The Safety Case Regulatory Regime 21st Century Major Accident Prevention

1. The Safety Case Regulatory Regime 21st Century Major Accident Prevention The CSB Chevron Investigation Rafael Moure-Eraso, Ph.D., Chairperson CAER-CCCRichmond, CA DEcember 16, 2013

2. Chevron Refinery Richmond CaliforniaAugust 6th, 2012-- Pipe Rupture and Fire • Pipe rupture in Crude Unit • Formation of Hydrocarbon Vapor Cloud • Nineteen (19) Chevron Fire fighters and Operators engulfed • Vapor cloud ignited – One mile high plume • >15,000 residents sought medical attention

6. Refinery Safety is a National Problem • The CSB has noted a considerable trend of significant and deadly incidents at petroleum refineries over the last decade. • In 2012 alone, the CSB tracked 125 significant incidents at US petroleum refineries. Seventeen of these took place in California. “The U.S. refining sector has more than three times the rate of property losses of refineries overseas.”Swiss Rae, 2011

7. Refinery Safety CSB Focus (I) The CSB has investigated many refinery incidents: • Tosco Avon Refinery (1999, 4 fatalities) • Motiva Enterprises Refinery (2002) • BP Texas City (2005, 15 fatalities) • Valero Refinery (2005, 2 fatalities; 2007)

8. Refinery Safety CSB Focus (II) The CSB has investigated many refinery incidents • Silver Eagle Refinery (2009) • CITGO Refinery (2009) • Tesoro Anacortes Refinery (2010, 7 fatalities) • Chevron Richmond (2012)

9. Deepwater Horizon Incident Investigation The safety case regime is a more effective approach for preventing major accidents at U.S. refineries than current U.S. regulatory systems.

10. Chevron First Report Chevron 1 (Interim)

11. Chevron First Report (April 2013) Key Findings • Sulfidation caused extreme pipe thinning • Lack of damage mechanism hazard review • Internal Chevron Recommendations not implemented • Insufficient application of inherent safety

12. Recommendations Chevron First Report California State Legislature to California refineries to: • Perform damage mechanism hazard reviews; • Identify and report leading and lagging process safety indicators; • Document recognized methodologies, rationale, and conclusions used to verify that safeguards in place indeed control hazards; • ALARP--Document their inherently safer systems analysis and the hierarchy of controls with the goal of reducing risks to As Low As Reasonably Practicable

13. Chevron First Report Conclusions The CSB committed to investigate additional issues: • Emergency Planning and Reporting; • Emergency Response; • Safety Culture; and • Regulatory Oversight of Petroleum Refineries • Chevron Regulatory Report Draft—Chevron 2 • Examines the safety case regime as an alternative regulatory model for accident prevention for California petroleum refineries.

14. Process of Releasing Chevron 2 Regulatory Report • Preliminary press conference today (12/16/13) at Hilton Hotel Concord, CA to open Chevron 2 -- Regulatory Report for public discussion • Comments can be submitted to: chevroncomments@CSB.gov until 1/5/2014 • Release of Regulatory Report Chevron 2 at Public meeting after CSB Board vote: January 15th, 2014 in Richmond CA—See Federal Register Announcement for Public Meeting

15. Chevron Regulatory Report Chevron 2 Staff Draft Report for Public Comment

16. Chevron 2 Regulatory Report Findings (I) Chevron internal recommendations not implemented • 100% component inspections • Inherent Safety PHA Safeguards not evaluated • Chevron experts had limited participation • Deficiencies were not citable by the regulator No requirement to reduce risks to as low as reasonably practicable, or ALARP. No requirement to implement inherent safety

17. Chevron 2 Regulatory Report Findings (II) Regulators lack the technical staff with the necessary • skills • knowledge, and • industry experience These are essential to provide sufficient direct oversight of petroleum refineries in California.

18. Regulatory Report Key Findings The CSB has made a number of process safety-related recommendations to OSHA and the EPA. • None of these recommendations have been implemented • There have been no significant changes made to the PSM and RMP regulations. • The CSB believes: • Tweaking PSM regulations only incorporates learnings from most recent accidents • A new approach: The safety case regime is proposed as an effective alternative for prevention

19. Regulatory Report Key Findings Available data from Norway and the United Kingdom (UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime.

20. Chevron 2 RegulatoryConclusions The existing regulatory regimes for onshore petroleum refineries in the US and California: • PSM is primarily activity-based (12 elements) rather than goal-based ( only 2 PHA-Mechanical Integrity) • Do not require risk reduction to ALARP • Do not ensure continuous improvement • Are static, unable to adapt to innovation and advances • Place the burden on the regulator to verify compliance • Do not effectively incorporate lessons learned from major accidents • Do not effectively use indicators to reduce risk to ALARP

21. PSM Gaps and Weaknesses

22. PSM Gaps and Weaknesses The existing U.S. and California Process Safety Regimes: • Do not require the use or implementation of inherently safer systems • Do not effectively involve the workforce in hazard analyses • Do not grant the regulator the authority to accept or reject a company’s hazard analysis, risk assessment, or proposed safeguards; and • Lack a sufficient number of staff with the technical skills, knowledge, and industry experience to provide direct safety oversight of petroleum refineries.

