PRELIMINARY DETERMINATION Phillips 66 San Francisco ... · PRELIMINARY DETERMINATION . Phillips 66...

PRELIMINARY DETERMINATION

Phillips 66 San Francisco Refinery 1380 San Pablo Avenue

Rodeo, CA 94572

Site ID: 771363

July 3, 2017

HAZARDOUS MATERIALS PROGRAMS

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

ccheung

Typewritten Text

AdPD_Phillips 66_010417.doc July 3, 2017

Preliminary Determination

Contra Costa Hazardous Materials Programs (CCHMP) conducted a comprehensive audit/inspection of the programs, policies, and procedures developed by Phillips 66 San Francisco Refinery (Phillips 66) in Rodeo, California to satisfy the requirements of the California Accidental Release Prevention (CalARP) Program (Title 19 California Code of Regulations Division 2 Chapter 4.5) and Chapter 450-8 of County Ordinance 98-48 (ISO), as amended. The audit took place from January 4, 2017 through February 2, 2017. CCHMP is required to conduct an audit/inspection of Phillips 66 per Sections 2775.2 and 2775.3 of the (CalARP) Program Regulations (Title 19 Division 2 Chapter 2.5 of the California Code of Regulations), and per Chapter 450-8 §8.018(f) of the ISO. CCHMP conducted the audit/inspection in accordance with the Audit Plan for the California Accidental Release Prevention (CalARP) Program & Industrial Safety Ordinance (ISO) Program Audit/Inspection developed for Phillips 66. This plan describes pre-audit, audit, and post-audit activities and is included in Attachment A. The completed questionnaires (e.g., “A11 – Process Safety Information”), including the basis for each recommended action item, are included as Attachment B. There may be questions receiving “R” answers that were not assigned an action. In these instances, a previous corrective action will address the identified deficiency. CCHMP also conducted interviews of approximately 9 (~5%) of operators, 3 (~6%) of maintenance, and approximately 20 “key personnel” (those employees with responsibility for developing and or implementing programs required by the CalARP Program and ISO regulations). CCHMP appreciates the cooperation from Phillips 66 management and personnel during the audit and interview process. The participants were open in their discussion and helpful in the audit process. During the field audits, employees and contractors all exhibited high safety awareness and generally are diligent in following company’s safety policies and procedures to create a safe work environment. CCHMP reviewed the management system at Phillips 66 responsible for overseeing the implementation of the CalARP/ISO Programs. The facility’s Health, Safety, and Environmental Management System (HSEMS) was found to be well developed and the various CalARP and ISO programs incorporated within its 15 elements. Senior refinery management was found to be engaged in overseeing the implementation of the various safety programs, including frequent meetings with element owners and in the review of metrics. Each element owner provides a report out to the site’s Safety Leadership Committee and provides a detailed review of their progress in meeting their stated goals and objectives, including improvements implemented from the previous year. CCHMP did not observe any program that appeared deficient based on a lack of management oversight or one that needed additional oversight. CCHMP identified 1 deficiency and 23 partial deficiencies in existing programs at the facility. The following program areas were found to have deficiencies: four within the Compliance Audit program element; three within the Safety Culture Assessment element; three within the Process Hazard Assessment element; two within the Management of Change element; two within the Management of Organizational Change element; and two within the Operating Procedure element. This audit report identifies the corrective actions generated to correct all of the deficiencies in Attachment C.

AdPD_Phillips 66_010417.doc July 3, 2017

CCHMP also generated 30 corrective actions to improve upon programs that already comply with the requirements of the CalARP Program Regulations and County Ordinance 98-48, as amended. These corrective actions begin with “consider” and are optional for Phillips 66 to incorporate (e.g., consider updating the Operating Procedure section of Safety Plan to correct the reference to the Operating Procedure Policy). This audit report identifies all of the suggestions to improve upon programs that already comply with the requirements of the CalARP Program Regulations and County Ordinance 98-48, as amended, in Attachment D. Upon completion of addressing the action items, Phillips 66 will provide CCHMP with a resolution status update. The status update does not need to include the actual copies of the proposed remedies (i.e. studies, updated policies, training documentation, etc.), but rather an overview of the actions taken by Phillips 66 to complete the action items and actual dates of completion. Audit Reporting Process Once CCHMP completes an audit, an Administrative Draft of the Preliminary Determination report is issued and the audited Stationary Source has 14 days to respond in writing to identify any technical or factual inaccuracies. If no written technical or factual inaccuracies are received, the Administrative Draft will then become the Preliminary Determination report. Once the Preliminary Determination has been issued, the Stationary Source has 90 days to respond in writing and provide proposed remedies and due dates to address the identified corrective actions. The Stationary Source can also identify which recommendations, if any, will be rejected in whole or in part. For those recommendations rejected, the Stationary Source shall explain the basis for the rejection and provide substitute revisions. Upon receipt, CCHMP reviews the proposed remedies, due dates, and any rejections proposed and will communicate any final revisions to the Stationary Source. Once CCHMP is in agreement, the Summary of Actions Items Table contained within Attachment C and the Summary of Consider Items Table contained within Attachment D are modified to include the proposed remedies, due dates, and other approved revisions. A 45-day public review process is planned after this time. As required by the County’s ISO, a public meeting must be held to allow review and comment on the issues found during the audit. After the conclusion of the public notice period and incorporation of any relevant public comments, this final document is considered to be the Final Determination.

ATTACHMENT A

Audit Plan for the California Accidental Release Prevention (CalARP) Program & Contra Costa County Industrial Safety Ordinance (ISO) Program

Audit/Inspection

Audit/Inspection Plan for the California Accidental Release Prevention (CalARP) Program

& Industrial Safety Ordinance (ISO) Program /

Richmond Industrial Safety Ordinance (RISO) Program

Prepared for:

Phillips 66 San Francisco Refinery 1380 San Pablo Avenue

Rodeo, CA 94572

Site ID: 771363

November 28, 2016

Prepared by:

HAZARDOUS MATERIALS PROGRAMS

CalARP/ISO/RISO Audit Plan November 28, 2016 1

I. INTRODUCTION This document describes the plan for conducting a comprehensive audit/inspection of the programs, policies, and procedures developed by Phillips 66 Refinery (Phillips 66) located in Rodeo, California, to satisfy the requirements of the California Accidental Release Prevention (CalARP) Program (Title 19 California Code of Regulations, Division 2 Chapter 4.5) and either Chapter 450-8 of County Ordinance 98-48, as amended, (hereafter referred to as ISO) or Chapter 6.43 of the City of Richmond Industrial Safety Ordinance 42-01, as amended, (hereafter referred to as RISO). A generic audit plan, including pre-audit/inspection, on-site audit/inspection, and post audit/inspection activities is included in Appendix A. This audit plan describes the pre-audit/inspection activities for the Phillips 66. II. ALLOCATE RESOURCES Accidental Release Prevention Engineers Michael Dossey, Habib Amin, Nicole Heath, Cho Nai Cheung, Miguel Rizo and Robert Long will conduct the audit/inspection. The audit team will conduct quality assurance/quality control (QA/QC) on the work plan and Written Preliminary and Written Final Determinations. The audit responsibilities will be distributed through the completion of the following questionnaires:

Questionnaire Program Level 1

Responsibility

• A11 – Process Safety Information 3 Cheung • A12 – Process Hazard Analysis 3 Dossey • A13 – Operating Procedures 3 Amin • A14 – Training 3 Amin • A15 – Mechanical Integrity 3 Heath • A16 – Management of Change 3 Heath • A17 – Pre-Startup Review 3 Heath • A18 – Compliance Audits 3 Cheung • A19 – Incident Investigation 3 Heath • A20 – Employee Participation 3 Heath • A21 – Contractors 3 Amin • A22 – Emergency Response Program 1, 2, 3 Cheung • A24 – Section A: Management System ISO/RISO Dossey • A25 – Section B: Latent Conditions ISO/RISO Amin • A26 – Section B: PHA's ISO/RISO Dossey/Long • A27 – Section B: Incident Investigation ISO/RISO Heath/Long • A28 – Section B: Procedures ISO/RISO Amin/Rizo • A29 – Section B: MOC for Organizational Changes ISO/RISO Heath/Rizo • A30 – Section B: Employee Participation ISO/RISO Heath • A31 – Section B: Training ISO/RISO Amin • A32 – Section C: Root Cause Analysis ISO/RISO Heath/Long • A33 – Section D: PHA/Action Items ISO/RISO Dossey/Long • A34 – Section D: Inherently Safer Systems ISO/RISO Dossey • A36 - Section F: Safety Culture ISO/RISO Amin/Rizo • S1 – Hot Work Permit 3 Cheung • S3 – Lockout / Tagout 3 Cheung

1 - Refers to what CalARP Program levels (1, 2, or 3) or whether ISO/RISO applies to the questionnaire


Contra Costa Hazardous Materials Programs (CCHMP) will require one meeting room to accommodate the audit team members (i.e., ideally the room would be equipped with a table and sufficient electrical outlets for laptop computers). CCHMP will also require two or more meeting rooms to accommodate simultaneous employee interviews on scheduled days. III. PURPOSE & SCOPE The primary purpose of this audit/inspection is to evaluate Phillips 66’s capability to effectively meet the requirements of the CalARP Program regulations and ISO/RISO, to verify the status of previous audit action items, and to identify potential regulatory deficiencies or areas where improvement is warranted. A secondary purpose of the audit is to ensure that the Risk Management Plan (RMP) and Safety Plan accurately describe the accidental release prevention programs and safety programs currently being implemented at Phillips 66. Finally, CCHMP may identify areas of the accidental release prevention program and safety program that may be improved based on generally accepted practices and guidelines. All non-mandatory action items will begin with “Consider…”. The physical scope of the Phillips 66 audit/inspection includes the following covered processes as identified in the SP:

- Butane Systems, flammables (Program 3) - Steam Power Plant Ammonia NOx Controls, aqueous ammonia (Program 3) - Coker (Unit 200), flammables and aqueous ammonia (both Program 3) - Gasoline Fractionation (Unit 215), flammables (Program 3) - Isomerization (Unit 228), flammables and aqueous ammonia (both Program 1) - MP 30 Complex (Units 229, 230, 231), flammables (Program 1) - Fuel Gas Center (Unit 233), flammables (Program 1) - Sulfur Complex (Units 235, 236, 238), hydrogen sulfide (Program 3) - Unicracker (Units 240), flammables, hydrogen sulfide, and aqueous ammonia (all

Program 3) - Reforming Unit (Unit 244), flammables (Program 3) - Heavy Hydrocracking Unit (Unit 246), flammables (Program 3) - Diesel Hydrotreater (Unit 250), flammables (Program 1) - Crude Unit (Unit 267), flammables (Program 3) - Marine Terminal Vapor Recovery System, flammables (ISO) - Hydrogen Plant (Unit 110), flammables (ISO) - Blending (Unit 76), flammables (ISO) - Refined Oil Shipping (Unit 80), flammables (ISO) - Wastewater Treatment (Unit 100), (ISO) - Unisar (Unit 248), flammables (ISO) - Flare Blowdown System, flammables (ISO) - Storage Tanks, flammables (ISO)

Additionally, every process at Phillips 66 is subject to ISO/RISO. CCHMP representatives must specify records and documents sampled from covered processes subject to the CalARP Program and covered processes subject to ISO/RISO (i.e., not all processes are subject to Program 3 requirements under the CalARP Program, but all processes are subject to Program 3 requirements under


ISO/RISO). The historical scope of this audit/inspection is from the effective date of the CalARP Program regulations, August 19, 1996, and either the ISO, January 15, 2000, or RISO, December 18, 2001, to January 4, 2017, the starting date of this audit/inspection. The regulatory scope of this audit/inspection includes the requirements included within the CalARP Program regulations (T19 CCR Division 2 Chapter 4.5) and either the ISO or RISO. The CalARP Program regulations also reference the following regulations: T8 CCR §3220 Emergency Action Plans T8 CCR §5192 Hazardous Waste Operations and Emergency Response T8 CCR §5189 Hot-Work Permits/Procedures T8 CCR §5156/5157/5158 Confined-Space Regulations T8 CCR §5194(g) MSDS Requirements under Hazard Communications T8 CCR §2320/3314 Lockout/Tagout T8 CCR §3329/6815/6816 Line Opening In addition to the preceding requirements, the following sources will be utilized in assessing compliance and formulating action items during the audit: • Contra Costa County CalARP Program Guidance Document • Contra Costa County Safety Program Guidance Document • Accidental Release Prevention Requirements: Risk Management Programs Under the Clean

Air Act, Sections 112(r)(7) Parts III and IV of 40 CFR Part 68 • Pre-amble Part III of 40 CFR Part 68 • CAA Section 112(r) Frequently Asked Questions • Sections 25531-25543.3 of the California Health and Safety Code • Pre-amble to the OSHA PSM standard, 29 CFR §1910.119 • Questions and Answers to the Cal/OSHA PSM standard, T8 CCR §5189 • OSHA Instruction CPL 2-2.45A CH-1 Program Quality Verification Checklist • OSHA 3132, Process Safety Management, 1994 (Compliance Audits) • OSHA 3133, Process Safety Management Guidelines for Compliance, 1994 (Compliance

Audits) • Guidelines for Auditing Process Safety Management Systems, Center for Chemical Process

Safety, AIChE, 1993 Acceptance criteria for the audit/inspection will be determined on a case-by-case basis. CCHMP will determine whether the deficiencies represent isolated incidents (in which individual deficiencies would be identified to correct) or trends (in which program deficiencies would be identified to correct). CCHMP may take photographs in the field as part of the facility audit records. IV. QUESTIONNAIRES Phillips 66 has nine Program 3 and four Program 1 covered processes under the CalARP Program regulations. All processes are subject to the requirements of ISO/RISO. As a result, questionnaires


associated with CalARP Program 3 and the ISO/RISO program will be completed (CalARP Program 3 and ISO/RISO questionnaires to be completed were identified in Section II of this Audit Plan and are included in Appendix B). The sampling size for the records will be determined on a case-by-case basis. CCHMP shall document the findings, including documents reviewed (see Appendix D) and records sampled, in the “Findings” column. The “Clarifications” column provides guidance to the auditors including suggested documents to review and interpretations from federal OSHA and federal EPA. CCHMP shall then provide the answer to the question in the “Answer” column. The following codes shall be applied: • Y Full compliance with all requirements of the question • N No compliance with the question’s requirements • P Partial compliance with the requirements • R An action item is listed elsewhere with cross reference • N/A The question is not applicable to the facility CCHMP shall develop a list of actions to resolve potential deficiencies in the risk management program or to resolve discrepancies between the risk management program and the RMP and Safety Program and the Safety Plan. These and other regulatory deficiencies are required to be addressed and will begin with “Ensure”. CCHMP may also develop a list of actions to improve a risk management program based on generally accepted practices or guidelines. These actions are non-mandatory and will begin with “Consider”. If no actions are developed, CCHMP shall enter “None”. V. EMPLOYEE & “KEY PERSONNEL” INTERVIEWS CCHMP shall meet with Phillips 66 personnel to review an organizational chart of employees and the existing shift schedule. CCHMP shall then identify approximately 1-5% of the employees to interview including personnel from operations, maintenance, and engineering. Employees shall also be notified that they may have union representation present, if they choose. Any employee not selected, but whom would like to be interviewed, will also be interviewed. Interviews will last approximately 30 minutes. CCHMP shall also meet with “key personnel” responsible for each CalARP Program and Safety Program requirement. The following “key personnel” were identified in Appendix C of the RMP: • Health, Safety & Environmental Manager – Management of Organizational Change • Health and Safety Superintendent – Safety and Risk Program Management, Incident

Investigation • Maintenance Superintendent – Maintenance Training and Mechanical Integrity including

Rotating Equipment • Bulk/Process Operations Superintendents – Operating Procedures and Safe Practices Procedures • Operations Training Coordinator – Operator Training • ME&I Superintendent – Mechanical Integrity including Fixed Equipment • Special Programs Coordinator – Compliance Audits, Employee Participation, Human Factors


and H&S Training • Process Engineering Supervisor – Process Safety Information • Field Safety & Emergency Response Superintendent – Hot Work/Safe Work Practices and

Contractors • PHA Coordinator – Process Hazard Analysis, Management of Change, Pre-Start-up Safety

Review, and Inherently Safer Systems • Emergency Response Coordinator – Emergency Response and Planning CCHMP will conduct procedural and/or P&ID walk-downs with qualified operators in the field during this audit. These walk-downs are anticipated to be in lieu of some or all of the sit down employee interviews and include an assessment of the relative accuracy of the written documents based on field observations and input from site personnel. Written notes of these walk-downs will be provided to Phillips 66 for their records. These walk-downs should be treated as personnel interviews and be without the presence of management and supervision. CCHMP will meet with local union representatives, as applicable, at the stationary source at the beginning of the audit/inspection. CCHMP will also meet with personnel to discuss the management system in place necessary to implement the CalARP Program and include a summary of this in the completed audit report. In addition CCHMP shall meet with a representative(s) from the Process Engineering/ Capital Improvements/Long Range Planning department(s) or corporate equivalent to understand if there may be new processes being considered for the facility, where ISS should be applied in the early stages of the project conception, scoping and design. VI. AUDIT SCHEDULE CCHMP will begin the audit/inspections with an opening meeting to discuss the audit process and answer any specific questions by Phillips 66. CCHMP encourages the attendance of all Phillips 66 CalARP and Safety Program key personnel, management staff, and union representatives (if applicable). Tentative Overall Schedule The on-site audit/inspection activities will start: January 4, 2017: 9:00 a.m. – 11:00a.m. CCHMP Safety Orientation @ Phillips 66 11:00 a.m. – 12:00 p.m. Opening meeting. An agenda is included in

Appendix D. 1:00 p.m. – 4:30 p.m. Audit CCHMP shall schedule weekly debriefings with Phillips 66 representatives, beginning the week of January 9, 2017. Preferably, the debriefings will be held in the late afternoon. During the


debriefings, CCHMP will discuss their current draft findings and action items. Completion of all on-site audit/inspection activities is anticipated to be on or before February 2, 2017. This date may change depending on the circumstances. Phillips 66 may be able to rectify potential deficiencies before the conclusion of the audit/inspection. These deficiencies will still be included in the written report, however, they will be identified as rectified. VII. DOCUMENTS TO BE REVIEWED CCHMP may request and review the documents listed in Appendix C during the on-site portion of the audit/inspection. Phillips 66 is expected to have this information compiled and available prior to the audit/inspection.

VIII. PUBLIC COMMENTS CCHMP has not concluded the public notice/comment period per §2745.2(c) and §2745.2(d) of the CalARP Program regulations for Phillips 66’s RMP submitted on September 14, 2014. IX. SITE SAFETY PLAN CCHMP shall wear personal protective equipment (PPE) as appropriate (i.e., hard hat, safety glasses/goggles, steel toed shoes, Nomex coveralls, hearing protection). CCHMP will not enter any areas where respiratory protection is required. CCHMP shall be escorted throughout the facility by personnel who are knowledgeable of the facility’s emergency action plan (i.e., evacuation routes, headcounting procedures, alarms).

CalARP/ISO/RISO Audit Plan A - 1

APPENDIX A OVERALL AUDIT PLAN

AUDIT ACTIVITIES CCHMP followed the internal procedure, “Conducting Audit/Inspection Protocol”, adapted from the Guidelines for Auditing Process Safety Management Systems (Center for Chemical Process Safety, AIChE, 1993) for developing this work plan and for conducting the audit. This procedure includes specific tasks for three phases of the audit: Pre-Audit/Inspection, On-site Audit/Inspection, Post-Audit/Inspection. The specific tasks to be completed are as follows: Pre-Audit/Inspection Activities Allocate resources

a. Select audit team members with the following attributes: auditing skills, knowledge of the process, diligence, perceptiveness, thoroughness, objective, unbiased

b. Provide audit team members as needed with copies of the audit/inspection questionnaires, objectives, sampling strategies, and secondary reference materials

c. Schedule the conference and meeting rooms required for the initial, daily, and closing debriefing sessions; the employee interviews; and team meeting rooms

d. Acquire any required audit equipment/software (i.e., computers, software for recording, documentation forms, printers, copiers)

Clearly identify objectives of the audit/inspection

a. Assign audit/inspection team members to programs to be reviewed based on familiarity with the CalARP Program regulations, ISO/RISO, and the processes, and availability

b. Clearly identify “final products” from each of the audit/inspection team members (i.e., agree on documentation format and ensure consistency with audit/inspection report and the trade secret policy)

Determine the scope of the audit/inspection

a. Identify the physical scope of the audit/inspection – clearly identify the covered processes and ISO/RISO covered processes that will be included in the evaluation and their boundaries

b. Identify the historical scope of the audit/inspection under the CalARP Program – the starting date of the program is August 19, 1996, the effective date of the CalARP Program regulation. The starting date of subsequent audits, perhaps due to covered process modifications, will be determined.

c. Identify the historical scope of the audit/inspection under ISO – the starting date of the initial audit will be January 15, 1998, the effective date of ISO. The starting date of subsequent audits, perhaps due to ISO covered process modifications, will be determined.

d. Identify the historical scope of the audit/inspection under RISO – the starting date of the initial audit will be December 18, 2001, the effective date of RISO. The starting


date of subsequent audits, perhaps due to RISO covered process modifications, will be determined.

e. Identify the regulatory scope of the audit/inspection – the audit/inspection includes the requirements of the CalARP Program regulation, Title 19, Division 2, Chapter 4.5. The CalARP program regulation also references the following regulations:

T8 CCR§3220 Emergency Action Plans T8 CCR§5192 Hazardous Waste Operations and Emergency

Response T8 CCR§5189 Hot-Work Permits/Procedures T8 CCR§5156/5157/5158 Confined-Space Regulations T8 CCR§5194(g) MSDS Requirements under Hazard Communications

f. Determine acceptance criteria for the audit (i.e., if one record out of 100 sampled

shows that the written procedure was not followed does this constitute a finding and warrant a recommendation)

Plan and organize the audit/inspection

a. Develop (i.e., identify and revise as necessary) the questionnaires to be used by the audit team members. When auditing/inspecting an ISO/RISO regulated source all processes are to be audited/inspected against Program 3 requirements. This includes all questionnaires listed in Appendix B.

b. Compile all secondary reference materials (e.g., OSHA Instruction 2-2.45A CH-1, CAA Frequently Asked Questions, industry standards and techniques from professional groups such as AIChE, ASME, Chlorine Institute, IIAR)

c. Determine documentation methodology (i.e., consistency in use of wording and columns) and audit team member’s deliverables (e.g., working papers, software printout, interview information)

d. Determine sampling size and strategy for records (e.g., stratified). e. Schedule employee interviews and meetings with key personnel f. Schedule opening and closing meeting start times and participants g. Schedule debriefing meetings, as needed.

Collect background information, as needed, from the list in Attachment G of Conducting Audits/Inspection Protocol (see Appendix D) Stationary sources may elect not to submit confidential business information (CBI) to CCHMP prior to the on-site portion of the audit. These documents will therefore need to be reviewed during the on-site portion of the audit, possibly increasing the duration of the audit. If the stationary source elects to submit CBI to CCHMP, it will be handled in accordance with the Trade Secret Policy.

Review public comments and written responses developed in accordance with Section 6.6 of the RMP/Safety Plan Completeness Review Protocol Also review any other comments or questions submitted by the public regarding the regulated source or ISO/RISO regulated source. All of the public comments should be available in each regulated source’s or ISO/RISO regulated source’s files under RMP/Safety Plan Completeness Review and


Public Notices and Comments, and Written Responses to Comments. Finalize audit/inspection scope, objectives, and methodology

a. Develop a written audit plan. Follow the format included in Attachment I of Conducting Audits/Inspections Protocol.

b. Circulate the written audit plan to audit team members and to the regulated source or ISO/RISO regulated source

c. Revise the written audit plan to reflect the audit team members’ and the regulated source’s or ISO/RISO regulated source’s comments

On-site Audit/Inspection Activities The audit team leader is responsible for ensuring that the audit team members conduct the following activities/tasks. Conduct opening meeting

a. Discuss the audit objectives, scope, methodology, and schedule for the audit b. Conduct a tour of the stationary source with stationary source escorts (optional) c. Identify personnel who are responsible for the implementation of the various

elements of the program. Establish schedule, as necessary, for audit team members to meet with personnel to discuss the programs and review records, and to conduct P&ID and/or Procedure walk-downs as applicable

d. Receive any necessary safety training (emergency evacuation procedures) and specialty PPE (e.g., alert monitors, escape respirators)

Review programs, policies, and procedures associated with the CalARP program and the Safety Program (if applicable) including, but not limited to, those documents listed in Attachment G of Conducting Audits/Inspections Protocol

a. Identify any findings or potential deficiencies between the existing programs, policies, and procedures and the developed protocol

b. Identify any findings or inconsistencies between the existing programs, policies, and procedures and the written RMP and Safety Plan (if applicable)

c. Formulate action items to rectify any identified potential deficiencies or inconsistencies

Collect and record data to verify that the regulatory requirements are being met and that the stationary source programs, policies, and procedures are being implemented

a. Perform records reviews using the selected sampling strategies discussed in Attachment H of Conducting Audits/Inspections Protocol

b. Conduct an on-site conditions inspection c. Perform interviews with selected management, operations, and maintenance

personnel d. Perform and document the activities denoted with an asterisk (*) in the Clarifications

column of the protocol. The Clarifications column includes information from OSHA, EPA, OES, and professional organizations that may or may not be applicable to the stationary source being audited. The auditors should use judgement in


applying the guidance. e. Conduct procedural walk-downs in the field with qualified personnel as appropriate

to verify accuracy of select procedures f. Conduct P&ID walk-downs in the field with qualified personnel as appropriate to

verify accuracy of select P&IDs

Document the audit/inspection a. Audit findings and action items should be written to “stand alone” b. The regulatory basis that supports the ensure action items (e.g., §2755.1) must be

identified in the question, findings, or referenced at the end of the ensure action c. Action items should not be written to constrain the regulated source or ISO/RISO

regulated source, in the event that better alternatives may be available d. Clearly differentiate between action items necessary for compliance and items

beneficial to safety but not necessary for compliance (These actions are non-mandatory and will begin with “Consider”)

e. Audit findings and action items should be objectively documented. Avoid making legal conclusions, characterizing conduct, or inappropriate connotations (e.g., grossly negligent, unprofessional operating practices, appalling)

f. Ensure that all findings and action items are true. Avoid speculating (e.g., “it appears”) or expressing opinions (e.g., “I believe”)

Evaluate audit information by applying the acceptance criteria Document “Y”, “P”, “N”, “R”, “N/A” in the “Answer” column of the questionnaire for each question. Avoid making conclusions based on a statistical summary (e.g., the stationary source is 60% in compliance with the CalARP Program regulation or Safety Program Elements of ISO/RISO) because some audit questions are more indicative of a successful accidental release prevention program than others.

a. Acceptable (i.e., full compliance with the acceptance criteria): “Y” b. Incomplete (i.e., partial compliance with the acceptance criteria): “P” c. Negative (i.e., no compliance with the acceptance criteria): “N” d. Cross Reference (i.e., an action item is listed elsewhere): “R” e. Not applicable (i.e., acceptance criteria not applicable): “N/A”

Incorporate public comments into the questionnaires where appropriate.

Post-Audit/Inspection Activities The audit team leader is responsible for ensuring that the audit team members conduct the following activities/tasks. Prepare audit/inspection report and send to stationary source

a. Gather all audit/inspection documentation from audit team members b. Consider all public comments on the RMP or Safety Plan formulated during the

formal public review (§2745.2 of the CalARP program regulations, ISO Chapter 450-8.018(A), RISO Section 6.43.100)

c. Generate a “written administrative draft preliminary determination” of necessary


revisions, including an explanation for the basis of the revisions, reflecting industry standards and guidelines (such as AIChE/CCPS Guidelines and ASME and API standards) to the extent that such standards and guidelines are applicable.

d. Distribute the written administrative draft preliminary determination to at least one other member of the audit team for that stationary source for a quality control review.

e. Address technical or factual inaccuracies, if necessary, in the written administrative draft preliminary determination as appropriately identified by the stationary source and then issue the written preliminary determination. Both the written Administrative Draft and the Preliminary Determination should be sent to the stationary source via email or certified mail.

f. Work with each regulated source and ISO/RISO regulated source to ensure the accuracy of the written preliminary determination. The regulated source or ISO/RISO regulated source may reject revisions, in a written response, and may propose a substitute recommendation. Documentation of meetings, including all agreements and points of contention shall be documented and maintained in each regulated source’s (including ISO/RISO regulated source’s) file. Unresolved issues between the CalARP team members and the regulated source or ISO/RISO regulated source will be handled in accordance with the Dispute Resolution Policy.

g. Both the written administrative draft preliminary determination and the written preliminary determination are public documents and shall be made available for review upon request.

Verify the implementation of proposed corrective actions from the stationary source CCHMP will review proposed remedies and due dates from the stationary source identified to address the action items and consider items formulated from the audit/inspection. The status of each resolution should be recorded in the appropriate column of the report. CCHMP will take enforcement action, in accordance with the Enforcement Policy, if the resolution status review demonstrates that the Stationary Source is not implementing the action items in a timely fashion as agreed upon.

CalARP/ISO/RISO Audit Plan B - 1

APPENDIX B QUESTIONNAIRES

Copies of the complete questionnaires are included in this Appendix. The column titled “Type” identifies whether a question is included as an abridged question by the “Abr” notation. For this audit, CCHMP will focus on answering those questions with the abridged notation; however, retains the discretion to answer additional questions or even entire questionnaires based on information uncovered during the onsite audit.

(Blank questionnaires not included in final report)

CalARP/ISO/RISO Audit Plan C - 1

APPENDIX C DOCUMENTATION TYPICALLY REVIEWED DURING AN AUDIT

The following is a list of documents normally reviewed during a CalARP Program audit/inspection. Information tagged with a (*), or samples of this information, may be asked for in advance of the audit/inspection. All other information should be available for review during the audit/inspection. The documentation shown in bold may be available, to some extent, in the RMP; however, more detailed information may be required. Stationary sources may elect not to submit confidential business information (CBI) to CCHMP prior to the onsite portion of the audit. Background Information * Plant/process descriptions * Plant plot plan * Plant CalARP program manual * Plant organization chart * List of covered chemicals * Rationale for covered and non-covered processes * Rationale for any claimed regulatory exemptions Management System * Description of CalARP Program * Designation of responsible management * CalARP program policy statement and the Environmental Health and Safety Policy • Plant policies manual • Objective evidence of management commitment and leadership * CalARP program performance criteria * CalARP program progress reports * Description of system to track CalARP program action items • Records from tracking CalARP action items • Injury and illness log for employees • Evidence of communications of the CalARP program within and outside the company Process Safety Information/Safety Information * PFD's or block flow diagrams • Process chemistry • Maximum intended inventory • Safe upper and lower limits for key operating parameters • Evaluation of consequences of process deviations • Materials of construction • P&ID's • Electrical classification * Process descriptions for covered processes • MSDS's for regulated substances • Engineering documents that list/show:

- codes and standards used in design and construction


- ventilation system design for process buildings, control rooms, other areas where people may be located

- relief system design and design basis (more detailed than just data sheets) - material and energy balances - safety systems (e.g., interlocks, detection and shutdown systems)

• Documentation that equipment complies with recognized and generally accepted good engineering practice (RAGAGEP)

* Listing of names of operators * Listing of names of engineers and areas of responsibility * Listing of names of maintenance technicians and engineers and areas of responsibility Process Hazard Analysis/Hazard Review * Priority order for plant PHA's and documentation thereof * Schedule for plant PHA's * PHA manual or procedure * Rationale for selecting PHA technique(s) used • PHA reports (current and all previous) • PHA worksheets (current and all previous) and associated supplementary data * Listing of PHA team members with areas of expertise (may be part of PHA reports) • Documentation of PHA training for team members and team leaders * Description of system used to manage PHA recommendations • Records from managing PHA recommendations Operating Procedures * Guidelines for generating, modifying and controlling operating procedures including format

and content * List of operating procedures for initial startup, normal operations, temporary operations,

emergency shutdown, emergency operations, normal shutdown, startup following a turnaround, startup after an emergency shutdown

* List of safe work practices including lockout/tagout; lifting equipment over process lines; capping over ended valves; opening process equipment or piping; excavation; control over entrance into a facility by maintenance, contractor, or other support personnel

* List of safe work practices for contractors • Annual certification of procedures • Operating procedures Training * Description of training program (initial and refresher) • Training materials (initial and refresher) • Records of employee training (initial and refresher) • Certification of training where appropriate • Frequency of refresher training and documentation of employee consultation


Contractors * Contractor safety program • Records on contractor selection • Records on contractor use • Documentation of information communicated to contractors * Safety Manual for contractors (both employer and contractor) • Documentation of periodic contractor CalARP performance evaluation • Documentation of periodic contractor CalARP training evaluation • Documentation of actions taken to correct contractor deficiencies • Documentation showing control of contractor plant entry and egress • Injury and illness log for contract employees • Records of training of contractors (from Contract Employer) • List of names of contractor employees used Pre-startup Review * PSR procedure * PSR checklists • Completed PSR's Mechanical Integrity/Maintenance * MI program management policy document or procedure * Rationale for exclusion of any systems, equipment, or instrumentation • Relevant portions of manufacturers' manuals, codes and standards * List of maintenance procedures • Maintenance procedures • Documentation on use of MI procedures * Description of training program for process maintenance activities • Training materials • Records of employee training • Training certification documents for employees where appropriate • Inspection and test procedures (including instrumentation) • Records, including results, of inspection and testing • Description of system used to track the mechanical integrity program • Description of system used to track Safeguards identified in PHAs • Records on correction of deficiencies * Quality assurance program and procedures for new plants and equipment • Quality assurance records * Procedures for control of spares and other equipment and materials Hot Work Permit * Hot work permit procedure • Completed permits * Description of training for hot work activities • Records of employee training • Training certification documents for employees where appropriate


• Documentation of communication to contractors on hot work permitting programs Management of Change * MOC procedure • MOC records Incident Investigation * Description of II procedure * Lists of names for any II teams, past and present * Listing of incidents • Incident investigation reports * Description of system used to manage II findings • Records from tracking II report findings • Documentation on consultation with affected employees and contractors on II results Compliance Audits * Audit procedure * Copies of any previous compliance audits (at least the two most recent audits) * Action plans from any previous audits * List of auditors and their areas of relevant expertise for previous audits • Records from tracking compliance audit findings • Triennial certification Employee Participation * Employee Participation Plan • Records of employee participation in the prevention program elements of the CalARP

program Root-Cause Analysis – ISO/RISO Regulated Sources only * Description of root-cause analysis method applied Emergency Response Program * ER plans • Evidence of compliance with T8 CCR 5192 where applicable * Designation of personnel who will respond to an emergency • Training records for these personnel * Designation of personnel who will assist with emergency evacuation • Training records for these personnel • Records documenting communication of ER plan to employees * Description of alarm system • Test and maintenance records for alarm system • Debriefings on any ER plan activations • Debriefings on any ER drills or exercises • Documentation of inspection, testing, and maintenance of emergency equipment • Copy of Consolidated Contingency Plan if applicable

CalARP/ISO/RISO Audit Plan D - 1

APPENDIX D OPENING MEETING AGENDA/REMARKS

I. Introductions II. Assess compliance of programs with CalARP regulations and ISO/RISO & confirm accuracy of the

RMP and Safety Plan. A. CalARP Program Regulations

1. 9 Program 3 processes 2. 0 Program 2 processes 3. 4 Program 1 processes

B. Safety Program (ISO/RISO) 1. All of the process units

C. May identify “non-compliance” findings and develop “non-mandatory” action items. These will be included in the report and begin with “consider”. CalARP Program regulations requires that we provide the basis for all ensure action items

D. If there is an action item that is resolved before the conclusion of the onsite audit, the action item will still be included in the report, but will be modified to identify it has already been resolved

III. Approach – standard audit using all abridged questionnaires A. NEW – Conduct operating procedure and P&ID walk-downs B. Review documentation and meet with Key Personnel (To find out how the programs are

designed/supposed to function) 1. Schedule meetings with Key Personnel

C. Verification of documentation 1. Sample records – sample size will depend on number and importance of the records 2. Conduct employee interviews – look for any trends

a. Schedule/ random selection (different shifts, different jobs, various lengths of employment, etc.) – ideally 1-5%

b. If any employees want to talk with us that are not selected, let them know they can schedule time with us

c. Employees interviews are confidential – “no right or wrong answers”; the main purpose is to verify if employees were involved in certain tasks that are required by regulations such as incident investigations, PHA teams; no “trick questions”; we take notes but names are not written down; interviews usually lasts approximately 30 minutes

D. Expected duration of the on-site portion of the audit is 4 weeks. CCHMP may take photographs in the field as part of the facility audit records

E. Weekly debriefings to discuss findings F. Complete questionnaires (same format as RMP/SP completeness review) G. February 2, 2017 is the expected audit completion date and closing meeting H. Administrative Draft “Preliminary Determination” within four to eight weeks I. Facility will have fourteen days to review draft for factual inaccuracies J. “Preliminary Determination” issued and facility will have 90 days to submit proposed

remedies and due dates to address any deficiencies K. Begin 45-day public notice period after CCHMP agrees to proposed remedies and due dates L. Schedule public meeting

ATTACHMENT B

Completed Questionnaires

A11 - CalARP Prevention Program: Process Safety Information (Program 3)

ID# Category Question Clarifications Findings Answer ActionsType

A11-02 Program 3 CalARP & ISO

Did the PHA team members have access to the compiled PSI while conducting the PHA? [T19 CCR §2760.1(a) & Section 450-8.016(a)(1)(A)]

* Review the PHA report and interview members of the PHA team to ascertain whether PSI was made available during the PHA.

Per interview with Supv. Process Engineer, the PHA team had access to PSI electronically and had copies of the P&IDs to highlight during the PHA sessions. Per CCHMP review of the PHAs (see A12 for the 5 PHAs reviewed), Appendix B includes a table for general reference and with location and source for the PSI information .

Per the P&P 12.0-2 (1/5/2016), Process safety information is organized into Process Safety information Package (PSIP) that is an electronic format made available to affected individuals. LiveLink is the computer system used to deliver official controlled documents and this is where PSIP resides. Section E of the policy states each PSIP is organized to include six major sections:-Section 1: Process Descriptions-Section 2: Piping and Instrumentation Diagram-Section 3: Hazard of Material-Section 4: Design Basis-Section 5: Protective Safety Systems-Section 6: References

Y NoneAbr

Page 1 of 11Phillips 66 - 2017 CalARP/ISO Audit Findings03-Jul-17



Does the information pertaining to the hazards of the regulated substances include reactivity data and chemical compatibility data during handling, use and application at the stationary source? [T19 CCR §2760.1(b)(4)& Section 450-8.016(a)(1)(A)(i)]

1. MSDS's must be supplemented with process chemistry information, including runaway reaction and overpressure hazards, if applicable [OSHA 3133, PSM Guidelines for Compliance, 1994] or [29 CFR 1910.119 Appendix C].

Per P&P 12.0-2 section D, PSIP shall be developed for each SFR process unit, the unit and system boundaries shall be consistent with those defined by the Refining PHA Required Standard and Contra Costa County Industrial Safety Ordinance.

Section 3.0 Hazards of Materials - summarizes hazards that could result from inadvertent mixing of reactive chemicalsSection 3.1 unit chemicals shows reaction possibilities between binary mixtures of unit chemicals.Section 3.2 explanation of inadvertent mixing reactionsSection 3.3 is the MSDS information

Per interview with SME and live navigation of PSI data on the network, CCHMP randomly selected PSIP for the following:-MP 30: Unit 229 (Light Naphtha hydrotreater), Unit 230 (Naphtha Hydrotreater), Unit 231 (Naphtha Reformer)-Unicracker complex: Unit 244 (Reformer), Unit 24 (Heavy Gas Oil Hydrotreater), Unit 248 Unisar-Crude/Coker: Unit 267 Crude Distillation

Y NoneAbr


Does the information pertaining to the hazards of the regulated substances include the hazardous effects of inadvertent mixing of different materials that could foreseeably occur? [T19 CCR §2760.1(b)(7) & Section 450-8.016(a)(1)(A)(i)]

* Look for written information regarding chemical incompatibility or reactive chemistry.1. Most MSDSs do not list all other chemicals that could be at the stationary source. If documentation is not found, recommend that the stationary source “consider” developing an “incompatibility or reactive chemical matrix”. [CCHMP Interpretation]

Section 3.2 of PSIP is explanation of inadvertent mixing reactions and includes conditions for initiation, likely circumstances, reaction results, steps to handle the reaction, safeguards, etc. Per interview with SME and live navigation of PSI data on the network, CCHMP randomly selected PSIP and confirmed information related to inadvertent mixing of materials. This information is separate and is in addition to the information contained in the Safety Data Sheet.

Y NoneAbr




Does the information pertaining to the technology of the process include process chemistry? [T19 CCR §2760.1(c)(1)(B) & Section 450-8.016(a)(1)(A)(iii)]

Section 1.0 of the PSIP is process description and provides an overview of the unit's process written in narrative format. Section 1.1 - Process Steps -describes the unit purpose and major processing steps including the major control schemes. Section 1.2 - Process Chemistry - describes the process chemistry including amounts and types of feeds, chemical reactants, required utility systems including heat required or generated by a reaction. Section 1.3 - Process Flow Diagrams (PFDs) - display the major components used in the process and the connections between the major components.

Y NoneAbr


Does the information pertaining to the technology of the process include the maximum intended inventory? [T19 CCR §2760.1(c)(1)(C) & Section 450-8.016(a)(1)(A)(iii)]

1. Sources for vessel maximum capacity information could include a placard attached to the tank, documents from the manufacturer of the tank, log sheets, and the business plan.2. Trade association or industry standard may recommend limiting the usable volume of a vessel (e.g., tank not to be filled to more than 85% capacity). [CCC CalARP Program Guidance Document]

Section 1.5 -Maximum Intended Inventories, and defined to be set at the point beyond which would be considered upset conditions and will include major equipment. Piping shall be included as a line item and is 10% of the total inventory of all major equipment items or calculated if the scope of piping is large.

CCHMP reviewed maximum intended inventory for Unit 230, unit 228 and unit 233 and noted that inventories are reported for flammables, toxics, RMP flammables and RMP toxics and piping inventories were assumed to be 10% of the total major equipment inventory.

Y NoneAbr




Does the information pertaining to the technology of the process include safe upper and lower limits for such items as temperatures, pressures, flows, or compositions? [T19 CCR §2760.1(c)(1)(D) & Section 450-8.016(a)(1)(A)(iii)]

SOLs are listed as section 1.4 of the PSIPs. CCHMP reviewed P&P 7.0-9 "SFR Process Safety Information Safe Operating Limits (SOLs)" which states "the value for a Critical Operating Parameter that defines the equipment or process unit safe operating envelope beyond which a process will not intentionally be operated due to the risk of imminent catastrophic equipment failure or loss of containment. Operational or mechanical troubleshooting ceases and immediate predetermined actions are taken at these Critical Operating Parameter values in order to bring equipment and process units to a safe state. This parameter is also called the Never-Exceed-limit in industry guidelines."

