. Detail of electrode assembly of ESD testing machine.). The electric charge is discharged through a sample of the test material held on a grounded Teflon plate. The discharge point is a needle of specific design that is lowered toward the sample. As the distance between needle and the grounded plate narrows, the electricity arcs from the needle to the grounded plate. The electric arc passes through the test sample resulting in a reaction or non-reaction of the material. The whole apparatus is shown in Figure 9. The goal of the ESD test is to find the threshold of initiation level (TIL). This is the highest level of electrical energy (joules) at which 20 consecutive “no gos” are recorded. The operator places approximately 10 mgs of the test material on the platform. The appropriate capacitor is selected by the turn of two knobs and is charged to 5000 Vdc. The operator fires the machine and observes. If results are negative, i.e., no reaction, the test is continued until 20 consecutive “no-gos” are reported. If the test sample has a positive result, i.e., flash, spark, burn, odor, or noise other than instrument noise, then testing should be performed at the next lower level until 20 consecutive “no-gos” are reported. The final number is reported as number of “no gos” out of 20 at the tested power level; for example “0/20 “No Gos” @ 0.19 Joules.” 4.3.4 Scanning Electron Microscope – Energy Dispersive X-ray (SEM-EDAX) Analysis SEM is a type of high-magnification imaging in which the sample is scanned with a focused beam of electrons. These electrons typically interact with the sample material on an atomic level, yielding information about the material’s morphology (in the case of the fireworks samples, particle size and heterogeneity). Detection is performed through observation of an image of secondary electrons emitted from the sample after having been excited by the input Needle Sample Figure 8. Detail of electrode assembly of ESD testing machine. Figure 9. ABL Electrostatic Discharge Testing Machine.

15

beam. These images are not natively colored, because no light of visible wavelength is involved. The images are typically shown in black and white. When excited by the electron beam, X-rays characteristic of the atomic composition of the sample are also emitted, which forms the basis of the X-ray elemental analysis. The instrument was run under a relatively high-pressure and humidity environment, enabling imaging of materials sensitive to electrostatic discharge to be performed. 4.3.5 Inductively Coupled Plasma Atomic Emissions Spectroscopic (ICP-AES) Analysis

ICP-AES, also called ICP-optical emission spectrometry (ICP-OES) is a type of emission spectroscopy that uses a high-temperature plasma to excite atoms in a sample to highly excited states or to create ions. These excited or ionized atoms emit light at frequencies characteristic of their elemental composition. Detection of this light is used to determine the trace elements present in a sample. For this analysis, samples are typically dissolved or digested into an acidic aqueous matrix that is fed into the plasma torch through a nebulizer that sprays the matrix into the torch as an aerosol. Results are generated by comparing the amount of light produced at each of a number of wavelengths to those generated from a known amount of that same element from a standard. 4.3.6 Fourier Transform Infrared Spectroscopy (FTIR) Analysis In FTIR analysis, the absorbence of light in the IR region by the sample is measured. This type of instrument uses a broadband infrared source coupled with wavelength deconvolution with a Michelson interferometer to determine which molecular features are present from the sample. In the fireworks, FTIR is principally used for identification of anions in powdered salts, like the nitrate in potassium nitrate (NO3 -). The output spectra often has units of % transmission vs wavenumber. In this case, because of the sensitivity of the samples toward impact and friction, they were presented to this instrument dissolved in water. 4.3.6 Differential Scanning Calorimetry (DSC) Analysis Differential scanning calorimetry is a thermoanalytical technique in which the difference in the amount of heat required to increase the temperature of a sample and reference is measured as a function of temperature. Both the sample and reference are maintained at nearly the same temperature throughout the experiment. Generally, the temperature program for a DSC analysis is designed such that the sample holder temperature increases linearly as a function of time. The basic principle underlying this technique is that when the sample undergoes a physical transformation such as phase transitions, more or less heat will need to flow to it than the reference to maintain both at the same temperature. Whether less or more heat must flow to the sample depends on whether the process is exothermic or endothermic. Although the endothermic events result in remarkable data in this work, chiefly we are interested in exothermic behavior indicative of decomposition.

16

1. 0 Data, Observations and Results

In this section, the results of the chemical composition testing will be presented sample by sample, and then compared with each sample’s sensitivity to initiation by mechanical insult. A small percentage of the data, mostly SEM images, are presented here to guide the reader. The section is organized into two tables of overall results. Table 2 is organized by sample name. Table 3 presents the same information broken down by sample type. Following the tables, each individual material is addressed. The results section for each material is structured into a description of the sample, both visual and SEM. The EDAX results are related to the SEM image, and here the overall composition is given, rather than the composition of individual particles, unless they are exceptional. Many other SEM-EDAX results are available on each material in the Appendix. Because of the heterogeneity of the powders, the EDAX should be considered a semi-quantitative measurement, a sort of overall average of the material seen in the SEM image. As previously mentioned, although oxygen and carbon values are given in the EDAX results, these numbers are probably not useful, because of the contribution of these signals from the tape used to present the sample to the testing. ICP data given in this section is largely a “presence or absence” measurement, a correlative study looking for agreement with the EDAX work. The samples were not digested prior to the testing, and therefore materials not soluble in water will appear only weakly, or not at all. However, in every case, good agreement was established between the elemental composition data from the EDAX and the ICP. FTIR and chromatographic analysis used to determine anions were also a correlative pair. In this case, the primary measurement was IC (for chlorate and nitrate) and LCMS (for perchlorate). These should also be considered semi-quantitative results, because of the small amount of material used to create the slurry for testing (FTIR) and the filtered solution used in the chromatographic analyses. It is unknown if sample heterogeneity can be adequately represented by samples as small as those we received The chief result from thermal testing is the decomposition temperature of small quantities of sample material. The testing takes the sample from room temperature to 500 °C at a rate of 20 °C per minute. Interesting data is also obtained from lower temperature endotherms where chemical components of the sample undergo crystal rearrangement or melt. These exact temperatures vary with sample particle size, and also the presence of the other components in the sample matrix. DSC thermograms are shown on only a few of the individual sample descriptions, in order to save space. All the others are available in the Appendix. The mechanical insult testing yields a value for each type of possible initiation; impact, friction and electrostatic discharge. These values are used to compare the behavior of the sample with those of the standards, in order to classify the samples as more (or less) dangerous to handle than military explosives that are often considered the least reactive primary explosives (PETN and RDX). A non-detect (ND) is reported if the sample is not sensitive to that particular stimulus. Results ordered by sample name are given in Table 2. Results that have been presented by type of material are shown in Table 3.

17

Table 2. Compiled Results of Testing by Sample Name Name of sample Physical Description Impact (H50%) Friction (F50%) ESD (joules) Major cations Major anions Sulfur %/wt Thermal decomp onset Units

cm psi 0/20 at

°C O-Triple C #A fine gray sparkly powder 62 9 0.063 Mg, Al, K, Ti

ClO4

1. 5

500

O-Triple C #B small black pebbles ND ND 0.25 K