23. Process Safety Gaps Led to Chevron Refinery Incident • Damage mechanism hazard reviews were not performed • Internal Chevron recommendations were not implemented • Safeguard effectiveness was not rigorously evaluated • Inherently safer design was not effectively employed • MOCs and incident investigations did not control recognized hazards

24. CSB’s Proposed PSM Regulatory System Conclusions Tweaking current OSHA-PSM and EPA-RMP regulations only incorporates learnings from most recent accidents. This is performed at a very slow rate, if at all. The safety case regime proposed in the report requires continuous risk reduction and is a more effective approach to prevent major incidents in petroleum refineries.

25. SAFETY CASE REGULATORY REGIME

26. DefinitionAndrew Hopkins: Lessons from Esso Gas Plant Explosion, ANU 2013 “A verifiable case which the operator of a hazardous facility makes to a regulator, setting how safety is to be managed. Includes: • Identification of Hazards and controls • Operator has to convince regulator that its strategy for managing safety is satisfactory • Operators are expected to adopt best practices on risk management”

27. Key Features of an Effective Safety Case Regime • Duty Holder Safety Responsibility, including a Written Case for Safety • Continuous Risk Reduction to ALARP • Adaptability and Continuous Improvement • Active Workforce Participation • Process Safety Indicators that Drive Performance • Regulatory Assessment, Verification, and Intervention; and an • Independent, Competent, Well-Funded Regulator

29. Duty Holder Safety Responsibility and Written Case for Safety • Written safety case report that describes how hazards and risk are reduced to ALARP • Must demonstrate how inherently safer design concepts have been applied • Should be an evergreen document • Regulators must “accept” the safety case report • Submitted to the regulator at least every five years

30. Continuous Risk Reduction to ALARP • Duty on owners or operators of covered facilities to reduce risks to ALARP or equivalent • CCPS definition of ALARP: • “a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.” Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., 2009; p 46. • Regulator may accept good practice as ALARP or may require additional measures be taken to further reduce risk.

31. Adaptability and Continuous Improvement • Allows regulator to require facilities to go above and beyond current good practices and standards to achieve ALARP without requiring rulemaking • Baker Panel definition of “continuous improvement” • Controls for process hazards • Engineering to mitigate process hazards • Going beyond compliance

32. Active Workforce Participation • Key element of process safety and effective major accident prevention. • CCPS: Workforce involvement provides management a mechanism for tapping into valuable expertise. Guidelines for Risk Based Process Safety; March 2007. • The PSM standard requires consultation with employees • The safety case goes further • Provides for the election of safety representatives and creation of safety committees. • Uses tripartite approach with active and equal participation from the regulator, industry, and labor.

33. Process Safety Indicators OSHA recordable injury and illness rates (lagging indicators) are not sufficient. The Safety Case allows regulators to • Collect and analyze a variety of indicator data(leading and some lagging) • Release the data and trends to the public • Use the data to target inspections • Drive continuous improvement

34. Leading Process Safety IndicatorsSome Examples • Frequency of challenges to protection barriers • Number of non-planned “Shutdowns” • Number of Releases of hydrocarbons to atmosphere • Number and duration of use of equipment “out of service” or temporary equipment • Number of applications on processes of recommendations from Safety Function

35. In a “Safety Case Regime”: Regulatory Assessment, Verification, and Intervention Regulators review and accept safety case reports Great emphasis is placed on inherent safety The regulator may reject the safety case report and require additional measures to further reduce risks Preventative inspections and audits are conducted to intervene before high-risk activities commence. • This rarely happens in the US.

36. “Well-Funded and Qualified Regulator” in Safety Case Regimes The role of the safety regulator: • Provide independent assurance that companies have identified risks and put appropriate measures in place to control the risks • Retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess safety case reports and performance • Can interact as equals with company management

37. U.S. Uses Safety Case Approach in Other Industries The safety case regulatory approach is not foreign to the US: The US already has the safety case approach: • Nuclear Regulatory Commission (NRC) • NASA

38. Safety Case Implementation Issues • Has to link with current safety system already in place • Conform with target structure, high quality hazard identification and risk assessment, there has to be high linkage to actual safety systems installed or to normal operations • Currently not enough Professionals Understanding of how to use • Need to train practitioners on how to communicate to workforce and contractors—UK, Norway, Australia resolving this issue by training • Avoid to reduce Safety Case as only a mean for regulatory compliance • Should be “live” document , enforce requirement of keeping up with state of the art (ALARP). Cannot be paperwork exercise, cannot be ignored by line management and by facility managers/ supervisors • Continuous updating • Change is continuous – managed through MOC processes on the facility, safety case can continuously updated to approach state of the art

39. Conclusion:Draft recommendation for the state of California to implement a safety case approach for refineries • Reduction of Risk to As Low as Reasonable Practicable (ALARP) • System is adaptable for continuous improvement without rulemaking • Meaningful Workforce Participation in Tri-partite model: workers, regulator, company. • Development and Implementation of Key Process Safety Indicators • Competent regulator assessment of hazard reviews • Independent, Competent, Well-Funded Regulator

40. Questions?