The policy specifies that when an SOL limit is reached or exceeded the Operator in Charge will take immediate predetermined action, manual, or automatically initiated, to return the unit to a safe operating condition. The operations supervision shall contact ME&I on-call to conduct a technical evaluation when requirements is noted on the SOL table. Per interview, the safe operating limit information is compiled in an emergency procedure for each unit as "Emergency - Safe Operating Limits (SOL) procedure), this information can be accessed when you select PSIP Index 1.4 Safe Operating Limits or from the operating procedures for the unit. CCHMP randomly selected SOLs from the SOL list and verified the settings in the cause and effect table.

Per interview, there are also listed Reliability Operating Limit (ROL) which are limits if exceeded requires notification to appropriate personnel so that adjustment can be made to inspection/test to prevent a catastrophic

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeequipment failure. Environmental Operating Limit (EOL) are numeric emissions limit established by permits, regulations, and/or other legal requirements.


Does the information pertaining to the equipment in the process include materials of construction? [T19 CCR §2760.1(d)(1)(A) & Section 450-8.016(a)(1)(A)(iv)]

1. Old/used equipment: analysis and/or testing appropriate to the new service with revised documentation of PSI is required [OSHA co-sponsored PSM workshops in Spring, 1993] [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM standard, September 13, 1994].

PSIP Section 4.0 Design basis provides operating and design information for process equipment and piping and includes a nominal list of the materials used to build the process equipment and a list that references all codes and standards used to design the facilities.

Section 4.4 is equipment list that lists fixed and rotating equipment including equipment number, service, materials of construction, design conditions and applicable code. See examples and discussion details in A11-21.

Y NoneAbr




Does the information pertaining to the equipment in the process include piping and instrumentation diagrams (P&ID's)? [T19 CCR §2760.1(d)(1)(B) & Section 450-8.016(a)(1)(A)(iv)]

1. Complete and accurate P&ID’s are essential for conducting a PHA. P&ID’s are used to describe the relationships between equipment and instrumentation as well as other relevant information that will enhance clarity. P&ID’s present useful information on process equipment, piping, valves, and instrumentation. Pressure, temperature and materials of construction are shown for major process equipment. Pipe size and material specifications are shown for main piping as well as the presence of insulation, heat tracing, corrosion monitors and other special piping equipment. [CCC CalARP Program Guidance Document]

Per interview with SMEs, P&IDs should be updated within one year after MOCs are completed. However, there is no formal policy for managing finalization of P&IDs.

Per CCHMP review, many P&IDs used in the PHAs were listed as preliminary drawings. Per interview with SME, preliminary P&IDs are prepared to account for most up-to-date P&IDs for use in the PHAs including approved MOCs. However, per CCHMP review for P&IDs from PSI, much of the P&IDs stay as preliminary P&IDs and was not approved and finalized in a timely basis. CCHMP noted in one instance, there were 2 versions of the same P&ID (0228-YD-005-003) and both were labelled version 6. CCHMP noted the following P&IDs are still "preliminary" and not approved.

0246-YD-002-004,1 OF 1, rev 0, 5/20/2014

0267-YD-001-005,5 OF 13, rev. 5, 7/8/2015

0267-YD-001-001,1 OF 13, rev. 8, 7/8/2015, (DCN 10, 11, 1300, SFE 07226 DCS, 10144, 10145, 11131, 11209, 13083)

0246-YD-001-030,1 OF 1, rev. 0, 3/24/2015

0246-YD-008-001,1 of 1, rev. 0, 9/17/2015

0246-YD-008-002,1 OF 1, rev. 0, 3/24/2015

0248-YD-001-001,1 OF 4, rev. 8, 12/4/2014

0228-YD-005-003,3 OF 3, rev. 6, 2/24/2015,(M20146383, SFC 07050, 10113, DCN 10000, SFE 05156, 10117)

CCHMP also performed 2 field P&ID walkdowns to confirm accuracy of the P&IDs. CCHMP noted some inconsistency in the information shown.

P Ensure that a policy is developed and implemented to finalize P&IDs on a timely basis and not to exceed one year.




Does the information pertaining to the equipment in the process include electrical classification? [T19 CCR §2760.1(d)(1)(C) & Section 450-8.016(a)(1)(A)(iv)]

1. Electrical classification of equipment applies to equipment in flammable/ combustible service.

Per P&P 3.08, all refinery electrical installations within operating unit boundaries, pipe trenches and pipe ways shall be installed to a minimum standard of Class I division II. The engineering department maintains a set of Master Area Electrical Classification drawings denoting the Class I division I, division II and unclassified area.

Y None


Does the information pertaining to the equipment in the process include relief system design and design basis? [T19 CCR §2760.1(d)(1)(D) & Section 450-8.016(a)(1)(A)(iv)]

1. PSV's are critical safety equipment and information that supports PSV design and specification are critical to maintain - simple data sheets are not enough, calculations or other detailed documents are required [OSHA co-sponsored PSM workshops in Spring, 1993] [OSHA Region VI presentation on PSM in January, 1994].

PSIP section 4.2 addresses Relief System Design: and the minimum required information include: relief device number, relief device location description (e.g. vessel, exchanger or line number), where the device relieves to (e.g. flare, acid relief, atmosphere, or process), set pressure, required relief rate, maximum capacity of the relief device, the critical design basis (e.g. fire, blocked liquid outlet or steam failure), and relief device size and type.

CCHMP reviewed selective relief system design information from the network for selected PSVs and verified the set points, materials of construction, design basis (the relief case). This is a summarized information and additional information are also available in the relief system folders.

Y NoneAbr




Does the information pertaining to the equipment in the process include ventilation system design? [T19 CCR §2760.1(d)(1)(E) & Section 450-8.016(a)(1)(A)(iv)]

1. Ventilation systems pertain to the control rooms or wherever personnel may be located. The ventilation system must be such to protect the personnel within the buildings. [CCHMP Interpretation]

PSIP section 5.2 is the ventilation system information which are the HVAC systems in associated buildings. Per CCHMP review in the live navigation, all the buildings, shelter, trailer, etc.. are evaluated and contained in the same spreadsheet. The information included the building category (by API category), coordinates, overpressure setting (psi), permanent building or not, building type (BRM, trailer, building), HVAC or pressurized ventilation, occupancy hours, manufacturer of the HVAC system and model no., building square footage, etc.

Y NoneAbr


Does the information pertaining to the equipment in the process include design codes and standards employed? [T19 CCR §2760.1(d)(1)(F) & Section 450-8.016(a)(1)(A)(iv)]

PSIP section 4.0 Design Basis: includes operating and design information for process equipment and piping and reference codes and standards used to design the facilities. Section 4.4 is equipment list that lists fixed and rotating equipment including equipment number, service, materials of construction, design conditions and applicable code.

CCHMP reviewed equipment list for Unit 267 and Unit 229 and the equipment list includes: heater, pressure vessel, rotating equipment, heat exchanger, and tank. Example information listed for pressure vessel included equipment identification, design pressure, design temperature, materials of construction, design code (e.g. API 510), etc.; example information listed for rotating equipment included equipment identification, max suction temp, flow, suction pressure, discharge pressure, specific gravity, head (@GPM), flange class and rating, materials of construction for pump case, design code (e.g. API 610), etc.

Y NoneAbr




Does the information pertaining to the equipment in the process include material and energy balances for processes built after June 21, 1999? [T19 CCR §2760.1(d)(1)(G) & Section 450-8.016(a)(1)(A)(iv)]

1. PSM regulations require facilities to develop material and energy balances for processes built after September 1, 1992 [T8 CCR §5189(d)(3)(7)].

PSIP section 4.1 states that the Heat & Material Balance (H&MB) are available for units and systems built after 5/26/1992. For units where the overall H&MB are available, it shall be included. Per live navigation of the PSIP on the network, for units that H&MB was not available, a message stating that overall H&MB is not required for unit built prior to 5/26/1992. CCHMP reviewed heat and material balance for unit 246 and unit 110. These table includes the stream and mass contribution of each component, energy content for the process input and output as well as the operating conditions.

Y NoneAbr




Does the information pertaining to the equipment in the process include safety systems (e.g., interlocks, detection, or suppression systems)? [T19 CCR §2760.1(d)(1)(H) & Section 450-8.016(a)(1)(A)(iv)]

PSIP section 5.0 is the protective safety systems includes:-Section 5.1: plot plans-safety equipment not covered elsewhere e.g. firewater, hydrocarbon & h2S monitors, safety showers (but not relief devices), location of mechanical safety systems, ventilation systems or instrumented protective systems.-Section 5.3: Mechanical protective system such as vibration detection system, turbine over speed trips, low lube oil pressure detection, critical check valves, etc. The description shall include the following: functional location, descriptions, protective device ID and description, Safety system, set point with units. Critical check valve list will also identify those check valves that are required for mitigating overpressure scenarios. -Section 5.4 Instrumented Protective systems: This include Safety Instrumented Systems or interlocks designed to shutdown equipment or the unit, to auto-start equipment, close or open valves, etc.; Overpressure instrumented protective systems such as high integrity pressure protection systems (HIPPS) and emergency depressuring; or Independent Protection Layers (IPL) identified during Layers of Protection Analysis (LOPA). Instrumented protective system may be identified in a cause and effect diagram, if not, they should be described in tabular form.

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the existing Process Safety Information Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

CCHMP reviewed the RMP (V9 submitted September 12, 2014), Section 1.1 and the Safety Plan (August 7, 2015), p. 7-9 briefly describes the process safety information that are available at the facility.

Y NoneAbr



A11-28 Audit Follow-Up

Have all ensure action items associated with the previous CalARP/ISO audit of the stationary source been addressed within this prevention program questionnaire?

* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There were no ensure actions associated with the 2014 CalARP/ISO audit at this facility.

N/A NoneAbr


A12 - CalARP Prevention Program: Process Hazard Analysis (Program 3)



Did the stationary source use one or more of the following methodologies that are appropriate to determine and evaluate the hazards of the process being analyzed: (a) What-If (b) Checklist (c) What-If/Checklist (d) Hazard and Operability Study (HAZOP) (e) Failure Modes and Effects Analysis (FEMA) (f) Fault Tree Analysis (g) An appropriate equivalent methodology? [T19 CCR §2760.2(b) & Section 450-8.016(d)(1)

CCHMP reviewed five PHA reports that were completed since the previous audit in 2014. Each of the five PHAs were performed using the HAZOP method. The following PHAs were reviewed:-- Unit 228 (Isomeration), re-do PHA, final report dated 8/21/14, session dates between 2/17/14 and 3/3/14, managers meeting 3/18/14

-- Unit 244 (Reformer), re-do PHA, final report dated 6/30/15, session dates between 1/21/15 and 2/24/15, managers meeting 6/8/15

-- Unit 246 (Hydrocracker), re-do PHA, final report dated 12/23/14, session dates between 6/24/14 and 8/7/14, managers meeting 10/7/14

-- Unit 248 (Unisar), re-do PHA, final report dated 7/10/15, session dates between 1/27/15 and 2/24/15, managers meeting 6/8/15

-- Unit 267 (Crude), PHA revalidation, final report dated 10/23/15, session dates between 7/20/15 and 7/30/15, managers meeting 10/16/15.

Y NoneAbr




Do the PHA(s) address the hazards of the process? [T19 CCR §2760.2(c)(1) & Section 450-8.016(d)(1)]

* Review a representative sample of process-related equipment to determine whether hazards have been identified, evaluated, and controlled (i.e., electrical classifications are consistent with flammability hazards, pressure relief valves are properly designed and discharge to a safe area, pipework is protected from impact) [CalOSHA Consultation, Guidelines for Process Safety Management, Part 1, June 1994].1. Examples include: (a) failure of equipment to start, (b) operator stops equipment inadvertently, (c) valve mispositioned inadvertently, (d) possible exothermic reactions, (e) pressure relief, venting, or flare capacity inadequate or disabled, and (f) loss of utilities.2. Hazard analysis "by action items only", where the PHA includes only those hazards for which recommendations are made for safety improvements, and hazard analysis "by exception", where the PHA includes only those hazards for which the team felt there were significant consequences (e.g., explosions, toxic releases) are not acceptable. [OSHA Training Material Reference Manual].3. OSHA has not issued a clarification regarding "PHA by Exception"; however, OSHA Region VI issued a citation to Marathon Oil that used the specific phrase "HAZOP by Exception".4. The following question was answered by OHSA in a Beaumont, Texas meeting: In our PHA program, we concentrate on very serious hazards with potentially catastrophic consequences. Other hazards with less serious, non-catastrophic consequences are not included in the study and recommendations are not made as part of the PHA. We have other safety programs that address these hazards. Is this OK? Answer: The key thing is that only "catastrophic" possibilities are covered. Other possibilities still need to be addressed and documented as to why they are not catastrophic.

CCHMP reviewed the PHAs listed in A12-05. Four of the five PHAs were re-do studies. The HAZOP worksheets listed a number of guidewords to assess the hazards of each process unit. In addition to the typical more/less/no guidewords, the following were used:-- As Well As Flow-- Mis-Directed Flow-- More Level-- Composition-- Corrosion-- Incorrect Sampling-- No Utility-- Maintenance-- Startup/Shutdown-- Abnormal Operation

CCHMP confirmed that hazards of the processes were evaluated using the HAZOP guidewords. For example:-- PSV leaks and fails to reset-- Level controller receives incorrect signal-- Failure of electrical grid-- Tube leak-- Loss of natural gas-- Excessive chemical injection-- Heat exchanger fouling-- High composition of butane-- High composition of water-- High composition of H2S-- Valve fails closed-- Plugging-- Pump stops-- Seal failure-- Channeling-- Excessive thermal cycling-- Power failure-- Loss of steam-- Failure to install ground cables for maintenance-- Bleed valve left open-- Bypass inadvertently opened-- Operator closed wrong valve-- Blind left in after maintenance-- Pump bearing failure due to lack of lubrication

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsType5. Do observations of a representative sample of process-related equipment indicate that obvious hazards have been identified, evaluated, and controlled? (For example, hydrocarbon or toxic gas monitors and alarms are present, pressure relief valves are properly designed and discharge to a safe area) [OSHA Instruction CPL 2-2.45A CH-1 Appendix A].

-- Incorrect temperature set point-- Sight glass failure-- Control loop failure/malfunction-- Pump/compressor failure-- Overspeed on turbine


Do the PHA(s) address the identification of any previous incident which had a likely potential for catastrophic consequences? [T19 CCR §2760.2(c)(2) & Section 450-8.016(d)(1)]

1. Catastrophic consequence is defined to be consistent with “catastrophic release” which means a major uncontrolled emission, fire, or explosion, involving one or more regulated substances that presents an imminent and substantial endangerment to public health and the environment. [T19 CCR §2735.3(m)]2. OSHA believes that it would be extremely useful if incident investigation report findings and recommendations were reviewed in the subsequent update or revalidation of the process hazard analysis (or hazard review) of the process [29 CFR 1910.119 preamble].

Each of the PHAs reviewed contained a list and description of the incidents reviewed as part of each study. The applicable incidents were summarized within a table at the beginning of the report. Reviewing this table CCHMP found that statements such as, "Loss of fuel gas is adequately covered in Node 14 with adequate safeguards." Although not required, CCHMP was unable to locate statements within the referenced node that referenced back to the past incident for the following PHAs: Unit 228, 244, 246 and 248. Only the Unit 267 PHA contained such references.

CCHMP also found that each PHA report included a node titled "Incidents" within the HAZOP worksheets. The list of incidents is conservative as it includes a variety of smaller events not classified as catastrophic or potentially catastrophic.

Y NoneAbr


Do the PHA(s) address the consequences of failure of engineering and administrative controls? [T19 CCR §2760.2(c)(4) & Section 450-8.016(d)(1)]

Each of the PHAs reviewed used HAZOP worksheets to summarize the study. Each worksheet includes a column to document the consequences associated with a deviation/cause pair. CCHMP confirmed that consequences were listed for every deviation/cause pair, except for situations when there were no additional causes to be found since they were already identified in a previous deviation.

Y NoneAbr




Do the PHA(s) address covered process and stationary source siting? [T19 CCR §2760.2(c)(5) & Section 450-8.016(d)(1)]

1. The CalARP program regulations only require that stationary source siting be reviewed. CCHMP has expanded this requirement to include a siting evaluation for the covered processes. [CCHMP Interpretation]

Siting was covered as a checklist with each PHA report. The siting checklist was documented as a node in the worksheets of each PHA. All of the questions asked were identified as satisfactory with no recommendations. Topics covered in the siting checklists included: -- Location and Spacing Between Process Equipment-- Unit Layout and Location of Facility Relative to Neighbors-- Location and Adequacy of Drains, Basins and Dikes-- Ignition Sources-- Control Rooms-- Location of Emergency Shutdown/Isolation Switches/Controls-- Availability and Location of Fire Protection Equipment-- Emergency Stations

Y NoneAbr


Do the PHA(s) address human factors? [T19 CCR §2760.2(c)(6) & Section 450-8.016(d)(1)]

1. Such factors may include a review of operator/process, operator/operator and operator/equipment interface, the number of tasks operators must perform and the frequency, the evaluation of extended or unusual work schedules, the clarity and simplicity of control displays, automatic instrumentation versus manual procedures, operator feedback, clarity of signs and codes (etc.) [OSHA Instruction CPL 2-2.45A CH-1: Appendix A PSM Audit Guidelines].

Each of the PHA reports reviewed included a human factors checklist as a node within the report. One or more Operators complete a human factors (HF) latent conditions checklist (LCC) prior to the PHA sessions and document them on a checklist that is included within the report. This information is then placed into the HF node. Since the facility is covered under the county's Industrial Safety Ordinance, this is further described in A26-01.

Y NoneAbr




Do the PHA(s) include consideration of external events, including seismic events, as applicable? [T19 CCR §2760.2(c)(8) & Section 450-8.016(d)(2)]

* Review written documentation of seismic review and compare against seismic guidelines.* Review external event considered (use of a checklist is acceptable). Documentation by exception is not sufficient.1. PHAs completed for other programs (e.g., PSM) where external events were not considered shall be updated to include external events [T19 CCR §2760.2(c)(8)].2. External events include nearby pipeline accidents, releases of chemicals, sabotage, seismic activity, transportation accidents, maintenance activities, external flooding/landslides, extreme winds, fire, fog, high/low temperatures, internal flooding. [Section 7.3.4 of CCHMP’s CalARP Guidance Document]3. For ISO regulated facilities, external events, including seismic, shall be considered for all covered processes containing a regulated substance, if a public receptor is within the distance to a WCS toxic or flammable endpoint. [Section 450-8.016(d)(2) as amended under Co. Ord. 2000-20]4. Did the PHA team reviewed a facility/equipment check for after a seismic event to confirm that no damage was sustained as a result of the earthquake?

The facility completed a facility-wide seismic assessment in 2015 and documented in a report dated 2/8/16. The seismic study is further discussed within A33-01. As stated within the seismic report, the seismic assessment followed the Guidance for California Accidental Release Prevention (CalARP) Program Seismic Assessments, dated December 2013 and the American Society of Civil Engineers (ASCE) Guidelines for Seismic Evaluation and Design of Petrochemical Facilities, dated 2011, 2nd Edition.

Each of the five PHAs reviewed considered external events as a Global node. In reviewing these Global nodes, CCHMP noted that no recommendations were formulated.

Y NoneAbr


Did at least one employee on the PHA team have experience and knowledge specific to the process being evaluated? [T19 CCR §2760.2(d) & Section 450-8.016(d)(1)]

CCHMP reviewed the five PHA reports listed in A12-05 and confirmed that each team included employees that had experience and knowledge on the process. As described within A12-17, each PHA was comprised of a team that included Operators, Process/Unit Engineers, Area Supervisors, and others as necessary.

Y NoneAbr




Was the PHA performed by a team with expertise in engineering and process operations? [T19 CCR §2760.2(d) & Section 450-8.016(d)(1)]

CCHMP reviewed the facility's PHA policy, PNP 2.0-6, last reviewed 11/7/16. Section E.2.a.i identified, "PHA team shall be comprised of at least three full time members, namely the Leader, Unit Operator, and Process Engineer. (Other full time members may be required to meet expertise and experience requirements.)" Section E.2.a.iii identified, "Either the Unit Operator or another full time Operations Representative shall have at least 5 years experience working on the process under review in the PHA (unless the process is less than 5 years old) and shall be familiar with current operation."; also, "The combined experience level between the Unit Operator, other full time Operations representatives such as the Operations Supervisor, and Process Engineer shall be at least 8 years working on the process under review (unless the process is less than 5 years old)."

From reviewing the 5 PHAs listed in A12-05, PHA team members included a variety of personnel that ranged from: Operations Engineers, ME&I Engineer, ME&I Superintendent, ME&I Inspectors, Process Engineers, Process Engineering Supervisors, Operators, Area Supervisors.

CCHMP found the PHA teams for Units 228, 246 and 267 consistently included personnel with the proper years of expertise in engineering and operations each day of the study.

In reviewing the Unit 248 PHA, CCHMP was unable to confirm that the proper team members were present on all of the six PHA session dates. For example, on 1/30/15 only the facilitator and the PHA Coordinator were present (i.e., no process engineering or operational expertise were present). The unit Process Engineer was only present at 1 of 6 (17%) session dates. One Operator was present for 5 of 6

P Ensure that the Unit 248 PHA report is amended to clarify that there was not a PHA session date held on 1/30/15.

Abr


ID# Category Question Clarifications Findings Answer ActionsTypesession dates (missed 1/30/15) and another Operator attended only part of one session (2/24/15). Two Area Supervisors were listed on the team although each of them only attended part of one session on different days and they were not present when both Operators were missing on 1/30/15. Per interviews and file review, the PHA report mistakenly listed that a session took place on 1/30/15 when in fact there was not. Also, other engineers knowledgeable in process operations were present in the PHA when the Process Engineer was not.

In reviewing the Unit 244 PHA, the report documented that Operators were present for each session although not for the Process Engineer. The Process Engineer was only present on 1 of 7 (14%) sessions dates. An Ops Engineer was present for 3 of 7 session dates. Between the Ops Engineer and the Process Engineer, a total of 4 of 7 session dates were attended. Per interviews, the remaining three session dates included additional personnel with process engineering expertise.

CCHMP noted that the PHA teams for Units 244 and 248 were almost identical and took place roughly at the same time. CCHMP was informed that similar units may have the same PHA Team makeup. Nevertheless, CCHMP believes that PHA Team attendance should be improved for the assigned Unit Engineer or Process Engineer.




Did at least one member of the PHA team have knowledge in the specific PHA methodology used? [T19 CCR §2760.2(d) & Section 450-8.016(d)(1)]

1. For PHA team leaders, OSHA will look for documentation of formal training - course certificates are acceptable [OSHA co-sponsored PSM workshops in Spring, 1993].2. Non-team leader previous participation in a PHA would not qualify a team leader to lead an initial or update PHA [OSHA co-sponsored PSM workshops in Spring, 1993].3. For PHA team leaders, qualification gained through experience as a team leader is acceptable - OSHA might want to see examples of PHA reports led by a team leader qualified in this manner [OSHA co-sponsored PSM workshops in Spring, 1993].

Each of the PHAs reviewed was led by a facilitator (consultant) with ten years of experience leading PHA studies, and specifically HAZOPs. In addition, each PHA was attended by the PHA Coordinator, who was in that position for approximately 5 years and was expected to participate in all PHAs.

Y NoneAbr




Has the stationary source established a system to document what actions are to be taken; develop a written schedule to complete these actions within two and one-half (2.5) years of performing the PHA, or the next planned turnaround (for those items requiring a turnaround); document the final resolution taken to address each recommendation and the actual completion date? [T19 CCR §2760.2(e)]

* Request all stationary sources to consider using a single system to track and document the resolutions of all recommendations resulting from PHAs, incident investigations, compliance audits, etc.1. This question is for tracking actions taken. [CCHMP Interpretation]2. The timeline applies to PHAs completed after January 1, 2015.3. Stationary sources subject to ISO or RISO requirements must complete PHA actions within one year as specified in A12-23. 4. Turnaround means a planned process shutdown for the purpose of repair, maintenance, process modification, equipment upgrade, or other significant process activity. [T19 CCR §2735(aaa)].

Each of the PHA reports identified that recommendations would be identified based upon the assessed risk ranking of the severity/likelihood pair. The facility uses a 5x5 matrix of severity/likelihood pairs that result in a total of four overall risk rankings of Category I (low), II (medium), III (significant), IV (high). These are defined as:-- I - fine as is with no recommendation required -- II - no recommendation needed if "controls can be verified as functional"-- III - recommendation must be developed and implemented with priority-- IV - recommendation must be developed and implemented with highest priority.

Per PNP 2.0-6 (PHA policy), any Category IV scenario must be immediately communicated to the Operations Manager and "require temporary/interim risk reduction measures within 30 days of identification to reduce the short term risk to the equivalent of a Category III or lower, until the permanent risk reduction measure can be implemented."

PNP 2.0-6 identified that a "PHA recommendation is not completed until the physical addition/ replacement/ revision (via MOC as may be required) or administration action is completed and is permanently in place with PSI updated, training completed, etc. or the recommendation is rejected with a documented basis."

PNP 2.0-6 also identified that to comply with the Contra Costa County Industrial Safety Ordinance (ISO), "all PHA recommendations must be mechanically complete and/or resolved within one year after completion of the PHA study", or next regularly scheduled turnaround if one is required to implement the recommendation. Wording is also included

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypein the PNP that CCHMP must be contacted to extend completion dates. In addition, "The PHA study is considered complete after the management review of the study or no more than the PHA report communication plan date." Compliance with this requirement is described in A33-04.

Although not directly applicable to the P66 Rodeo Refinery, the PNP included language that PHA recommendations associated with Category II risks have a maximum target resolution date of within 3 years. As stated in the question, the CalARP regulations were modified, effective January 1, 2015, that requires a shorter PHA recommendation resolution date. CCHMP suggests that the PHA policy be modified for all Phillips 66 refineries within California.

CCHMP was informed that PHA recommendations are discussed during the Manager's Meeting and initial time frames for completion are assigned based on an assessment of the task. Since the facility is subject to the county's Industrial Safety Ordinance, this starts with a 1-year clock (see A33-04 for more detail). If those present in the Manager's Meeting believe the task must be resolved when the equipment is down then it is assigned to the next available turnaround. Target dates for all PHA recommendations are entered into Impact and assigned to a responsible party. CCHMP reviewed the closure status of 24 (all) PHA recommendations from the 5 PHAs listed in A12-05. A total of 3 recommendations remain open and are scheduled to be completed during turnarounds, 1 was rejected due to factual errors, and the remaining 20 have been completed. Most of the completed recommendations were closed within 1 year. A total of 4 recommendations received a variance request which is further described in A33-04.



A12-21 Program 3 CalARP

Has the stationary source established a system to complete actions on a timetable agreed upon with CCHMP if not within the timeline in question A12-20? [T19 CCR §2760.2(e)]

1. The stationary source must document the agreed upon timetable with CCHMP and how they are addressing the actions taken from the PHA recommendations. [CCHMP Interpretation]

As described in A12-20 and A33-04, the facility has periodically contacted CCHMP to request additional time to complete select PHA recommendations not resolved within one year or subject to turnaround.

Y NoneAbr


Has the stationary source established a system to communicate the actions to operating, maintenance, and other employees whose work assignments are in the process and who may be affected by the recommendations or actions? [T19 CCR §2760.2(e) & Section 450-8.016(d)(4)]

* Enquire during employee interviews the location of PHA binders/results. 1. PHA availability: Merely placing a copy of the PHA results in a common location is not enough - must provide "substantial communication" [OSHA Region VI presentations on PSM in January, 1994].

CCHMP reviewed packages for communicating PHA results to the workforce for each of the five PHAs reviewed. Documentation included sign-in sheets for operations and maintenance personnel and emails to Area Supervisors. In reviewing when these communications took place, CCHMP found that the majority of them took place within one month of the managers meeting that approved the PHA report. CCHMP noted that communicating the Unit 246 PHA took up to 6 months and up to 9 months for the Unit 228 PHA. Further review found that none of the PHA recommendations for these two units were resolved sooner than this time period. Nevertheless, since PHA recommendations need to be addressed within one year to comply with the county's ISO, it is suggested that this communication consistently take place in the fist couple of months after the managers meeting if at all possible.

Y NoneAbr



A12-25 Program 3 CalARP

Did the stationary source consider the use of Inherently Safer Systems in the review of: new processes and facilities, existing processes, or in developing recommendations and mitigations for PHA’s? [Section D.1 of the CCC Safety Program Guidance Document]

* Request all CalARP facilities to consider use of inherently safer systems. Inherently Safer Systems are optional for CalARP Program only stationary sources.1. This question is not applicable to facilities subject to CCC Industrial Safety Ordinance (ISO) since more detailed Inherently Safer System questions must be answered in ISO questionnaire A34.2. Inherently Safer Systems include four levels of risk reduction in order of decreasing reliability (the first is the most reliable) as follows:a) Inherent - Eliminating the hazard by using materials and process conditions which are non-hazardous; e.g., substituting water for a flammable solvent.b) Passive - Minimizing the hazard by process and equipment design features that reduce either the frequency or consequence of the hazard without the active functioning of any device; e.g., the use of equipment rated for higher pressure.c) Active – Using controls, safety interlocks, and emergency shutdown systems to detect and correct process deviations; e.g., a pump that is shut off by a high level switch in the downstream tank when the tank is 90% full. These systems are commonly referred to as engineering controls.d) Procedural – Using operating procedures, administrative checks, emergency response, and other management approaches to prevent incidents, or to minimize the effects of an incident; e.g., hot-work procedures and permits. These approaches are commonly referred to as administrative controls.

The facility is subject to the County ISO so is required to have an inherently safer system (ISS) program. As described in the A34 questionnaire, the facility has an ISS program for evaluation of ISS during development of PHA recommendations, existing processes and new processes.

Y NoneAbr




Has the PHA been updated and revalidated by a team meeting the requirements of §2760.2(d) at least every five years after the completion of the initial PHA to assure that the PHA is consistent with the current process? [T19 CCR §2760.2(f) & Section 450-8.016(d)(2)]

1. Updated and revalidated PHA's completed to comply with PSM are acceptable to meet the requirements of the paragraph, notwithstanding the requirements of §2760.2(c). (Any updates or revalidations which occurred following August 1996 must include the requirements of §2760.2(c)) [T19 CCR §2760.2(a)].2. PHA revalidations should address the following questions: (a) Does the current PHA reflect all of the changes made since the last PHA? (b) Have any new requirements, either voluntary or non-voluntary, emerged since the last PHA? (c) Did the last PHA contain any omissions? (d) Have there been any incidents since the last PHA in the process unit to be revalidated, or in other process units/areas that affected the process unit to be studied?

As identified in A12-05, 4 of the 5 PHAs reviewed were re-do studies and 1 was a revalidation. CCHMP was informed that the facility uses the PHA session start date as the 5-year clock date. CCHMP was provided with a schedule of performing all PHAs onsite. Due dates were listed for the previous PHA and the next PHA for each plant five years into the future. For the 5 PHAs reviewed, the following dates were listed:-- Unit 228; 2/17/14, 2/17/19-- Unit 244; 1/21/15, 1/21/20-- Unit 246; 6/24/14, 6/24/19-- Unit 248; 1/28/15, 1/28/20-- Unit 267; 7/20/15, 7/20/20

In reviewing the PHA reports, the first session date listed for the 2015 Unit 248 PHA started on 1/27/15 instead of 1/28/15 as listed in the facility's EUPHA (Existing Unit PHA). The remaining dates matched.

Y NoneAbr


Has the stationary source retained copies of the PHA's and updates or revalidations for each covered process for the life of the process? [T19 CCR §2760.2(g)]

CCHMP was informed that older PHAs and PHA recommendation closure documentation are maintained in paper form. The last several PHA cycles have been generated electronically and are maintained as such along with the electronic closure tracking system documentation. All PHAs and recommendation closure documents are maintained for the life of the process.

Y NoneAbr


Has the stationary source retained copies of the documented resolution of the recommendations described in §2760.2(e) for the life of the process? [T19 CCR §2760.2(g) & Section 450-8.016(d)(4)]

1. At a minimum the documentation is to include the final resolution taken to address the recommendation and the actual completion date. [T19 CCR §2760.2(e)]

As described in A12-27, all resolutions to PHA recommendations are maintained for the life of the process.

Y NoneAbr


Does the submitted RMP accurately reflect the existing Process Hazard Analysis Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

Section 1.2 of the facility's RMP submitted to CCHMP on 9/12/14 accurately reflects the onsite Process Hazard Analysis Program.

Y NoneAbr






There were no ensure action items associated with CCHMP's previous audit of this regulatory topic. This question is not applicable.

N/A NoneAbr


A13 - CalARP Prevention Program: Operating Procedures (Program 3)



Are the written operating procedures consistent with the process safety information for the process? [T19 CCR §2760.3(a) & Section 450-8.016(a)(2)(A)]

* Compare operating procedures to P&IDs, equipment data sheets, consequence of deviation, operating limits, etc.

CCHMP reviewed about 35 written operating procedures associated with the following units: - Unit 246 Hydrocracker- Unit 228 Isomerization- Unit 267 Crude Distillation- Unit 244 Reforming- Unit 248 Unistar (jet fuel)

Examples of procedures reviewed from the above units included:- NOP-200-246: Establishing U246 Circulation, approved 9/8/2015- NOP-201-246: U-246 Startup after Short Term Shutdown with Clean Hydrogen, approved 9/8/2015- NOP-204-246: U-246 Startup after Short Term Shutdown with Unit 246 (Dirty) Hydrogen, approved 9/8/2015- EIP-001-246: Emergency U-246 Isolation, approved 4/17/2013- NOP-206-248: Unit 248 Startup after Short-Term Shutdown, approved 9/8/2015- EOP-700-248: Emergency - 66-602 A or B Makeup Compressor failure, approved 4/29/2013- NOP-215-228: Tank 310/311 Circulation Start-up, approved 5/19/2016- EIP-001-228: Emergency U-228 Isolation, approved 9/4/2014- EOP-001-244: Emergency Safe Operating Limits (SOL0 for Unit 244- EOP-700-244: Emergency - 5G-501 Reformer Recycle Compressor Failure, approved 12/8/2015- NOP-203-244: Start-up after a Short-term Shutdown, approved 9/23/2016- EOP-100-267: Emergency Shutdown, Hot Circulation, Cold Circulation, approved 7/1/2013- EOP-200-267: Unit 267 Emergency Isolation valve Activation, approved 9/1/2013

P Ensure to verify the accuracy and consistency of the PSI (such as plot plans and partial plans) provided in support of the emergency isolation procedures.

Abr


ID# Category Question Clarifications Findings Answer ActionsType- EOP-300-267: Emergency Power failure, Emergency Circulation, approved 7/1/2013- NOP-302-267: Planned Shutdown/Steaming of Unit, approved 8/11/2014

CCHMP reviewed three (3) P&IDs from Unit 246 Plant 8 and one P&ID from Unit 228 through P&ID walkdowns. CCHMP confirmed that these P&IDs accurately reflected what was observed in the field except for some minor corrections.

CCHMP reviewed selected number of "Emergency Isolation Procedures (EIP)" to check for accuracy and consistency with process safety information. For each EIP, the facility includes two valve location maps showing the location of the emergency isolation valves, the corresponding valve number and whether the valves are elevated on an elevated platform. The attached valve location maps are presented in two ways, on a traditional ‘plot plan’ showing the valve location in relation to key equipment, and on a ‘partial plan’ showing the valves on a relative basis that is decluttered with a list of the valves. CCHMP reviewed the attached maps to the following procedures, and found the following inconsistencies.- EIP-001-246 Emergency U-228 Isolation – valve 61 is shown in two different locations relative to valve 60.- EIP-001-246 Emergency U-244 Isolation – valve 100 and 196 is shown on the plot plan, but not on the partial plan- EIP-001-246 Emergency U-246 Isolation – valve 40 is shown on two different locations.- EIP-001-246 Emergency U-248 Isolation – valve 35 is shown on the plot plan but not on the partial plan




Do the procedures address initial startup or startup following a turnaround? [T19 CCR §2760.3(a)(1)(A), §2760.3(a)(1)(G) & Section 450-8.016(a)(2)(A)]

1. Examples include: (a) preparation of utilities, process lines, and instruments (b) equipment preparation and testing (c) inerting/purging of equipment [OSHA Training Material Reference Manual].

The procedures reviewed address startup or startup following a turnaround. Examples included the following:- NOP-201-228: Unit 228 Start-up and Start-up following automatic shut down, Rev.11- NOP-201-244: Start-up after a short term shutdown for maintenance, Rev.11

Y NoneAbr


Do the procedures address normal operations? [T19 CCR §2760.3(a)(1)(B) & Section 450-8.016(a)(2)(A)]

1. Examples include process conditions for steady state and means to identify parameters outside of normal or acceptable range [OSHA Training Material Reference Manual].

The procedures reviewed address normal operation. Examples included the following:- NOP-304-244: Short-Term Shutdown for Unit 244 with Unit 248 Running, Rev.3- NOP-500-246: B-801A/B Heater Light-Off Procedure, Rev.1

Y None




Do the procedures address temporary operations? [T19 CCR §2760.3(a)(1)(C) & Section 450-8.016(a)(2)(A)]

1. Examples may include special conditions where safeguards may be bypassed, loading/unloading of catalyst into/out of a reactor, sampling, and equipment bypassing [OSHA Training Material Reference Manual].

The procedures address temporary operations. The facility has temporary operating procedures for specific tasks that are infrequent, unique and not routine. The Operating Procedures Policy (P&P Section 6.1-1, dated 9/1/2017) identifies that normal operating procedures (NOP) could be modified to a temporary operating procedure (TOP) for a one-time use due to the need to install bypass lines or additional equipment to sustain operations.

The table of contents for unit procedures included the archived temporary operating procedures (TOP). However, the table of contents did not include the active TOP for any of the five unit procedures reviewed. For example, CCHMP was looking for TOP-301-246 that was referenced in Unit 246 PHA Page 18 and could not identify this TOP on the list of active or archived procedures. Per a follow-up interview, the list of active TOPs is maintained by the Training Manager.

Per interview, temporary operating procedures (TOP) require going through an MOC procedure and are normally used once and can remain active for a maximum of one year. Per interview, there are currently 27 active TOP for the refinery. After the active period of the TOP, the procedure is archived for possible future reactivation which would require going through an MOC process again. Examples of TOPs reviewed included:- TOP-1016-200: Processing U-267 Light Naphtha at U-200 Light Ends, Expiration 1/22/2017- TOP-301-246: Short-Term Shutdown with Flush and Hot Hydrogen Stream, next review 8/22/2013, no expiration date

Y NoneAbr




Do the procedures address emergency shutdown, including conditions under which emergency shutdown is required, and the assignment of shutdown responsibility to qualified operators to ensure that emergency shutdown is executed in a safe and timely manner? [T19 CCR §2760.3(a)(1)(D) & Section 450-8.016(a)(2)(A)]

1. Examples may include conditions requiring emergency shutdown, and operating procedures or steps to take to control or mitigate an emergency condition [OSHA Training Material Reference Manual].

The procedures address emergency shutdown, including conditions under which emergency shutdown is required, and the assignment of shutdown responsibility to qualified operators. Examples include:- EOP-100-267: U267 Emergency Shutdown, Hot Circulation, Cold Circulation- EOP-307-240: Emergency - Total Power Failure Emergency

Per interview, only qualified operators are allowed to use the written operating procedures including emergency procedures. New hires must be qualified to perform tasks by themselves listed in the written operating procedures. The procedures do not need to specify who (such as board or field operator) needs to perform each step as it is very evident to all qualified operators.

Y NoneAbr


Do the procedures address emergency operations? [T19 CCR §2760.3(a)(1)(E) & Section 450-8.016(a)(2)(A)]

* Verify procedures exist to address complete and partial loss of power to the site/unit.1. Examples include procedures for loss of a utility such as process air, instrument air, cooling water, steam, nitrogen, power, etc.

The procedures address emergency operations including procedures for loss of instrument air, steam, power, etc. Examples include:- EOP-300-228: Emergency- Power Failure - EOP-301-228: Emergency - Instrument Air Failure- EOP-302-267: Steam Failure, Emergency Circulation

Y NoneAbr


Do the procedures address startup after an emergency shutdown or partial shutdown? [T19 CCR §2760.3(a)(1)(G) & Section 450-8.016(a)(2)(A)]

1. Examples may include identifying the allowable process conditions for which emergency startup is permissible [OSHA Training Material Reference Manual].

Procedures address startup after an emergency shutdown or partial shutdown. Examples include:- NOP-201-246: Startup After Short Term Shutdown with Clean Hydrogen or with Unit 240 (Dirty) Hydrogen- NOP-204-246: Startup After Short Term Shutdown with Unit 240 (Dirty) Hydrogen

Y NoneAbr




Do the procedures address consequences of deviations and steps required to correct or avoid deviating set operating limits? [T19 CCR §2760.3(a)(2) and §2760.1(c)(1)(E) & Section 450-8.016(a)(2)(A) and 450-8.016(a)(1)(A)(iii)]

1. The consequences of deviating beyond the parameter ranges should be consistent with the results of the process hazard analysis [OSHA Training Material Reference Manual].

The procedures address consequences of deviations and steps required to correct or avoid deviating set operating limits. The facility has developed stand-alone procedures called Safe Operating Limits (SOL) for all operating areas as well as Reliable Operating Limits (ROL).

SOLs are limits that have been established to minimize the risk of mechanical failure. Addressing a SOL requires immediate corrective action. ROLs refer to parameters that are monitored for issues like corrosion, embrittlement and the like. The facility has divided ROLs into three risk levels although only the first 2 levels have been completed. The levels refer to how long it is expected that mechanical issues might develop. High level refers to issues that could happen in days to weeks; and medium level refers to issues that might emerge in weeks to months. Examples of ROLs include high bearing temperature, excess vibration, and low pH in overheads.

Examples of SOL and ROL include:- EOP-001-244: Emergency - Safe Operating Limits (SOL) for Unit 2445- ROL-001-228: Reliability Operating Limits (ROL) for Unit 228

These procedures include tables that address consequences of deviations and steps required to correct or avoid deviating set operating limits. CCHMP reviewed various operating procedures and confirmed that the unit area's SOL procedure was referenced.

Y NoneAbr




Do the operating procedures include safety and health consideration such as precautions necessary to prevent exposure, including engineering controls, administrative controls, and personal protective equipment? [T19 CCR §2760.3(a)(3)(B) & Section 450-8.016(a)(2)(B)]

* Review training records to ensure that employees have been trained in proper use of PPE. 1. MSDS may be referred to or attached to satisfy the personal protective equipment portion of this requirement. If MSDS are referenced in the operating procedures, the document containing the MSDS will be required to be annually certified to be current and accurate per §2760.3(b). [CCHMP Interpretation]

Operating procedures each include a section that addresses safety and health consideration. This procedure section addresses items such as potential for hydrocarbon release, and reference to MSDSs such as H2S, Hydrogen and refinery fuel gas. The MSDSs are maintained by corporate and are certified annually to be current and accurate.

Y NoneAbr


Do the operating procedures include safety systems and their functions? [T19 CCR §2760.3(a)(4) & Section 450-8.016(a)(2)(C)]

The operating procedures include safety systems and their functions. Operators are required to be trained on the various safety systems in their unit as part of their qualification process.

Per a review of the operating procedures reviewed in A13-02, CCHMP found that individual operating procedures contained information on safety systems. For example: emergency isolation valves (EIVs) activation are described in EIP-001-228 and emergency shutdown of Unit 267 in a safe and efficient manner due to an emergency power failure is described in EOP-300-267.

Y NoneAbr


Did/does the stationary source annually certify that the operating procedures are current and accurate? [T19 CCR §2760.3(c) & Section 450-8.016(a)(2)(E)]

1. Sources are also to ensure that procedures are reviewed as often as necessary to assure that they reflect current operating practice (including changes that result in changes in process chemicals, technology, and equipment. [T19 CCR §2760.3(c) & Section 450-8.016(A)(2)(e)].

CCHMP reviewed annual certification statements that operating procedures reviewed are current and accurate. The MSDSs are maintained by corporate and are certified annually to be current and accurate. The signed certification statements were available for 2014, 2015 and 2016. The certification statements included that MSDS/SDS referenced in the procedures have been reviewed and are current.

Y NoneAbr


Does the submitted RMP accurately reflect the Operating Procedures Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted RMP dated September 12, 2014, pages 8-10, reflect the Operating Procedures Program at the stationary source.

Y NoneAbr






There was one ensure action items associated with the previous CalARP/ISO audit that has been addressed.

Y NoneAbr


A14 - CalARP Prevention Program: Training (Program 3)



Has the stationary source ensured that each employee presently operating a process, and each employee newly assigned to a covered process have been trained in an overview of the process and in the operating procedures provided in Section 2760.3? [T19 CCR §2760.4(a)(1) & Section 450-8.016(a)(4)(A)]

* Review the source of training (e.g., equipment vendor) and training requirements (e.g., state regulatory requirement, industry-specific standard), content of training, training style (e.g., classroom, computer-based, OJT) to ensure that it is commensurate with the training content, and the means used to verify competency.1. The training shall include emphasis on the specific safety and health hazards, emergency operations including shutdown, and safe work practices applicable to the employee's job tasks [T19 CCR §2760.4(a)(1) & Section 450-8.016(a)(4)(A)].2. On-the-job training (OJT) is acceptable, as long as the OJT program is documented [OSHA Region VI presentation on PSM in January 1994].

CCHMP reviewed the following training policies from the SF Refinery Policies and Procedures Manual, Awareness Training & Competency:- HSE Training Standards, Section 9.0-1, reviewed 7/22/16- Site Operations Training Plan, Section 9.0-2, reviewed 9/15/15

Per a review of Section 9.0-1, the procedure goal is to ensure that all employees receive training to ensure that all work is performed in compliance with regulatory and company requirements for safety, quality and productivity. The Training Department will schedule and coordinate initial refinery regulatory training for new employees or transferees. Site specific training shall be completed before any employee is permitted unescorted access to operating process units. Training methods can be Classroom Training, Web Based Training (WBT) or Computer Based Training (CBT), On the Job and One on One Instruction.

The Rodeo Refinery uses the Philips 66 global enterprise Learning Management System (LMS) database and Success Factors database located on the company intranet site. The system is used to schedule, track, and document employee training. The system also delivers WBT and CBT. Success Factors responsibilities and procedures are available to Site Coordinators on a Share Point site.

Per a review of Section 9.0-2, the purpose of this procedure is to define a uniform approach to operator training and development from point of hire through

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTyperetirement for company employees; to establish minimum requirements that ensure operators are thoroughly trained and able to contribute to a safe and productive workplace; and to comply with the requirements of all government regulations including PSM, County ISO, and corporate safety, health and environmental guidelines and the refinery training standard. Per this section and interview, operator training consists of four tiers of training as follows:- New Employee Site Orientation- Basic Operator Training- Area Orientation and Process Overview- Job Specific Training

Tier 1 - Orientation includes company and site policies and procedures and provides the fundamental knowledge and skills to prepare an employee for his or her first work assignment and it takes typically 2 days.

Tier 2 - Basic Operator Training is about 10 weeks of training on process fundamentals, process safety and PSM regulations, general refinery overview, fixed and rotating equipment in the process units, basic instrumentation and control, and procedures and safe work practices.

Tier 3 - Area Orientation and Process Overview is to introduce a newly assigned operator to the unique aspect of the unit they are assigned. This includes: an introduction to the unit and unit personnel, overview of the process, HSE overview, unit hazards, department and unit expectations, unit progression and organization, introduction to operator rounds and shift relief and housekeeping requirements. Tier 3 training is a mix of classroom and field work and a prerequisite to Job Specific Training in Tier 4.


ID# Category Question Clarifications Findings Answer ActionsTypeTier 4 – Job Specific Training is broken into four categories: - Process Overview - Process Systems Detail

- Job Specific Tasks - Job Shadowing/Cementing

Topics include detailed training on unit equipment, the process systems within the unit and all the procedures associated with their first job. This is a combination of self-driven content, instructor led training, and field application.

Tier 3 and Tier 4 training are integrated into the initial unit operating training plan. The new operators are assigned a mentor and a dedicated trainer. Training includes training on human factors, PSM, lock/tag/try and other environmental type of training.

CCHMP reviewed training documentation for 10 operators, five of which were relatively new with less than three years at the site. Training documentation reviewed included testing Tier 3 training comprehension tests, and included date of training and name and signatures of the operator and the mentor/trainer. Tier 4 training is by job shadowing and review of CBTs related to the specific procedures on the computer. Documentation included the list of CBTs successfully completed for each operator.




Has refresher training been provided at least every three years, and more often if necessary, to each employee operating a process to ensure that the employee understands and adheres to the current operating procedures of the process? [T19 CCR §2760.4(b) & Section 450-8.016(a)(4)(B)]

* Review documentation maintained at the stationary source to verify that refresher training was conducted at least every three years. Documentation must be maintained by the stationary source to ensure compliance with this requirement. [CCHMP interpretation]

Section I of Policy and Procedures (P&P) Section 9.0-2 referenced in question 14-01 describes the refresher training requirements. This section covers the requirement for certified operators to maintain their qualifications and is divided into 7 main topics:- Procedure review- Special emphasis topics- Job Specific refresher Training - future development- Simulator training - for console operators - future development- Key policies and procedures, and information- PHA Overview- Table Top drills

Operations Department is responsible for refresher training. To maintain job certification for Operator 1 and Operator 2 positions, the Operator must work each job family at least 12 hours every 6 months. The Head Operator must work the Operator 1 jobs at least 12 hours every 6 months. Attachment 2 of the Manual Section 9.0-2 provides job families. For example, Unicracker Complex - Block 1 includes one Block 1 Console Operator and two Block 1 Outside Operator Family that consists of Plant 1/4 Outside Operator and Plant 2/3 Outside Operator. The Operations Department, with assistance from the Training Department, track the refresher training requirements using the P66 Learning Management System (LMS) and Success Factors databases on the company intranet site. The system is used to schedule, track, and document employee training.

CCHMP reviewed the CBT refresher training material and tests for 8 procedures. The CBT training material included the written procedure, the purpose of the procedure, reviewing the

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeprocedure and completing a set of multiple choice questions that addressed key aspects of the procedure.

Table top drills are conducted every quarter. All emergency procedures are reviewed every year for a given unit. For example, there are a total of 89 procedures, including NOPs and EOPs, for Unit 228. Out of these 89 procedures, there are 43 EOPs covering Unit 228 as well as the entire MP-30 Complex that are issued out to the operators and reviewed monthly. The remaining 46 procedures are NOPs and are divided to be reviewed in 3 years on a monthly basis as well. All operating procedure refreshers are done using computer based training (CBTs). Each CBT typically include about 7 questions that have to be correctly answered to be able to pass that procedure's CBT.




Does the stationary source prepare and maintain records that contain the identity of the employee, the date of training, and the means used to verify that the employee understood the training? [T19 CCR §2760.4(c) & Section 450-8.016(a)(4)(C)]

1. An auditable training records system will include at a minimum: the employee’s name; the name or description of any formal training undertaken by the employee; the date and duration of any formal training; the results of related tests and certification attained; the expiration date of any related certificate, license, etc.; and a copy of external certificates, licenses, etc. awarded [Plant Guidelines for Technical Management of Chemical Process Safety, CCPS].

As referenced in A14-01, CCHMP reviewed training records for 10 operators. These consisted of 2 operator from each of the five Process Units 267, 248, 228, 244 and 246. CCHMP received a package of training records for each of the operators. CBT training is documented electronically and CCHMP reviewed rosters of the employee training by CBT for each operator. The records maintained included the employee’s name; the name or description of any formal training undertaken by the employee; and the date of training. For CBTs, there are about 7 questions on each CBT and the employee needs to get a passing score only if all questions are answered correctly. CCHMP reviewed three examples of CBTs, 2 for procedures and one for human factors refresher training, and the questions asked that reflected the understanding of each CBT.

For new operators, the training is done by supervisors or assigned mentors and other SMEs and is documented by the supervisor/mentor or instructor and sign-in rosters are maintained. CCHMP reviewed rosters for training of each of the 10 operators for the past couple of years.

Y NoneAbr




Has the stationary source trained each employee involved in maintaining the on-going integrity of the process equipment in an overview of that process and its hazards? [T19 CCR §2760.5(c) & Section 450-8.016(a)(5)(C)]

1. Examples of training in "the hazards of the process" may be training in the safework practices (e.g. confined space entry, lockout/tagout) and HazCom training.2. The same qualification criteria required for process operators under the training element of the PSM standard will apply to maintenance technicians, including the "grandfather" clause [OSHA Region VI presentation on PSM in January 1994].3. OSHA identified that without continual attention to training needs due to process changes and other changes, little assurance will exist that maintenance employees will perform their tasks safely [federal OSHA PSM Preamble].

Per interview with the SME, part of the maintenance training program is to go through regional orientation that includes safe work practices. The maintenance employees go through Tier 1 onboarding that consists of basic maintenance program per P&P Section 9.0-3. This training includes providing an overview of the refinery process that includes a tour of the process unit, HAZMAT training for mechanics involved in emergency response, and introduction to maintenance on mobile equipment such as forklifts and manlifts and on general maintenance tools such as metal cutters, chain saws etc. Training also includes introduction to metallurgical materials and positive identification methods and refinery safework practices. Most of this training is done in classroom settings.

CCHMP reviewed P&P Section 9.0-3: Maintenance Training System, last reviewed 11/16/2016. Per this policy, craft training consists of five tiers of training:- Tier 1 Site Orientation- Tier 2 Maintenance Core- Tier 3 Craft Specific (Fundamental and Enhanced Training)- Tier 4 Refresher Training- Tier 5 Advanced Training

Each new craftsman is assigned a mentor through the first twelve months of employment. New employee site orientation includes an overview of P66 and Rodeo Refinery. Maintenance Core training includes job responsibilities, safe work practices and procedures, maintenance procedures, overview of the refinery processes and equipment. Craft Specific Training includes the Training Need Assessment (TNA) and development of a training plan for the specific employee to determine training assignments. Refresher training consists

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeof three main elements: Procedure Review, Craft Specific Refresher Training based on the employee TNA and key policies, procedures and information. Each craft employee and their Supervisor shall work together to complete and/or update the employee TNA at least every thirty-six months. Advanced training will be based on TNA and covers key areas such as : Safety Leadership, Troubleshooting/Investigation, Complex Equipment repair and reliability principles.




Has the stationary source trained each employee involved in maintaining the on-going integrity of the process equipment in the procedures applicable to the employee's job tasks to assure that the employee can perform the job tasks in a safe manner? [T19 CCR §2760.5(c) & Section 450-8.016(a)(5)(C)]

* Review employee’s (i.e., those employees doing nondestructive tests, welding on pressure vessels, etc.) training records for certifications, content of training, means to verify competency, etc. [OSHA 3133, PSM Guidelines for Compliance, 1994].1. Examples of "the procedures applicable to the employee's job tasks" may include vocational school training, trade schools, and community colleges.2. CCHMP expects that the facility has a process that assures maintenance employees understand and adhere to the facility's written maintenance procedures applicable to their job tasks [CCHMP interpretation].

As described in A14-07, P66 has a process to train each employee involved in maintaining the on-going integrity of the process equipment in the procedures applicable to the employee's job tasks to assure that the employee can perform the job tasks in a safe manner. Specific types of maintenance activities such as none-destructive testing and welding on pressure vessels are conducted by outside contractors. CCHMP reviewed a summary of near 25 contractors training and experience. The experience summary included the contractor employment history and training summary.

CCHMP reviewed a table titled, 'Maintenance Procedures Refresher Schedule'. This is a three year plan for refresher training for five maintenance areas as follows:- Maintenance Services Shop- Instrumentation and Electrical Shop- Machine Repair Shop- Reliability- Hazardous Waste- Tool Room

For example, refresher for Instrumentation and Electrical Shop employees include: Electrical Equipment; Isolation of Electrical Circuit; and Refinery Electrical Classification System.

Per interview and P&P Section 9.0-3 referenced in A14-07, the competency of craft employees is assessed throughout all tiers of the training. Minimum passing score is 80% and a maximum of 3 tries. Maintenance craft personnel are considered "qualified" after the successful completion of Tier 1 "New Hire Orientation", Tier 2 "Maintenance Core Training" and Tier 3 "Craft Specific Training".

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeCCHMP reviewed training needs assessment for 10 maintenance staff, 2 from each of five maintenance areas indicated above. Each training assessment table documented identification and proficiency level for the maintenance employee in areas such as codes and standards, safety, test and measurement equipment, and so on depending on the maintenance area they cover. CCHMP also reviewed training records for 7 new hire maintenance staff that included identification of classes completed and copies of the completed exam/classroom training questions addressed for at least two areas including human factors and regulatory compliance.


Does the submitted RMP accurately reflect the existing Training Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted RMP dated September 12, 2014, pages 10-13, reflect the existing Training Program at the stationary source.

Y NoneAbr




There were no ensure action items associated with the previous CalARP/ISO audit to be addressed here. This question does not apply.

N/A NoneAbr


A15 - CalARP Prevention Program: Mechanical Integrity (Program 3)



Has the stationary source established and implemented written procedures to maintain the on-going mechanical integrity of process equipment? [T19 CCR §2760.5(b) & Section 450-8.016(a)(5)(B)]

1. “Mechanical integrity” means the process of ensuring that process equipment is fabricated from the proper materials of construction and is properly installed, maintained, and replaced to prevent failures and accidental releases [T19 CCR §2735.3(y)].2. The mechanical integrity program for a covered process applies to: (a) Pressure vessels and storage tanks, (b) Piping systems (including ancillary components such as valves), (c) Relief and vent systems and devices, (d) Emergency shutdown systems, (e) Controls (including monitoring devices and sensors, alarms, and interlocks), (f) Pumps, compressors and their drivers. [T19 CCR §2760.5(a) & Section 450-8.016(A)(5)(a)]3. Mechanical Integrity applies to tanks and vessels that are not pressurized as well as those that are pressurized [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard].4. For ISO covered stationary sources, mechanical integrity includes the use of Industry Codes, Standards, and Guidelines, which are defined as "the edition of the codes, standards, and guidelines in effect at the time of original design or construction for the design, construction, alteration, maintenance, or repair of process units, industrial equipment, or

CCHMP reviewed the following procedures related to mechanical integrity:

1) Manual Section 7.0-10 SFR Process Safety Information Reliability Operating Limits (4/24/14)

2) Manual Section 7.0-9 SFR Process Safety Information Safe Operating Limits (SOL)

3) Piping pressure test guidelines

4) Assured Equipment Grounding Conductor Program

5) Electrical Motor Lubrication

6) Instrumentation Calibrations

7) Relief and Safety Valve Maintenance

8) Requirements when using composite materials

9) PMI for mechanical equipment

10) Ball Check Valve Inspection

11) Plant Air Compressor Inspection Procedure

12) Centrifugal Pump Repair Specifications

13) SIL Selection and Verification Guidance Document

14) Rotating Equipment Mechanical Integrity Program

15) Critical Check Valve Procedure

Additionally, other MI procedures were reviewed as part of the Human Factors in maintenance procedures effort. See A28 for further details on these procedures.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeother industrial facilities, structures, or buildings published by the American Petroleum Institute (API), the Chemical Manufacturers Association (CMA), the American Society of Mechanical Engineers (ASME) or the American National Standards Institute (ANSI) [Section 450-8.014(f)].




Is the frequency of inspections and tests of process equipment consistent with the following (a) applicable manufacturer's recommendations (b) good engineering practices (c) prior operating experience? [T19 CCR §2760.5(d)(3) & Section

* Review and document the criteria used for inspection and test frequency, including trends and tracking methods.1. This includes frequencies recommended by applicable standards such as API, NACE, NFPA, etc., and through experience gained by on-site mechanical integrity personnel only if it is more stringent than the manufacturer’s recommendations and applicable standards. [CCHMP Interpretation]2. If prior operating experience is used as the basis for testing and inspection frequencies, the past trends and experience must be documented to establish the justification for the frequencies used. [CCHMP Interpretation]

CCHMP reviewed various different departments and equipment to verify inspection and testing. CCHMP reviewed fixed and rotating equipment as well as electrical equipment including Safety Instrumented Systems (SIS) and Independent Protection Layers (IPL).

Per CCHMP review of fixed equipment files and per review of metrics kept for the ME&I group, there have been no overdue inspections since the previous audit.

Per CCHMP review of rotating equipment, many of the more critical equipment (compressors, etc.) are connected to a 24/7 Bentley Nevada monitoring device. The other equipment are on a monthly schedule to check vibration readings. CCHMP reviewed the equipment history for two pumps and verified the correct inspections and tests were completed.

For the SIS, CCHMP reviewed select SIS from PHAs recently completed and followed up on the inspection and testing history. The items reviewed by CCHMP all had their test done in the appropriate time frame.

Per interview with the SME, the P66 facility has not done their initial testing of IPLs. This is a project they have currently started to undertake and currently less than 50% of the project is completed and not all units have had their IPLs initially tested. This needs to be completed as soon as possible and a subsequent testing schedule developed.

Per CCHMP review, the frequencies of inspections and tests that were completed were consistent with good engineering practices, etc.

P Ensure that IPL initial testing is completed and a schedule is developed for subsequent testing.

Abr


Has the stationary source documented each inspection and test that had been performed on process equipment? [T19 CCR §2760.5(d)(4) & Section 450-8.016(a)(5)(D)]

1. Documentation of tests and inspections does not mean certification or validation by a third party or by signature [29 CFR 1910.119 preamble].

Per CCHMP review of various databases and equipment files/folders, P66 has documented each inspection and test that has been performed on the process. See A15-06 for more detailed discussion on the documentation.

Y NoneAbr




Does the inspection and testing documentation identify: (a) the date of the inspection or test, (b) the name of the person who performed the inspection or test, (c) the serial number or other identifier of the equipment on which the inspection or test was performed, (d) a description of the inspection or test performed, (e) the results of the inspection or test? [T19 CCR §2760.5(d)(4) & Section 450-8.016(a)(5)(D)]

For the Metallurgical Engineering and Inspection department (ME&I) which deals only with fixed equipment such a vessels, exchangers, PSVs, piping, all inspection and testing data is maintained in the PCMS (plant conditioning monitoring system). CCHMP has reviewed data in the PCMS for select equipment.

1) From Unit 110, E-04. Per the PCMS database, the last internal was conducted 2/26/12. The last external was completed on 1/20/17. Per CCHMP review the external inspection report included some action items which are scheduled to be completed during the next turnaround in 2022. CCHMP reviewed the turnaround work scope and verified that these action items were on the list. 2022 is also the next scheduled date for the internal and external inspections.

2) From Unit 110: PSH-09. Per the PCMS database the following inspections have been done: on 2/23/12 there was a dead leg inspection done on the piping system. This piping system has also had recurring PMI, retro PMI, and external inspections. P66 has evaluated an area of this piping circuit that was chrome and did a PMI map and report. As a result, all the low-chrome piping is going to be upgraded to 5Cr. The report was done on 5/5/15 and the work has a scheduled due date of 5/15/20. CCHMP has reviewed the active CMLs for this piping system as well in PCMS on the CML tab. This tab includes the readings taken, the next inspection date (based on the API corrosion rate formula) and an estimated retirement date for the piping system.

3) From Unit 110: P-SH15: This is the line to the PSA. Per CCHMP the external inspection was last done on 7/15/16 with a prior done in 2012. Per the 7/15/16 inspection no repairs were needed. The internal inspection was done 1/18/17.

4) From Unit 110; P-SH18 with a last external done 7/15/16

5) From Unit 110: V-02 (H2S reactor). The last internal was done 1/12/17 and external 6/26/16. Per

R NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeCCHMP review the internal thickness readings have an API inspection report as an attachment. UT results are in PCMS in the CML tab.

6) CCHMP reviewed various PSVs from the PSV database:-- Unit 40: PSV U-383 is tested every 10 years. The last test was done on 1/18/17. The pop test results were 251, 244, 250 psig. The PSV is set for 250 psig. -- Unit 244: 5PSV-3 was tested 10/25/2004, 3/17/2009, and 6/23/2015. In 2015 it was redesigned and installed as a new valve The new valve did not pass the pop test so it was rebuilt and popped at 320 psig. The PSV is set to pop at 315 psig. Per P66 there is a 25% tolerance range for pop tests.-- Unit 228: PSV-408 was tested in 2008 and on 1/15/15. The PSV is set to pop at 190 psig and the test showed the PSV popped at 200 psig. PSV-501 was tested 1/15/15 and before that in 2008. In 2008 it popped at 152 psig and in 2015 popped at 148 psig. The PSV is set at 150 psig. PSV-502 was tested on 1/23/15 and popped at 155.97 psig with a set point of 150 psig. There is a recommendation to replace this at the next service.-- Unit 267: PSV-1506, which is a new PSV. There are two entries for this PSV. One on 7/15/14 which is when it was new and it tested good for set point of 525 psig. In 10/28/14 it underwent its first repair and passed the pop test at 526.7 psig. PSV-1507 is a new PSV like 1506 with the same set pressure and passed the pop test at 527 psig. PSV-1518 was tested 12/17/2001, 1/13/2011/ and 8/20/2014. In 2014 it popped at 294 psig set at 295 psig.-- Unit 240: 2PSV-2 test history shows it was tested 10/30/2004, 3/29/2009, and 3/7/2016. All pop tests were good.

CCHMP reviewed the following rotating equipment, IPL, and SIS many of these items were selected from PHAs where they were listed as safeguards:

*Unit 246: 8LI070, 8FT-007A/B/C, and 8FT-010A/B/C. Per CCHMP review 8LI070 is an IPL not SIS rated and it has not been tested, the 8FTs are on a 75 month frequency and were calibrated on 12/4/15. CCHMP reviewed the signed off


ID# Category Question Clarifications Findings Answer ActionsTypecompleted testing procedures in the Unit binder.

8FT019A/B/C testing data could not be found. 8XV-005 CCHMP reviewed the function test from the binder. 8PSV-27A/B/C was an IPL and has not been tested. 8XPV-108 and -109 were also IPLs and not tested.

*Unit 228: 228TE/TT-538/539/540/541 all were last calibrated on 12/2/16. 228G-540 is a spare pump. CCHMP reviewed the pump history and verified that the PMs have been completed on time.

*Unit 244: 244XV-2031 and 244XV-2066 dual crucial check valves. CCHMP was able to review documentation that these test were completed on time and contained the correct information listed in a-e.5SIS I-4 was last tested on 8/20/15.

All the records reviewed by CCHMP included the required information in A-E of this question.

CCHMP also reviewed various documents related to damage mechanism studies at P66. Per interview the facility is currently working on completing all their damage mechanism reviews. These studies are called Corrosion Risk Assessments. CCHMP reviewed the corrosion risk assessments for Units 267 and 229. CCHMP also notes that in the MI database there is a tab for each piece of equipment where damage mechanisms that can occur are documented (e.g. CUI, SCC). Per CCHMP review of the PHAs, the PHAs also include a damage mechanism questionnaire which ask broad questions related to corrosion and damage mechanisms to foster discussion on what the MI team is doing and also to help the team look at consequences of deviations related to the damage mechanism. CCHMP also evaluated three cases where inspection frequencies were accelerated and changes made to a unit due to the observance of damage mechanisms. The three cases are as follows:

1) Ammonium Bisulfide DM found in the hydroprocessing area at a spec break of a stagnant zone of piping. They currently have done a


ID# Category Question Clarifications Findings Answer ActionsTypetemporary repair complete with MOC. P66 has increased the inspection interval to every 12 months and are in the process of evaluating whether or not it is necessary to alloy up.

2) A vacuum tower overhead is not being monitored once a month as sudden accelerated corrosion was found. They have a plan to repair in 2018 and have placed an Inconel patch on the affected area and are monitoring it once a month.

3) Bubble Tower had a leak at the bottom piping. They have inspected the piping and found corrosion. They replaced 200ft of piping and will replace the rest at the next turnaround.


Has the stationary source corrected deficiencies in equipment that are outside acceptable limits before further use or in a safe and timely manner when necessary means are taken to assure safe operation? [T19 CCR §2760.5(e) & Section 450-8.016(a)(5)(E)]

1. The acceptable limits should be defined under T19 CCR §2760.1(c), process safety information.2. Equipment found operating outside acceptable limits does not have to be shut down if other protective measures and continuous monitoring are available, and the deficiencies are corrected in a "safe and timely manner." [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard].

CCHMP has reviewed the backlog for P66. Per CCHMP review, since 2013 the weekly maintenance plan schedule compliance (e.g. completion of work) has averaged around 80%. CCHMP feels this level is backlog is comparable to other sites. CCHMP also reviewed the number of temporary repairs that were currently outstanding at the time of the audit. There were 85 outstanding temporary repairs.

Y NoneAbr


Does/did the stationary source assure that equipment as it is fabricated is suitable for the process application for which they will be used (in the construction of new plants and equipment)? [T19 CCR §2760.5(f)(1) & Section 450-8.016(a)(5)(F)]

* Review and document the criteria used for QA/QC of process equipment as it is fabricated – ask engineering department or equivalent.1. A QA/QC process includes providing the vendors with equipment performance and materials of construction requirements, and shop and field testing such as leak tests, hydro tests, operating curve tests, etc. [CCHMP Interpretation]

Per CCHMP review, P66 has a PSSR program which is used to ensure equipment is fabricated and installed correctly prior to start up of the process. See A17 for a description of PSSRs that CCHMP reviewed and a description of the PSSR program. CCHMP also reviewed the QAQC process and verified that equipment is checked to ensure it is suitable for the process and is installed correctly.

Y NoneAbr




Does/did the stationary source assure that appropriate checks and inspections have been performed to assure that equipment is installed properly and consistent with design specifications and the manufacturer's instructions? [T19 CCR §2760.5(f)(2) & Section 450-8.016(a)(5)(F)]

* Review and document the criteria used for QA/QC of process equipment as it is installed.1. This includes project monitoring, field weld X-rays, system leak checks, system hydro tests, positive material identification, etc. [CCHMP Interpretation]

See A15-08 for a complete discussion of checks/inspections etc.

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the Mechanical Integrity Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted 2014 RMP accurately describes the MI program at P66.

Y NoneAbr




There were no ensure action items from the previous CalARP/ISO audit of this questionnaire. This question is not applicable.

N/A NoneAbr


A16 - CalARP Prevention Program: Management of Change (Program 3)

ID# Categor Question Clarifications Findings Answer ActionsType


Has the stationary source established and implemented written procedures to manage changes (except for "replacement in kind") to process chemicals, technology, equipment, and procedures? [T19 CCR §2760.6(a) & Section 450-8.016(a)(6)(A)]

* Review MOC policy to ensure the ISO stationary source has a process to conduct an ISSA for a “major change”, that could reasonably result in a MCAR. The policy should define what is considered a major change. Criteria for how site personnel would determine whether a change could reasonably result in a MCAR should also be included in policy.* Review MOC records for the ISO stationary source for any major changes and provide records to auditor doing A34 so ISS can be evaluated.1. "Replacement in kind" means a replacement that satisfies the design specifications [T19 CCR §2735.3(tt)].2. Examples of changes in process technology include (a) production rates (b) new equipment © change in catalysts (d) changes in operating conditions to improve yield or quality [OSHA 3133, PSM Guidelines for Compliance, 1994].3. Examples of changes in equipment include (a) materials of construction (b) piping arrangements © alarms and interlocks [OSHA 3133, PSM Guidelines for Compliance, 1994].4. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].5. OSHA's PSM preamble identifies that changes made to operating procedures need to be handled through the MOC Program. Maintenance procedures were not specifically identified within the PSM preamble. The CalARP regulation states changes to "procedures" need to be managed and does not only limit it to

CCHMP has reviewed P&P 2.0-5, MOC (Management of Change) Policy, which was last revised on 07/27/2016. Per this policy, "The following MOC policy is required for all SFR Refinery operations. This policy covers the regulatory requirements, responsibilities, and procedures for MOC. The policy also documents which changes must undergo the MOC process."

This policy also documents other changes that could occur in the refinery which have a separate policy dictating the management of these changes. This includes: MOOC, Safe Work Practice Changes, Equipment and Testing Procedures, Building Changes, HSE policy changes, ME&I policy changes, bypassing of safety devices, turnaround interval extensions, emergency response plan, and temporary hose and piping.

CCHMP reviewed 17 completed MOCs as part of the audit. The MOCS reviewed were completed during the last three years (i.e. the scope of this audit)

CCHMP also reviewed one completed turn around interval change MOC approval form.

Per CCHMP review the MOC process does not cover new/modified maintenance procedures. Per interview with P66 this type of MOC has not been done. P&P 2.0-5 (MOC Policy) or Procedure 1.01 (Procedure Policy) needs to be updated accordingly to capture this.

P Ensure the MOCs are conducted for new and modified maintenance procedure and that P&P 2.0-5 or Procedure 1.01 is updated accordingly.

Abr


ID# Categor Question Clarifications Findings Answer ActionsTypeoperating procedures. Auditors need to verify that facilities with Program 3 covered processes have a way to manage changes to operating procedures through a MOC process and a formal policy or protocol to manage changes to maintenance procedures. [CCHMP interpretation]6. Examples of operating or maintenance procedure changes subject to MOC requirements include those that are beyond formatting, grammar, typographical errors, etc., and include changes, that are not associated with changes in process chemicals, technology or equipment. [CCHMP interpretation]7. Procedure changes that are independent of other changes require either that the MOC procedure/policy or separate procedures/policies clearly indicate that changes require a minimum of a technical basis/analysis, a health and safety review, and documentation of the above along with training and notification documentation, as appropriate. [CCHMP interpretation]


Do the Management of Change procedures address the impact of the change on safety and health prior to any change? [T19 CCR §2760.6(b)(2) & Section 450-8.016(a)(6)(B)]

* Review PHA's, meeting minutes, or other reviews conducted to ensure that the impact of the change on safety and health was addressed.1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].

CCHMP has reviewed 17 completed MOCs. Per CCHMP review the 17 MOCs reviewed included reviews of the impacts of the change to safety and health. This varied from doing a PHA to completing environmental and health and safety appraisals (forms R-42/R-42A and R-140/R-140A).

Y NoneAbr


Do the Management of Change procedures address modifications to and/or development of new operating and maintenance procedures prior to any change? [T19 CCR §2760.6(b)(3) & Section 450-8.016(a)(6)(B)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].

CCHMP has reviewed 17 MOCs. Of these, 2 MOCs were related to modifications of procedures. One was to modify the drum switching procedure and the other was to bring a temporary procedure out of archive.

None of the MOCs CCHMP reviewed were related to a modification of a maintenance procedure. See A16-01 for further details.

R NoneAbr




Do the Management of Change procedures address the necessary time period for the change prior to any change? [T19 CCR §2760.6(b)(4) & Section 450-8.016(a)(6)(B)]

* Review records on how temporary changes are tracked and how the changes are restored to their original or design conditions.* Review the procedures and policies in place that address when a temporary change can be kept longer than specified in the MOC. 1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].2. Time limits should be defined for all temporary changes and monitored. Since otherwise, without control, these changes may tend to become permanent. The MOC procedure must also address how equipment and procedures are restored to their original or design conditions at the end of a temporary change [OSHA 3133, PSM Guidelines for Compliance, 1994].

CCHMP has reviewed 17 completed MOCs of these 3 were temporary MOCs. Per CCHMP review, the MOC package clearly states the temporary change expiration date. Per CCHMP review none of the temporary MOCs were extended.

Y NoneAbr


Do the Management of Change procedures address authorization requirements for the proposed change prior to any change? [T19 CCR §2760.6(b)(5) & Section 450-8.016(a)(6)(B)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].2. Information needs to be maintained at the stationary source to document the authorization of the proposed change. This information should include authorization signatures and/or initials from individuals with the authority to approve the change. [CCHMP Interpretation]

Per CCHMP's review of 17 completed MOCs, 1 of the 17 MOCs indicated that start up was authorized before all the necessary MOC items were completed. This was MOC M20146493-001

CCHMP also reviewed 8 impact reports in which the impact report (investigation) shows that MOCs were started before all required items were completed. Please refer to A19-01 for further details on the impact report numbers to correspond to the MOCs.

P Ensure the MOC authorization for start up does not occur before the required MOC items are completed.




Are employees involved in operating a process informed of, and trained in, the change prior to start-up of the process or affected part of the process? [T19 CCR §2760.6(c) & Section 450-8.016(a)(6)(C)]

* Review training records or meeting minutes to show that affected employees were trained in the change.1. OSHA intends that the requirements for communication and training be completed prior to start but not necessarily before the change is made [29 CFR 1910.119 preamble].2. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].

Per CCHMP review of 17 completed MOCs, CCHMP noted various inconsistencies with the training documentation. This includes some MOCs stating there was an R-506 training form and the documentation uploaded did not include such form (per interview this is an optional requirement for that MOC so CCHMP was unable to verify if they had chose to fill out an R-506 and didn't upload it or if the MOC mistakenly said an R-506 should be there). Another item noted by CCHMP in 3 MOCs was that the training documentation form R-506 did not list exact dates of the training but rather stated "various dates", based on this CCHMP was unable to verify that training was completed in the proper MOC time frame.

Additionally CCHMP noted that for MOC where the training was simply a notification to operators the documentation in KMS is a screen shot of the night notes informing operators of the MOC. There is a section in the night notes where operators are supposed to check that they have read the MOCs but there is no system to ensure they do or hold them accountable.

The issues noted by CCHMP are not indicators that employees are not trained prior to the start-up of the process rather they are areas for improving the program to ensure that P66 is able to verify that training was done appropriately, therefore only consider items have been issued for these.

Y NoneAbr




Are maintenance employees whose job tasks will be affected by a change in the process informed of, and trained in, the change prior to start-up of the process or affected part of the process? [T19 CCR §2760.6(c) & Section 450-8.016(a)(6)(C)]

* Review training records or meeting minutes to show that affected employees were trained in the change.1. OSHA intends that the requirements for communication and training be completed prior to start-up but not necessarily before the change is made [29 CFR 1910.119 preamble].2. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].

Per CCHMP review of the MOC program, the MOC database, KMS, includes a trigger to ask if maintenance employees will need training. Per CCHMP review of 17 completed MOCs, there was one example where maintenance training was needed and it was completed per the correct MOC timeline.

Y NoneAbr


Does/did the stationary source ensure that if a change results in a change in the PSI (§2760.1 and Section 450-8.016(A)(1)), that this information will be updated accordingly? [T19 CCR §2760.6(d) & Section 450-8.016(a)(6)(D)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].2. Sources should promptly update the PSI, at a minimum, PSI must be updated prior to the next PHA. (e.g., redline mark-ups of P&IDs need to be formalized). [CCHMP Interpretation]

Per CCHMP review of 17 completed MOCs, all MOCs which required updates to PSI ensured that this information was updated. P&IDs were usually uploaded into Livelink as redline copies, but other PSI reviewed by CCHMP were uploaded as final and revised per the MOC (examples of this included cause and effect diagrams, SOL list, etc.).

Y NoneAbr


Does/did the stationary source ensure that if a change results in a change in the operating procedures or practices (§2760.3 and Section 450-8.016(A)(2)), and/or results in a change in the written procedures to maintain the ongoing integrity of process equipment required by Section 2760.5 that such procedures or practices will be updated prior to the start-up of the process? [T19 CCR §2760.6(e) & Section 450-8.016(a)(6)(e)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the MOC audit questions) [T19 CCR §2745.11].2. For this regulatory requirement, “updated accordingly” is interpreted to mean update the written operating procedures or practices prior to start-up of the process. [CCHMP Interpretation]

Per CCHMP review of 17 completed MOCs, the MOC process addresses the development of new operating/maintenance procedures prior to the change. Examples CCHMP saw of this in the completed MOCs include development of operating procedures and development of ROL and SOL procedures.

Y NoneAbr




Do the submitted RMP and Safety Plan accurately reflect the Management of Change Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

Per CCHMP review of the 2014 RMP and 2015 SP, both accurately reflect the MOC program at P66.

Y NoneAbr





N/A NoneAbr


A17 - CalARP Prevention Program: Pre-Startup Review (Program 3)



Does/did the stationary source perform pre-startup safety reviews for modified stationary sources when the modification is significant enough to require a change in the process safety information? [T19 CCR §2760.7(a) & Section 450-8.016(a)(7)(A)]

* Review completed PSSR's and corresponding information. Employee interviews may identify changes to the regulated source which should have required a PSSR.1. A PSSR must occur if a change at a stationary source results in a change in PSI [CCC CAER MOC Workshop by Science Applications International Corporation, December 12, 2001]. (T19 CCR §2760.7(a))2. PSI must be modified before startup [OSHA Instruction CPL2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard, September 13, 1994].3. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the PSSR audit questions) [T19 CCR §2745.11].4. Modified Stationary Source means a stationary source which has undergone an addition or change which qualifies as a "major change" as defined in T19 CCR §2735(x) [T19 CCR §2735(bb)].5. Major change means introduction of a new process, process equipment, or regulated substance, an alteration of process chemistry that results in any change to safe operating limits, or other alteration that introduces a new hazard [T19 CCR §2735(x)].

Per CCHMP review of select MOCs from KMS and per interview, all MOCs completed by P66 include a PSSR.

Y NoneAbr




Does/did the stationary source confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that safety, operating, maintenance, and emergency procedures are in place and adequate? [T19 CCR §2760.7(b)(2) & Section 450-8.016(a)(7)(B)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the PSSR audit questions) [T19 CCR §2745.11].

Per CCHMP review the KMS system includes a verification check that is independent of the MOC check that procedures have been updated. Per CCHMP review of PSSRs completed, this check while not always done by a different person, has been done at a different time than the first check to ensure it is an independent verification check.

Y NoneAbr


Does/did the stationary source confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that training of each employee involved in operating a process has been completed? [T19 CCR §2760.7(b) (4) & Section 450-8.016(a)(7)(B)]

1. Sources with Program 1 or 2 covered process that are undergoing a covered process modification, as described in §2745.11, must develop procedures to manage that change and notify CCHMP that those procedures have been established (and answer the PSSR audit questions) [T19 CCR §2745.11].

Per CCHMP review, the KMS system includes a verification check that is independent of the MOC check that training has been completed. Per CCHMP review of MOCS and PSSRs completed there are two separate checks for training intended to be an independent verification check. See A16-08 for further discussion on training as per CCHMP review this could not always be verified.

R NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the Pre-startup Review Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted 2014 RMP and 2015 SP accurately reflects the PSSR program at P66.

Y NoneAbr





N/A NoneAbr


A18 - CalARP Prevention Program: Compliance Audits (Program 3)



Has the stationary source certified that they evaluated compliance with the provisions of this article at least every three years to verify that the procedures and practices developed under this chapter are adequate and are being followed? [T19 CCR §2760.8(a) & Section 450-8.016(a)(8)(A)]

* Review the signed and dated audit reports.1. The start point of the three-year compliance audit cycle under the RMP/CalARP program has the following effective dates: a) June 21, 1999 for stationary sources subject to the federal RMP program; b) June 21, 2002 for stationary sources subject to the state CalARP program, but not subject to the federal RMP program. [T19 CCR §2745.1 and CCHMP interpretation]2. The first compliance audit for stationary sources that comply with the federal PSM standard, 29 CFR §1910.119 is required by May 26, 1995. [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994]3. CalOSHA's PSM standard, T8 CCR §5189, does not specify a frequency for conducting the Injury and Illness Prevention Program audits. However, federal PSM specifies three years. CalOSHA uses the three-year frequency in their compliance checklist. 4. Employers must certify in writing that there has been a PSM compliance audit at least every three years [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994].

CCHMP reviewed a certification of Evaluation of Compliance for a compliance evaluation during September 2013. In an interoffice communication dated Dec. 17, 2013, it states that a "corporate operations excellence compliance audit" was conducted September 10-19, 2013.

CCHMP reviewed a certification of compliance for evaluation of the compliance audit performed in Aug 2, 2016 and it states that the Phillips 66 Corporate Health, Safety, and Environmental Auditing group conducts a formal audit of the site every three years to verify that the procedures and practices developed in accordance with the PSM and RMP regulations are adequate and are being followed and that a third party company conducted an audit for compliance with CalARP and ISO regulations.

CCHMP was provided an audit report titled " Process Safety Management Audit Report of the CalARP and Contra Costa Health Services Industrial Safety Ordinance (ISO) Risk Management Programs, August 2016" prepared by a third party and the audit performed Aug 1-5. This report covers 43% of the total CalARP/ISO topics. CCHMP reviewed section 4.0 of the report which identified that the majority of the PSM elements were assessed by the P-66 corporate audit team and the ISO requirement and some CalARP non-PSM topics were addressed by the third party contractor.

R NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeCCHMP reviewed a concurrent P-66 corporate audit that covered the PSM and RMP topics and the audit was conducted Aug 2-5, 2016. This was transmitted via an interoffice memorandum by a 11 member team from other refineries as well as from HSE auditing group. The memo identified one non-conformance to be of significant risk. See discussion of the completeness of the memorandum in A18-03.




Does/did the stationary source document the scope, methods used, results and findings in a report that is available for AA to review? [T19 CCR §2760.8(c) & Section 450-8.016(a)(8)(C)]

* Review the compliance audit reports. CCHMP was provided an audit report titled " Process Safety Management Audit Report of the CalARP and Contra Costa Health Services Industrial Safety Ordinance Risk Management Programs, August 2016" prepared by a third party, the report included purpose and scope (section 2), audit approach (section 3), and audit findings (section 4), and the audit worksheets were provided in appendices B. Section 2 of the report states the audit intended to cover the State of California and Contra Costa County Specific requirements and that compliance with the OSHA PSM and EPA RMP provisions was ascertained by a concurrent Health and Safety audit conducted by the Phillips 66 Corporate Audit Team. It also states the audit covered CalARP Risk Management Plan and the corresponding prevention program elements, and the County specific requirements (human factors, management of organizational change, Inherently Safety System, Security Vulnerability Assessments, Safety Culture Assessments). CCHMP noted a table in section 4 listed 210 of the 488 questions (43.1%) were non-observed by the company and these were addressed by the Phillips 66 Corporate Audit team. By examination, these were largely the PSM and RMP prevention program elements.

CCHMP reviewed a concurrent P-66 corporate memorandum that covered the PSM and RMP topics. The memo states "the audit was conducted using the PSM and RMP Self Audit checklist prepared by HSE Auditing and the audit included interviews of plant personnel (process and mechanical personnel); observation of

P Ensure the evaluation for compliance with the provisions of this article to verify that the procedures and practices developed under this chapter are adequate and are being followed is documented in a report that includes the results and findings and is available for review. (This is a modified repeat).

Abr


ID# Category Question Clarifications Findings Answer ActionsTypemaintenance and operations; inspection of plant facilities; and review of documentation. This 3 page documentation reported one non-conformance and it was considered to be of Significant Risk. However, there is no report that documented the results and findings of the assessment available for CCHMP to review. Similar lack of documentation was found during CCHMP's 2014 audit.


Does/did the stationary source promptly determine and document an appropriate response to each of the findings of the compliance audit and complete the resolution of these findings within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround? [T19 CCR §2760.8(d) & Section 450-8.016(a)(8)(D)]

1. The timeline shall not apply to any compliance audit completed prior to January 1, 2015. [T19 CCR §2760.8(d)]2. The stationary source may enter into an agreement with the AA for an extended timetable.3. Turnaround means a planned process shutdown for the purpose of repair, maintenance, process modification, equipment upgrade, or other significant process activity [T19 CCR §2735(aaa)].

Per P&P 14.0-6 (rev. 12/28/2016), Process safety related HSE audit non-conformances shall be identified and managed per the Phillips 66 Corporate HSE-Process Safety Incident Reporting Procedure. Per review of the third party audit report, a total of 10 recommendations were identified in the report by topics. Per interview with SME, the facility received the August corporate audit report on January 17, 2017 and therefore have not documented the response. There were no documented response to the Aug 2016 findings that were identified in the third party audit report. The due date for resolutions of these recommendations should be by 2/5/2018.

N Ensure that a response to each of the findings of the compliance audit is promptly determined and the resolution of these findings are completed within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround.

Abr




Does/did the stationary source document the actual completion dates when deficiencies were corrected? [T19 CCR §2760.8(d) & Section 450-8.016(a)(8)(D)]

* Review the documentation regarding tracking of changes to correct deficiencies, including how scheduled dates are changed.1. The stationary source needs to document the final resolutions taken and actual completion dates when deficiencies were corrected. [CCHMP interpretation]

CCHMP reviewed documentation titled HSE Corrective Action Status with the audit type being identified as "Corporate HSE Compliance Audit", there were 9 non-conformances listed, one of these is only related to the Carbon Plant. These 2013 compliance audit non-conformance are documented to be closed from between June 2014-Nov. 2014. Per CCHMP review, NC6 was documented to be closed with the following "This item was entered into IMPACT as an action item (#194893) with a Target Date …………for 2015 turnaround." Per CCHMP review of the impact record, this MI non-conformance was completed in 2016.

P Ensure that action items are not documented to be closed until the deficiencies are actually corrected.

Abr


Does the stationary source retain the two most recent compliance audit reports? [T19 CCR §2760.8(e) & Section 450-8.016(a)(8)(E)]

1. The start point of the three-year compliance audit cycle under the RMP/CalARP program has the following effective dates: a) June 21, 1999 for stationary sources subject to the federal RMP program; b) June 21, 2002 for stationary sources subject to the state CalARP program, but not subject to the federal RMP program. [T19 CCR §2745.1 and CCHMP interpretation]2. The first compliance audit for stationary sources that comply with the federal PSM standard, 29 CFR §1910.119 is required by May 26, 1995. [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994]3. Employers are required to retain the two most recent compliance audit reports, as well as the documented actions in response to audit findings. The purpose of this provision is to focus on any continuing areas of concern that are identified through the compliance audits [29 CFR 1910.119 preamble].

CCHMP was provided an audit report titled " Process Safety Management Audit Report of the CalARP and Contra Costa Health Services Industrial Safety Ordinance Risk Management Programs, August 2016" prepared by a third party, and an interoffice communication dated December 17, 2013 for a "Corporate Operations Excellence Compliance Audit" that was conducted September 10-19, 2013.

Per P&P 14.0-6 (rev. 12/28/2016), section D.9 "The refinery is responsible for retaining the audit report, creating and retaining the certification letter, and retaining records showing audit findings closure per the regulatory requirement to maintain the two most recent compliance audit reports."

Y NoneAbr




Does the submitted RMP and Safety Plan accurately reflect the existing Compliance Audits Programs at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

"Section 1.8 of the RMP (9/12/2014), p. 24 states "During the 2013audit, 10 non-conformance findings were identified. Of the 10 nonconformance's, none were considered to be of High Risk, one wasconsidered to be of Significant Risk, and nine were considered to be ofMedium Risk." Per CCHMP review of the Dec. 17, 2013 interoffice Communication, there were 9 non-conformances and the HSE Corrective Action Status.

Safety Plan (8/7/2015) p. 25-26 describes the compliance audit program at the facility.

P Ensure that the RMP is corrected to reflect that there were 9 non-conformances associated with the 2013 compliance audit.

Abr




The one ensure action was addressed in the August 2015 Safety Plan submittal. The ensure listed in A18-03 is a modified repeat of one issued in the 2014 audit.

R NoneAbr


A19 - CalARP Prevention Program: Incident Investigation (Program 3)



Has the stationary source investigated each incident, which resulted in, or could reasonably have resulted in a catastrophic release of a regulated substance? [T19 CCR §2760.9(a) & Section 450-8.016(a)(9)(A)]

* Review the Incident Investigation policy to ensure the ISO stationary source has a process to conduct an ISSA if the investigation recommends a “major change” that could reasonably result in a MCAR. They should have a policy that defines major change and have criteria for how site personnel would determine whether a change could reasonably result in a MCAR. Policy wording should also identify to complete ISSA as soon as administratively practicable after completion of the incident investigation report.* Review incident investigation records for the ISO stationary source for any qualifying recommendations that trigger ISS and provide records to auditor doing A34 so ISS can be evaluated.* Review how the stationary source defines a "near miss" and how and when they investigate a "near miss".1. This may include "near misses". "Near misses" are an incident that has the potential for injury and/or property damage. [Guidelines for Auditing Process Safety Management Systems - CCPS]2. The intent of an incident investigation is for employers to learn from past experiences and thus avoid repeating past mistakes [OSHA 3133].3. The CCHMP Notification Policy requests that stationary

CCHMP has reviewed P&P 10.0-1 (Incident Management Policy, last reviewed 01/03/2017). Per this policy, all injuries, incidents, and accidents must be reported immediately. The reported events are tracked in IMPACT and risk ranked to determine the type of investigation that will be done.

Per this policy:

-- "Any recommendation from an investigation of an incident that resulted in, or could have reasonably resulted in a catastrophic release of a regulated substance that proposes a major change that could reasonably result in a major chemical accident or release will have an inherently safety system analysis (ISSA)

-- Any recommendation from a root cause analysis investigation of an MCAR (major chemical accident or release) that proposes a major change that could reasonably result in a major chemical accident or release will have an ISSA

-- Any recommendation from an investigation conducted by the Contra Costa County Hazardous Materials Program of an MCAR (major chemical accident or release) that proposes a major change that could reasonably result in a major chemical accident or release will have an ISSA

-- The ISSA of a recommended change, as described by 14-16 above, will be conducted and completed as soon as administratively practicable."

CCHMP reviewed 23 incident investigations from 2015-2017, this included near miss reports and CalARP incidents.

CCHMP also reviewed, P&P 10.0-2, Safety Concern/Near Miss/ Good Catch Program (last revised 03/01/2016) which indicates that P66 has a process for capturing near miss incidents and multiple avenues for contractors and employees to report them.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypesources apply a root cause methodology to Major Chemical Accident or Releases as defined by County Ordinance Code Section 450-8.014(h).4. “Catastrophic release” means a major uncontrolled emission, fire, or explosion, involving one or more regulated substances that presents an imminent and substantial endangerment to public health and the environment. [T19 CCR §2735.3(m)]

As part of the review of incident list from the last three years CCHMP also identified incident investigations of instances when MOCs were found to not have been completed correctly. CCHMP reviewed selected MOC investigations from this list and reviewed the actual MOCs during a live navigation. Per CCHMP review many of the MOCs reviewed all indicated the same deficiency in the MOC program. CCHMP has highlighted this in A16-07. The impact reports reviewed by CCHMP are as follows:

1) 10/11/2016 U200 MOC Issue 101116-1 impact 276923; 2) 09/30/2016 MOC ISSUE MP30 Flare Line 093016 impact number 276378; 3) 09/09/2016 MOC Issue 0909162 impact number 275196; 4) 08/03/2016 U246 MOC Issue 080316-4 impact number 273346; 5) 08/03/16 U236 MOC Issue 080316-2 impact number 273281; 6) 07/29/2016 U250 MOC Issue 072916-4 impact number 272998; 7) 06/20/16 MOC issue 062016-1 impact number 271008;


Was a report prepared at the conclusion of every investigation? [T19 CCR §2760.9(d) & Section 450-8.016(a)(9)(D)]

Per CCHMP review of 23 investigations from 2015 -2017, a report was prepared at the end of each investigation.

Y NoneAbr




Does the incident investigation report include a description of the incident, including all of the data required under 2750.9(b)? [T19 CCR §2760.9(d) & Section 450-8.016(a)(9)(D)]

1. §2750.9(b) is the 5-year accident history, which includes: (a) date, time, and approximate duration of the release, (b) regulated substance(s) released, (c) estimated quantity released in pounds, (d) type of release event and its source, (e) weather conditions if known, (f) onsite impacts, (g) known offsite impacts, (h) initiating event and contributing factors if known, (i) whether offsite responders were notified if known, (j) operational or process changes that resulted from investigation of the release [T19 CCR §2750.9(b)].

CCHMP reviewed 23 investigation reports and verified that each of the 23 reports included a description of the incident and all the data required in a-j of this question's clarification.

Y NoneAbr


Does the incident investigation report include any recommendations resulting from the investigation? [T19 CCR §2760.9(d) & Section 450-8.016(a)(9)(D)]

Each of the 23 investigation reports reviewed included recommendations resulting form the investigation.

Y None




Did/does the stationary source promptly address and resolve the incident report findings and recommendations and document the resolutions no later than one and one-half (1.5) years after the completion of the incident investigation, or two (2) years after the date of the incident, whichever is the earlier of the two dates, or the next planned turnaround for those items requiring a turnaround? [T19 CCR §2760.9(e) & Section 450-8.016(a)(9)(D)]

1. OSHA developed criteria for justifiably declining recommendations formulated during incident investigations. a) The finding upon which the recommendation is based contains factual errorsb) The recommendation is not necessary to protect the health of employees or contractorsc) An alternative measure to the recommendation would provide a sufficient level of protectiond) The report recommendation is infeasible [Settlement between labor and industry (Chemical Process Safety Report - August 94)].2. Turnaround means a planned process shutdown for the purpose of repair, maintenance, process modification, equipment upgrade, or other significant process activity. [T19 CCR §2735(aaa)]

Per CCHMP review, the Incident Investigation policy 10.0-1 does not state that recommendations be resolved in 1.5 years after the completion of the investigation or 2 years after the date of the incident.

Per CCHMP review of 23 investigations from 2015-2017, IMPACT records the action item, assigned date, target date, and completed date. Per CCHMP review, only one action item from all the reports did not have a completed date that fell in the new 2015 CalARP regulatory update requirements. The action item exceeded the 1.5 year timeframe by 20 days. CCHMP does not feel this warrants an action item.

Y NoneAbr


Are incidents "tracked" in any way to identify "trends" that may lead to prevention/risk reduction?

1. "Tracking trends" is optional for stationary sources; however it would be beneficial if stationary sources implement similar "optional” activities.

Per interview with the SME, the IMPACT database (which among other items retains incident records) gives the SME the ability to query and trend incidents. Per interview this is done a few times a year and reported to upper management.

Y NoneAbr


Do the submitted RMP accurately reflect the existing Incident Investigation Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted 2014 RMP accurately reflects the Incident Investigation program at P66.

Y NoneAbr







N/A NoneAbr


A20 - CalARP Prevention Program: Employee Participation (Program 3)



Has the stationary source consulted with employees and their representatives on the development of the other elements of process safety management (other than PHA's)? [T19 CCR §2760.10(b) & Section 450-8.016(a)(3)]

1. The intent of "consult" is to exchange information, solicit input and participation from the employees and their representatives. It requires more than simply informing employees. [OSHA Instruction CPL 2-2.45A CH-1 Appendix B, September 1994]2. OSHA is looking for active participation - suggestion boxes and simple policy statements by management are not enough [OSHA co-sponsored PSM workshops in Spring 1993].3. Employers must consult with contractor employees to the same extent that they consult with direct-hire employees (subject to settlement terms) - contractor employer shares responsibility for ensuring that this is done [OSHA Instruction CPL 2-2.45A CH-1 Appendix B, September 1994].

Per CCHMP interview and per review of completed studies such as MOCs, MOOCs, PHAs, Incident Investigations, etc. employees and their representatives are consulted on the development of elements of PSM.

CCHMP has also reviewed 1.5 years worth of Joint Health and Safety Committee meeting minutes. The Health and Safety Committee is comprised of employee representatives and management. Per review of the meeting minutes the committee discusses various CalARP elements.

Y NoneAbr


Does the submitted RMP accurately reflect the Employee Participation Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016)]

The 2014 submitted RMP accurately reflects the Employee Participation Program at P66.

Y NoneAbr






There were no ensure action items associated with the previous CalARP/ISO audit of this questionnaire. This question is not applicable.

N/A NoneAbr


A21 - CalARP Prevention Program: Contractors (Program 3)



When selecting a contractor, does the stationary source obtain and evaluate information regarding the contract owner or operator's safety performance and programs? [T19 CCR §2760.12(b)(1) & Section 450-8.016(a)(11)]

1. This section applies to contractors performing maintenance or repair, turnaround, major renovation, or specialty work on or adjacent to a covered process. It does not apply to contractors providing the incidental services which do not influence process safety such as janitorial work, food and drink services, laundry, delivery or other supply services. [§2760.12(a)].2. Employers who use contractors to perform work in and around covered processes have to establish a screening process so that they hire and use only contractors who accomplish the desired job tasks without compromising the safety and health of any employees at a facility [OSHA 3133].

CCHMP reviewed the P&P Manual Section 6.3-1: SFR Contractor Safety Management Program, revised 2/9/2016. This policy establishes the minimum requirements and expectations for health, safety and environment (HSE) management of contractors and subcontractors by formalizing the HSE aspects of the contractor procurement process and the associated record keeping. The San Francisco Refinery (SFR) has selected IS NetWorld (ISN) as a partner in this policy to collect and review any contractor for work at SFR.

P66 uses the services of ISN, a third party contractor that has developed a database of safety performance of a good number of contractors. P66/Conoco Phillips has been using ISN for near 10 years. Per interview, all of the contractors working on or near the process at SFR are included in the ISN database.

Per interview with the SME, the facility reviews the following information available on the ISN database for each contractor hired new and all contractors that continue to work at the facility at the beginning of each year:- Fatalities in the past 3 years, this should be zero.- What incidents have happened in the past 3 years and what have they done to make sure it will not happen again. - Review situations that they may have received an Experience Modification Rate (EMR) above 1. EMR has to be below 1, If higher the SME will investigate why.- OSHA log: Total Recordable Incident Rate (TRIR), 3 year average If TRIR is =or<0.25, Grade is A and they will be used; if >0.25 to 0.99, Grade is B

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeand involves additional evaluation on the slightly elevated TRIR and corrections implemented; Grade C Contractor: 1.0 to <2.0, and this requires a variance as they don't meet the P66 requirements and will only be considered by a variance that requires management authorization; Grade D is 2.0 and higher, this will also require a variance issued with management and refinery leadership team approval which involves higher level of scrutiny.- If the company has multiple D grades, refinery manager has to sign off on the variance.

The written contractor safety program referenced above has established minimum safety programs for each task that is done by contractors at the refinery. ISN assists in evaluating the contractors safety programs per P66 requirements and federal and state regulations. Per the contractor policy referenced above, the contract owner (the P66 management responsible for contracted work) in conjunction with the H&S Department shall assess the HSE risk of all contracted activities. Using the SFR HSE Risk matrix, the H&S reviews the work to be performed and assigns a Risk Ranking consistent with personnel hazard exposure and potential severity of related consequences. The risk ranking categories by work activity are listed below:- Risk Level 4 - High: Specialty High Risk Work, examples include inert entry or working on energized equipment- Risk Level 3 - Significant: Mechanical work and services where an elevated risk is involved, examples include construction within process units or work involves safe work practices.- Risk Level 2 - Medium: Contract Companies who may work in the process areas with hands on but generally not on


ID# Category Question Clarifications Findings Answer ActionsTypeprocess equipment. Examples include field engineers or consultants who work in the process unit or contractors who work on equipment not located in or on the process units or equipment. Risk Level 1 - Low: No hands on work at SFR,

CCHMP reviewed a list of Risk Level 3 and 4 contractors used by SFR and noted that that it includes about 170 contractors on the list. Per interview, about 50 contractors are used per year at the Rodeo refinery.

CCHMP observed a live navigation of five contractors on the ISN database and the printouts from 3 which the facility uses for contractor prequalification. The information generally included the number of citations, the EMR, the number of fatalities, the Safety Program, and the TRIR. Each of these programs receives a grade. The information also includes a list of all of the training programs and policies related to safety that each contractor requires their personnel to know. Each also has a link to open the individual policy or program from the individual contractor for review. There also is a list indicating what work type the contractor can perform. One contractor work scope reviewed included general contractors, turnaround contractor, routine maintenance, mechanical, electrical and instrumentation; another contractor work list included several items related to I&E; and another contractor's work included general mechanical contractor, machine installation/troubleshooting/repair, compressor/turbine.




Does/did the stationary source periodically evaluate and document the evaluation of the performance of the contract owner or operator in fulfilling their obligations as specified in T19 CCR §2760.12(c)? [T19 CCR §2760.12(b)(5) & Section 450-8.016(a)(11)]

1. The employer must ensure through periodic evaluations, that the training provided to contractor employees by the contract employer is equivalent to the training required for direct hire employees [OSHA Instruction CPL 2-2.45A CH-1 Appendix A, September 1994].2. Employers must periodically audit contractor's performance in the field. A records review alone is not acceptable [OSHA Region VI presentations on PSM in January, 1994].

Per interview with the SME, every contractor is evaluated by ISN at the beginning of every year. The contractors that remain in the approved safety contractor group will be considered for future work or continuation of their current work at the refinery. All of the higher risk contractors, i.e., Level 3 and 4, are required to be a part of the ISN evaluation program. All contractors are required to update their safety data with ISN on an annual basis. If a contractor grade changes, the contractor program SME will be notified via ISN system updates.

P66 conducts two types of audits on the contractors working at the facility. The contractor audits consist of safety field audits and office audits. Pages 14 and 15 of the P&P Section 6.3-1 (referenced in A21-01) describe the requirements for conducting field safety audits and office audits.

Office audits are discussed in A21-05. Safety field audits are conducted each quarter. Each contractor Risk Rank 3 and 4 and a good number of Risk Rank 2's get the quarterly field audit. Per interview, generally the field safety audits takes about 45 minutes and it entails looking at their work site and how they deal with hazards, and how they conduct their work in the field. The field audits uses R996 form that is completed by the SME or a contract owner group hired by P66 with guidance from SME. The key elements of field safety audits included contractor safety program assessment, field work site audit including parts such as job set up including pre-job safety meeting, communication such as training on proper use of refinery radios, tooling including tool conditions and proper use, hot work and confined space documentation on site and emergency response including familiarity with emergency whistle sounds.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeThe facility completed 230 field safety audits in 2016, almost one audit per quarter for all contractors on site. CCHMP reviewed 10 completed field safety audits that identified the name of the contractor and the date of the field audit, the name and signature of the auditor and the name and signature of the contractor supervisor.




Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job? [T19 CCR §2760.12(c)(1) & Section 450-8.016(a)(11)]

* Review contractor training records to determine whether there is documentation that contract employees have been trained in the work practices necessary to perform their jobs safely. [CalOSHA Consultation, Guidelines for Process Safety Management, Part 1, June 1994].1. The facility should be knowledgeable in how the contract owner trains contract employees. [CCHMP Interpretation]2. The facility should request/review documentation from the contract owner to ensure that only properly trained contractors work on or near covered processes. Stationary sources do not have to maintain the actual training records on site, but should maintain at least a record of the review process. [CCHMP Interpretation]3. For NAICS codes: 324110 or 325110: For contracts awarded, extended or renewed as of January 1, 2014, at least 30 percent of the skilled journeypersons are graduates of an apprenticeship program for the applicable occupation that was either approved by the chief pursuant to Section 3075 of the Labor Code or located outside California and approved for federal purposes pursuant to the apprenticeship regulations adopted by the federal Secretary of Labor. As of January 1, 2015, at least 45 percent, and as of January 1, 2016, at least 60 percent. [SB54_Section 25536.7, SEC 2 (b)]

As referenced in contractor policy, Contractor safety office audits address the contractor HSE management system including the contractor documented training/certification of contractor employees. Per the P&P Manual Section 6.3-1, Section G.6, "In addition to the initial review conducted during the prequalification process, the Contractor Safety Coordinator will coordinate a Contractor Safety Program Office Audit, of Category 3 & 4 (Significant and High Risk) Contractor Companies every 3 years using R-995 Form."

Per interview, the SME has conducted 6 contractor office audits in 2016, 4 audits in 2015 and 5 in 2014. The office audits consists of a visit to the contractor office to review the safety program management system and training documentation including skilled or craft training or certifications.

As referenced in A21-01, CCHMP reviewed a list of Risk Level 3 and 4 contractors used by SFR and noted that it includes about 170 contractors on the list. Per interview, there are about 120 contractors at Risk Level 3 and 4 that have actually been used in the past five years at the Rodeo refinery. Conducting only about five office audits seems to be well below the desired level as it would take over 20 years to complete office audits for all higher risk contractors ranked 3 & 4. The facility needs to conduct sufficient office audits of contractor programs so as all higher risk contractors are audited for their training within a reasonable timeframe (such as a maximum of 5 to 7 years).

CCHMP inquired for information on how P66 addresses H&SC Section 25536.7 requirements. Per interview, contracts with the facility contractors were signed

P Ensure that the contract owner or operator assures that each contract employee is trained in the work practices necessary to safely perform his or her job. The facility needs to follow their policy to coordinate a Contractor Safety Program Office Audit, of Category 3 & 4 (Significant and High Risk) Contractor Companies every 3 years.

Abr


ID# Category Question Clarifications Findings Answer ActionsTypefor 5 years before January 2014. There has been at least one new contract signed in 2016 by P66 and the requirement of H&SC Section 25536.7 apply to this contract employee qualification which utilized boiler makers and welders. Per interview and a review of the contract employees provided to P66 by the contractor, more than 90 percent of the skilled journeypersons were graduates of an apprenticeship program for the applicable occupations. The SB54 requirements were well met by this contract as the required percentage is 60 percent for the contractors hired after January 1, 2016. Per CCHMP review, the current contractor policy does not address the requirements of H&SC Section 25536.7 as part of the qualification of the contractors hired after January 1, 2016. Per interview, all of their remaining contracts with various contracting companies are existing and the terms do not expire until 2018.


Does the submitted RMP and Safety Plan accurately reflect the Contractors Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

The submitted RMP, dated September 12, 2014, pages 33-37, and submitted Safety Plan, dated August 7, 2015, pages 33-35, accurately reflect the Contractors Program at the stationary source.

Y NoneAbr




There were no ensure action items associated with the previous CalARP/ISO audit to be addressed here. This question is not applicable.

N/A NoneAbr


A22 - CalARP Emergency Response Program (Programs 1,2,3)


A22-01 Non Responding - Programs 1,2,3 CalARP & ISO

If the stationary source elects not to respond to accidental releases of regulated substances, have they developed and implemented an Emergency Action Plan as specified in T8 CCR §3220? [T8 CCR §5192(q)(1) & Section 450-8.016(a)(12)(D)]

* Verify the facility has an Emergency Action Plan. 1. Stationary sources are not required to respond to an accidental release of regulated substances.2. Stationary sources who will evacuate their employees from the danger area when an emergency occurs, and who do not permit any of their employees to assist in handling the emergency, are exempt from the requirements of developing and implementing an emergency response plan and other emergency response requirements identified within T8 CCR §5192(q) if they provide an emergency action plan (EAP) in accordance with T8 CCR §3220. The EAP includes (but is not limited to) escape routes, procedures for critical plant operations, head counting procedures, emergency reporting, alarm system, types of evacuations, and training.3. The EAP must be written, kept at the workplace, and made available for employee review.4. For those employers with 10 or fewer employees, a written EAP is not required, but the plan needs to be communicated orally to employees.

This is a responding facility. This question is not applicable

N/A NoneAbr




If the stationary source (with regulated flammable and/or regulated toxic substances) elects not to respond to accidental releases of regulated substances, has the stationary source documented that response actions have been coordinated with the local fire department and hazardous materials response agencies? [T19 CCR §2765.1(b)(1), §2765.1(b)(2) & Section 450-8.016(a)(12)(D)]

1. Stationary sources are not required to respond to an accidental release of regulated substances.2. Typically response actions for toxic regulated substances are coordinated with the CCHMP HazMat Team, the San Ramon Valley Fire Protection District in that area, Contra Costa Fire District, and if in Richmond, the Richmond Fire Department.


N/A NoneAbr


If the stationary source elects not to respond to accidental releases of regulated substances, are appropriate mechanisms and written procedures in place to notify emergency responders when there is a need for a response? [T19 CCR §2765.1(b)(3) & Section 450-8.016(a)(12)(D)]

* Verify the EAP contains procedures sufficient to address when and how to notify emergency responders.1. Stationary sources are not required to respond to an accidental release of regulated substances.2. The Emergency Action Plan (EAP) must identify the means of reporting accidental releases of regulated substances and other emergencies.


N/A NoneAbr



A22-07 Responding - Programs 1,2,3 CalARP & ISO

Does the emergency response plan include procedures for informing and interfacing with the public and local emergency response agencies about accidental releases, emergency planning, and emergency responses? [T19 CCR §2765.2(a)(1)(A) & Section 450-8.016(a)(12)(A)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement partially corresponds to T8 CCR §5192(q)(2)(A) and §5192(q)(2)(I).

CCHMP reviewed the P&P 8.0-1 'Emergency preparedness policies', (rev. 6/1/2015), and section B.5 identifies emergency response team and the Safety and Emergency Response Supervisor is responsible for periodically reviewing the requirements for emergency response, the frequency and adequacy of the training and drills, and maintaining and updating the manual. The policy also identifies that the Emergency response coordinator is responsible for the emergency response plan.

CCHMP reviewed sections of the Emergency Response Plan (ERP) (Oct 2015, rev. 15), section 2.2.4.2 states the public information officer will utilize the following system in the event of an emergency:-- Automated Community Information System (ACIS): allows the facility to send a pre-recorded telephone message to certain recipients in the local communities. This system was developed with input from a local community committee. -- ACIS sensitive receptors telephone ring down: selected recipients were identified as sensitive receptors and some members of the community who have requested this information service. This is only used for an emergency categorized as CWS Level 2 or other criteria warrant its use. This will not be used if there is a CWS Level 3 as agreed with Contra Costa County so it will not interfere with the County's Telephone Emergency Notification System (TENS).-- Community Advisory Panel (CAP): the ACIS system will be used to send message to CAP members for emergencies that are categorized as CWS level 2 or 3 (or if other criteria warrant its use).

Section 2.2.4.1 of the ERP, states "the initial Incident Commander, generally the Shift Superintendent is responsible for making the initial agency notifications in addition to CWS activation including CCCHSD, Rodeo-Hercules Fire Protection District, Crockett-

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeCarquinez Fire Department, Bay Area Air Quality Management District, Contra Costa County Office of Emergency Services (OES). CCHMP located a notification flow chart and the telephone numbers for initial notifications to NRC [National Response Center], States OES and USCG [US Coast Guard]. The CWS notifications follows the R-900. CCHMP reviewed the R900 (rev. 12/15) titled 'SFR Initial Notification Log', the form includes check marks for use of automatic notifications with the community warning systems, time when the callback is received and name of contact for CCCHSD, BAAQMD, SFR-Rodeo Environmental On-call, SFR-Rodeo Public Affairs, SFR-Rodeo Public affairs and SFR Operations Manager. If also includes phone notifications for Rodeo-Hercules Fire Protection District, Crockett Fire Department and CCCOES. The R-900 form also includes definition of CWS classification levels.

CCHMP also reviewed the Shift Superintendent Guidebook Annex 14, discovery tab, states "all small releases of hazardous materials (including any greater than a drip or puff but less than one barrel) and excessive odors are required to be reported to a SFR Supervisor, who is responsible for immediately reporting the release or odor information to the Shift Superintendent (by radio or phone). Even if emergency responders are not needed, the Shift Superintendent must determine if there are any internal and/or external reporting requirements for the release. Appendix A of the guidebook is the CCCHSD Incident Notification policy. CCHMP noted there are outdated contact information in the guidebook.

Per interview, the facility performs annual table top drill with various fire department and agencies including CCHMP.




Does the emergency response program include procedures for the use of emergency response equipment and for its inspection, testing, and maintenance? [T19 CCR §2765.2(a)(2) & Section 450-8.016(a)(12)(A)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement partially corresponds to T8 CCR §5192(q)(2)(K) and §5192(g).3. This includes fire water piping systems and hydrants, fire water pumps and drivers, fire trucks, SCBA, fire extinguishers, etc. [CCHMP Interpretation]

CCHMP reviewed P&P 8.0-10 'First Aid and Safety Equipment' (rev. 6/1/2015), pg. 2 listed standard equipment, inspection frequency by the department, inspection frequency by the Health and Safety Department and a description of the department check. For example, the SCBAs are to be checked weekly by the department and every 2 months by H&S; portable gas monitors (calibration) are checked daily by the department and as requested by H&S department, Safety showers and stationary eyewash stations are checked weekly by the department and every 2 months by the H&S department.

CCHMP reviewed P&P 8.0-12 'Fire Fighting Equipment', (rev. 12/5/2016), and it states 'equipment such as fixed fire water pumps, hydrants, monitors, hose, extinguishers and mobile fire apparatus are all inspected and/or tested on an annual basis.' CCHMP reviewed electronic test records of the pump stations (4 diesel pumps) that were started weekly by the Steam Power Plant operator to ensure the functionality. The annual fire hydrant (286 hydrant) and fire monitor testing was also reviewed for 2016. Per interview, the fire extinguisher are annually tested by a contractor that comes on site to examine and charge the fire extinguisher at the facility.

CCHMP also reviewed a PPE matrix (R-985, rev. 10/25/15) which identified for each chemical listed, the appropriate protection for respiratory, foot, body/skin, eye/face and hand. CCHMP also reviewed the 2016 record for the annual testing of the level A suits. Per interview, operators did weekly eye wash and safety shower operation tests. However, starting in 2017, the safety group will be performing flow test for the eye wash and the safety showers.

Y NoneAbr




Does the emergency response program include training for all employees in relevant procedures and relevant aspects of the Incident Command System? [T19 CCR §2765.2(a)(3) & Section 450-8.016(a)(12)(A)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement corresponds to T8 CCR §5192(q)(6), (7), and (8).

CCHMP reviewed P&P 8.0-7 'Emergency Response Team Participation Criteria (rev. 7/29/2016) section D specified the emergency response team members must attend and pass the training as defined in the San Francisco Refinery Emergency Response Plan. It further specified that ERT members who are members of Fire Brigade must attend:-annual Fire School,-quarterly ERT training-a minimum of 75% of monthly ERT Training sessions-a minimum of 75% of ERT Leader classes (if working ERT Leader)

Specialty Team members must:-pass a certified course to the technician level-attend 75% of quarterly team training sessions-pass an annual Individual skills demonstration and-may be assigned an emergency response pager

Emergency response team members must pass the Emergency Response Team physical. Fire Brigade leader must be trained and qualified for their role. Incident commanders must complete training that meets the requirements as defined in the HAZWOPER standard. Per interview with Fire Chief, training records are maintained to track personnel for their role which consist of fire brigade member, hazardous materials response, oil spill response, rescue, medical respond and incident command.

CCHMP reviewed training record for 5 randomly selected emergency response team members. This included the annual fit test reports for the most recent 2 years and training records for the quarterly team training sessions. CCHMP noted that of the record reviewed, one or 2 are missing some of the quarterly team training sessions.

CCHMP also reviewed Annex 5, section A.5.2.6 listed training for fire brigade

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTyperesponders as "trained personnel will have initial fire fighting training as specified in OSHA Fire Brigades California Code of Regulations 3411. Annual fire schools will be conducted to meet the requirements of the standard. Brigade members are required to attend an off-site school training every other year.

CCHMP also reviewed record of the 2016 evacuation drill and floor monitors drill.


Does the emergency response program include procedures to review and update, as appropriate, the emergency response plan to reflect changes at the stationary source and ensure that employees are informed of changes? [T19 CCR §2765.2(a)(4) & Section 450-8.016(a)(12)(A)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. Stationary sources need to have a program to periodically review and update their emergency response program. Relying on using the MOC process to make changes may not satisfy this requirement since the MOC process covers only what is being changed. The MOC process may not result in a complete or very frequent review of the response plan. [CCHMP Interpretation]

Per interview, the Emergency Response Coordinator, the ERPs are reviewed annually. CCHMP reviewed the table of content of the emergency response plan and selected various elements for review. The issue date of the plan was revision October 2015. ERP section II part 2, item 2.2.4 discuss notifications and refers to the Shift Superintendent Emergency Response Guidebook and use of the SFR Initial Notification Log. Per CCHMP review, the form includes the CWS levels, notification to CCCHSD, BAAQMD [Bay Area Air Quality Management District], SFR environmental On-call, SFR public affairs, and SFR operations manager as automatic notifications and phone notifications to RHFPD, Crockett/Carquinez Fire Department and CCCOES Sheriffs.

CCHMP noted in the Shift Superintendent Guidebook (rev. Nov. 2016) that the guidebook will be reviewed and updated at least annually or whenever necessary to reflect changes in procedures, response strategies, phone numbers, or regulatory requirements. Per CCHMP review of the guidebook, there are personnel listed in the contact that have been outdated for several years.

Y NoneAbr

A22-15 Programs 1,2,3 CalARP & ISO

Does the submitted RMP and Safety Plan accurately reflect the Emergency Response Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

Section 3.0 of the RMP (9/12/2014) and pages 36-40 of the SP ( 8/7/2015) generally describes the emergency response program at the facility.

Y NoneAbr






There were no action items associated with the 2014 CalARP/ISO audit for this topic. This question does not apply.

N/A NoneAbr


A24: ISO Section A - Management Systems

ID# Question Clarifications Findings Answer ActionsCategory Type

A24-01 Does the management systems program describe how senior Stationary Source staff members are assigned overall responsibility to oversee compliance for the Safety Program? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This may be documented in senior Stationary Source staff job function descriptions or competency models, the goals and responsibilities documented during regular performance reviews, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the facility's Health, Safety, and Environmental Management System (HDSEMS, PSM, RMP, CalARP, ISO) policy (PNP 15.0-2, last reviewed 12/20/16). This policy summarized the management system used to address company standards, applicable laws, various federal, state and local requirements. This policy identified that the facility maintains 15 elements within the HSEMS and that an owner is assigned to each. The HSE Manager has the overall responsibility for implementation of the HSEMS.

Each of the element owners are required to establish goals and objectives for their element and periodically report to various stakeholders that include the Joint Health and Safety Committee and other Refinery Leadership. Metrics associated with each of the 15 elements have been developed and incorporated into Refinery Leadership scorecards to monitor the site's progress at meeting HSE Goals and Objectives. The Refinery Leadership Team (RLT) meets at least annually with element owners to assess whether the site is doing as well as last year on the topic and how they can improve. The RLT makes sure that sufficient resources are in place to ensure that is not an impediment for achieving stated goals. The HSEMS program includes reporting HSEMS results to corporate and ultimately to the company's Board of Directors.

The 15 elements include: 1. Policy and Leadership2. Risk Assessment3. Legal Requirements & Standards of Operation

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Type4. Strategic Planning, Goals & Objectives5. Structure & Responsibility6. Programs & Procedures7. Asset & Operating Integrity8. Emergency Preparedness9. Awareness, Training, & Competency10. Non Conformance, Investigation, and Corrective Action11. Communications12. Document Control & Records13. Measures and Monitoring14. Audits15. Review.

Each of the HSEMS elements have been assigned to one of 5 phases of continuous improvement (numbers reflect HSEMS elements): -- Policy and Leadership (1)-- Plan (2-4)-- Do (5-12)-- Assess (13, 14)-- Adjust (15)

According to the facility's HSEMS policies, each of the CalARP/ISO Safety Program elements map to the 15 elements. In a number of cases there is overlap so select topics are listed more than once. Based on CCHMP review, this is how the HSEMS elements [listed in ()] map:-- (1) Contractors, Employee Participation, Management Systems, Security Vulnerability Assessments-- (2) ISS, MOC, PHA, MOOC, Compliance Audits, Hot Work, LOTO, Operating Procedures-- (3) Human Factors-- (4) Management Systems-- (5) Management Systems, Employee Participation, MOOC-- (6) Operating and Maintenance Procedures, Maintenance-- (7) Mechanical Integrity, Operating Procedures, PSI, MOC-- (8) Emergency Response, Incident Investigations


ID# Question Clarifications Findings Answer ActionsCategory Type-- (9) Training-- (10) Incident Investigations, RCA-- (11) Employee Participation, Management Systems-- (12) PSI, Management Systems, Mechanical Integrity-- (13) Management Systems, Incident Investigations-- (14) Compliance Audits-- (15) Safety Culture Assessment, Management Systems.

A24-03 Does the management systems program state how senior Stationary Source staff has established detailed Safety Program goals for management with specific objective and goals, and tracks management involvement in workplace safety meetings, audits, and related activities? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This may be documented in meeting minutes with record of attendees, or senior Stationary Source staff normal performance reviews, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

As described in A24-01, each HSEMS element owner is required to establish goals and objectives for their element and these must be discussed and approved with the RLT.

Per interviews with the Plant Manager, RLT members are required to attend various safety meeting throughout the year although these meetings are not specifically detailed within the HSEMS. Examples include, RLT members are required to rotate their attendance in the All Hands monthly CAST (Contractor Action Safety Team) meetings where they are required to present a topic. RLTs attend morning meetings that discuss operational issues, incidents, business matters and other issues. RLTs attend various safety meetings associated with their role (e.g., weekly in the process areas, maintenance). RLTs meet weekly with Division Heads to discuss status of their departments. CCHMP reviewed Joint Health and Safety Committee (JH&SC) meeting minutes from July 2015 through December 2016 and observed that three RLT members routinely attended these meetings.

Y NoneISO Abr



A24-04 Does the management systems program address: a) How senior Stationary Source staff is held accountable for their Health and Safety Program record, andb) How the rewards and penalties compare to those for production performance? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This may be documented in the senior Stationary Source staff normal performance reviews, or Stationary Source’s “score card” or “performance indicators”, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

CCHMP was informed that the entire facility is held accountable for their Health and Safety program record. CCHMP was informed that the facility has a variable cash incentive program that applies to everyone at the refinery and not just senior staff. This program is designed to assess three areas for contributing to the bonus program: 1/3 related to safety, 1/3 related to site-wide net income, and 1/3 related to site-wide operating expenses. For HSE: the facility tracks the number of API Tier 1 and 2 incidents. The facility also tracks API Tier 3 and 4 incidents. Increases in Tier 1 or 2 incidents reduces the site's multiplier for their variable cash incentive program. Similarly for personal safety and environmental issues, the more injuries or environmental impacts during the year, the lower their multiplier. Poor performance in HSE equates to a lower end of year bonus.

CCHMP was informed that senior stationary source staff monitor the site's HSE performance through various metrics through the use of scorecards. Each RLT member has their own scorecard designed to monitor select metrics. In reviewing five different scorecards, common metrics included: process safety and operational excellence, safety, environmental, regulatory, people, HSE management system, reliability, mechanical integrity, run the plant, and various business metrics. Metrics are further described in A24-06. CCHMP reviewed the following scorecards: HSE Manager, Operations Superintendent, Operations Manager, Technical Manager, and Refinery Manager.

Y NoneISO Abr



A24-05 Does senior Stationary Source staff address how the Stationary Source promotes “safety first” approach? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This should be apparent in the safety program policies and documents. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interviews with select RLT members, CCHMP was informed that safety is an item that is constantly discussed. For example, each meeting typically starts with a safety moment; daily morning meetings discuss safety as the first topic; company newsletters promote good examples of using stop work authority and near miss investigations; life saving rules are discussed and if not followed are written up as an incident.

CCHMP was informed that corporate required all sites to implement Life Saving Rules to prevent serious incidents and injuries. A total of 10 Life Saving Rules have been implemented and include:-- Protect Against Falls & Dropped Objects-- Verify Line-Up & Containment-- Control Hazardous Energy-- Follow Safe Rigging & Lifting Practices-- Operate Vehicles & Industrial Equipment Responsibly-- Perform Excavations Safely-- Assess & Mitigate Hazards Before Working-- Properly Plan & Execute Hot Work-- Work in Confined Spaces Safely-- Maintain Safety System Protection

P66 has a stop work program where an employee can stop a job if it is perceived as unsafe. CCHMP reviewed PNP 1.0-3, Procedures for Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard, last reviewed 11/10/16. CCHMP interviewed front line operators and maintenance personnel as well as management and consistently was informed that the stop work program onsite is effective and allows anyone (employee or contractor) to pause work if they believe something is unsafe. Positive examples of stopping work have been communicated in weekly

P Ensure the process to authorize exceptions to the Fatigue Management Standard is revised to match the requirements contained within the PNP.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typenewsletters to employees to encourage others to use this practice to make sure that all work is performed safely. The concept is promoted by the Plant Manager in the orientation video provided to visitors and contractors. Nevertheless, CCHMP believes that the title of the standard could be improved. Specifically, the title, "Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard", seems to be focused on an employee refusing to do work instead of a perception of trying to stop and correct an unsafe situation. CCHMP believes there is a difference between refusing to work and convincing others there is something unsafe than having the authority to stop work to make sure tasks are performed safely.

CCHMP was informed that the facility has a Fatigue Management Standard policy (PNP 1.1-22, latest revision 12/1/16). The intent of the Fatigue Management Standard is to improve safety at the facility by minimizing impacts associated with worker fatigue. In reviewing this PNP, CCHMP confirmed that the facility has adopted API RP 755 on fatigue risk management (e.g., for 12-hour operations: maximum 7 consecutive shifts during normal operations; and a maximum of 14 consecutive shifts during outage, turnaround and special projects). The facility's PNP contains an exception process for the limits listed in the fatigue policy. In reviewing select Exception Process Approval Forms, CCHMP was unable to confirm that the facility's PNP is being followed. Specifically, the PNP identified that the Plant Manager is to authorize a worker to exceed the maximum number of consecutive shifts although in documentation reviewed for December 2016 and January 2017 none of the forms were signed by the Plant Manager; instead they were signed by a Health & Safety Supervisor and Process


ID# Question Clarifications Findings Answer ActionsCategory TypeShift Supervisor. The exception form identified that the Plant Manager is to authorize the employee to work if the employee is to exceed 8 consecutive shifts, which means if working 9 or more shifts. It is also unclear to CCHMP why no fatigue exception is required for 8 consecutive shifts (versus exceeding 8 consecutive shifts) when the listed maximum is 7 consecutive shifts. CCHMP found that one exception form was completed for someone working 8 consecutive shifts, which is consistent with management interviews.



A24-06 Does senior Stationary Source staff periodically review the Safety Program management system for: a) Continuing appropriateness;b) Adequacy; andc) Effectiveness? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. Documentation of these reviews may be in meeting minutes, study reports, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

CCHMP was informed that during RLT meetings as well as department meetings, metrics are reviewed that provide an overview of the health of a program. For example, at RLT meetings monthly reports for incident investigations, PHAs, MOCs, compliance audits, etc. are reviewed for due date compliance. The reports reviewed for PHAs include the number of action items coming due in the next 90 days.

CCHMP reviewed scorecards maintained by some of the RLTs members for 2016. Scorecards are used by RLTs and others to monitor select information, including metrics that apply to monitoring the health of the safety program. For example:-- Number of overdue temporary MOCs-- Number of incidents tracked (near misses, first aids, recordables, fires, etc.)-- Percent compliant with HSE required standards-- Percent compliance with regulatory training-- Number of SOL/ROL/EOL exceedances-- Number of relief devices activated-- Number of mechanical trips-- Number of SIS trips (total and spurious)-- Number of SIS trips that failed to activate-- Number of SISs bypassed > 12 hours-- Number of overdue MOCs-- Number of emergency operating drills completed versus planned-- Number of pressure vessel and piping fitness-for-service evaluations outside of acceptable limits-- Number of Tier 1 or 2 events-- Number of other process and critical utility leaks-- Number of overdue inspection work requests-- Percent of engineering mentors assigned to new hires-- Percent of weekly maintenance plan

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeschedule compliance

Each element owner is required to monitor their element performance. Periodically, each element owner is required to report out on their topic to the site's Safety Leadership Committee, which includes RLT members. On an annual basis each element owner is required to lead a detailed review of their element to complete an HSE Management System Assessment. This annual assessment involves each element being evaluated under the corporate framework through the completion of an assessment checklist. A relative score is developed for each element and summarized as the site's total score, which is compared to the site's score from the previous year. CCHMP was informed that corporate expects every site to have continuous improvement so the scores should increase over time.



A24-10 Does senior Stationary Source staff ensure that there is expertise available in each of the different Safety Program elements, including Human Factors? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This includes proper training and background experience. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview and documentation review, the facility's human factors program has been integrated into various onsite programs. For example, personnel in the PHA Program complete a human factors latent conditions checklists (LCC); personnel in the Training Program complete LCCs associated with operating procedure development; personnel in the Incident Investigation Program complete LCCs associated with significant incident investigations. As such, onsite expertise for human factors has been expanded to multiple individuals.

As described in A24-06, the facility developed a management system that, among other things, assesses the adequacy of staffing in the various safety programs. Meetings are held to confirm the various goals and objectives of each management system element are being met and part of this evaluation is making sure sufficient resources are made available. As described in A29-01, the facility has a process to manage personnel changes to ensure that the experience level is maintained. Through this program, the level of expertise in the various safety programs is maintained.

Y NoneISO Abr



A24-11 Does senior Stationary Source staff allocate time and resources for the different Safety Program elements? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. Documentation of allocated resources may include budget line items, sufficient personnel assigned to develop and implement the Safety Program elements, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

CCHMP was informed that one of the functions of the periodic HSEMS reviews with the Refinery Leadership Team is to verify sufficient resources have been made available to accomplish the element owner's stated goals and objectives. Per interviews with the Refinery Manager, meetings are held daily and weekly on a number of topics that center on verifying sufficient resources are made available to perform tasks, which include safety program topics.

Also, CCHMP reviewed Joint Health and Safety Committee (JH&SC) meeting minutes from July 2015 through December 2016 and confirmed that safety program topics were discussed.

Y NoneISO Abr



A24-15 Does the Safety Program address the communications between appropriate personnel in the organization (such as between shifts)? [Section A.1.2.1 of the CCHMP Safety Program Guidance Document]

Per interviews with the Refinery Manager, he is tasked to specifically communicate safety and environmental principles to the workforce and to lead by example. The Refinery Manager performs field visits weekly for a number of reasons, including to communicate these principles and to hear what the workforce has to say. CCHMP was informed that similar routes of communication happen for other RLT members.

One of the main routes for communicating information on the front line is during shift turnover. The facility uses an electronic shift communication program called OIS for each position (e.g., field operator, board operator, shift supervisor) to record select information that happened that shift to ensure it is adequately communicated to the next shift. This system is designed to complement the verbal turnover that is given at every shift change. CCHMP reviewed OIS records for a board operator shift change for several units. Each OIS board log included the same minimum amount of information such that important information is properly communicated. For example, whether any safety or environmental limits were exceeded; whether there were any SOL exceedances; whether any emergency shutdown systems or relief systems were bypassed; whether there are any safety equipment inadequacies; shift operations status; equipment issues; maintenance issues. The logs reviewed also included an overview, as in, bulleted list of major activities performed that shift. CCHMP noted that these logs also documented that the operator reviewed the MOC log for any new MOCs put in service since they last worked, and they reviewed the night instructions and the previous shift handover with the outgoing operator.

Y NoneISO Abr



CCHMP was informed that the facility issues newsletters and weekly safety messages that highlight successful process safety activities such as stop work. Also communicated was the process to report a safety concern in paper Near Miss Green Cards or electronically under the Quick Links portion of their intranet, or through making a notification in SAP.

CCHMP reviewed select employee publications (e.g., SaFeR CONNECTIONS, VPP Newsletter, News Cast). Contained within these publications are metrics (e.g., environmental events, total recordable injury rates). A Safety Express was listed that communicated the Safety Culture Assessment completed in late 2015.

Corporate started a biennial employee survey called VIEWPOINT. This anonymous survey allows all employees to express their opinions to leadership and the results are provided back to the workforce.

A24-17 Do the Safety Program elements include the Stationary Source's personnel's specific responsibilities for managing Safety Program elements development and implementation? [Section A.1.2.2 of the CCHMP Safety Program Guidance Document]

As previously described, each of the various safety programs fall into one or more of the facility's HSEMS 15 elements. The facility's PNP 15.0-2 (HSEMS policy) details how personnel assigned as element owners monitor their elements. Also, the HSE Manager (RLT member) is assigned overall responsibility to champion the HSEMS and make sure the element owners develop their elements and implement them properly to achieve continuous improvement in HSE.

Y NoneISO Abr



A24-19 Are the job descriptions collectively reviewed to be sure that there are no gaps in coverage? [Section A.1.2.2 of the CCHMP Safety Program Guidance Document]

1. Job descriptions include job function descriptions.2. Competency models or task assignments could be considered job function descriptions.

Per interviews, the facility is required to develop a Refinery Playbook that identifies how the business will be run to achieve site and corporate goals, including goals related to HSE. The facility developed such a playbook. This playbook incorporates the use of scorecards and HSEMS program elements to achieve their goals. One of the early parts of the playbook is to evaluate staffing and assignments to make sure they are sufficient to reach their goals. Refinery goals are typically established at the Refinery Manager level and then complementary goals are developed by the RLTs, department heads, supervision and on down through the organization. Departments review their staffing needs with the goals in mind and evaluate how they can be accomplished with their current staffing and experience. If additional resources are needed, meetings with management are held to prioritize the appropriate workflow. The HSEMS process requires periodic review and discussion to verify the goals can be attained.

CCHMP reviewed job descriptions for select positions (i.e., Technical Services Manager, HSE Manager, H&S Team Leader, Process Safety Director, Senior H&S Consultant, Supervisor Process Engineer). CCHMP found the job descriptions matched the duties specified within the Refinery Playbook Guideline (RE-00-UP-01, rev 1.0, dated 10/3/16).

CCHMP was informed that the facility's Management Of Personnel Change (MOPC) process is used to make sure the experience level of personnel is maintained associated with staffing changes. Since the facility has been complying with county ISO requirements for some time, the MOPC process is used more than the review of individual

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typejob descriptions as necessary capabilities have been incorporated into the various positions and changes to them primarily need to maintain those capabilities.

A24-20 Has the Stationary Source developed leading and lagging metrics to measure the effectiveness of the Safety Program elements including establishing an initial baseline? [Sections A.1.2.3 and A.1.2.8 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources should implement effective leading and lagging process safety metrics consistent with those identified in Section A.1.2.8 of the CCHMP Safety Program Guidance Document and/or API RP 754. 2. The Stationary Source should develop metrics that promote broad awareness of process safety concerns, some of which may not be related to an actual or potential catastrophic incident. [Section A.1.2.8 of the CCHMP Safety Program Guidance Document]

Select leading and lagging metrics monitored by senior management were summarized in A24-06. These metrics were listed on various scorecards maintained by select RLTs. CCHMP noted that a number of these metrics followed the four tiers listed in API RP 754 and were aligned with the County's Safety Program Guidance document, Section A. Although CCHMP was not provided with details on individual metrics (i.e., monthly, quarterly, annual values), CCHMP was informed that many of these metrics were monitored prior to being added to the County's Safety Program Guidance document.

Y NoneISO Abr

A24-22 Are changes to the different Safety Program elements policies and procedures based on the following:a) Evaluation process of the management systems;b) The auditing of the Safety Program; andc) Input from the employees? [Section A.1.2.4 of the CCHMP Safety Program Guidance Document]

1. The management system should have written policies and procedures for review of Safety Program elements policies that ensure effectiveness of the program. This may be included in the Management of Change process.

As mentioned in A24-01, the HSEMS Program is based on the continuous improvement cycle of: Policy & Leadership, Plan, Do, Assess, Adjust. Each of the various 15 HSEMS elements along with the corresponding CalARP and ISO programs are listed in A24-01. As previously described, the facility monitors the performance of each of these areas and makes changes to them as necessary. CCHMP was informed that the primary mechanism for employees to provide input to various safety programs is through the JH&SC although comments can be made to any manager at any time.

Y NoneISO Abr



A24-26 Has the Stationary Source worked with CCHMP in preparing for public meetings associated with the Industrial Safety Ordinance and participated with CCHMP in these meetings as requested? [Section A.1.2.7 of the CCHMP Safety Program Guidance Document]

In the past, Phillips 66 worked with CCHMP when requested to prepare for public meetings associated with the Industrial Safety Ordinance. CCHMP has not made any such requests in recent years as we are attending public venue events.

Y NoneISO Abr

A24-27 Does the submitted Safety Plan accurately reflect the existing management system at the Stationary Source? [Co. Ord. Section 450-8.016 and Section E.2 of the CCHMP Safety Program Guidance Document]

The Safety Plan submitted to CCHMP on 8/7/15 accurately reflects the existing management system onsite with one exception. Page 43 of the SP identified that two members of the senior staff are members of the JH&SC; whereas CCHMP found that three members have been attending these meetings. CCHMP does not believe it is necessary to list the number of senior staff on the committee in the RMP.

Y NoneISO Abr

A24-28 Have all ensure action items associated with the previous ISO audit of the Stationary Source been addressed within this prevention program questionnaire?

* Complete the status column in the previous ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.1. This question is only applicable to Stationary Sources that have had prior ISO audits by CCHMP.

Both of the ensure action items CCHMP issued during the previous audit associated with this regulatory topic have been completed.

Y NoneAudit Follow-Up

Abr


A25: ISO Section B - Latent Conditions


A25-02 Does the written human factors program include:a) Staffing;b) Shift work; andc) Overtime? [Co. Ord. Section 450-8.016(b)(3)]

1. This question may be best addressed through a facility-wide or management system latent conditions checklist.

CCHMP reviewed the facility P&P Manual Section 3.0-2, Human Factors Program, revised 4/1/2016. This policy describes the human factors program as well as the training employees receive for human factors. Per this policy, the human factors program is to be addressed in the PHA process; incident investigation process for Major Chemical Accident or Release or for an incident that could reasonably have resulted in a Major Chemical or Accidental Release; consideration of human factors in the development of operations and maintenance procedures; conducting a Management of Organizational Change prior to staffing changes in permanent staffing changes in operations, maintenance, health and safety or emergency response; and the ongoing evaluation of management issues such as staffing, shift work and overtime. This policy also indicates that as part of addressing management issues, “A specific subset of the CCHS Latent Condition Checklist questions dealing with management of human factors issues such as staffing, shift work, overtime, etc. will be evaluated based on document review and discussions with employees and their representatives."

CCHMP also reviewed P&P Manual Section 7.0-3: Shift Relief Rules, last reviewed 9/1/2013. Per this policy, "No employee will leave the job until proper relief has been made or approval is obtained from the Supervisor. A shift handover checklist/operator log shall be used for each operating position. The checklist/log shall be used during the shift handover meeting to guide the discussion and ensure all key information

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeis covered."

CCHMP also reviewed P&P Manual Section 1.1-22; Fatigue Management Standard Policy, last reviewed 12/1/2016. This policy provides minimum requirements for a refinery Fatigue Management Program to reduce the likelihood of fatigue related incidents. This policy applies to all aspects of refinery operation including normal operating conditions, maintenance, start-ups, shutdowns, turnarounds, and project construction. In developing extended schedule, supervisors and scheduling personnel shall comply with the defined hours of service policy that are provided in tables for operations and maintenance staff. A Form R-682 "Fatigue Management Standard Hours of Service - Exception Process Approval Form" is required to be used for situations such as extended shifts greater than 14 hours or more than the maximum shifts in a work-set for the operational situation with less than the minimum time off prior to starting a new



A25-06 Does the Stationary Source ensure that personnel applying the latent conditions checklist are trained to understand that the intent of the checklist isn't to identify their errors, but rather to identify latent conditions that could cause them to make an error and are truly contemplating each question (i.e., not simply checking boxes)? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. Personnel applying the latent conditions checklist should be trained to view the checklist indicators or questions as examples to lead the thought process. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]2. The checklist should be used as a “tool” to prompt further discussion. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

3. Stationary Sources should consider requiring personnel applying the checklists to provide justification or supporting examples for all answers. Since personnel not involved with the original analysis may review checklists sometimes years later, documentation of supporting examples or justification will remove some of the subjectivity of applying the checklist. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

The facility provides employees and their representatives with specialized initial and refresher training on writing effective procedures for operating procedure writers every three years and this training includes addressing latent conditions checklist for procedures. This training is refreshed every three years for the procedure writers who remain in this role. CCHMP reviewed a list of procedure writers who had completed this training and noted that about 30 procedure writers remain up to date on their CBT or live refresher training. Per a review of 10 new or revised procedures prepared in the last three years, LCCs were completed for each procedure and these were completed by employees that received specialized training on writing effective procedures per a review of the list of up to date trained operations staff listed in the roster of procedure writers who had completed the training.

CCHMP also reviewed 7 maintenance procedures and the completed LCCs. CCHMP also reviewed a roster of training for maintenance staff that they received procedure writing training in February 2012. Per interview, the maintenance staff involved with procedure writing do not get refresher training on procedure writing and some may be missing the initial training. Per interview, one member of the training department provides assistance in formatting the procedures for the maintenance staff but the maintenance staff involved with procedure writing do not get refresher training in writing effective procedures including completing the LCC checklist for maintenance procedures.

The facility also provides specialized training on completing latent conditions checklists for PHAs and these are completed in time and copies of

P Ensure that the maintenance staff involved in writing maintenance procedures receive initial or just in time specialized training and 3-year refresher on writing effective procedures and applying LCCs.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typecompleted LCCs by operations staff and signed rosters of training are included in Appendix C of each of the five PHAs reviewed (see A25-08 for PHAs reviewed). Just in time training for PHAs included addressing a human factors checklist derived from the County LCC checklist and included 68 questions. CCHMP noted that just in time training for four out of five PHAs were completed from a few weeks to near 2.5 years before completing the LCCs. For the 5th PHA, just in time training was done more than 2.5 years before. For those employees who do not routinely complete a latent conditions checklist, refresher specialized training should occur just prior to applying the checklist.

The facility also provides specialized training for completion of checklists for MOOCs. CCHMP confirmed that employees receive timely training on completion of the checklist based on a review of documented rosters of the training.

For incident investigations, Policy 10.0-4 requires special handling of a Major Chemical Accidental Release (MCAR), as defined by the Contra Costa County Industrial Safety Ordinance. For any situation that did or could reasonably have resulted in a MCAR, the team may conduct training on the Human Factors Prechecklist for incident investigations (Form R-10.0-7) before conducting the root cause analysis (RCA). Per the policy, this form will be completed before conducting the RCA when training is needed based on the experience of the team members. The current TapRoot incident investigation software is capable of addressing human factors and per a review of Form R-10.0-7, the LCC questions are addressable by TapRoot. There are currently about 30 staff at the refinery with about 5 who have the


ID# Question Clarifications Findings Answer ActionsCategory Typetraining to be an incident investigation facilitator.



A25-08 Does the Stationary Source ensure that employees who completed the latent conditions checklist AND appropriate members of management review and sign off that the checklist was appropriately applied? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. CCHMP does not consider the definition of management to be simply defined by whether a position receives a salary versus receiving hourly compensation.2. To satisfy the management sign off requirement, a Stationary Source should specifically authorize individuals who have sufficient knowledge of applying latent conditions checklists, and have been trained in this application, to assume the role of management to approve the application and completion of checklists.3. If multiple employees participated on a latent conditions checklist team, sign offs do not need to include each employee individually; a representative of the employees is sufficient.

For PHAs, CCHMP reviewed completed HF LCCs for 5 PHAs completed in the past three years (Unit 267: Crude, Unit 248: Unisar, Unit 228: ISOM, Unit 244: Reformer and Unit 246: Hydrocracker). CCHMP confirmed that employees who completed the LCCs (2 to 3 operators) and the appropriate members of management reviewed and signed off and dated the completed checklist (Area Supervisor on the completed LCC and operations engineer, process engineering supervisor, and operations superintendent on the overall implementation of the County ISO requirements).

For operating procedures, CCHMP reviewed completed LCCs for 10 operating procedures and noted that they are signed off and dated by an operator that completed the checklist, a Unit Supervisor and an SME.

Foe maintenance procedures, CCHMP reviewed 7 procedures and noted that the completed LCCs included the signoff and date by the participating craft/mechanic and the engineer/maintenance supervisor that the checklist was appropriately applied to the procedure reviewed.

For incident investigations, a checklist was not applied for investigation of an MCAR or near-miss MCAR as running TapRoot software is considered to be adequate instead of completing the LCC as described in A25-06.

The facility does not conduct a facility-wide LCC as the PHAs for all process areas of the refinery will conduct the process unit specific LCCs. The unit PHA LCCs incorporate any corrective actions with the corresponding PHAs.

Y NoneISO Abr



A25-09 Does the Stationary Source ensure that each latent conditions question receiving a "No" answer is thoroughly analyzed and a recommendation developed and implemented for resolution of the problem? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. The analysis should be conducted with appropriate members of operations and maintenance as well as supervisory positions and members of management.2. Each question is an indicator of a program deficiency relating to a tangible item that can be observed.

Reviewing the LCCs completed for five PHAs reviewed, CCHMP found that each latent conditions question receiving a "No" answer is analyzed and a recommendation developed and implemented for resolution of the problem. The findings from the LCCs are included and addressed as part of the Human factors node in the corresponding PHA. Per a review of the Unit 246 Hydrocracker PHA, CCHMP noted a number of items that were identified on the LCC to be further evaluated and the Node 17 of the PHA was titled R-296 Human Factors Checklist and the node brought forward the concerns from the LCC and recommendations were developed to address the concerns.

Reviewing LCCs for operating procedures, CCHMP noted a limited number of recommendations were identified. When recommendations were made, the procedures were appropriately revised.

For incident investigations, the TapRoot facilitators are familiar with how to address LCC issues as described in A25-06. For an MCAR or a near MCAR, attention is given by the incident investigation facilitator to address human factors concerns which are then addressed by the team.

Y NoneISO Abr



A25-10 Does the Stationary Source ensure a formal "feedback" loop is developed to inform personnel of the recommendations from the checklist and to ensure that the recommendations developed will adequately address the concerns? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. A feedback loop is expected to promote a two-way communication with affected personnel on the corrective action proposed to resolve a human factors latent condition. 2. It is not the intent of the feedback loop to require the Stationary Source to formally respond to or address all of the comments received, but appropriate comments should be given adequate consideration.3. Instructing affected personnel that PHA recommendations are available for review without describing the latent conditions deficiency recommendations is unacceptable.

For PHAs, a formal feedback loop has been developed to inform the PHA team of the recommendations from the LCCs completed in the PHA. The recommendations from the LCCs are brought forward to a node on Human Factors in the PHA HAZOP nodes and shared with the PHA team. This would enhance the team communication to adequately address the corrective action proposed to resolve a human factors latent condition.

For procedures, a formal feedback loop is developed by including a procedure writer, an SME and an area supervisor for completing and reviewing the procedure and addressing any concerns from the LCC completed.


CCHMP reviewed emails that were issued from the PHA coordinator to the Unit Supervisors after a PHA was completed for the five PHAs reviewed and referenced in A25-06. Based on this review, the email to the unit supervisor and the rosters signed by operational staff confirmed that the PHA actions are reviewed with the relevant operation staff and if there have been LCCs that identified concerns and the human factors node of the PHA identified actions to take, those were identified in the PHA action items provided to be reviewed by affected operators. However, CCHMP could not confirm that the human factors concern items identified in LCCs are consistently documented to address all of LCC concerns. See A26-08 for a consider item on this issue. The facility

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeshould consider highlighting the latent conditions deficiency recommendations when instructing affected personnel that PHA recommendations are available for review.

A25-11 Does the Stationary Source have a formal tracking mechanism to ensure that latent conditions checklist recommendations are resolved in a timely fashion? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. Co. Ord. Section 450-8.016(d)(4) identifies schedule requirements for PHA recommendations. If the checklist is applied as part of the PHA process, the recommendations will be under the same requirements (i.e., one year unless a shutdown is required, then during the next shutdown unless the source can demonstrate infeasibility to CCHMP).2. LCC action items identified in a PHA are subject to the same PHA actions requirement. Stationary Sources must send CCHMP a request for extension before PHA actions related to LCC become overdue if they cannot be addressed within 1 year and a turnaround is not applicable. [Section B, Chapter 3.2 of the CCHMP Safety Program Guidance Document]

For PHAs, the concerns from completed LCCs are reviewed as a node in the PHA and recommendations from the PHA will include those from completed LCCs. The recommendations from LCCs are then a part of the recommendations from PHAs and are tracked in the IMPACT database as part of the action items that need to be completed as part of the PHA. This will ensure that the latent conditions checklist recommendations are resolved in a timely fashion.

For procedures, any latent conditions checklist recommendations developed in the review of the procedure are addressed timely as part of the review and revision of the procedure. The facility also has near 30 operating procedure writers that are trained in writing effective procedures. The action items from completed LCCs are also completed for maintenance procedures in similar approach as for operating procedures.

For incident investigations, recommendations developed using TapRoot software will include addressing human factors issues and these will then become a part of the incident investigation action items that need to be addressed timely using the IMPACT tracking database.

Y NoneISO Abr





There was one ensure action item associated with the previous ISO audit that has been addressed.


Abr


A26: ISO Section B - PHA's


A26-01 Did the Stationary Source elect to complete the applicable questions of the Latent Conditions Checklist prior to conducting the PHA?

If so:a) Were PHA team members provided with copies of the completed checklist prior to the PHA meeting;b) Were the PHA team members provided with all of the action items or recommendations formulated to resolve the latent conditions and the status of each;c) Did the PHA team evaluate the consequences of implementing action items or recommendations from the latent conditions review; andd) Did the PHA team leader use the results of the latent conditions checklist to focus the PHA revalidation (similar to MOC and II) to consider the effects of existing latent conditions on the frequency of and consequences associated with any active failure or unsafe act? [Section B: Chapter 4.2.1 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may elect to apply the Latent Conditions Checklist prior to the PHA (question A26-01), apply the Latent Conditions Checklist during the PHA (question A26-02), or apply a different approach after consulting with CCHMP (question A26-03).2. The requirements of this protocol apply to PHAs performed on existing systems, PHA revalidations, and PHAs performed during the design of a new process.3. The latent condition checklist (or other method used to identify existing latent conditions) is designed to be a “brainstorming tool” to prompt personnel into further discussion.

Per SME interviews and review of PHA PNP 2.0-6, one or more operators complete a written Latent Conditions Checklist (LCC) in advance of the PHA. CCHMP was informed that on the first day of the PHA the LCC findings are reviewed by the team. CCHMP reviewed the LCCs for the five PHAs listed in A12-05 (e.g., Units 228, 244, 246, 248, 267). Dates when each LCC was completed were listed in Appendix C of each PHA report. CCHMP confirmed that the LCCs for Units 244, 246, 248, 267 were completed prior to the first PHA session date. Per review, CCHMP found that Unit 228 LCC was completed on 2/25/14 although the PHA sessions started on 2/17/14. Further review identified that CCHMP's previous audit in May 2014 identified that the facility was not completing the LCC prior to the PHA sessions and issued an ensure action item to address this issue. The Unit 228 PHA was performed prior to this 2014 audit before the facility made changes to their process. As such, CCHMP believes no ensure action is warranted.

Y NoneISO Abr



A26-02 Did the Stationary Source elect to complete the applicable questions of the Latent Conditions Checklist during the PHA?

If so:a) Did the PHA team analyze and document "why" employees would execute each active failure or unsafe act resulting in a potentially hazardous scenario; andb) Do PHA revalidations include a review of each active failure or unsafe act resulting in a potentially hazardous scenario; andc) Did the PHA team consider the effects of existing latent conditions on the frequency and consequences associate with any active failure or unsafe act? [Section B: Chapter 4.2.2 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may elect to apply the Latent Conditions Checklist prior to the PHA (question A26-01), apply the latent conditions checklist during the PHA (question A26-02), or apply a different approach after consulting with CCHMP (question A26-03).2. The requirements of this protocol apply to PHAs performed on existing systems, PHA revalidations, and PHAs performed during the design of a new process.3. The PHA team should identify the latent conditions for each individual active failure, or elect to group active failures with the potential for similar latent conditions.

As described in A26-01 Stationary Source completed the PHA Latent Conditions Checklist before the PHA. This question is not applicable.

N/A NoneISO Abr



A26-04 Did the Stationary Source perform Procedural PHAs to evaluate potential active failures or unsafe acts in the procedure such as missed or out of sequence steps and including raising questions regarding the availability of personnel to perform a task as specified in the procedure? [Section B: Chapter 4.3 of the CCHMP Safety Program Guidance Document]

1. Stationary Source should screen all activities performed in their processes using established criteria (e.g., frequency, criticality, emergency or temporary procedures, large equipment startup/shutdown procedures, consequences of failure, etc.).

2. Procedural PHA process should be considered for "high active failure likelihood and high hazard potential" activities (e.g., furnace lighting, manually gathering samples of acid, hot catalyst samples, sampling that requires additional PPE, etc.). For certain activities (e.g., unloading/loading, manual manipulation of complex valve configurations, bypass of an independent protective function, etc.), procedural PHA can provide a more detailed review of potential active failures. [Section B: Chapter 4.3 of the CCHMP Safety Program Guidance Document]

As described in A28-02, the facility developed a process to evaluate tasks to determine whether a written operating procedure is required. Associated with this process, procedures that are classified as being of low frequency, high consequence and high criticality are classified as level 4 and require a procedural PHA be applied to them. To complete the procedural PHA the stationary source used the guide word HAZOP approach.

In previous audits CCHMP was provided with a list of 48 Procedural PHAs. Currently, due to the implementation of additional safeguards on existing process equipment, a total of 9 procedures have been identified as needing procedural PHAs. CCHMP reviewed 5 out of this 9. Other refineries had an average of 110 Procedural PHAs, with some doing fewer and others doing more. CCHMP recognizes that Phillips 66 has performed significant research in determining a method to select procedures for procedural PHAs, nevertheless there is a significant gap between refineries within the county on the number of procedures ultimately selected. CCHMP suggests that this topic be further explored when the county's Safety Program Guidance document is amended. CCHMP reviewed a total of 5 of the 9 procedural PHAs. In the Health, Safety and Environmental Precautions section of each, the Procedural PHA identified those steps that were evaluated if the PHA team elected not to re-evaluate the entire procedure. The following summarizes those procedural PHAs reviewed: -- NOP-700-SPP (Procedural PHA on steps 1.4, 4.0, 4.1.1 out of a total of 46 steps) completed 3/10/14

P Ensure that the entire procedure is included in the Procedural PHA and not just sections of a procedure.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Type -- NOP-309-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-310-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-104-MTC (Procedural PHA on steps 3.3, 3.7, and 4 out of a total of 17 steps)

-- NOP-108-MTC (Procedural PHA on step 2.3) CCHMP was informed that the facility completed Procedural PHAs based on the overall risk of the procedure and at times only on certain critical steps of a procedure if performing the step wrong could lead to a significant incident (e.g., MCAR) and this process was previously discussed with CCHMP. Although meetings were held on this topic, CCHMP does not believe that only reviewing select steps of a procedure is consistent with the concepts of a procedural PHA. The facility needs to include every step of the procedure in the Procedural PHA and not just the high risk steps.

The facility has used the following 7 guideword approach in their procedural PHA process:1. No2. More3. Less4. As Well As5. Part of6. Reverse7. Other than

CCHMP has been informed of good success in using a 2 guideword approach that takes less time to complete and still obtains similar results. The 2 guideword approach uses the following steps: "Step not performed" and "Step performed


ID# Question Clarifications Findings Answer ActionsCategory Typewrong".

A26-06 Did the Stationary Source identify latent conditions that may exist at the Stationary Source through the PHA process? [Section B: Chapter 4.1 of the CCHMP Safety Program Guidance Document]

* Verify by sampling some of the applicable latent conditions and confirming how the Stationary Source addressed the issues.1. This question applies to those latent conditions applicable during a PHA (i.e., some management questions may not be appropriate for a unit's PHA).2. Stationary Sources should also raise questions during the procedural PHA if there is adequate time to perform all the required tasks.

CCHMP reviewed the PHAs for units 228, 244, 246, 248, and 267. Each PHA evaluated the safeguards in place to minimize hazards including those related to latent conditions. CCHMP noted that several PHA recommendations were developed for two of the process units that related to human factors issues:

-- Re-labeled a field start/stop switch to make it clearer the switch is only used for infield reset testing of an interlock and does not activate a 300# depressuring

valve (Unit 246)-- Relocated site glasses on G-809 and G-816A/B to enable better access for

operators (Unit 246)-- Rotate select valves to prevent pinch points (Unit 244)

Y NoneISO Abr



A26-08 Does the Stationary Source manage the active failures and latent conditions by formulating and implementing action items in accordance with Section 450-8.016(d)(4) of the ordinance? [Section B: Chapter 4.1 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP audit questions A12-23 and A12-24.2. Co. Ord. Section 450-8.016(d)(4) identifies: a) Documentation maintained regarding decisions to implement or not implement recommendations (i.e., justification for not implementing the recommendations);b) Documentation maintained on results of recommendations for additional study; c) Implementation of recommendations within one year unless a shutdown is required, then due during the first regularly scheduled turnaround. NOTE: These schedules are accurate unless the Stationary Source is able to demonstrate to CCHMP that the schedule is infeasible; andd) Documentation of closure shall be maintained.

All 5 PHA's were reviewed and found to have used a LCC to assess human factors issues. Several PHAs identified that active failures could exist and recommendations were listed to address those.

For example, CCHMP reviewed Unit 244 Reformer PHA completed 2/24/15.

The HF findings were as follows: -"D506 block valves need to be ¼ to avoid pinch points." *This item was closed 2/10/16 -"Utility water to E503 downstream valve needs to be ¼ turned to avoid pinch points." *This item was closed 2/10/16 -"G510 A&B BFW pumps start/stop switch needs ID plate." *This item will be closed during the next turnaround.

In reviewing the PHAs, a number of the hand written LCCs completed by the operator(s) prior to the PHA sessions contained notations indicating latent condition concerns. CCHMP was informed that once the LCC is brought to the PHA team, the LCC is discussed and issues are copied into the Human Factors node of the PHA worksheets. CCHMP noted that a number LCC concerns listed on the hand written LCC were crossed off and still others were not. In reviewing the Human Factors nodes for the various PHAs, a number of the items crossed off the hand written LCC were identified as "operational concern" and no recommendation was listed. In a some cases, an issue on the hand written LCC was risk ranked and some concluded with recommendations for resolution. This is an acceptable

Y NoneISO


ID# Question Clarifications Findings Answer ActionsCategory Typepractice. In two PHAs, it was less clear to CCHMP whether a latent condition was identified or not given the little documentation maintained. For example:

-- Unit 244 and 248 - The action items listed in the hand written LCCs were: "Refinery radio’s do not work, cut in and out and batteries don’t last" and "Radios don't work well". In each of the Human Factors nodes for these PHAs, it was described that radios do not work well and new radios will be ordered and old batteries removed and replaced. Each also identified that there was no recommendation.

During the 2017 audit, CCHMP was informed that the facility purchased radios for the entire facility soon after these PHAs were performed. A consider item was issued to better document resolution to potential latent conditions.

A26-09 Does the submitted Safety Plan accurately reflect the PHA Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.1 of the CCHMP Safety Program Guidance Document]

The Safety Plan submitted in August 2015 accurately reflects the PHA Program onsite.

Y NoneISO Abr



The ensure action items from the previous audit have all been resolved. This question does not apply.


Abr



A26-11 Has the Stationary Source determined the effectiveness of existing safeguards and safeguards recommended in the PHA through use of LOPA or another quantitative, qualitative, or equivalent semi-quantitative method approved by CCHMP? [Co. Ord. Section 450-8.016(j)(1)]

1. This was effective as of September 30, 2014. Stationary Sources have until June 30, 2019 to complete all such analyses.2. The analyses may be done with the PHA or as a standalone evaluation.[Co. Ord. Section 450-8.016(j)(2)]

CCHMP reviewed PNP 2.0-6 SFR Process Hazard Analysis which addressed the issue of LOPA that the facility used as their Safeguard Protection Analysis and risk assessment in Section E. This section focuses on Existing Unit PHA Studies.

In Section E.2.c.iii, a "more rigorous" risk assessment is used for incidents such as LOPA or Quantitative Risk Assessment (QRA) and is performed during the PHA or afterwards.

LOPA assessments are done on safety and environmental scenarios with a severity of 4 or 5, unless LOPA is deemed inappropriate. Acts of God, Procedural PHAs would not receive a LOPA evaluation. Per SME, LOPA is performed as part of the PHA. The PHA team evaluates LOPA in the LOPA Study Worksheets that cover all of the LOPA scenarios identified in the HAZOP evaluation. CCHMP was informed that the facility has completed their first round of LOPA evaluations on all units in the facility and is almost finished in revalidating those existing LOPAs. Per CCHMP review of the PHA, the facility used LOPA to identify potential weaknesses in their process and safety programs that help protect against scenarios with severity levels 4 or 5.

Y NoneSafeguard Analysis

Abr



A26-12 Was the safeguard protection analyses performed by a team with expertise in engineering and process operations? Did the team include at least one employee who has experience and knowledge specific to the safeguards and one member who is knowledgeable about the specific safeguard protection analysis method used? [Co. Ord. Section 450-8.016(j)(3)]

Each of the PHAs addressed issues of LOPA for a particular unit within LOPA Study Worksheet in Appendix A. Per CCHMP review of PNP 2.0-6 SFR Process Hazards Analysis, section E.2.a, the requirements and responsibilities are listed for each member of the PHA team.

According to the PHAs for Units 228, 244, 246, 248, 267, the team consisted of members that met the required minimum for each PHA session: one Unit Operator, one process engineer, and one PHA leader. CCHMP was informed by the SME that all process engineers (and other participants in a PHA) have been trained in the LOPA process although the primary individual present in all PHA sessions was the PHA coordinator who had thorough knowledge of LOPA..

The duration of and attendance for each meeting was documented. The LOPA

also included an evaluation of the SILs as well as other equipment that were considered essential parts of the safeguard protection analysis. The requirements to be a PHA coordinator are as follows:-- Shall have at least 8 years of process industry experience.-- Shall have a technical background.-- Shall have participated in at least two previous Phillips 66 process unit PHA's, or completed documented training in the Phillips 66 PHA tools and guideline documents.-- Shall have successfully led a PHA under guidance of an experienced PHA leader.-- Shall have trained in the specific methodology of PHA.-- Shall have trained in Phillips 66 Layers of Protection Analysis (LOPA) Refining Required Standard LMS Course


Abr


ID# Question Clarifications Findings Answer ActionsCategory TypeID:RMT0100 (no substitution).-- Shall be familiar with Inherently Safer System (ISS) Study Methodology

The PHA coordinator attended all of the PHA sessions.

A26-13 Did the Stationary Source prepare a written report that documents the safeguard protection analysis in accordance with the standard of practice applicable to the type of analysis conducted? [Co. Ord. Section 450-8.016(j)(4)]

1. The Stationary Source will complete the report within thirty days after the completion of the safeguard protection analysis and make the report available to CCHMP during an audit or inspection and upon request.[Co. Ord. Section 450-8.016(j)(4)]

All LOPA analyses are included within the PHA reports. CCHMP was unable to confirm that these reports were issued within 30 days of completion. The facility tracks the session dates, manager meetings, and final report dates.

See A12-05 for details on session dates, manager meetings and final report dates. The ISO requires that the Stationary Source complete the report within thirty days after the completion of the Safeguard Protection Analysis. The overall process was described as follows: after completion of the PHA session dates each PHA is required to have the LOPA independently reviewed. The facility only has one individual that performs this review. After the review is completed, modifications are typically needed in the LOPA study, including the possibility that the PHA team reconvene to address any noted issues. After this the recommendations are organized for the managers meeting. After the managers meeting a final report is prepared.

P Ensure that the SPA report is completed within 30 days after the LOPA analysis.

Safeguard Analysis

Abr

A26-14 Did the Stationary Source update and revalidate the safeguard protection analysis at least once every five years? [Co. Ord. Section 450-8.016(j)(2)]

Per CCHMP review of the LOPA reports contained in the PHA, the facility is on the second round of LOPA's already. The facility does their LOPA's inside of the PHA's every 5 years.


Abr


A27: ISO Section B - Incident Investigation


A27-01 Are Human Systems considered as causal factors in the incident investigation process for Major Chemical Accidents or Releases, or for incidents that could reasonably have resulted in a Major Chemical Accident or Release? [Co. Ord. Section 450-8.016(b)(1)(B)]

1. Human systems are discussed in Section B: Chapter 5.1.1 of the CCHMP Safety Program Guidance Document. Latent conditions are discussed in Section B: Chapters 2 and 3 of the guidance document.2. A root cause analysis is not required for a near miss MCAR, but an incident investigation, including human factors considerations, is required for a near miss MCAR.

CCHMP reviewed PNP 10.0-1 Incident Management Policy which details the approach taken to document near miss or MCAR investigations. In section D2. Incident Classification and Risk Ranking there is a list of classifications that provide a guide to help the facility adopt the best approach for investigating incidents. P66 uses Taproot to investigate incidents and near misses. This method is recognized by CCHMP as adequate for evaluating HF issues

without the need for a LCC. Per CCHMP review of the report for Coker Antifoam Fire (IMPACT ID # 253782), the facility addressed human factors in accordance with PNP 10.0-1 that helped lead to the MCAR. In section D2, Incident Classification and Risk Ranking, there is a list of classifications that provide a guide to help the facility choose the best approach for investigating incidents. There is another section in the PNP called the Special Incident Classification that includes RMP, MCAR, Serious Incident, Environmental Incident, and Process Safety Event that is also used to help guide the investigative team. Per SME interview, the facility does not directly track near miss MCARs. Instead, they investigate incidents based on the facility risk ranking of category III or IV which would correspond roughly to an MCAR. The SME also mentioned that even for lower category (below category III), the facility uses R-10.0-2 the RCA Checklist. CCHMP reviewed this document and it seems to capture the intent of the CCHMP latent conditions checklist in Attachment A of the county

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory TypeISO document.



There were no ensure action items from the previous audit. This question does not apply.

N/A NoneAudit Follow-Up

Abr

A27-04 Does the Stationary Source have a process in place to identify near miss MCARs? [Section B: Chapter 5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources must have a system in place to identify near miss MCARs [ Section B: Chapter 5 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed PNP 10.0-1 Incident Management Policy which details the approach taken to document near miss or MCAR investigations. In section D2, Incident Classification and Risk Ranking, there is a list of classifications that provide a guide to help the facility adopt the best approach for investigating

incidents. Per CCHMP review of the report for Coker Antifoam Fire (IMPACT ID # 253782), the facility addressed human factors in accordance with PNP 10.0-1 which may have contributed to the MCAR. In Section B Chapter 5, the Safety Program guidance document states:

"Stationary Sources must have a process in place to identify near miss MCARs."

Per SME interview, the facility does not directly track or classify incidents as near miss MCARs.

P Ensure that a process is developed for identifying near miss MCAR's per the ISO document.

ISO Abr



A27-05 Does the submitted Safety Plan accurately reflect the Incident Investigation Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.2 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed Incident Investigation section (page 27) of the Safety Plan for the San Francisco Refinery completed in August 2015. The Incident Investigation section refers to the Incident Management Policy (PNP 10.0-1).

Per CCHMP review of 23 reports selected, the Safety Plan accurately reflects on the onsite Incident Investigation Program.

Y NoneISO Abr


A28: ISO Section B - Operating Procedures


A28-02 Has the Stationary Source:a) Determined which tasks require written procedures; b) Verified that they have written procedures for every task deemed necessary; andc) Augmented vendor or manufacturer procedures to ensure information includes appropriate level of detail to match facilities’ worker competency ? [Section B: Chapter 6.1.2.1 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources should address routine activities as well as infrequent tasks, shared tasks, or tasks requiring assistance from operators from other areas or assistance from other craft.2. Task analysis (e.g., hierarchical task analysis, tabular task analysis, and timeline analysis) is one method to develop comprehensive task descriptions and procedures. Stationary Sources should also remember to consider all operating modes including non-routine and maintenance activities in the task analysis.3. Training Needs Assessments, Process Hazard Analysis, and Job Safety Analysis are examples of resources for identifying tasks that should have written procedures.4. Factors that should be considered when determining whether a written procedure is necessary include: a) Frequency; b) Criticality; c) Complexity; and d) Regulatory requirements.4. Stationary Sources may find it beneficial to review existing work instructions, training matrices, and the most hazardous or unreliable processes (e.g., high risk work).5. For uniformity in procedure development, written criteria that defines levels of frequency, criticality, complexity and procedure requirements is encouraged.6. If the consequence of not performing a task or performing a

P&P 6.1-2 'Operating Development and Document Management', rev. 09/01/2017, describes the process for evaluating operational tasks. Within the policy the facility has developed a 'Procedure Development Work Flow' which establishes criteria to determining which tasks require written procedures. Per P&P 6.1-3 'Operating Procedure Assessment', rev. 06/30/2016, all newly identified tasks go through a Risk Assessment comprised of a minimum of two people. The facility has developed a 'Procedure Risk Based Matrix', that determines the Risk Classification of a task by quantifying the following three parameters: complexity, task frequency, and potential consequences. Complexity is measured on a scale of Low (performed with little assistance), Moderate (console to field, field to field communication), High (likely to involve multiple shifts). Frequency is measured as Frequent (daily/weekly), Infrequent (greater than weekly - less than annual), Rare (annual or greater); and Potential Consequence is measured as Low, Moderate, Severe (offsite impact, asset damage >$1MM).

The resultant risk class ranges from 1-4, with 4 being the highest. All tasks that are Risk 1 are classified as 'Job Aid/Work Instruction' and do not require a written procedure and these can be executed through work instructions, handwritten directions, verbal instructions or incorporated in operator training. Risk-2,-3,-4 require a written procedure, Risk 3-4 require a operators to print and carry/sign, Risk 4 requires a procedural PHA.

P Ensure the Maintenance Procedure Risk Based Assessment is used to evaluate maintenance tasks associated with key equipment, repetitive inspections, preventative maintenance, testing, and repair tasks.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typetask in an arbitrary manner is acceptable, an official written operating procedure is probably not required.

CCHMP identified situations where Risk 1 tasks can have potential consequences that meet the MCAR definition. For example, the cutoff threshold between ‘Severe’ and ‘Moderate’ is $1MM in asset damage, which is higher than the MCAR definition of $500k in damage. Thus it is possible for a ‘task’ to be ranked ‘low’ in complexity, performed at a frequent or infrequent rate, and potentially cause between $500,000 - $1MM in damage, and still be ranked as a Risk 1 which would not require a written procedure. The facility should review the Risk Matrix and consider updating it so that all tasks that could result in a MCAR have a written procedure.

Per interview with SME, most of the new procedures are developed as a result of an MOC. However tasks can also be identified by Operators and craft personnel at anytime. Per interview with Maintenance SME, new maintenance procedures are also used to capture knowledge due to personnel changes or it is common to develop/revise procedures as a result of a lessons learned from field work.

Maintenance Procedures: The facility has written a total of 158 maintenance procedure, 54 of those procedures are task-based which can be executed by craft personnel. The remaining 104 are policy/administrative based.

Per the Maintenance Procedure Policy No. 1.01 (dated 5/11/16), "Maintenance procedures are developed for key equipment to provide helpful recommendations to improve performance of the equipment, and non-specific instructions for repetitive inspections, preventative maintenance, and testing and repair tasks." In the latest revision to the policy the facility included, "Maintenance Procedure Risk


ID# Question Clarifications Findings Answer ActionsCategory TypeAssessment" R-116 similar to the operating procedure risk assessment. As described in the policy, the maintenance risk assessment ranks task on a scale of 1-3 based on the complexity, frequency and potential consequence; 'Risk 1' tasks do not require a written procedure, Risk 2 tasks require a procedure to be developed, and Risk 3 tasks require the development of procedure and signature signoff. Per interviews with maintenance personnel and SME's, the Maintenance Procedure Risk Assessment is currently not in use and some personnel are unaware of its existence. The facility should identify tasks associated with key equipment, inspections, preventative maintenance, testing, and repairs and evaluate them using the Maintenance Procedure Risk Based Assessment.



A28-06 Has the Stationary Source ensured that interrelated procedures are reviewed and that gaps and overlaps are eliminated? [Section B: Chapter 6.1.2.3 of the CCHMP Safety Program Guidance Document]

1. If the Stationary Source elects to eliminate an existing procedure, a separate methodology, such as a procedure needs assessment, should be developed by the Stationary Source to document the assessment process. Such assessment should include a rationale for elimination of the procedure and should include review and considerations by existing trained and qualified personnel satisfying employee participation requirements. 2. It is important to review boundary operations and shared resources and equipment.3. A gap analysis is a tool for creating procedures and eliminating overlaps/redundancies within procedures, not for eliminating procedures.[Section B: Chapter 6.1.2. CCHMP Safety Program Guidance Document]

Operations: Per interview with SME, in 2009 the facility reviewed all the existing Operating Procedures and any overlap between procedures was identified and removed and appropriately referenced to another procedure. CCHMP did not observe any overlap between the procedures. Unit start-up and shut-downs procedures appropriately referenced individual equipment start-up / shut-down procedures as to avoid any duplication of procedural steps.

If a new task is identified, the Area Supervisor, Shift Supervisor or Lead Operator (normally Area Supervisors) will review the task to determine if the task has previously been assessed or if a procedure exists.

Maintenance: Per interview with maintenance personnel, prior to writing the maintenance procedure the Superintendent responsible for the task will review the task to determine if the procedure is already covered. If the procedure is not covered then they will make an assessment whether there is a need for the procedure. Per discussion with SME the facility is in the process of combining procedures that are related into one procedure. For example the facility has developed a specific general procedure for flange torque, but may not apply to torqueing bolts of a shell and tube exchanger.

Y NoneISO Abr



A28-09 Has the Stationary Source trained employees responsible for developing and maintaining the procedures in rules for writing effective instructions? [Section B: Chapter 6.1.2.5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources should consider developing written guidelines that summarize the accepted manner in which procedures are to be written, reviewed, revised, and maintained.2. Stationary Sources should identify the frequency for refresher training of appropriate personnel in rules for writing effective instructions (e.g., at least every three years, just in time) to be consistent with Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document.

All operating procedure writers are required to complete an initial 2-day procedure writing course. Every three years the operation trainers are required to complete a refresher training for HF/Procedure Writing. The training is divided into to two sections, writing techniques and using the Mobil-Ops procedure platform. CCHMP identified two procedure authors that were on the list but had not received the training since 2010. Upon further investigation one person had retired while the other was no longer on the procedure. However in the procedure heading they were listed as the "procedure writer". The facility indicated that authors name remain on the document until the next major revision. The facility provided copies of older revisions of the procedure supporting evidence that the procedures were written within 3-years of receiving training and it appears there were no major updates to the procedure.

The facility developed an Operating Procedure Writing Guide (OPWG), dated 1/29/16 and P&P 6.1-4 'Operating Procedures Formatting and Writing Elements ', dated 12/13/2014. All procedures are required to include the following sections listed in order as they appear: PURPOSE, HSE PRECAUTIONS, SPECIAL MATERIALS, CONDITIONS, TASK SUMMARY, TASK AND STEPS ATTACHMENTS REFERENCES. The writing guide includes elements such as how to use caution, notice and warning statements.

The OPWG also has a list of defined 'action' words. CCHMP compared the defined 'action' words to the ones used in the procedure and determined that 'action' words (e.g. ESTABLISH, CASCADE) that were routinely used were not defined in OPWG. If the word

R NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typedoes not have an equivalent in the OPWG then it should be added. Conversely, CCHMP identified many procedures that used ‘action’ words not defined in the OPWG but appear to have an equivalent already defined. For example procedure NOP-500-228 used; IGNITE, LIGHT and LIGHT-OFF but only IGNITE was defined. Using multiple ‘action’ words that have the same meaning only increase the opportunities for confusion. The following are more examples of ‘action’ words identified:

-- SLOWLY CRACK OPEN (NOP-215-228) vs. CRACK OPEN vs. OPEN -- CAREFULLY VERIFY (NOP-215-228) vs. VERIFY -- BRIEFLY OPEN (NOP-205-267) vs. OPEN -- PUT (NOP-203-244) vs. PLACE, SELECT, SWITCH -- PUSHING (NOP-704-248) vs. PRESS, DEPRESS -- OBSERVE (NOP-702-228) vs. MONITOR -- PERIODICALLY START (NOP-205-267) -- CONTINOUSLY CHECK (NOP-201-246) vs MONITOR vs. CHECK -- CONTINUOUSLY MONITOR (NOP-201-246) vs. MONITOR -- VISUALLY VERIFY (NOP-203-244) vs. VERIFY

CCHMP recognizes that many times, it is important to use ‘action’ words that are not defined in the OPWG, but when it is appropriate the facility should minimize the variability and use words that are defined in the OPWG.

As discussed in A25-06 one member of the training department provides assistance in formatting the procedures for the maintenance staff.



A28-10 Has the Stationary Source developed programs to review and approve operating procedures to ensure that the operating procedures are accurate, current, and that the effects of procedural errors are fully understood, and appropriately documented? [Section B: Chapter 6.1.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP audit questions A13-18 and A13-19, as well as ISO question A26-04.2. Stationary Sources may elect to have employees observing other employees performing the task, identifying any discrepancies between the written procedure and the actual practice.3. Stationary Sources may elect to combine the procedure review and refresher training by requiring personnel to "walkthrough" the procedure with their supervisors.4. Stationary Sources may elect to conduct a formal error analysis such as barrier analysis, work safety analysis, and/or human error HAZOP.

Per interview with operations personnel, once per month the facility operators review normal and emergency procedures, changes that are identified are redlined and sent to the Training Department to make edits to the procedure. Procedures can also be flagged for review during CBT review of the procedure. The facility has developed a button to allow personnel to submit revisions to the operating procedure writers. Per interview with SME, through this process the facility has received approximately ~10 revisions through this method. The facility was unable to provide examples of this during the CCHMP.

In addition, procedures are certified annually, see question A13-19 for further information. A small portion of the procedures go through a PHA process, see question A26-04 for further information.

Maintenance procedures are reviewed by the SME. Maintenance procedures are typically written by the SME Engineer and or Maintenance Superintendent. As part of the procedure writing process the author observes the task being performed. Once the procedure is written, the procedure will receive input from craft personnel. The procedures may be further supplemented with photographs and shop drawings to increase the accuracy of the procedure. Once the procedure is in a draft form it is sent over to a person trained in procedure writing to apply the format and styling. This is performed by the procedure writer trainer. The procedure writing process is detailed in P66 Policy "Maintenance Procedure 1.01".

Y NoneISO Abr



A28-12 Does the Stationary Source ensure that only current, approved versions of procedures are accessible to employees? [Section B: Chapter 6.1.4 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources that maintain both electronic and printed procedures need to have a program to ensure that both contain only current and approved versions of procedures.

The facility maintains all the procedures in electronic form. The software platform, Mobil-Ops, that is used to write the operating procedures is also a database and web-publishing tool. Per interview with SME, this system enables the facility to make only the latest version of the procedure available to employees. Personnel can access active procedures through the company intranet. Procedures that are not active are designated as "ARCHIVE" and the hyperlinked to the procedure is inactive making the inaccessible to personnel. Archive procedure require an MOC to be completed prior to use.

Procedures can be printed on demand from the LiveLink, the online document management system. The printed procedures are stamped with the current date. Per interview with SME, uncontrolled printed operating procedures currently do not have an expiration date. Per operator interviews, as a general practice operators use printed procedures within 30 days of the print date and older copies are discarded. The Guidelines for Risk Based Process Safety (CCPS, 2007) recommends that for operating procedures which are printed on demand are clearly marked 'uncontrolled' with a relatively short expiration date, which is often the same day. In order to control or limit out-of-date documents the facility should establish and print expiration dates on all uncontrolled printed procedures.

Per operator interviews, the emergency procedures are printed and made available in the control room. During the field procedure walk, CCHMP confirmed the procedures were located in the control room and current.

Per interview the with procedure

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typewriter/trainer SME, maintenance procedures are maintained in Word format. Maintenance procedures are converted to PDF and made available to craft personnel through LiveLink.



A28-14 Has the Stationary Source incorporated the following into normal procedures and emergency operating procedures:a) Procedure title and number (if appropriate) should be easy to locate;b) The last step of the procedure should be identified;c) Temporary procedures should be clearly identified;d) Each procedure should be written for the procedure user (i.e., engineer, operators, health and safety staff, level of experience);e) Each step should be written as a command;f) Use common words;g) Avoid vague terms (i.e., leave no room for guessing or interpreting word meaning);h) Spell out first use of acronyms and abbreviations; i) Each step should include only one action. This will help to ensure that employees will not “overlook” an assumed but unwritten step;j) Steps that should be performed in a particular sequence should be numbered and listed sequentially;k) Critical step sequencing should be preceded by a caution or warning;l) Whenever possible, the procedures should reference equipment or instrumentation by unique number or name;m) Page layout (i.e., line spacing, length of lines, and font size) should not negatively affect readability;n) Procedures should neither reference steps from nor excessively reference other procedures or documents;o) Precautionary statements (e.g., warning, caution) should be clearly

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated. 2. Flow charts can aid in understanding complex procedures with parallel paths.

The facility has developed a "Operating Procedures Minimum Content Requirements", included in the document. CCHMP reviewed the minimum contents along with the criteria within the question and found the following deviations.

Per interviews and review of the operating procedures, the facility started using symbolic icons (e.g. colored 'display monitors' and 'hard-hat'), within the procedural step to designate board/field operator responsibility. Some units have incorporated this practice while others determined it caused confusion when procedures were copied in black & white. Additionally some procedures have the role spelled out before the step. The facility should evaluate the use of board/field designations from a human factors perspective and consider applying the practice universally to all Operating Procedure.

The equipment ID’s written in the procedure are the same ID that the control board operators view of the equipment but this is not the same ID/label that is in the field. If the procedure included both board and the field ID it would reduce the risk of error especially for steps that require both board/field to complete (e.g. valve stroking).

Per operator interviews, it is a standard practice for operator to initial/mark procedural steps as they are completed. Traditionally procedural steps only had one spot to initial, but recently the Mobil-Ops software was updated and now there are two spots. As a result CCHMP identified multiple ways in which procedural steps are now being completed. Some operators continue to

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typedefined and placed immediately before the step to which they apply; p) Precautionary statements should stand out from procedure steps;q) Procedure “branching” (e.g., return to step 3) should be minimized; r) Sign off should be required for verifying critical steps of a procedure;s) Steps within procedures to be performed by multiple employees should be clearly indicated and possibly require checklists or signoffs;t) Complex procedures or procedures that require more than one shift to perform should require check-off or sign-off;u) Steps that require contingencies or criteria to assist the employee should precede the action (i.e., if the temperature is above XX, set the flow rate to the following range YY-YYY);v) Formulas or tables should be included when procedures require calculations (i.e., minimize “in your head” calculations); w) Incorporate feedback loops as appropriate in the procedure so that employees can verify that their activities were correct; x) Non-routine personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply (alternatively a step to don or use the PPE);y) Instructions and conditions when by-passing shutdown systems or interlocks is allowed should be specified; andz) Write all steps necessary for the operating task (e.g., do not list “startup compressor” if there is

sign-off in the one spot, other use the second spot to track a second operators actions. Others used the second spot for verification during shift change. Per interview with SME, the change to the format was included in the software update per request from another facility, and thus the change is irreversible. The facility should consider identifying the appropriate manner to sign-off on the procedure and communicate it to the work force.


ID# Question Clarifications Findings Answer ActionsCategory Typemore than a simple push-button to press)? [Section B: Chapters 6.2 and 6.4 of the CCHMP Safety Program Guidance Document]

A28-15 Has the Stationary Source ensured that emergency operating procedures are easy to access and clear to understand? [Section B: Chapter 6.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to ISO question A28-05.2. Stationary Sources may elect to use different color paper or a separate brightly colored binder for emergency procedures.3. Clarity in understanding may be enhanced by using larger type than usual, or by using lists in conjunction with simplified drawings or flow diagrams.4. Decision aids (flow charts, decision trees) may be used to assist the operator in making correct decisions.

Emergency procedures are located on the intranet through LiveLink. All the emergency procedures are also located in hardcopy form in the central control room. In the event of a power failure the facility has a uninterrupted power supply that will power computers in the control room that would make the procedures accessible to personnel.

Y NoneISO Abr

A28-17 Does the submitted Safety Plan accurately reflect the Procedures Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.3 of the CCHMP Safety Program Guidance Document]

P. 48 of the Safety Plan, dated August 7, 2015, states: "The Operating Procedures Policy, found in the Policy and Procedures manual Section 4-1-0". Per CCHMP review the documentation, Operating Procedure Policy dated 9/1/2015 is identified as Element: 6.1-0. The facility should correct reference to "section 4-1-0" or remove it to avoid confusion.

Y NoneISO Abr



There was one ensure from the previous 2014 CalARP/ISO audit that was addressed in 2014 during the audit.


Abr



A28-19 Has the Stationary Source incorporated the following into maintenance procedures: a) Elements listed in A28-14;b) List the craft or personnel to which the procedure is applicable;c) Labeled graphics should be included for the user’s benefit;d) Sufficient detail must be used to reduce interruptions (i.e., times that the user must stop the procedure or put the procedure down);e) The procedure should include the Scope and Purpose;f) Special tools and equipment necessary to complete the job should be listed at the beginning of the procedure;g) Specific or unique cleaning supplies should be noted;h) Appropriate health and safety information should be included or referenced;i) The personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply; j) Should include required follow-up actions or tests and identify the user who must be notified as appropriate;k) Consider identifying critical maintenance tasks; andl) Consider including self-checks that should be used during maintenance activities? [Section B: Chapter 6.3.1 of the CCHMP Safety Program Guidance Document]

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated.

The maintenance procedures adopted the same format as the Operating procedures and included the same writing style elements. The procedure writing trainer has developed an MS Word document, which is available to craft persons and engineers to write procedures. The procedure writing trainer at the moment has been responsible for reviewing the formatting of the maintenance procedures to ensure they are consistent with their Operating Procedure Guidance document. This includes writing steps in command format, cautionary statements, special equipment needed, mechanic qualifications, engineering diagrams, and photographs. The maintenance procedures referenced the supporting codes standards and reference documents.

Y NoneISO Abr



A28-20 Has the Stationary Source incorporated the following into safe work practice procedures:a) Elements listed in A28-19;b) Steps to drain, purge, or clean the equipment, if applicable;c) Safeguards to protect against the hazards, for example, isolation of energy sources and process materials;d) Required monitoring of worksite conditions and worker performance; ande) A method to formally turn over control of the equipment from operations to the group responsible for the maintenance work? [Section B: Chapter 6.3.2 of the CCHMP Safety Program Guidance Document]

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated.

CCHMP reviewed maintenance procedures related Safe Work Practices: 2.52 "Safe Line Opening Process", 2.54 "Hot Bolting & Half Bolting Removing and/or Replacing Bolt on In-Service Process Equipment", 2.07 "Welding or Hot Tapping Equipment Containing Hydrocarbons, Hydrogen, Steam or Water".

Procedure 2.52, Safe Line Opening Process outlines the steps for safely performing line breaks. Line breaks are performed only after the system has been isolated and deenergized.

Procedure 2.54 Hot Bolting & Half Bolting, discusses the requirements and approvals needed to complete the HOT Bolting and Half Bolting. In general the half bolting is applied as a unit is preparing to for shut down and there is reduced pressure temperature. The work practice references the appropriate ASME and API for performing work. This procedure requires evaluations approval from engineering prior to executing.

Y NoneISO Abr


A29: ISO Section B - MOC for Organizational Changes


A29-01 Has the Stationary Source developed and implemented a procedure for conducting MOC's on the:a) Reduction in the number of positions, or number of personnel…b) Substantive increase in the duties of personnel…c) Changes in the responsibilities of positions... in operations, maintenance, health and safety or emergency response? [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources can incorporate MOC for organizational changes into their MOC process, or can develop a separate Management of Organizational Change (MOOC) process.2. MOOC requirements also apply to contractors in permanent positions in operations and maintenance [Co. Ord. 450-8.016(b)(1)(F) adopted June 27, 2006]3. Reduction in the number of positions, substantive increase in duties, and changes in responsibilities refer to changes in permanent staffing levels / reorganizations. Staffing changes that last longer than 90 days are considered permanent. [Co. Ord. 450-8.016(b)(1)(F) adopted June 27, 2006]4. Positions in operations include engineers and supervisors with direct responsibilities in operations. [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

The facility has developed a Policy and Procedure (P&P) 5.0-5 "SFR Management of Organizational Change (MOOC)", dated 12/15/16.

The MOOC process is triggered when there are changes to the org chart including adding, removing, changing reporting relationships or permanently altering staffing levels. The policy defines "permanent" as greater than 90 days. As described in question A29-02 this includes, substantive increases in duties and changes in the responsibilities of positions.

In addition to the MOOC process, the facility has also developed a "Management of Personnel Change" (MOPC) process. MOPC is focused on the movement of personnel into or out of an existing position. The MOPC process is intended to identify new skills, competencies the employee will need to acquire in order to perform their job. Refinery maintenance and operators are not required to complete the MOPC process since they have defined hiring, training and qualification process.

Since the last CalARP audit the facility has completed the following six MOOC's:

--MOOC IMPACT# 32917 - Selenium Press Post Elimination (target implementation: 2Q14 or 3Q14) --MOOC IMPACT# 33332 - Marine Terminal Dispatcher to CCR (target implementation: 10/1/14) --MOOC IMPACT# 195769 - U200 OP2 post reduction (target implementation: 6/15/2014) --MOOC IMPACT# 34499 - U76 Controls

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory TypeModernization to CCR (target implementation: 10/6/14) --MOOC IMPACT# 34678 - U76 U80 Operator Consolidation (target implementation: 6/15/15 (training) -- IMPACT# 33133 - East Bulk Controls Mod Reorganization (target implementation: 10/6/14)



A29-02 Has the Stationary Source developed criteria or guidance to assist appropriate personnel in determining "when" an MOC for an organizational change should be initiated? [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

1. The MOC for organizational changes or MOOC should occur prior to the change although this may not always be possible (for example, an employee abruptly leaving on their own accord).2. If the MOC for organizational change takes place after the change is made, the MOC Policies or procedures shall state when the MOC will be complete for this organizational change.3. MOOC requirements also apply to contractors in permanent positions in operations and maintenance and temporary changes associated with strike preparations. [Co. Ord. 450-8.016(b)(1)(F) adopted June 27, 2006]4. Process changes may impact the way personnel interact with the process and should be examined as possible candidates for MOOC analysis. 5. Stationary Sources are encouraged to develop a documented screening process to briefly review all pending changes in positions of operation, maintenance, emergency response, and health & safety to determine whether the change would be subject to a full MOOC evaluation.[Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

Per P&P 5.0-5, the Refinery Leadership Team (RLT) is responsible for notifying the Health, Safety and Environmental (HSE) Manager of a proposed change, by completing the R-761 "Understanding the Organizational Change" form. The HSE Manager reviews the information and determines whether a MOOC is required; If an MOOC is not required they recommend for a MOPC to be completed, if neither MOOC/MOPC is not required then a Negative Declaration is written. This includes adding, removing, or moving boxes in the org chart, staffing reductions, adding responsibilities requiring new skills and competencies. The positions that are subject to the policy are listed in the "Attachment 1, Position Classification" which include Operations, Maintenance, Mechanical Integrity, Process Safety, HSE, Environmental, and Refinery Manager.

The policy lists the following examples of when the MOOC is initiated "A. Reduction/Increases in permanent staffing levels. Staffing changes that last longer than 90 days are considered permanent by the Contra Costa County ISO regulation. B. Substantive increases in duties (e.g. addition of equipment or instrumentation, which significantly adds to the complexity of the system). C. Changes in the responsibilities of positions D. Consolidation or dividing of departments, such as changes in number or designation of functional areas. E. Moving duties from one department to another. F. Reorganization of departments. G. Temporary changes associated with strike preparation. H. Individuals are required to take on new responsibilities requiring skill and competencies unconnected with those

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typerequired previously."

Per interview with HSE Manager, the facility has evaluated approximately 12 changes, 7 of those changes resulted in MOOCs. CCHMP confirmed through review of the documentation and per interview, the MOOC process were conducted prior to completing the Organizational change.

A29-03 Does the Stationary Source ensure that affected employees and their representatives are consulted in the MOC for organizational change? [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar in nature to CalARP questions A16-08 through A16-10.

Per policy P&P 5.0-5, 'the MOOC team shall include at least one representative from the group to be affected by the change." The minimum group size for a MOOC is two persons, one person is a representative from the group and the second is a manager/supervisor. Per CCHMP's review of the MOOCs there were no fewer than 3 persons involved and each team consisted of at least one Supervisor and one Operator from the affected unit.

Per interview with HSE Manager and SME, changes made to the organization that permanently impacts a represented position, the facility discusses the changes with the Union prior to the MOOC process.

Y NoneISO Abr

A29-04 Has the Stationary Source developed and disseminated criteria or guidance to assist personnel responsible for conducting the MOC for organizational change in determining whether a team approach is appropriate and the composition of the team? [Section B: Chapter 7.1 of the CCHMP Safety Program Guidance Document]

1. "Change teams" or "MOOC teams" should include employees and their representatives, as appropriate, from engineering, maintenance, and operations as well as safety and health.2. The “change team” or “MOOC team” must be given the time, resources, and management support to properly evaluate proposed staffing changes [Section B: Chapter 7 of CCHMP Safety Plan Guidance Document]

ISO



A29-05 Has the Stationary Source developed and implemented a method to ensure that they clearly understand their existing situation prior to making the organizational change? [Section B: Chapter 7.2 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may elect to conduct a job task analysis to clearly understand the responsibilities of each position.2. Prior to conducting the MOOC, the Stationary Source shall ensure that the written descriptions of job tasks are current and accurate for the positions under evaluation. Stationary Sources need to evaluate job tasks and any “other” activities that an individual performs to effectively account for the existing situation. 3. Written descriptions of job tasks must be current and accurate for the positions under evaluation.4. Job tasks and any “other” activities that an individual performs need to be evaluated to effectively account for the existing situation.5. All positions that may be reduced or eliminated as well as those positions that may have an increase in duties and/or responsibilities associated with the change must be assessed.6. Stationary Sources are encouraged to develop a process to attempt to capture the knowledge and experience from personnel before they change positions or vacate their position even if there are no proposed changes. The MOOC process may be used to document such information.[Section B: Chapter 7 CCHMP Safety Plan Guidance Document]

'Section E' of policy P&P 5.0-4 states, "the team must clearly understand the responsibilities of each position affected by the change. Additionally, if the change involves elimination of a position or significant changes to individual job responsibilities and job tasks, these are described along with a disposition for each task/responsibility." Per interview with the HSE Manager and SME, the MOOC team reviews the completed R-761 "Understanding the Organizational Change" along with a description of the position's responsibility and tasks. During the CalARP/ISO audit, CCHMP was not provided copies of job responsibilities and job tasks used by the MOOC review team.

The "Position Screening" process as described in the section E.5.b. of P&P 5.0-4, requires the team to complete the "Safety and Environmental Responsibility Mapping Chart" form, R-765 p. 2, and the "Identifying Potential Safety, Health and Environmental Impacts" form, R-765 p.3 (formerly R-764).

Per policy a HSE Impact study required to be completed for all MOOC and is intended to identify groups with similar positions that may be impacted by the change. Positions Affected by the change are listed on the form along with a "description", the "potential safety impact" and priority "ranking". Priority ranking are given on a high, medium, low scale. CCHMP reviewed the six MOOCs and determined the majority of the Impact Studies were incomplete, below is a summary listed by MOOC IMPACT number:

-- IMPACT #33133 - "positions affected" were not identified, description is left blank for all entries, priority ranking was left blank for all entries;

P Ensure the MOOC team clearly understands the existing situation prior to making the organizational change by reviewing the job responsibilities/tasks for the affected personnel, complete all 'Impact Assessments', complete all appropriate signoffs and maintain the documentation. (Modified Repeat)

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Type-- IMPACT #33332 - the "Description" column was left blank for all entries;-- IMPACT #32917 - identified "SRP OP2" in the "position affected" column but there is no description, potential safety impact or priority identified;-- IMPACT #34499 - "positions affected" left blank for all positions, "description" left blank for all entries, "priority" left blank for all entries.-- IMPACT #34678 - "positions affected' left blank, "description" column left blank, "priority left blank'

Per P&P 5.0-4, the MOOC Team leader is required to track the progress of MOOC in the "Management of Organizational Change Procedure" R-765

form. The following steps require Date Completed and Signatures: 1. Purpose and Scope of Change; 2. Position Screening/Job Duty Disposition; 3. Health and Safety Impact

Assessment; 4. Action Plan Review; 5. Action Plan Tracked; 6. Completion of

Pre-Change Action Items. Per CCHMPs review the majority of the signatures were missing including the 'Final Review/Approval' signature from the HSE Manager. The facility is missing completion signatures on the majority of the steps and final approval. The MOOC documentation was missing 32 signatures out of 42 for the 6 MOOCs reviewed, below is a list organized by IMPACT number:

-- IMPACT #32917 - Step 5, -6, and Final Review/Approval was not signed complete-- IMPACT #33332 - All Steps and Final Review/Approval was not signed complete-- IMPACT #195769 - Final Review/Approval was not signed complete-- IMPACT #34499 - All Steps and Final Review/Approval was not signed


ID# Question Clarifications Findings Answer ActionsCategory Typecomplete-- IMPACT #34678 - All Steps and Final Review/Approval was not signed complete-- IMPACT #33133 - All Steps and Final Review/Approval was not signed complete

A29-06 Has the Stationary Source developed and implemented a method for determining the technical basis for the organizational change including: a) Purpose; b) Scope; andc) Schedule of the pending staff change and the potentially affected positions? [Section B: Chapter 7.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP question A16-03.2. The technical basis should include what is to be changed, what is to be achieved by the change, why will the change achieve the intended goal, and why is the change necessary at this time.3. Stationary Sources may elect to use Attachment B of the CCHMP Safety Program Guidance Document (CMA’s Management of Safety and Health During Organizational Change).4. Solomon Data is one example of "benchmarking" data that a facility may use. However, this data is based on production (not safety) and may or may not be applicable to the facility (i.e., the facility may not be able to identify comparable units).

ISO



A29-07 Has the Stationary Source developed and implemented a method for assessing the impact that the change in staffing will have on safety and health? [Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP question A16-04, but is focused on staffing changes.2. Stationary Sources may elect to conduct a modified PHA to assess the impact of the change on safety and health. 3. Stationary Source may elect to complete a time sequencing analysis to outline all of the tasks that must be performed during critical and emergency situations. 4. Stationary Source may elect to conduct field verification of the time/task analysis for the identified scenarios, as appropriate.5. Stationary Source must stop and redefine the situation if the health and safety evaluation discovers additional position(s) that are affected that are not being evaluated. [Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

The MOOC impact assessment is described in section E.5.c of the P&P 5.0-4. The MOOC team completes the both "Operating and Maintenance Procedure Checklist" (R-765, p.4) and "Management of Organizational Change Impact Assessment" R-765, p.5-13) to determine the overall impact of the change.

Management of Organizational Change Impact Assessment form (R-765 pages 5-13): The impact assessment is divided into the following sections: Operations & safety Effectiveness, Safety & Health Management, Safe Work practices, Process Safety Management (PSM/RMP/ISO), Contractor Safety, Emergency Response, HSE Regulatory Compliance, Occupational Health, and Process Unit Operability & Safety Effectiveness. The form documents the following responses "yes/no/n/a", "possible effect", "Action to maintain or improve safety", responsible party, and target date.

Per CCHMP review of the MOOC documentation, both the Operating and Maintenance Procedure Checklist and the Impact Assessment, appear to be complete.

Y NoneISO Abr



A29-08 Does the Stationary Source document the effects of the organizational change and potential action items to mitigate the consequences of the change? [Section B: Chapters 7.4 and 7.5 of the CCHMP Safety Program Guidance Document]

1. Documentation must include: MOOC team members, description of the MOOC, how the existing situation was defined, technical basis for the change, how any impacts on safety and health were assessed, negative impacts identified and documented mitigation actions that resolved each identified negative impact.2. The documentation must clearly identify if the management decision is inconsistent with the team findings (e.g., the MOOC team concludes that the change could negatively impact safety and cannot be mitigated and the management feels that the effects can be addressed by certain corrective actions.)

Action items developed from the MOOC are listed in the facilities action item database. CCHMP reviewed a sample of the MOOC action items and determined the closure and verification process needs improvement. In summary CCHMP reviewed 10 action items and found issues with three; two action items were completed but supporting documentation was not attached for verification, and one instance the attached documentation did not support the closure of the action item. The facility should ensure action items are completed and verified ins Below is a summary of the deficiencies identified by the corresponding IMPACT # and Action Item #:

-- IMPACT #33133; Action Item 197202 states, "Define job description and responsibilities of U80/80 CCR operator and include in CCR training for operators." Resolution: "see attachment [CCRduties.docx]" . [CCHMP reviewed the attached document which contained a job description for the CCR operated in list format. One of the duties in the job description stated "4 hour gauging? - not sure how this will work with new gauging system". The attached documentation does not support the closure of this action item].

-- IMPACT #33133; ACTION ITEM 197203 states, "Develop CCR training manual for future qualifications before initial CCR training for operators"; Resolution: "training manual completed. Started using it during initial CCR on 9/14." [CCHMP found the action item was closed but supporting documentation was not attached].

-- IMPACT #33332; ACTION ITEM 197914 states, "Ensure that MT Dock Operators are TPIC trained"; [CCHMP

P Ensure that MOOC action items are completed, verified and supporting documentation attached.

ISO


ID# Question Clarifications Findings Answer ActionsCategory Typefound the action item was closed but supporting documentation was not attached].

A29-09 In their review of an organizational change, does the Stationary Source pay particular attention to assessing the impact on safety and health during: a) Off hours; and b) Emergency situations? [Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

1. For example, personnel changes may reduce the number of operators available during an emergency or increase operator response time to complete a task.2. For example, the addition of equipment that significantly adds to the complexity of the unit may require additional resources to bring to a safe state during an emergency.

ISO

A29-10 Has the Stationary Source developed and implemented a method to ensure that employees affected by the organizational change are informed of, and trained in, the change prior to the change occurring? [Section B: Chapter 7.5 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP questions A16-08 through A16-10.

ISO

A29-11 Has the Stationary Source developed and implemented a method to ensure that operating, maintenance, health and safety, and emergency response procedures are updated accordingly associated with an organizational change? [Section B: Chapter 7.5 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP questions A16-05 and A16-12.

ISO

A29-12 Does the Stationary Source ensure that procedures that require simultaneous tasks or require tasks to be conducted by certain positions are reviewed during the MOC for organizational change? [Section B: Chapter 6.1.4 of the CCHMP Safety Program Guidance Document]

ISO





CCHMP's previous audit identified three ensure action items associated with the MOOC program and this audit found two have been addressed. The action item listed in A29-05 is a modified repeat from the previous audit.

R NoneAudit Follow-Up

Abr

A29-14 Does the submitted Safety Plan accurately reflect the MOOC Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.2 of the CCHMP Safety Program Guidance Document]

The Safety Plan submitted to CCHMP on August 7, 2015 accurately reflects the Management of Organizational Change Program implemented onsite.

Y NoneISO Abr


A30: ISO Section B - Employee Participation


A30-05 Does the Stationary Source ensure that employees and their representatives review the written human factors program on an established frequency and that any necessary revisions are incorporated? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

Continuous improvement of the human factors program should be documented and may include, but is not limited to the following activities: periodic review of completed latent conditions checklists (LCC) for accuracy and appropriateness; periodic review of the various LCC questions or customized checklists for adequacy of use; field evaluations/spot checks on human factors issues; verification of human factors issues and assurance that subsequent recommendations were properly addressed; human factors training needs assessment for employees; and periodic review of the Stationary Source’s written human factors program.

CCHMP has reviewed P&P 3.0-2, Human Factors Program last revised on 04/01/2016. Per this policy, the Latent Conditions Checklist "will be reviewed on a 3 year basis coinciding with the policy update utilizing a team which will include representative employees to determine if the checklists reflect current conditions and if revisions are necessary."

Per CCHMP review, the policy was last updated 04/01/2016 which would make the next policy update due on 04/01/2019.

Per CCHMP review and per interview it could not be verified that a team which included a represented employee reviewed the LCCs for necessary updates per the Human Factors Policy. This was an ensure item from the previous audit. The MOOC checklist has been updated in 12/2016.

P Ensure that the LCC checklists are reviewed for modifications per P&P 3.0-2 and include a represented employee. (This is a repeat ensure)

ISO Abr

A30-07 Does the Stationary Source ensure that employees and their representatives participate in maintaining the written human factors program current and accurate? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

See A30-05 for more details. Employees have participated in maintaining the human factors program current and accurate with the exception of the LCCs.

R NoneISO Abr

A30-10 Does the Stationary Source ensure that employees and their representatives are included in the incident investigation team, and are involved with evaluating latent conditions during the investigation? [Section B: Chapter 8.2.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is a follow-up to CalARP/ISO question A19-03.

Per CCHMP review of incident investigations, employees and their representatives are included in incident investigation teams. See A27-01 for a discussion of latent condition evaluations during an investigation.

Y NoneISO Abr



A30-11 Does the Stationary Source ensure that employees and their representatives participate in developing, reviewing, finalizing, and maintaining procedures, including identification of latent conditions existing within the procedures that could cause or exacerbate an active failure? [Section B: Chapter 8.2.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is a follow-up to ISO questions A28-07 and A28-10.

Per CCHMP review, employees and their representatives are included in maintaining procedures including identification of LCCs in procedures. Refer to A28 for more details.

Y NoneISO Abr

A30-12 Has the Stationary Source developed a human factors committee to assist in the development and implementation of the human factors program; or maintain documentation of employee participation in continuous improvement of the human factors program? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

1. Optional to have a formal human factors committee, but recommended.2. Typical activities in continuous improvement of the human factors program could include, but are not limited to: periodically reviewing completed latent conditions checklists (LCC) for accuracy and appropriateness; periodic review of the various LCC questions or customized checklists for adequacy of use; performing field evaluations/spot checks on human factors issues; ensuring recommendations are properly addressed; and assessing human factors training needs for employees.

Per CCHMP interview, there is no human factors committee at P66. However employee participation is documented in the various activities employees are a part of (e.g. PHA II MOOC)

Y NoneISO Abr

A30-13 Does the submitted Safety Plan accurately reflect the Employee Participation Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.5 of the CCHMP Safety Program Guidance Document]

Per CCHMP review of the 2015 submitted Safety Plan (SP), the SP includes a description of employee participation for CalARP Prevention Program Elements but does not describe the employee participation in the Human Factors Program including latent conditions checklists beyond just a mention of the requirement that employees participate in maintaining the human factors program.

Y NoneISO Abr





There were two ensure action items from the previous audit of this questionnaire. One has been repeated in A30-05 the other has been completed.


Abr


A31: ISO Section B - Training


A31-05 Does the Stationary Source maintain training documentation (e.g., curriculum, instructor qualifications, course duration, course participants, and means used to ensure participants understood training) for: a) Basic awareness of human factors initial training;b) Overall human factors program; and c) Specialized training (e.g., completion of Latent Conditions Checklist)? [Section B: Chapter 9.2 of the CCHMP Safety Program Guidance Document]

1. Training on the application and completion of the latent condition checklists is required for users of the checklist if the facility uses latent condition checklists, see the Latent Condition questionnaire A25 (i.e., Stationary Sources have the option of developing an alternate method other than applying the latent conditions checklist to identify existing latent conditions).

CCHMP reviewed the basic awareness and overall human factors program training for new employees. This is an instructor led classroom training that consists of an introduction to human factors, finding solutions, applying human factors to refineries and P66 Rodeo program. All new employees including operation and maintenance staff take this class. CCHMP reviewed the slides for this training and noted that there are a total of 44 slides that cover the program. The training includes addressing how human factors is addressed by checklists that are available for PHAs, incident investigations, management of organizational change, and safety culture assessment.

P66 also has specialized training on completion of Latent Conditions Checklist for PHAs, writing procedures, and MOOCs. For example, specialized training for writing procedures that is used to train procedure writers includes writing effective procedures with examples of how to address latent conditions checklist. There is an initial and a 3 year refresher training for this training. CCHMP reviewed the slides for this training and noted that it provides examples of how to addresses the latent conditions checklist. Specialized training on latent conditions is also done for PHAs and MOOCs as just in time training. See A25-06 for how training is documented and tracked for various types of specialized training.

Y NoneISO Abr



A31-06 Does the facility provide employees and their representatives with basic awareness and overall human factors refresher training every three years, and more often if necessary? [Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document]

1. This training may be an extension of the material provided in the initial basic awareness and overall training curriculums.

HF training including basic awareness and overall human factors is refreshed every three years and the training is completed and tracked for each employee using CBTs. CBT records are maintained electronically and CCHMP reviewed these records for 10 operators and five maintenance staff and confirmed that the refresher HF training is done every three years by all employees including operations and maintenance staff.

Y NoneISO Abr

A31-07 Does the facility provide employees and their representatives with specialized refresher training on an as needed basis? [Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document]

1. In general, the minimum frequency employees should receive specialized refresher training on completing latent conditions checklists is every three years. For those employees who do not routinely complete a latent conditions checklist, refresher training should occur prior to applying the checklist.2. Individuals learn at different rates using different means. Please refer to the Safety Program Guidance Document for additional training considerations.

In general, the facility provides employees and their representatives with specialized just in time refresher training on completing LCCs for PHAs or operating procedures on an as needed basis. As described in A25-06, just in time training in PHAs has not been very timely. Also just in time or refresher training has not been done for maintenance staff involved with writing procedures. See A25-06 for related findings and an ensure action on this issue.

R NoneISO Abr

A31-08 Does the submitted Safety Plan accurately reflect the Training Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.6 of the CCHMP Safety Program Guidance Document]

The submitted Safety Plan dated August 7, 2015, pages 14-15, reflects the Training Program at the Stationary Source.

Y NoneISO Abr





There were no ensure action items associated with the previous ISO audit to be addressed here. This question is not applicable.


Abr


A32: ISO Section C - Root Cause Analysis


A32-03 Does the Stationary Source ensure that the final report containing the Root Cause Analysis will be submitted to CCHMP within 30 days of completion of the Root Cause Analysis? [Co. Ord. Section 450-8.016(c)(1) and Section C.2.2.4 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the Incident Management Policy (PNP 10.0-1) which addresses classification of incident reporting and closure times for each incident level. The Incident Management Policy does not clearly state what the reporting requirements are for CCHMP. According to the policy, as a category III or IV, a Full Team investigation is assembled to investigate MCARs but does not state the reporting requirements beyond the requirement of a 60 day

closure. The 2015 Safety Plan does specify the 30 day reporting requirement to CCHMP. Per CCHMP review of the documentation for the Coke Antifoam Fire RCA, the 72 hour and 30 day reports were submitted on time.

Y NoneISO

A32-14 Does the submitted Safety Plan accurately reflect the Root Cause Analysis method and Accident History information maintained by the Stationary Source? [Co. Ord. Sections 450-8.016(c), 450-8.016(e), and Sections E.4 and E.6 of the CCHMP Safety Program Guidance Document]

Per CCHMP review of the Safety Plan, dated Aug 7, 2015, the RCA and accident history meet the requirements of the facility Safety Plan.

Y NoneChapter 450-8 of Co. Ord. 98-48

Abr







Abr


A33: ISO Section D - PHA/Action Items


A33-02 Does the Stationary Source document the decision made to implement or not implement all PHA recommended action items?

If the recommendation is not implemented, does the documentation include the justification for not implementing any recommended actions? [Section D.1.4 of the CCHMP Safety Program Guidance Document]

1. Federal OSHA provided guidance for declining recommendations: a) The analysis upon which the recommendation is based contains factual errors;b) The recommendation is not necessary to protect the health and safety of the employer 's own employees, or the employees of contractors;c) An alternative measure would provide a sufficient level of protection; andd) The recommendation is infeasible. [September 1994, OSHA Instruction CPL 2-2.45A CH-1]

CCHMP reviewed all 5 PHAs which used closure forms to document how each recommendation was resolved. Of the recommendations, only 1 recommendation was rejected and that was based on Factual Error, which is an approved rationale for rejecting a PHA issue.

Y NoneISO Bar

A33-03 Does the Stationary Source document the results of recommendations for additional study? [Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. Refers to PHA recommendations that involve performing additional study.

Per CCHMP review of the five PHAs for Unit 228, 244, 246, 248, and 267 and all recommendations were identified to be addressed without referring to additional study. This question is not applicable.

N/A NoneISO Bar



A33-04 Did the Stationary Source complete the PHA recommended actions selected for implementation within one year after submittal of the original Safety Plan to CCHMP or after completion of the PHA and revalidation? [Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. This does not apply to PHA recommended actions requiring a process shutdown, or those the Stationary Source has demonstrated to CCHMP’s satisfaction that completing them within one year is infeasible (see A33-05).2. PHA recommendations developed from Seismic assessment, Inherently Safer System analyses and revalidations, siting and other technical studies, human factors and latent conditions checklists performed during PHAs should be completed within one year, or at least resolved in a timely manner. A one-year schedule may not be appropriate for all ISS options. [Section D.1.5 of the CCHMP Safety Program Guidance Document]3. If a Stationary Source cannot complete action items in 1 year and a turnaround is not required, a request for extension must be sent to CCHMP.

CCHMP reviewed five PHAs for Unit 228, 244, 246, 248, and 267. U244: There was one action item (5G-503A/B IPLs) remaining to be closed that received an extension from CCHMP. There are two other action items (5G-501 IPL and 5D-506 bottom IPL) waiting for the next turnaround. Both had a due date of 6/7/16. Unit 246: One needed a variance request from the CCHMP because the engineering was not done in time. The due date was 10/7/15. Units 248 and 267: The action items have been closed for these two units.

-There were a total of 24 action items for both PHA and LOPA.-There are a total of 3 action items waiting for T/A.-There were two action items that received a variance from CCHMP.-There were a total of 10 action items that went beyond one year to complete.

CCHMP was informed that the facility tracks the 1-year completion of each PHA recommendation based upon when the managers meeting takes place. Of the five PHAs reviewed, CCHMP found a large variety of time between the last PHA session and the managers meeting (actual dates listed in A12-05):-- Unit 228 - 0.5 months-- Unit 244 - 3.4 months-- Unit 246 - 1.6 months-- Unit 248 - 3.4 months-- Unit 267 - 2.6 months

CCHMP believes that, in general, the last PHA session date should ideally be used to start the one year clock for addressing PHA recommendations. CCHMP understands that there may be

Y NoneISO Bar


ID# Question Clarifications Findings Answer ActionsCategory Typecorrections needed to be made to the PHA based on QC and that additional time should be allowed for this. It is also common for sites to have a managers meeting to approve the PHA. As such, CCHMP believes it should be reasonable for sites to take two months after the last PHA session to begin their 1-year clock. Three out of the five PHAs took longer than two months to begin their 1-year clock. A consider item has been issued as this is not yet a requirement.

A33-05 Did the Stationary Source complete the PHA recommended actions selected for implementation during the first regularly scheduled turnaround of the applicable process? [Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. This applies to recommended actions requiring a process shutdown (see A33-04).2. This does not apply when Stationary Sources can demonstrate to the satisfaction of CCHMP that such a schedule is infeasible. 3. CCHMP would consider factors such as equipment procurement and obtaining permits (when applied for in a timely fashion) to be examples of infeasible scheduling.

Per SME, items identified for turnaround are typically discussed during the managers meeting that approves the PHA. Sometimes as work is being performed to address an action item, an issue originally targeted for completion within a year is found to be more complicated than anticipated and may later on be identified as needing a turnaround. Similarly, CCHMP was informed that several PHA recommendations that were originally targeted for a turnaround were completed during an earlier opportunity so CCHMP recognizes that the facility has tried to address PHA recommendations as soon as practicable.

Y NoneISO Bar





Bar



A33-07 Does the submitted Safety Plan accurately reflect the PHA/Action Items Program at the Stationary Source? [Co. Ord. Section 450-8.016(d) and Section E.5 of the CCHMP Safety Program Guidance Document]

Per CCHMP review of the Safety Plan revised Aug 7, 2015, the PHA Action Items program accurately reflects the safety program.

Y NoneISO Bar


A34: ISO Section D - Inherently Safer Systems


A34-08 Does the Stationary Source adequately document their Inherently Safer Systems analysis for new processes for each phase? Documentation maintained should include, as applicable, but is not limited to:a) ISS team makeup, responsibilities, qualifications and experience;b) Criteria used to require an ISS review for the process;c) The relevant ISS questions asked and answered (e.g., can quantities be reduced, can other chemicals be used, can different equipment be used, etc.);d) The information available during the ISS assessment (e.g., chemical compatibility matrix, chemical properties, material and energy balances, PFD, P&ID, etc.);e) How process improvements were reviewed and the determination of the process that was determined to be the inherently safest process;f) The process used to determine that the equipment sizes are minimized and the results of this determination;g) The process used to determine the minimum inventories needed and the results of this determination;h) The process used to simplify the covered process, if applicable, and the results of this process;i) The process used to reduce the waste made from the

* If no new processes have gone through an ISS assessment, review the system in place to evaluate Inherently Safer Systems for new processes.

CCHMP reviewed the facility's Inherently Safer System Analysis policy, PNP 2.0-7, last reviewed 7/20/16. This policy identified for new ISS analyses the documentation will be consistent with that performed in a PHA HAZOP and include a post-study report. Section E.5.b.i of the PNP specifies that ISS evaluations associated with new processes need to be documented for each phase of the project (i.e., chemistry forming, design and scoping, basic design).

Section E.3. of the PNP identified that the ISS team needs to include:"i. ISS team leader with formal training and/or experience in the ISS methodology;ii. An engineer with experience in the process technology;iii. An operator with recent operating experience on the process (for new processes, the operator should have experience on similar types of processes);iv. Operations Supervisor who is familiar what facility-wide operations and the inter-relationship with other processes. The team member may be an Operations Area Supervisor, Shift Superintendent or Shift Supervisor."

The method used to evaluate ISS was identified in the PNP as either an ISS Guideword or ISS Checklist. The guidewords listed in the PNP and ISS Checklist, R-237, matched those outlined in CCHMP's Safety Program Guidance Document.

Per interviews, one new process ISS analysis, LPG Project, was completed since the previous audit. The ISS

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeproject and the results of the determination; j) Applicable items considered from the ISS checklist in Attachment C of the SP Guidance Document; andk) For applicable items from the ISS checklist in Attachment C of the SP Guidance Document that were not considered, the Stationary Source should document why each item was not considered. [Section D.1.1 of the CCHMP Safety Program Guidance Document]

analysis was actually started in June 2012 although was not completed until 2015. CCHMP reviewed information associated with the LPG Project in February 2015. To date, this project has not been implemented. Per records review and interview, CCHMP was informed that the ISS analysis was not conducted in accordance with the facility's PNP nor with the county's ISO guidance. For example, only one person conducted the study instead of a team; neither an ISS guideword or ISS checklist was used in the analysis; documentation was developed after the fact and little documentation was initially developed. The analysis was done in the chemistry forming phase although the project did not directly involve chemistry forming, there were options to the project that could involve different chemistry so an initial ISS review was performed. Subsequent to CCHMP's initial meeting on February 19, 2015, the facility formed a team that reviewed all of the data developed for the project and documented the study using the site's ISS Checklist. Documentation was subsequently developed and maintained for the Butane aspect of the project for various ISS phases (e.g., chemistry forming, design scoping, basic design) of the project. The revised documentation included the items listed in this question. To date, the Butane project has not been implemented.

Based on the analysis CCHMP performed in 2015 and reviewed during this audit in 2017, CCHMP does not believe any action items are warranted.



A34-10 Does the Stationary Source perform and document Inherently Safer System analyses for existing processes through a method independent from a PHA? [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources can perform an independent ISS analysis that is done in addition to a process PHA, or an ISS analysis that is incorporated into a PHA.2. The ISS analysis should review the covered processes for ways to eliminate or reduce hazards that are present as well as risks that are present in the covered process. This may be achieved by using a checklist (provided in Attachment C of the SP Guidance Document) or guideword analysis (provided in Attachment D of the SP Guidance Document) that incorporates ISS where a MCAR could reasonably occur. 3. If the Stationary Source decides to do the ISS analysis as part of the PHA, a N/A should be the answer for this question.4. If the Stationary Source decides to use some other ISS checklist or other methods to evaluate ISS, these must be approved by CCHMP prior to their use.

As described in A34-11, the facility completes their existing process ISS analysis within the PHA. This question is not applicable.

N/A NoneISO Abr



A34-11 Does the Stationary Source perform and document Inherently Safer System analyses for existing processes through the existing PHA review? [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. This would require that each covered process in its entirety have an initial ISS analyses conducted. Incorporating the ISS analysis into a revalidated PHA may not be sufficient if the whole process is not evaluated. 2. The ISS analysis should review the covered processes for ways to eliminate or reduce hazards that are present as well as risks that are present in the covered process. This may be achieved by using a checklist (provided in Attachment C of the SP Guidance Document) or guideword analysis (provided in Attachment D of the SP Guidance Document) that incorporates ISS where a MCAR could reasonably occur. 3. If the Stationary Source performs an independent ISS analysis, a N/A should be the answer for this question.

The facility conducts their existing process ISS analysis during the PHA and documents the evaluation in an ISS Node. CCHMP reviewed each of the ISS Nodes within the PHAs listed in A12-05. Each ISS analysis was conducted using the ISS Checklist technique although the "checklist" was incorporated into a PHA node. CCHMP verified that the ISS questions were the same as listed in Attachment C of the County's Safety Program Guidance document. The ISS node contains topics and questions related to evaluating whether the process can be made safer through minimization, substitution, moderation, or simplification. Each question in the ISS node was answered for each process and included an explanation of safer systems already in use when applicable. None of the existing ISS studies identified additional ISS actions to incorporate.

Per SME interviews, the facility has been performing existing process ISS analyses within the PHA since the ISO

Y NoneISO Abr



A34-12 Does the Stationary Source adequately document their Inherently Safer Systems analysis for: existing processes, MOC, II/RCA recommendations? Documentation maintained should include, as applicable, but is not limited to:a) The approach used for evaluating ISS for existing processes;b) ISS team makeup, responsibilities, qualifications and experience;c) ISS’s considered as well as those implemented;d) Applicable items considered from the ISS checklist (if used) in Attachment C of the SP Guidance Document; ande) For applicable items from the ISS checklist (if used) in Attachment C of the SP Guidance Document that were not considered, the Stationary Source should document why each item was not considered. [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. This documentation is required regardless of the type of ISS analysis used.2. Implementing only one ISS option to address identified hazards may not be adequate to address the greatest hazard reduction or elimination. However, it is not necessary to implement more than one ISS if the implementation of a second ISS does not add any significant hazard reduction or has been documented as infeasible.3. Effective September 30, 2014, an ISSA needs to be performed as part of the MOC review whenever a “major change” is proposed that could reasonably result in a MCAR.4. If an incident occurs on or after September 30, 2014, an ISSA needs to be performed as soon as administratively practicable after completion of a RCA report or an incident investigation report where a recommendation was made for a "major change" that could reasonably result in a MCAR.5. “Major change” means introduction of a new process, process equipment, or regulated substance, an alteration of process chemistry that results in any change to safe operating limits, or other alteration that introduces a new hazard. [T19 CCR §2735.3 Definitions (v)]

Existing Process:A minor discrepancy was noted between the PHA and ISS PNPs. Specifically, section E.2.f.i of PNP 2.0-6 (PHA) identified that the existing process ISS "team members (number and composition)" are different than that used for the PHA team. Section E.3.a of the PNP 2.0-7 (ISS) identified that the existing process ISS team is similar in composition to PHA team. Per interviews and review of 5 existing ISS analyses contained within the PHAs, the ISS team is comprised of the same people as the PHA team.

As described in A34-11, the facility conducts existing process ISS analyses during the PHA with the same PHA team members. This is documented within the individual PHA reports including team members qualifications and experience. In each case the ISS Checklist was used to document the ISS analysis. Section E.5.a.ii of PNP 2.0-7 identified that the ISS Checklist would document that "sufficient ISS design has been utilized or if implemented could eliminate or reduce the potential of an MCAR". The PNP further identified that if "an MCAR cannot occur or implementation of the ISS design would not eliminate or reduce the MCAR potential, the team will document this result in the checklist". "If the ISS on the checklist may eliminate or reduce the potential of an MCAR, the team will then determine if an MCAR could reasonably occur by using the ISS risk matrix (Attachment 4)." Using this risk matrix results in an ISS Risk Code of 'H' or 'L'. An 'H' code means that an MCAR could reasonably occur and require an inherent or passive ISS opportunity to be implemented. "If an MCAR could not reasonably occur - ISS Risk Code "L", then the ISS "L" risk ranking will be provided in either the completed checklist

P Ensure that PNP 2.0-7 is consistently followed to document an ISS risk code within the existing process PHA node if an ISS item could eliminate or reduce the potential of an MCAR.

Ensure that major change is defined in the context of evaluating for ISS associated with recommendations from MOC or incident investigation/RCA reports.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeof the worksheets and no further review by the team is required." CCHMP reviewed the 5 existing process ISS studies and was unable to confirm the site's practice consistently follows the policy. For example, Unit 248, Node 16, consequence 5.1.16(r), 5.2.10(k), 5.2.14(p); Unit 244, Node 19, consequence, 2.1.5(j); Unit 228, Node 24, deviation 5, consequence 4(d). Most of the ISS items were documented as installed, were being managed on the process, or were not applicable. There were occasional examples where this was not the case and the ISS Risk Code was not provided in the ISS Checklists. As specified in the PNP, if an ISS item could eliminate or reduce the potential of an MCAR, an ISS risk code needs to be documented. CCHMP was also informed during the audit that the facility does not track MCAR incidents or near misses (this is further described in A27-01 and A27-04). Not tracking MCARs would make complying with PNP 2.0-7 difficult. An ensure item was listed in A27-04 for the site to track near miss MCAR situations.

MOC:PNP 2.0-7 identified that the facility would "determine ISS feasibility for situations, such as a major change or a recommendation from an incident investigation report, where a Major Chemical Accident or Release (MCAR) could reasonably occur". As listed in A27-04, the facility does not specifically track MCARs or near miss MCARs. Although the ISS policy (PNP 2.0-7) contains a number of definitions, major change is not defined. Nevertheless, CCHMP was unable to locate any MOCs that identified significant recommendations that would likely be considered a major change.

II/RCA:


ID# Question Clarifications Findings Answer ActionsCategory TypeAs described previously under MOC, the facility's PNP 2.0-7 contains wording that ISS would be evaluated associated with a recommendation from an incident report where a MCAR could reasonably occur. CCHMP was informed that no such recommendations have been generated.

A34-13 Does/did the Stationary Source document for Inherently Safer Systems considered and not implemented the grounds that were used to make the feasibility determination? [Section D.1.4 of the CCHMP Safety Program Guidance Document]

1. Section D.1.4 of the CCHMP Safety Program Guidance Document defines feasibility.2. The documentation should include what Inherently Safer Systems were considered and why they were determined infeasible and rejected.3. Documentation is needed for all Inherently Safer Systems considered even if an Inherently Safer System was implemented as a result of a PHA recommendation or new design review.4. The documentation maintained by the Stationary Source shall include sufficient evidence to demonstrate to CCHMP’s satisfaction that implementing the ISS is impractical, and the reason for this conclusion.

As described in A34-16, each PHA recommendation is required to be closed out using a Unit/System PHA Recommendation Closure form that is to identify ISS design considerations. CCHMP reviewed each of these closure forms and consistently found multiple ISS options were listed along with an explanation of which ISS was selected and why. CCHMP found it clear why one alternative was selected over another in reviewing the ISS alternatives listed (e.g., either option could accomplish the task although the one representing a higher ISS category was selected and having both options may not have any added benefit).

Since the last audit the facility evaluated one "new process" for ISS as described in A34-08 although this process has not been built. The project documentation included discussions of various ISS options and the rationale why some options were deemed more appropriate than others based on various risk evaluations. The documentation maintained adequately described the feasibility determination.

As described in A34-11, there were no ISS recommendations developed associated with existing process ISS evaluations reviewed.

Y NoneISO Abr



A34-14 Does the Stationary Source revalidate the Inherently Safer System analysis for existing processes at least once every five years? [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. If the 5-year revalidation for an Inherently Safer System analysis is not yet due, the Stationary Source is expected to have a system or policy in place to perform the revalidation at least once every five years.

As described in A34-11, the facility conducts their ISS analyses for existing processes during the PHA. Also, as described in A12-26, CCHMP confirmed that the facility revalidates or performs a re-do analysis for each PHA every 5 years.

Y NoneISO Abr

A34-15 Does the Stationary Source adequately document their Inherently Safer System analyses revalidations? Documentation maintained should include, but is not limited to:a) Incorporation of improvements made in the ISS method since the last review was conducted or selection of a new method to perform the ISS analyses;b) ISS review for all changes that have been made since the last ISS analysis; c) Review of all MCARs or potential MCARs that occurred at the process under review; andd) Review for any new and existing technologies not previously reviewed that can be incorporated that will make the process under review inherently safer. [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. Regardless of whether the 5-year revalidation for an Inherently Safer System analysis has been completed yet, the Stationary Source is expected to have a system or policy in place to maintain this documentation.

As previously described, existing process ISS evaluations are documented within the process PHA report within an ISS node. ISS evaluations for existing processes are revalidated along with the PHA every five years. Documentation of the ISS revalidation is contained within the ISS node and PHA report and, per review, includes the information listed in the question. CCHMP was informed that during the PHA and ISS evaluations, past changes made to the process are reviewed as well as past relevant incidents. In addition, process engineers routinely work with corporate experts in their area and discuss upcoming technologies and potential implementation to existing operations. The facility has not changed the method used to evaluate ISS for existing processes.

Y NoneISO Abr



A34-16 Does the Stationary Source provide guidance to personnel responsible for developing and analyzing recommendations and mitigation items resulting from the unit PHA regarding the following:a) Use of the different categories of risk reductions;b) Moving up the different levels from procedural to active to passive to inherent levels; andc) Approaches to apply ISS including minimization, substitution, moderation, and simplification? [Section D.1.3 of the CCHMP Safety Program Guidance Document]

1. Risk reduction categories (inherent, passive, active and procedural) are defined in A34-03.2. Approaches for consideration of ISS (minimization, substitution, moderation, and simplification) are defined in A34-02.3. The Stationary Source is expected to document that these elements are incorporated into their ISS program.4. Stationary Sources are required to look at ISS for the mitigations that come from a PHA and to apply ISS moving up from procedural to inherent.

CCHMP was informed that the facility developed an ISS policy PNP 2.0-7 that contains instructions on conducting ISS analyses for all situations. Attachment 2 in the PNP contains guidance on how to use the ISS guideword approach. Attachments 3 and 4 contain guidance on how to use the ISS Checklist, the ISS risk ranking matrix, and how to identify ISS PHA recommendations. Attachment 5 (or 6) contains an ISS strategy methodology for evaluating new processes.

The ISS PNP includes definitions for the various approaches (e.g., minimization, substitution, moderation, and simplification). It also identifies that personnel closing PHA recommendations need to consider moving up the different categories of risk reduction from procedural to active to passive to inherent. The PHA closure forms include a statement, "Highest Applicable ISS Level" along with the ISS categories, "Inherent (highest), Passive, Active, Procedural".

In reviewing closed PHA recommendations, almost all the closure forms documented that a higher ISS level was selected even though multiple were listed. For example:-- Unit 228 PHA - elevated existing shutdown interlock to a Safety Instrumented Function (active ISS category) instead of adding a critical operating procedure (procedural ISS category)-- Unit 244 PHA - elected to reposition valves (passive) versus installation of signage (procedural) to warn personnel of potential pinch points-- Unit 246 PHA - reroute potential H2S water stream from open sewer to a closed process (inherent) instead of adding an H2S detector (active) and

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typealarm (procedural) to DCS.-- Unit 248 PHA - install an automated compressor shutdown (active) on loss of seal fluid medium instead of a low oil pressure alarm (active) and manual shutdown (procedural).

A34-17 Does the Stationary Source documentation, associated with ISS analyses for PHA recommendations and mitigations, identify:a) That at least one risk reduction strategy was taken using an ISS risk reduction category for each PHA mitigation item for scenarios that have the potential for a MCAR;b) A description of the risk reduction strategy used;c) Details of risk reductions considered that were not implemented; andd) Reasons the rejected risk reductions were determined to be infeasible using the ISS approaches? [Section D.1.3 of the CCHMP Safety Program Guidance Document]

1. Risk reduction categories (inherent, passive, active and procedural) are defined in A34-03.2. Approaches for consideration of ISS (minimization, substitution, moderation, and simplification) are defined in A34-02.

CCHMP was informed that every PHA recommendation is required to be documented as closed using a PHA Closure Form (R-295). The closed recommendation is to document the ISS category/approach pair (e.g., passive/minimize) regardless of whether the issue at hand could reasonably result in an MCAR (i.e., all PHA recommendations closed out are required to document the ISS applied). From the five PHAs reviewed, 20 PHA recommendations have been closed out of the 24 total recommendations issued. CCHMP verified that each closure form documented the ISS category/approach pair. As described in A34-16, CCHMP noted that a few of the closure forms identified other ISS opportunities that were rejected for a higher ISS category (e.g., active instead of procedural). Per interviews, the facility only identifies one ISS option to implement if other options do not add any significant hazard reduction. Per closure form review, the documentation maintained in the closure forms do not explicitly state this, but the intent was evident in the documentation maintained.

Y NoneISO Abr



A34-18 Has the Stationary Source documented how the Stationary Source encourages moving up the four levels of risk reduction strategies, from procedural to inherent during the Inherently Safer System analysis for PHA recommendations and mitigations? [Section D.1.3 of the CCHMP Safety Program Guidance Document]

1. Inherently Safer Systems include four levels for risk reduction in order of decreasing reliability (the first is the most reliable) as follows: Inherent, Passive, Active, and Procedural. These are defined within A34-03. 2. Stationary Sources must consider moving up through the four levels, from Procedural to Inherent, when evaluating process hazard analysis recommendations and mitigations. For new processes or existing process ISS analyses, the Stationary Source must focus on the Inherent and Passive levels only.3. The level of risk reduction increases from the procedural level to the inherent level. The intent of the Inherently Safer Systems requirements is that each Stationary Source will incorporate the highest level of risk reduction to the greatest extent feasible. The Stationary Source will document how this intent is met.

As identified in A34-16, CCHMP noted a number of examples in the PHA closure forms when a higher ISS strategy was selected out of several possibilities. Based on the number of PHA recommendation closures that included multiple options (19 out of 20), it was evident to CCHMP that personnel assigned to close out PHA recommendations understood the desire to move up the four levels of risk reduction.

Y NoneISO Abr

A34-19 Did the Stationary Source complete the recommended ISS actions selected for implementation in a timely manner? [Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. ISS actions formulated through the PHA process must be completed within one year or during the next scheduled turnaround if a shutdown was required. Stationary Sources must send CCHMP a request for extension before PHA actions (including other studies and analysis related to the PHA) become overdue when they cannot be addressed within 1 year and a turnaround is not applicable. [Section D.1.5 of CCHMP Safety Program Guidance Document]2. ISS actions formulated outside of the PHA process should be completed in a timely manner.

As described in A33-04, CCHMP verified whether each PHA recommendations was closed within one year, the next turnaround or through a variance. Each of the 20 PHA recommendations that have been closed and their associated ISS classification were done in a timely manner.

The facility has performed one new process ISS analysis and developed a plan to implement ISS although that project has been placed on hold.

None of the five existing process ISS analyses reviewed identified any recommendations to implement.

Y NoneISO Abr



A34-20 Based on CCHMP’s review for the previous questions, does the Stationary Source select and implement Inherently Safer Systems to the greatest extent feasible? [Section D.1.4 of the CCHMP Safety Program Guidance Document]

1. Section D.1.4 of the CCHMP Safety Program Guidance Document defines feasibility.

Based on CCHMP's review, Phillips 66 is implementing Inherently Safer Systems to the greatest extent feasible.

Y NoneISO Abr



The one ensure action item associated with CCHMP's previous audit of this regulatory topic has been addressed.


Abr

A34-22 Does the submitted Safety Plan accurately reflect the Inherently Safer Systems Program at the Stationary Source? [Co. Ord. Section 450-8.016(d) and Section E.5 of the CCHMP Safety Program Guidance Document]

The Safety Plan submitted to CCHMP on August 7, 2015 accurately reflects the Inherently Safer Systems Program implemented onsite.

Y NoneISO Abr


A36 - Safety Culture Assessment


A36-01 Has the Stationary Source completed an initial Safety Culture Assessment as of November 2010 and documented it in a report(s)? [Co. Ord. Section 450-8.016(h)]

1. Stationary sources are required to perform a Safety Culture Assessment within one year of the issuance of the Guidance Document. The ISO Safety Culture Guidance Document was issued 11/09. [County Industrial Safety Ordinance Section 450-8.016(h)]

The initial SCA was completed by August 5, 2010. This question was addressed in A36-01 of the previous CalARP audit and not applicable.

N/A NoneISO



A36-02 Has the Stationary Source used at least one of the following methodologies to perform the safety culture assessment: a) Written Survey, b) Interview, c) Observation, d) Focus Group, e) An equivalent method as approved in advance by CCHMP? [Co. Ord. Section 450-8.016 (h) and Section F.5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may use more than one methodology to perform the assessment of the entire site. [Co. Ord. Section 450-8.016(h)]

A third-party consultant, Bureau Veritas (BV), was hired to conduct the 2015 Safety Culture Assessment for P66. BV issued two final reports summarizing the data collected from the Contractor Survey and the other for P66, both reports are dated July 11, 2016.

P66's P&P section 15.0-1, "Safety Culture Assessment" (rev. 06/23/2016) states "the methodology for the assessment is the written survey, per F.5.1 in the [CCHMP] guidance document." Per interview with SME's, sometime between October-November of 2015 hardcopies of the written survey was distributed by BV, to participants. Completed copies were placed in a sealed envelope and returned to BV, where they transcribed the results into the report.

In addition to the BV SCA, in April - May of 2016 the facility completed a "Viewpoint Employee Survey" (VES). VES was a survey that was issued corporate wide. The survey is expected to be completed every 2-years thereafter. The survey was administered by an external provider and had approximately 45 questions with opportunity to provide additional comments. Per interview with an operator, the survey received positive feedback from both Management and the represented workforce. CCHMP recognizes the survey as a best practice that was performed in addition to the BV Safety Culture Assessment. The survey was administered corporate wide to all employees. CCHMP was not provided copies of the results, and thus it will not be evaluated further as part of the CalARP/ISO Audit.

Y NoneISO



A36-03 Did the Stationary Source establish a methodology for evaluating work groups? [Section F.3 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources MUST establish their assessment process and state the methodology selected for each work group. 2. The work groups assessed should at a minimum include: employees in management, supervisors, operators, maintenance, engineering, health and safety personnel and resident and applicable transient contractors. [Section F.3 of the CCHMP Safety Program Guidance Document]

Per interview with SCA SME, the written survey was made available to all employees, including all the units and all the shifts. P&P 15.0-1 requires the following groups to be included in the SCA: management, supervisors, operators, maintenance, engineering, health and safety personnel, and applicable contractors. CCHMP reviewed the 2015 SCA report, and the following groups were included in the survey: Production/Hourly, clerical/support staff, technical, supervisor, H&S employee, middle and senior management. These groups were used for both P66 employees and contractors. Per interview with SME, the facility scheduled 2015 SCA during normal plant operations, and not during a turnaround so that transient contractors would not disproportionately outweigh resident contractors and P66 employees. The facility should develop a method to assess the safety culture of both resident and applicable transient contractors, independent of each other. The facility may consider performing targeted SCA on transient (short-term) contractors during a turnaround.

Y NoneISO



A36-04 Does documentation exist to show that an appropriate participation level target was chosen and achieved for each selected work group? [ Section F.3 of the CCHMP Safety Program Guidance Document]

1. While 100% participation is difficult to attain, Stationary Sources should ensure they have the maximum participation from each work group.2. 2007 Baker Panel report achieved a 70% response rate.3. CCHMP believes that a low participation rate may be an indicator of safety culture issues.

Per review of the 2015 SCA Report, the facility achieved a participation rate of 90 percent for P66 employees and 68 percent for contractors. Bureau Veritas administered the survey to all employees including contractors that were onsite at the time of the survey. Per interview with SME, the facility did not establish a target participation rate for the 2015 SCA however the survey was distributed to everyone onsite. The facility achieved an overall combined (P66 and Contractors) participation rate was 83.7% percent. The workgroup that represented the lowest participation rate was P66 "Health & Safety Employees" 66.7 percent (10 out of 15).

Although the 2015 SCA survey results generally show good participation rates, the facility did not document target participation levels of each work group. As stated in Section F.3 of CCHMP's Guidance document " it is expected that whatever assessment method(s) used will include sufficient documentation to demonstrate to the satisfaction of CCHMP the appropriateness of the participation level targeted.

P Ensure to document the SCA participation level targeted from each workgroup.

ISO



A36-05 Did the Safety Culture Assessment address the following components: a) Management Commitment and Leadership, b) Individual Performance and Accountability, c) Peer Perception and Accountability, and d) Safety Program Performance? [Section F.6 of the CCHMP Safety Program Guidance Document]

1. The assessment must address all the listed components. Stationary Sources should consider addressing topics listed in F.6.1 through F.6. 4 of the Safety Culture Guidance Document. [Section F.6 of the CCHMP Safety Program Guidance Document]

P&P 15.0-1 states the "SCA must address these components: Management Commitment and Leadership, Individual Performance and Accountability, Peer Perception and Accountability, and Safety Program Performance.

CCHMP reviewed the '2015 Safety Culture Assessment - Results Summary' and determined the facility used the same 15 cultural "factors" as the 2010 survey. The "factors" are grouped into one of the four cultural "components". Below is the distribution of 15 "factors" within the 4 "components" and the number of questions asked within each.

MANAGEMENT COMMITMENT AND LEADERSHIP-- Organizational Diligence (7)-- Management/Supervision (9)-- Communication (2)-- Reward/Recognition (5)

INDIVIDUAL PERFORMANCE AND ACCOUNTABILITY-- Quality/Continuous Improvement (4)-- Empowerment (3)-- Stress/Workload (4)-- Substance Abuse (5)

PEER PERCEPTION AND ACCOUNTABILITY-- Teamwork/Cooperation (3)-- Respect/Treatment of Employees (4)-- Safety Rules and Discipline (4)-- Employee Diligence (8)

SAFETY PROGRAM PERFORMANCE-- Employee Development/Training (6)-- Hazard Identification and Correction (2)-- Physical Working Conditions/Ergonomics (11)

Y NoneISO



A36-06 Does the Stationary Source also maintain the following records for each Safety Culture Assessment: a) Criteria for rejection of any results or findings, b) Criteria used for determining if no actions will be taken on assessment results or recommendations, c) Rationale for prioritization of action items, d) Documentation of communications to work force, e) Qualitative and quantitative comparisons in subsequent assessments of whether improvement plans affected observable safety behavior or culture? [ Section F.8 of the CCHMP Safety Program Guidance Document]

P&P 15.0-1, states "a deficient area is any cultural factor that exhibits a score more than 0.4 below the 2010 results." The policy also says that the review team will develop recommendations for all deficient areas. The 2015 SCA was compared to 2010 and the facility did not identify deficient areas as defined by P66's policy. Action Items developed are then risk ranked using the 'P66 Risk Matrix'. The Refinery Leadership Team has the authority to reject recommendations but must have documentation explaining the reason. Per interview with SME, the facility did not reject any results from the SCA survey.

Y NoneISO



A36-07 Was a report(s) presented to management and the workforce within 6 months of data collection? [Section F.8 of the CCHMP Safety Program Guidance Document]

1. Reports that are not completed and communicated within 9 months of data collection must be discussed in advance with CCHMP and CCHMP must provide written confirmation of the consultation. [Section F.8 of the CCHMP Safety Program Guidance Document]

Per interview with SME, the data collection period for the Safety Culture Assessment was completed in the months of October, and November. The SCA findings were communicated to the workforce in a letter dated July 11, 2016. The letter appeared in the "SaFeR Connections" (Summer 2016), refinery publication bulletin. The letter included a link with full access to the survey results and the full SCA Report.

The timing of the communication occurred approximately 8 months after the completion of the data collection. CCHMP guidance document states "the [SCA] report is to be presented to management and the workforce and should be within 6 months of data collection."

The report included a detailed assessment comparing the 2015 SCA with the initial 2010 SCA. The assessment included an overall comparison and by group for each SC element. The report also included a list of survey questions. The facility received a final copy of the 2015 SCA in July and promptly communicated the report with the work-force, unfortunately the report did not include all the required elements. Per CCHMP's guidance document "the report is to include an action plan for areas that need improvement" and as discussed in A36-09, was not completed until 1/24/17. The facility needs to update the 2015 SCA report to include Action Plan (Implementation Plan). For future SCA reports that cannot be completed and communicated to the workforce within 9 months ensure to discuss in advance with CCHMP and CCHMP will provide written confirmation of the consultation.

P Ensure future SCA reports include the action plan for areas that need improvement when they are communicated to the workforce.

ISO



A36-08 Has the Stationary Source developed a written improvement plan with a clear list of action items and identifiable milestones? [Sections F.7 and F.8 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources MUST develop an improvement plan to take steps to act on the findings of the assessment.2. The implementation plan MUST identify milestones. [Sections F.7.1 and F.8 of the CCHMP Safety Program Guidance Document]

The SCA issues were selected at a VPP meeting held on 11/15/16 in this meeting management and union personnel reviewed the SCA assessment and identified areas for improvement. The areas of focus were selected from the question survey responses that exhibited decreases from the 2010 SCA.

Each action item in the Improvement Plan was assigned an owner and completion date. The development of the improvement plan was completed during CCHMP's 2017 audit but was not implemented. See question A36-09 regarding the implementation of the improvement plan.

Y NoneISO



A36-09 Has the Stationary Source developed metrics from the improvement plan to monitor the effectiveness in achieving the facility’s stated goals for the safety culture program? [Section F.7.2 of the CCHMP Safety Program Guidance Document]

1. Implementation of improvements should start within 3 months of the report presentation. 2. Stationary Sources MUST establish goals and metrics for the improvement of safety culture at the site. These goals should encompass the state of the group values, attitudes, perceptions, competencies and patterns of behavior. The improvements must be made into a plan of action designed with metrics to assess its effectiveness in achieving the Stationary Source's stated goals. 3. Stationary Sources need to track the progress made for items in their improvement plan. [Section F.7.2 of the CCHMP Safety Program Guidance Document]

The facility finalized the Improvement Plan and action items on 1/24/17, during the CalARP/ISO audit and 6 months after the report was initially communicated to the workforce. Per CCHMP guidance document, the Improvement Plan should ne implemented within 3-months of the report presentation.

Per interview with the SCA SME, the facility intends on using the API‐754, Process Safety Performance Indicators for the Refining and Petrochemical Industries recommendations (also known as the Refinery Playbook). However CCHMP believes, the information reported does not provide enough detail to determine if the Improvement Plan is accomplishing its objectives. The goal of the metrics is not to measure Safety Culture as a whole, but rather measure the effectiveness of the SCA Improvement Plan. Metrics could measure the performance of individual action items in the Improvement Plan. CCHMP recognizes the challenges of developing SCA Improvement Plan metrics and the facility should consult with CCHMP as needed.

P Ensure to develop metrics to monitor the effectiveness in achieving the facility’s stated goals for the safety culture program. (Modified Repeat)

ISO

A36-10 Has the Safety Culture been reassessed at least once every 5 years? [Co. Ord. Section 450-8.016(h)]

1. After the initial assessment, Stationary Sources must perform safety culture assessments at least every 5 years. [Co. Ord. Section 450-8.016(h)]

The facility completed their 2015 Safety Culture Assessment (SCA) data collection by August 5, 2010 by a third party. The facility started the data collection in October and November 2015.

Y NoneISO



A36-11 Have all ensure action items associated with the previous Safety Culture/ISO audit of the Stationary Source been addressed within this prevention program questionnaire?

* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.1. This question is only applicable to Stationary Sources that have had prior Safety Culture/ISO audits by CCHMP.

Two ensure action items were developed in CCHMP's previous 2014 CalARP/ISO audit. One has been addressed and the other is being partially repeated in A36-09.

R NoneAudit Follow-Up

A36-12 Does the submitted Safety Plan accurately reflect the Safety Culture Assessments performed at the Stationary Source? [Section E.10 of the CCHMP Safety Program Guidance Document]

1. The Safety Plan must include:(a) A description of what Safety Culture means to the Stationary Source;(b) The purpose and overall objectives of safety culture assessments;(c) A discussion of the type of data gathering technique(s) used (written survey, interviews, etc.) and rationale;(d) A description of how the Stationary Source ensures that the Safety Culture Assessment is performed as expected and how the results will be evaluated for their site; and(e) Plans for future revalidations. [Section E.10 of the CCHMP Safety Program Guidance Document]

The Safety Plan (rev. 8.7.15) accurately reflects the Safety Culture Assessment.

Y NoneISO


S01R - Hot Work Permit (Program 3)


S01-01 Hot Work Permit

Does/did the stationary source develop and implement a written procedure for the issuance of hot work permits? [T8 CCR 5189(k)]

1. The permit shall certify that the applicable portions of the fire prevention and protection requirements contained in Sections 4848 have been implemented prior to beginning the hot work operations. [T8 CCR 5189(k)].2. Per discussion with CalOSHA (Dec 07), a hot work program that incorporates all the provisions of Sections 4848 and 6777 including training of personnel, on-the-job hazard identification and signature on the permit constitutes "certification".

CCHMP reviewed P&P 6.2-5 "Safe Practice #5-Work Authorization permitting (5/1/2016)" Section L- Hot Work states low energy and high energy hot work are controlled and authorized via the Work Authorization Permit Process. High Energy Hot Work is controlled via High hazard work in sections C-K of this Safe Practice and Appendix 1.

CCHMP reviewed 18 completed permits and noted that section 6 of the permit is for signatures for low energy hazard work and it includes the signature of the operations representative and maintenance representative, time and the expiration of the permit. Section 8 of the permit are signatures for high hazard work and it included additional signature from HSE representative as well as the hole watch and/or fire watch (if used). Section 10 of the permit is "Permit sign-off" and must be signed-off at end of shift or job completion. It includes signature for operations and maintenance representatives, time and if the tasks are complete.

Y NoneAbr



S01-03 Hot Work Program

Has management designated an individual responsible for authorizing cutting and welding operations in areas not specifically designed or approved for such processes? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 3.2.1.3] Does the facility ensure that before welding or cutting is begun, inspection and authorization by a designated management representative is required? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.3 and 3.2.2.3]

1. This includes inside tank farms, process units, etc.; and any activity that may potentially generate a spark; i.e., cutting, welding, grinding, working with pyrophoric iron, hot taps, etc. [CCHMP Interpretation] 2. Secure the authorization for the cutting or welding operations from the designated management representative [T8 CCR 4848(a) via ANSI/ASC Z49.1-94, 3.2.2.3]3. Before hot work operations begin in a nondesignated location, a written hot work permit by the permit-authorizing individual shall be required. [T8 CCR §4848(a) via NFPA 51B 3-3.1]4. Management must require that a supervisor or contractor supervisor is responsible for ensuring that cutting and welding are so scheduled that plant operations that might expose combustibles to ignition are not started during cutting or welding? [29 CFR §1910.252(a)(xiv)]

P&P 6.2-5 section C identified the Operations Supervisors and the Maintenance and Constructions Supervisors to co-authorize high hazard work permits. It also states the Health and Safety Department is responsible to participate in the review and authorization of Work permits containing high hazard work for high energy hot work, initial confined space entries and whenever assistance is requested. Section D of the policy defines high hazard work to be: a) high energy work, b) confined space entry, c) work using supplied air, d) electrical hot work, e) hot tapping, f) critical lifts, g) excavations, h) abrasive or hydro blasting, i) use radiation source including x-ray radiography or work on radiation source, j) work involving lead, asbestos or hexavalent chrome, k) any other work deemed to be high hazard work.

CCHMP reviewed 18 completed hot work permits from April 2016-Aug 2016 and all were properly signed-off.

Y NoneAbr


Has the stationary source determined and documented that the flammable gas or vapor content is less than 20% of the LEL before the hot work permit is issued? [T8 CCR §6777(e)]

1. This includes testing with well-maintained and calibrated portable measuring devices. [CCHMP Interpretation]

Section 9 of the Work Authorization Permit documents the atmospheric testing results and it states this is required for low energy work, vehicle entry & hot work. Of the 18 completed hot work permits reviewed, all 18 have documented the flammable gas and vapor content. Per review, all 18 permit listed 0% LEL.

Y NoneAbr




Do the hot work permits require that suitable fire extinguishing equipment be maintained ready for use when working with a source of ignition?)[T8 CCR §6777(h)]

1. Fire extinguishing equipment shall be ready for instant use [29 CFR §1910.252(a)(2)(ii) 2. Before a hot work permit is issued, the permit-authorizing individual must verify that fully charged and operable fire extinguishers that are appropriate for the type of possible fire shall be available immediately at the work area. [T8 CCR §4848((a) via NFPA 51B 3-3.2(j)]3. Sufficient fire extinguishing equipment must be ready for use where welding and cutting work is being done; management must assure that proper personal protective and fire protection equipment is used; and assure that fire protection and fire extinguishing equipment are properly located at the site. [T8 CCR §4848((a) via ANSI/ASC Z49.1-94, 6.2.1.1 and 3.2.2.4]4. These requirements should also be stated in a policy/procedure. [CCHMP Interpretation]

CCHMP notes section 7 of the permit is a section for "description of High Hazard work and includes checks for fire protection and assistance" and includes checks for fire watch, hole watch, bottle watch, standby, spotter, extinguisher, fire hose, contain sparks, fire blanket, weld closure, no open fuel, combustible cleared 35 ft.

CCHMP also performed 2 site visits to hot work performed on tanks, unit 100 tank 130 and Unit 40 tank 202. The permits were properly posted at both sites and CCHMP observed the fire extinguishers and fire hoses available at the job location.

Y NoneAbr




Does the facility ensure that where practical, the work is moved to a designated safe location? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.1.2] Does the facility ensure that if the object to be welded or cut cannot readily be moved, all movable fire hazards in the vicinity are taken to a safe location? [T8 CCR §4848(a) and ANSI/ASC Z49.1-94, 6.1.3]

1. Check that where objects to be welded or cut are not movable and where fire hazards cannot be removed, guards are used to confine the heat, sparks, and slag, and to protect the immovable fire hazards and nearby personnel [T8 CCR §4848(a) via NFPA 51B 3-3.2(l) and ANSI/ASC Z49.1-94, 6.1.4] 2. The requirement for first assessing whether the object to be welded or cut could be moved to an approved hot work area to perform the work should be in a hot work policy/procedure [CCHMP Interpretation] 3. Additional precautions should be taken if combustible metals are in the area or will be the focus of the hot work. This includes equipment or piping constructed of magnesium, titanium, or zirconium. Examples include welding or cutting on titanium heat exchangers. [CCHMP Interpretation]4. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHS Interpretation] 5. Supervisors shall ensure that materials are not exposed to ignition by taking one or more of the following actions: have the work moved to a location free from combustibles and away from hazardous areas; have the combustibles moved a safe distance from the work or properly shielded against ignition if the work cannot readily be moved; or schedule welding and cutting so that such materials are not exposed during welding and cutting operations. [T8 CCR §4848(a) and ANSI/ASC Z49.1-94, 3.2.2.2]

CCHMP reviewed the "Hot work Plan" which is a required supporting document and documented in section 4 of the work authorization permit, a justification for Field hot work including:-Cold work methods maximized: Can hand tools be used? Can cold cutting methods be used?-Cannot relocate to shop or weld bay: Can items be measured in the field and worked in a shop?-Cannot relocate outside Process Ares: Can items be moved to roadways or outside process area?

Y NoneAbr




Does the permit authorizing individual require a fire watch and ensure precautions are taken to prevent ignition of combustibles when performing hot work: (a) in a location where other than a minor fire might develop; (b) when combustible materials in building construction or contents are closer than 35 feet to the point of operation; (c) when combustible materials are more than 35 feet away but are easily ignited by sparks; (d) when wall or floor openings within a 35 feet radius expose combustible materials in adjacent areas, including concealed spaces in walls or floors; or (e) when combustible materials are adjacent to the opposite side of partitions, walls, ceilings, or roofs and are likely to be ignited (by conduction or radiation)? [T8 CCR §4848(a) via NFPA 51B 3-4.1 & 3-3.2(g)], ANSI/ASC Z49.1-94,

1. Additional firewatchers shall be posted where it is necessary to observe areas that are hidden from the view of a single firewatcher (e.g., other side of partitions, walls, ceilings, etc.) if combustible materials could be ignited. [T8 CCR 4848(a) via NFPA 51B 3-4.3 and ANSI/ASC Z49.1-94, 6.2.3]2. Welding shall not be attempted on a metal partition, wall, ceiling or roof having a combustible covering nor on walls or partitions of combustible sandwich-type panel construction [T8 CCR §4848(a) via NFPA 51B 3-3.2(h)] 3. Cutting or welding on pipes or other metal in contact with combustible walls, partitions, ceilings, or roofs shall not be undertaken if the work is close enough to cause ignition by conduction [T8 CCR §4848(a) via NFPA 51B 3-3.2(i)] This includes ignition by convection, conduction and radiation. This includes hot taps [CCHMP Interpretation] 4. If hot work is done near walls, partitions, ceilings, or roofs of combustible construction, fire-retardant shields or guards shall be provided to prevent ignition. [T8 CCR §4848(a) via NFPA 51B 3-3.2(f)]5. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

P&P 6.2-5 Appendix I section F lists the Fire Watch Requirements. A fire watch is required whenever welding, grinding or flame cutting is performed in a location where a potential for a fire might develop and to remain in the area for 30 minutes after completion of the hot work to detect and extinguish possible smoldering fires. The policy identified that it is the responsibility of the Operating Supervisor in charge of the area and the HSE Representative to determine whether the services of a fire watch are required. The duties of the fire watch are listed as well. Of the 18 permits reviewed 17 indicated fire watch was required.

CCHMP noted P&P 6.2-5 Appendix 1, section D.5 a-f listed the items b-e in this question.

Y NoneAbr




Has the stationary source ensured that the fire watch is maintained for at least ½ hour after the completion of the hot work operation to detect and extinguish smoldering fires; and that fire watchers are qualified individuals, knowledgeable about fire reporting procedures, and emergency rescue procedures, who are assigned duties to detect and prevent spread of fires? [T8 CCR §4848(a) via NFPA 51B 3-4.2 and ANSI/ASC Z49.1-94, 6.2.2 and 6.2.4]

1. Verification of fire watch qualifications may be from training documentation, or listing the requirements on the back of the permit. [CCHMP interpretation]2. Fire watch shall be trained in the use of fire extinguishing equipment, familiar with facilities for sounding an alarm in the event of a fire, watch for fires in all exposed areas, try to extinguish them only when obviously within the capacity of the equipment available, or otherwise sound the alarm. [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.2.4]3. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

P&P 6.2-5 Appendix I section F lists the Fire Watch Requirements, a fire watch is required to remain in the area for 30 minutes after completion of the hot work to detect and extinguish possible smoldering fires. The duties of the fire watch is listed in Appendix I section F item 4. Of the 18 permits reviewed 17 indicated fire watch was required. The one permit that fire watch was not required was not welding or grinding but use of a heater (open flame on a burner) in the pressure wash.

Y NoneAbr


Are all welding and cutting equipment inspected as required to assure it is in safe operating condition? When equipment is found to be incapable of reliable safe operation, is the equipment repaired by qualified personnel prior to its next use or withdrawn from service? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 3.1.1]

CCHMP reviewed a maintenance department procedures No. 2.08 (8/13/2012). Section D.11 states welding cables and gas hoses shall be inspected for cuts, leaks, breaks and insulation damage, prior to starting any welding or cutting job. It also states that pre manufactured sleeves used for splicing welding cable or like materials will be used and that electrical tape will not be equivalent or adequate in most cases.

Y NoneAbr




Does the facility ensure that the area is inspected by the permit-authorizing individual at least once per day while the hot work permit is in effect to ensure that it is in a fire-safe area? [T8 CCR §4848(a) via NFPA 51B 3-3.4]

1. The permit-authorizing individual shall determine the length of the period for which the hot work permit is valid. [T8 CCR §4848(a) via NFPA 51B 3-3.3]2. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

Per the policy, section J, a work authorization permit is issued for a specific date and time period up to 12 hours with a maximum of 24 hours extension. Section H specifies a joint job walk by the operations and maintenance representative is mandatory prior to the issuance of a work authorization permit. To extend the permit, the operator representative, his/her relief and the maintenance representative shall revalidate the original permit conditions and conduct a joint job walk and initial the permit to acknowledge the extension. Section C.2.c. of the permit specifies operations personnel and equipment owners are responsible to periodically review on-going work within their area of responsibility to have an awareness of the work and to provide correction and updates as needed. Per interview with operator and SME, operators will visit the work site during their normal rounds to ensure conditions have not changed.

Y NoneAbr


Does the submitted RMP accurately reflect the Hot Work Permit Program at the stationary source? [T19 CCR §2745.2(d)]

CCHMP reviewed the RMP (V9 submitted September 12, 2014), section 1.11 that summarizes the hot work permit program at the facility.

Y NoneAbr

S01-22 Audit Follow-Up


1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.

There were no ensure action items from the 2014 CalARP audit.

N/A NoneAbr


S03c - Lockout/Tagout (Program 3)


S03-08 Hazardous Energy Control Procedure

Does/did the stationary source develop and use a written energy control procedure, which clearly and specifically outlines the following:a) The scope, purpose, authorization, rules, and techniques to be used for the control of hazardous energy; b) The means to enforce compliance including, but not limited to a statement of the intended use of the procedure; c) The means to enforce compliance including, but not limited to the procedural steps for shutting down, isolating, blocking and securing machines or equipment to control hazardous energy; andd) The means to enforce compliance including, but not limited to the procedural steps for the placement, removal, and transfer of lockout devices and tagout devices and the responsibility for them? [T19 CCR §2760.3(d)] [T8 CCR §3314(g)]

1. The energy control procedure applies when employees are engaged in the cleaning, repairing, servicing or adjusting of prime movers, machinery, and equipment [T8 CCR §3314(g)]2. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]

CCHMP reviewed P&P 6.2-3 (12/15/16), 'Safe Practice #3, Preparing Equipment for Opening, Cleaning, Repairing, Servicing and/or Adjusting Lock/Tag/Try (LTT) and includes the scope (section B), purpose (section A), authorization (section C: Responsibilities), and general requirements to be used for the control of hazardous energy including identification of acceptable methods of equipment isolation (blinding, air gapping, installing a bullplug/tubing plug/pipe cap, line stopping, opening an electrical disconnect device, single block and bleed valve, and double block and bleed valve.

Before working on piping or equipment where the unexpected energizing, start up, release of stored energy, or release of hazardous material could occur and cause injury it shall be isolated, depressured, rendered inoperative, locked/tagged and tried by an authorized worker per the procedure.

Lock and tag of equipment owner may only be removed for the following 3 parameters:-return the equipment to service-temporary equipment energization with workers out of the line of fire-temporary equipment energization with workers in the line of fire (exception to the LTT and must be done within the specific guidelines of section M.8 of the policy)

Y NoneAbr



S03-09 Hazardous Energy Control Procedure

Does the energy control procedure clearly and specifically outline the means to enforce compliance including, but not limited to the requirements for testing a machine or equipment, to determine and verify the effectiveness of lockout devices, tagout devices and other energy control devices? [T19 CCR §2760.3(d)] [T8 CCR §3314(g)]

1. The energy control procedure applies when employees are engaged in the cleaning, repairing, servicing or adjusting of prime movers, machinery, and equipment [T8 CCR §3314(g)]2. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]

Section F of the P&P 6.2-3 is to perform Lock/tag/try. Additionally, the Operations Supervisor has the discretion, based on the complexity of the Equipment Isolation Device (EID) log to require a second qualified operator to make an independent verification and initial that all the isolation devices and Try Point Tags are installed per the EID log and work permits?

Y NoneAbr

S03-12 Energy Control Procedure

Does the stationary source ensure that where lockout is used for energy control, the periodic inspection includes a review, between the inspector and authorized employees of their responsibilities under the hazardous energy control procedure being inspected; stationary source certifies that the periodic inspections have been performed; and the periodic inspection certification includes the following: a) Identifies the machine or equipment on which the energy control procedure was being utilized;b) The date of the inspection; c) The employees included in the inspection; andd) The person performing the inspection? [T19 CCR §2760.3(d)] [T8 CCR §3314(j)]

1. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]2. The periodic inspections shall be conducted to correct any deviations or inadequacies identified. [OSHA §1910.147 (c)(6)(B)]3. A periodic inspection of the energy control procedure(s) must occur at least annually. [T8 CCR §3314(j)]

Per P&P 6.2-3, section C.5.b states the Health and Safety Department is responsible to annually review the implementation of this Safe Practice (#3, LTT) and make recommendations to the Safe Practice Standards Committee.

CCHMP reviewed ~25 LTT Work Permit Inspection Checklist and noted the checklist included:a) Equipment name/numberb) date of the inspectionc) the employees included in the inspection andd) The person performing the inspection.

These were properly completed.

CCHMP reviewed the annual program assessment for Confined Space Entry, hot work, & lock-Tag-Try for 2014 and 2015. Recommendations included: to distribute site-wide audit results on a scheduled basis to promote awareness of current issues for LTT, HW and CSE and training for the EST 5 (Enhanced Safety Training) for proper tagging.

Y NoneAbr



S03-21 Audit Follow-Up



There were no ensure actions associated with the 2014 CalARP audit at this facility. This question is not applicable.

N/A NoneAbr


ATTACHMENT C

Summary of Action Items

Summary of Action Items and Proposed Remedies

ID# Question Actions Proposed Remedy Due DateFindings

A11-17 Does the information pertaining to the equipment in the process include piping and instrumentation diagrams (P&ID's)? [T19 CCR §2760.1(d)(1)(B) & Section 450-8.016(a)(1)(A)(iv)]

Ensure that a policy is developed and implemented to finalize P&IDs on a timely basis and not to exceed one year.

Phillips 66 has discontinued the practice of issuing “preliminary” drawings outside the projects construction group. In an effort to provide the most up to date drawings for a PHA team, projects that were nearing completion had drawings prepared. Drawings will now use the boxes on each sheet to indicate the approval status. The drawing approval practice did not use this box for a period of time because the approvals were done electronically.The PSI policy requirements have been reviewed with affected personnel to ensure that P&ID changes will be finalized within one year.The Design Services Procedure Manual will be reviewed and updated as appropriate.

2/1/2018Per interview with SMEs, P&IDs should be updated within one year after MOCs are completed. However, there is no formal policy for managing finalization of P&IDs.

Per CCHMP review, many P&IDs used in the PHAs were listed as preliminary drawings. Per interview with SME, preliminary P&IDs are prepared to account for most up-to-date P&IDs for use in the PHAs including approved MOCs. However, per CCHMP review for P&IDs from PSI, much of the P&IDs stay as preliminary P&IDs and was not approved and finalized in a timely basis. CCHMP noted in one instance, there were 2 versions of the same P&ID (0228-YD-005-003) and both were labelled version 6. CCHMP noted the following P&IDs are still "preliminary" and not approved.

0246-YD-002-004,1 OF 1, rev 0, 5/20/2014 0267-YD-001-005,5 OF 13, rev. 5, 7/8/2015 0267-YD-001-001,1 OF 13, rev. 8, 7/8/2015, (DCN 10, 11, 1300,

SFE 07226 DCS, 10144, 10145, 11131, 11209, 13083) 0246-YD-001-030,1 OF 1, rev. 0, 3/24/2015 0246-YD-008-001,1 of 1, rev. 0, 9/17/2015 0246-YD-008-002,1 OF 1, rev. 0, 3/24/2015 0248-YD-001-001,1 OF 4, rev. 8, 12/4/2014 0228-YD-005-003,3 OF 3, rev. 6, 2/24/2015,(M20146383, SFC

07050, 10113, DCN 10000, SFE 05156, 10117)

CCHMP also performed 2 field P&ID walkdowns to confirm accuracy of the P&IDs. CCHMP noted some inconsistency in the information shown.

Monday, October 30, 2017 Page 1 of 29Phillips 66 - 2017 CalARP/ISO Audit Findings


A12-17 Was the PHA performed by a team with expertise in engineering and process operations? [T19 CCR §2760.2(d) & Section 450-8.016(d)(1)]

Ensure that the Unit 248 PHA report is amended to clarify that there was not a PHA session date held on 1/30/15.

The 2015 Unit 248 PHA report will be amended to clarify that the January 30, 2015 meeting was used as a document review since the minimum team participation requirements had not been met (3 minimum).

10/1/2017CCHMP reviewed the facility's PHA policy, PNP 2.0-6, last reviewed 11/7/16. Section E.2.a.i identified, "PHA team shall be comprised of at least three full time members, namely the Leader, Unit Operator, and Process Engineer. (Other full time members may be required to meet expertise and experience requirements.)" Section E.2.a.iii identified, "Either the Unit Operator or another full time Operations Representative shall have at least 5 years experience working on the process under review in the PHA (unless the process is less than 5 years old) and shall be familiar with current operation."; also, "The combined experience level between the Unit Operator, other full time Operations representatives such as the Operations Supervisor, and Process Engineer shall be at least 8 years working on the process under review (unless the process is less than 5 years old)."



In reviewing the Unit 248 PHA, CCHMP was unable to confirm that the proper team members were present on all of the six PHA session dates. For example, on 1/30/15 only the facilitator and the PHA Coordinator were present (i.e., no process engineering or operational expertise were present). The unit Process Engineer was only present at 1 of 6 (17%) session dates. One Operator was present for 5 of 6 session dates (missed 1/30/15) and another Operator attended only part of one session (2/24/15). Two Area Supervisors were listed on the team although each of them only attended part of one session on different days and they were not present when both Operators were missing on 1/30/15. Per interviews and file review, the PHA report mistakenly listed that a session took place on 1/30/15 when in fact there was not. Also, other engineers knowledgeable in process operations were present in the PHA when the Process Engineer was not.

In reviewing the Unit 244 PHA, the report documented that Operators were present for each session although not for the Process Engineer. The Process Engineer was only present on 1 of 7 (14%) sessions dates. An Ops Engineer was present for 3 of 7 session dates. Between the Ops Engineer and the Process Engineer, a total of 4 of 7 session dates were attended. Per


ID# Question Actions Proposed Remedy Due DateFindingsinterviews, the remaining three session dates included additional personnel with process engineering expertise.




A13-02 Are the written operating procedures consistent with the process safety information for the process? [T19 CCR §2760.3(a) & Section 450-8.016(a)(2)(A)]

Ensure to verify the accuracy and consistency of the PSI (such as plot plans and partial plans) provided in support of the emergency isolation procedures.

The following inconsistencies have been corrected: EIP-001-246 Emergency U-228 Isolation (valve 61 is shown in two different locations relative to valve 60), EIP-001-246 Emergency U-244 Isolation – (valve 100 and 196 is shown on the plot plan, but not on the partial plan), EIP-001-246 Emergency U-246 Isolation (valve 40 is shown on two different locations), and EIP-001-246 Emergency U-248 Isolation (valve 35 is shown on the plot plan but not on the partial plan). Policy 6.1-4 Attachment 5, Item 3 will be revised to include verification of the plot plan drawings and unit isolation valve checklists used in the EIP.

Verify policy location

2/1/2018CCHMP reviewed about 35 written operating procedures associated with the following units: - Unit 246 Hydrocracker- Unit 228 Isomerization- Unit 267 Crude Distillation- Unit 244 Reforming- Unit 248 Unistar (jet fuel)

Examples of procedures reviewed from the above units included:- NOP-200-246: Establishing U246 Circulation, approved 9/8/2015- NOP-201-246: U-246 Startup after Short Term Shutdown with Clean Hydrogen, approved 9/8/2015- NOP-204-246: U-246 Startup after Short Term Shutdown with Unit 246 (Dirty) Hydrogen, approved 9/8/2015- EIP-001-246: Emergency U-246 Isolation, approved 4/17/2013- NOP-206-248: Unit 248 Startup after Short-Term Shutdown, approved 9/8/2015- EOP-700-248: Emergency - 66-602 A or B Makeup Compressor failure, approved 4/29/2013- NOP-215-228: Tank 310/311 Circulation Start-up, approved 5/19/2016- EIP-001-228: Emergency U-228 Isolation, approved 9/4/2014- EOP-001-244: Emergency Safe Operating Limits (SOL0 for Unit 244- EOP-700-244: Emergency - 5G-501 Reformer Recycle Compressor Failure, approved 12/8/2015- NOP-203-244: Start-up after a Short-term Shutdown, approved 9/23/2016- EOP-100-267: Emergency Shutdown, Hot Circulation, Cold Circulation, approved 7/1/2013- EOP-200-267: Unit 267 Emergency Isolation valve Activation, approved 9/1/2013- EOP-300-267: Emergency Power failure, Emergency Circulation, approved 7/1/2013- NOP-302-267: Planned Shutdown/Steaming of Unit, approved 8/11/2014

CCHMP reviewed three (3) P&IDs from Unit 246 Plant 8 and one P&ID from Unit 228 through P&ID walkdowns. CCHMP confirmed that these P&IDs accurately reflected what was observed in the field except for some minor corrections.

CCHMP reviewed selected number of "Emergency Isolation Procedures (EIP)" to check for accuracy and consistency with process safety information. For each EIP, the facility includes two valve location maps showing the location of the emergency isolation valves, the corresponding valve number and whether the


ID# Question Actions Proposed Remedy Due DateFindingsvalves are elevated on an elevated platform. The attached valve location maps are presented in two ways, on a traditional ‘plot plan’ showing the valve location in relation to key equipment, and on a ‘partial plan’ showing the valves on a relative basis that is decluttered with a list of the valves. CCHMP reviewed the attached maps to the following procedures, and found the following inconsistencies.- EIP-001-246 Emergency U-228 Isolation – valve 61 is shown in two different locations relative to valve 60.- EIP-001-246 Emergency U-244 Isolation – valve 100 and 196 is shown on the plot plan, but not on the partial plan- EIP-001-246 Emergency U-246 Isolation – valve 40 is shown on two different locations.- EIP-001-246 Emergency U-248 Isolation – valve 35 is shown on the plot plan but not on the partial plan



A15-04 Is the frequency of inspections and tests of process equipment consistent with the following (a) applicable manufacturer's recommendations (b) good engineering practices (c) prior operating experience? [T19 CCR §2760.5(d)(3) & Section 450-8.016(a)(5)(D)]

Ensure that IPL initial testing is completed and a schedule is developed for subsequent testing.

A current project in progress includes the verification of all critical instrumentation used as Independent Protection Layers, the development or review of the testing procedures, and the inclusion of the testing schedule in the plant’s SAP system to ensure periodic testing of IPL testing is scheduled and documented to meet the frequency defined in our Instrument Mechanical Integrity Standard. These defined frequencies are based on industry RAGAGEP or our more protective company engineering practices and required standards.

10/1/2018CCHMP reviewed various different departments and equipment to verify inspection and testing. CCHMP reviewed fixed and rotating equipment as well as electrical equipment including Safety Instrumented Systems (SIS) and Independent Protection Layers (IPL).

Per CCHMP review of fixed equipment files and per review of metrics kept for the ME&I group, there have been no overdue inspections since the previous audit.

Per CCHMP review of rotating equipment, many of the more critical equipment (compressors, etc.) are connected to a 24/7 Bentley Nevada monitoring device. The other equipment are on a monthly schedule to check vibration readings. CCHMP reviewed the equipment history for two pumps and verified the correct inspections and tests were completed.

For the SIS, CCHMP reviewed select SIS from PHAs recently completed and followed up on the inspection and testing history. The items reviewed by CCHMP all had their test done in the appropriate time frame.

Per interview with the SME, the P66 facility has not done their initial testing of IPLs. This is a project they have currently started to undertake and currently less than 50% of the project is completed and not all units have had their IPLs initially tested. This needs to be completed as soon as possible and a subsequent testing schedule developed.

Per CCHMP review, the frequencies of inspections and tests that were completed were consistent with good engineering practices, etc.



A16-01 Has the stationary source established and implemented written procedures to manage changes (except for "replacement in kind") to process chemicals, technology, equipment, and procedures? [T19 CCR §2760.6(a) & Section 450-8.016(a)(6)(A)]

Ensure the MOCs are conducted for new and modified maintenance procedure and that P&P 2.0-5 or Procedure 1.01 is updated accordingly.

Maintenance Procedure 1.01 and P&P 2.0-5 will be revised to specify the MOC requirements for new/modified maintenance procedures. The use of the KMS system could be optional except for project driven maintenance procedure changes.

3/1/2018CCHMP has reviewed P&P 2.0-5, MOC (Management of Change) Policy, which was last revised on 07/27/2016. Per this policy, "The following MOC policy is required for all SFR Refinery operations. This policy covers the regulatory requirements, responsibilities, and procedures for MOC. The policy also documents which changes must undergo the MOC process."

This policy also documents other changes that could occur in the refinery which have a separate policy dictating the management of these changes. This includes: MOOC, Safe Work Practice Changes, Equipment and Testing Procedures, Building Changes, HSE policy changes, ME&I policy changes, bypassing of safety devices, turnaround interval extensions, emergency response plan, and temporary hose and piping.

CCHMP reviewed 17 completed MOCs as part of the audit. The MOCS reviewed were completed during the last three years (i.e. the scope of this audit)

CCHMP also reviewed one completed turn around interval change MOC approval form.

Per CCHMP review the MOC process does not cover new/modified maintenance procedures. Per interview with P66 this type of MOC has not been done. P&P 2.0-5 (MOC Policy) or Procedure 1.01 (Procedure Policy) needs to be updated accordingly to capture this.



A16-07 Do the Management of Change procedures address authorization requirements for the proposed change prior to any change? [T19 CCR §2760.6(b)(5) & Section 450-8.016(a)(6)(B)]

Ensure the MOC authorization for start up does not occur before the required MOC items are completed.

Phillips 66 has implemented an MOC audit program to identify and correct MOC issues including those situations where the documentation does not clearly show the proper authorization for start-up. The incident entries for MOC Issues are a part of the MOC auditing program. The IMPACT entry ensures that the specific causes are addressed as appropriate and to track and monitor the frequency of the problem.The MOC auditing program will reinforce the importance of ensuring that start-up does not occur before all required MOC items have been completed.

12/1/2017Per CCHMP's review of 17 completed MOCs, 1 of the 17 MOCs indicated that start up was authorized before all the necessary MOC items were completed. This was MOC M20146493-001

CCHMP also reviewed 8 impact reports in which the impact report (investigation) shows that MOCs were started before all required items were completed. Please refer to A19-01 for further details on the impact report numbers to correspond to the MOCs.



A18-03 Does/did the stationary source document the scope, methods used, results and findings in a report that is available for AA to review? [T19 CCR §2760.8(c) & Section 450-8.016(a)(8)(C)]

Ensure the evaluation for compliance with the provisions of this article to verify that the procedures and practices developed under this chapter are adequate and are being followed is documented in a report that includes the results and findings and is available for review. (This is a modified repeat).

Since the new California PSM and CalARP regulations have been approved for implementation, the company checklists for PSM/PSM compliance audits will not cover all California requirements. The Rodeo refinery and other P66 California Refineries will develop or obtain new compliance audit checklists for use. It is anticipated that a California PSM/RMP audit template will be developed for use. A copy of the updated California Refinery audit checklists will be made available to the AA for review. The compliance audit report will include the results and findings. The report will be available for review by the Administrating Agency (CCCHMP).

10/1/2018CCHMP was provided an audit report titled " Process Safety Management Audit Report of the CalARP and Contra Costa Health Services Industrial Safety Ordinance Risk Management Programs, August 2016" prepared by a third party, the report included purpose and scope (section 2), audit approach (section 3), and audit findings (section 4), and the audit worksheets were provided in appendices B. Section 2 of the report states the audit intended to cover the State of California and Contra Costa County Specific requirements and that compliance with the OSHA PSM and EPA RMP provisions was ascertained by a concurrent Health and Safety audit conducted by the Phillips 66 Corporate Audit Team. It also states the audit covered CalARP Risk Management Plan and the corresponding prevention program elements, and the County specific requirements (human factors, management of organizational change, Inherently Safety System, Security Vulnerability Assessments, Safety Culture Assessments). CCHMP noted a table in section 4 listed 210 of the 488 questions (43.1%) were non-observed by the company and these were addressed by the Phillips 66 Corporate Audit team. By examination, these were largely the PSM and RMP prevention program elements.

CCHMP reviewed a concurrent P-66 corporate memorandum that covered the PSM and RMP topics. The memo states "the audit was conducted using the PSM and RMP Self Audit checklist prepared by HSE Auditing and the audit included interviews of plant personnel (process and mechanical personnel); observation of maintenance and operations; inspection of plant facilities; and review of documentation. This 3 page documentation reported one non-conformance and it was considered to be of Significant Risk. However, there is no report that documented the results and findings of the assessment available for CCHMP to review. Similar lack of documentation was found during CCHMP's 2014 audit.



A18-04 Does/did the stationary source promptly determine and document an appropriate response to each of the findings of the compliance audit and complete the resolution of these findings within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround? [T19 CCR §2760.8(d) & Section 450-8.016(a)(8)(D)]

Ensure that a response to each of the findings of the compliance audit is promptly determined and the resolution of these findings are completed within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround.

Our Compliance Audit policy will be revised to specify the target date for completion of corrective actions to be within 1.5 years of the audit report corrective action responses. The revised policy will also discuss the actions to be taken promptly for high risk items.

2/1/2018Per P&P 14.0-6 (rev. 12/28/2016), Process safety related HSE audit non-conformances shall be identified and managed per the Phillips 66 Corporate HSE-Process Safety Incident Reporting Procedure. Per review of the third party audit report, a total of 10 recommendations were identified in the report by topics. Per interview with SME, the facility received the August corporate audit report on January 17, 2017 and therefore have not documented the response. There were no documented response to the Aug 2016 findings that were identified in the third party audit report. The due date for resolutions of these recommendations should be by 2/5/2018.

A18-05 Does/did the stationary source document the actual completion dates when deficiencies were corrected? [T19 CCR §2760.8(d) & Section 450-8.016(a)(8)(D)]

Ensure that action items are not documented to be closed until the deficiencies are actually corrected.

The specific instance cited by CCHMP was documented to be closed because the required action was completed. The suggested action proposed by the audit team was the entry of an IMPACT item for an improvement project to address concerns with a specific injection mix point that had inconclusive material testing results. A proposed improvement was to replace the components with a new configuration that would make future monitoring and testing more successful.Our compliance audit policy and IMPACT system require an Approver to review items that are submitted for closure and reject items with insufficient documentation or incomplete actions.

10/15/2017CCHMP reviewed documentation titled HSE Corrective Action Status with the audit type being identified as "Corporate HSE Compliance Audit", there were 9 non-conformances listed, one of these is only related to the Carbon Plant. These 2013 compliance audit non-conformance are documented to be closed from between June 2014-Nov. 2014. Per CCHMP review, NC6 was documented to be closed with the following "This item was entered into IMPACT as an action item (#194893) with a Target Date …………for 2015 turnaround." Per CCHMP review of the impact record, this MI non-conformance was completed in 2016.



A18-07 Does the submitted RMP and Safety Plan accurately reflect the existing Compliance Audits Programs at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

Ensure that the RMP is corrected to reflect that there were 9 non-conformances associated with the 2013 compliance audit.

The RMP was corrected, submitted, and approved by the county on May23rd.The number of non-conformances was updated in that correction.

10/1/2017"Section 1.8 of the RMP (9/12/2014), p. 24 states "During the 2013audit, 10 non-conformance findings were identified. Of the 10 nonconformance's, none were considered to be of High Risk, one wasconsidered to be of Significant Risk, and nine were considered to be ofMedium Risk." Per CCHMP review of the Dec. 17, 2013 interoffice Communication, there were 9 non-conformances and the HSE Corrective Action Status.

Safety Plan (8/7/2015) p. 25-26 describes the compliance audit program at the facility.



A21-05 Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job? [T19 CCR §2760.12(c)(1) & Section 450-8.016(a)(11)]

Ensure that the contract owner or operator assures that each contract employee is trained in the work practices necessary to safely perform his or her job. The facility needs to follow their policy to coordinate a Contractor Safety Program Office Audit, of Category 3 & 4 (Significant and High Risk) Contractor Companies every 3 years.

The Contractor Safety Policy will be revised to include the target number of audits of active Category 3 and 4 companies. The policy revision will include the addition of a definition for “active” to our audit protocol.

3/1/2018As referenced in contractor policy, Contractor safety office audits address the contractor HSE management system including the contractor documented training/certification of contractor employees. Per the P&P Manual Section 6.3-1, Section G.6, "In addition to the initial review conducted during the prequalification process, the Contractor Safety Coordinator will coordinate a Contractor Safety Program Office Audit, of Category 3 & 4 (Significant and High Risk) Contractor Companies every 3 years using R-995 Form."



CCHMP inquired for information on how P66 addresses H&SC Section 25536.7 requirements. Per interview, contracts with the facility contractors were signed for 5 years before January 2014. There has been at least one new contract signed in 2016 by P66 and the requirement of H&SC Section 25536.7 apply to this contract employee qualification which utilized boiler makers and welders. Per interview and a review of the contract employees provided to P66 by the contractor, more than 90 percent of the skilled journeypersons were graduates of an apprenticeship program for the applicable occupations. The SB54 requirements were well met by this contract as the required percentage is 60 percent for the contractors hired after January 1, 2016. Per CCHMP review, the current contractor policy does not address the requirements of H&SC Section 25536.7 as part of the qualification of the contractors hired after January 1, 2016. Per interview, all of their remaining contracts with various contracting companies are existing and the terms do not expire until 2018.




Ensure the process to authorize exceptions to the Fatigue Management Standard is revised to match the requirements contained within the PNP.

The Fatigue Management Standard will be revised to clearly state the management review process for exceptions. The program will be monitored to ensure the implementation is consistent with the policy expectations.

3/1/2018Per interviews with select RLT members, CCHMP was informed that safety is an item that is constantly discussed. For example, each meeting typically starts with a safety moment; daily morning meetings discuss safety as the first topic; company newsletters promote good examples of using stop work authority and near miss investigations; life saving rules are discussed and if not followed are written up as an incident.


P66 has a stop work program where an employee can stop a job if it is perceived as unsafe. CCHMP reviewed PNP 1.0-3, Procedures for Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard, last reviewed 11/10/16. CCHMP interviewed front line operators and maintenance personnel as well as management and consistently was informed that the stop work program onsite is effective and allows anyone (employee or contractor) to pause work if they believe something is unsafe. Positive examples of stopping work have been communicated in weekly newsletters to employees to encourage others to use this practice to make sure that all work is performed safely. The concept is promoted by the Plant Manager in the orientation video provided to visitors and contractors. Nevertheless, CCHMP believes that the title of the standard could be improved. Specifically, the title, "Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard", seems to be focused on an employee refusing to do work instead of a perception of trying to stop and correct an unsafe situation. CCHMP believes there is a difference between refusing to work and convincing others there is something unsafe than having the authority to stop work to make sure tasks are performed safely.

CCHMP was informed that the facility has a Fatigue Management Standard policy (PNP 1.1-22, latest revision 12/1/16). The intent of


ID# Question Actions Proposed Remedy Due DateFindingsthe Fatigue Management Standard is to improve safety at the facility by minimizing impacts associated with worker fatigue. In reviewing this PNP, CCHMP confirmed that the facility has adopted API RP 755 on fatigue risk management (e.g., for 12-hour operations: maximum 7 consecutive shifts during normal operations; and a maximum of 14 consecutive shifts during outage, turnaround and special projects). The facility's PNP contains an exception process for the limits listed in the fatigue policy. In reviewing select Exception Process Approval Forms, CCHMP was unable to confirm that the facility's PNP is being followed. Specifically, the PNP identified that the Plant Manager is to authorize a worker to exceed the maximum number of consecutive shifts although in documentation reviewed for December 2016 and January 2017 none of the forms were signed by the Plant Manager; instead they were signed by a Health & Safety Supervisor and Process Shift Supervisor. The exception form identified that the Plant Manager is to authorize the employee to work if the employee is to exceed 8 consecutive shifts, which means if working 9 or more shifts. It is also unclear to CCHMP why no fatigue exception is required for 8 consecutive shifts (versus exceeding 8 consecutive shifts) when the listed maximum is 7 consecutive shifts. CCHMP found that one exception form was completed for someone working 8 consecutive shifts, which is consistent with management interviews.




Ensure that the maintenance staff involved in writing maintenance procedures receive initial or just in time specialized training and 3-year refresher on writing effective procedures and applying LCCs.

Maintenance procedure writers will receive refresher training on writing effective procedures and using the Latent Conditions Checklists through just-in-time training or scheduled training.

5/15/2018The facility provides employees and their representatives with specialized initial and refresher training on writing effective procedures for operating procedure writers every three years and this training includes addressing latent conditions checklist for procedures. This training is refreshed every three years for the procedure writers who remain in this role. CCHMP reviewed a list of procedure writers who had completed this training and noted that about 30 procedure writers remain up to date on their CBT or live refresher training. Per a review of 10 new or revised procedures prepared in the last three years, LCCs were completed for each procedure and these were completed by employees that received specialized training on writing effective procedures per a review of the list of up to date trained operations staff listed in the roster of procedure writers who had completed the training.


The facility also provides specialized training on completing latent conditions checklists for PHAs and these are completed in time and copies of completed LCCs by operations staff and signed rosters of training are included in Appendix C of each of the five PHAs reviewed (see A25-08 for PHAs reviewed). Just in time training for PHAs included addressing a human factors checklist derived from the County LCC checklist and included 68 questions. CCHMP noted that just in time training for four out of five PHAs were completed from a few weeks to near 2.5 years before completing the LCCs. For the 5th PHA, just in time training was done more than 2.5 years before. For those employees who do not routinely complete a latent conditions checklist, refresher specialized training should occur just prior to applying the checklist.


For incident investigations, Policy 10.0-4 requires special handling


ID# Question Actions Proposed Remedy Due DateFindingsof a Major Chemical Accidental Release (MCAR), as defined by the Contra Costa County Industrial Safety Ordinance. For any situation that did or could reasonably have resulted in a MCAR, the team may conduct training on the Human Factors Prechecklist for incident investigations (Form R-10.0-7) before conducting the root cause analysis (RCA). Per the policy, this form will be completed before conducting the RCA when training is needed based on the experience of the team members. The current TapRoot incident investigation software is capable of addressing human factors and per a review of Form R-10.0-7, the LCC questions are addressable by TapRoot. There are currently about 30 staff at the refinery with about 5 who have the training to be an incident investigation facilitator.




Ensure that the entire procedure is included in the Procedural PHA and not just sections of a procedure.

The documentation of procedural PHAs will be improved to show that although there were some specific steps that were evaluated as an active failure or unsafe act, the entire procedure is reviewed in the process to identify the steps where an active failure or unsafe act could potentially cause significant consequences.

2/15/2018As described in A28-02, the facility developed a process to evaluate tasks to determine whether a written operating procedure is required. Associated with this process, procedures that are classified as being of low frequency, high consequence and high criticality are classified as level 4 and require a procedural PHA be applied to them. To complete the procedural PHA the stationary source used the guide word HAZOP approach.

In previous audits CCHMP was provided with a list of 48 Procedural PHAs. Currently, due to the implementation of additional safeguards on existing process equipment, a total of 9 procedures have been identified as needing procedural PHAs. CCHMP reviewed 5 out of this 9. Other refineries had an average of 110 Procedural PHAs, with some doing fewer and others doing more. CCHMP recognizes that Phillips 66 has performed significant research in determining a method to select procedures for procedural PHAs, nevertheless there is a significant gap between refineries within the county on the number of procedures ultimately selected. CCHMP suggests that this topic be further explored when the county's Safety Program Guidance document is amended. CCHMP reviewed a total of 5 of the 9 procedural PHAs. In the Health, Safety and Environmental Precautions section of each, the Procedural PHA identified those steps that were evaluated if the PHA team elected not to re-evaluate the entire procedure. The following summarizes those procedural PHAs reviewed: -- NOP-700-SPP (Procedural PHA on steps 1.4, 4.0, 4.1.1 out of a total of 46 steps) completed 3/10/14 -- NOP-309-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-310-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-104-MTC (Procedural PHA on steps 3.3, 3.7, and 4 out of a total of 17 steps)

-- NOP-108-MTC (Procedural PHA on step 2.3) CCHMP was informed that the facility completed Procedural PHAs based on the overall risk of the procedure and at times only on certain critical steps of a procedure if performing the step wrong could lead to a significant incident (e.g., MCAR) and this process was previously discussed with CCHMP. Although meetings were


ID# Question Actions Proposed Remedy Due DateFindingsheld on this topic, CCHMP does not believe that only reviewing select steps of a procedure is consistent with the concepts of a procedural PHA. The facility needs to include every step of the procedure in the Procedural PHA and not just the high risk steps.


CCHMP has been informed of good success in using a 2 guideword approach that takes less time to complete and still obtains similar results. The 2 guideword approach uses the following steps: "Step not performed" and "Step performed wrong".

A26-13 Did the Stationary Source prepare a written report that documents the safeguard protection analysis in accordance with the standard of practice applicable to the type of analysis conducted? [Co. Ord. Section 450-8.016(j)(4)]

Ensure that the SPA report is completed within 30 days after the LOPA analysis.

The PHA process will be updated to indicate that the SPA must be issued within 30 days of completion of the LOPA analysis.

12/1/2017All LOPA analyses are included within the PHA reports. CCHMP was unable to confirm that these reports were issued within 30 days of completion. The facility tracks the session dates, manager meetings, and final report dates.

See A12-05 for details on session dates, manager meetings and final report dates. The ISO requires that the Stationary Source complete the report within thirty days after the completion of the Safeguard Protection Analysis. The overall process was described as follows: after completion of the PHA session dates each PHA is required to have the LOPA independently reviewed. The facility only has one individual that performs this review. After the review is completed, modifications are typically needed in the LOPA study, including the possibility that the PHA team reconvene to address any noted issues. After this the recommendations are organized for the managers meeting. After the managers meeting a final report is prepared.



A27-04 Does the Stationary Source have a process in place to identify near miss MCARs? [Section B: Chapter 5 of the CCHMP Safety Program Guidance Document]

Ensure that a process is developed for identifying near miss MCAR's per the ISO document.

A definition of “near miss MCAR” will be developed and added to the site’s Policy 10.0-1 Incident Management Policy which will describe how such incidents are investigated and tracked.

3/1/2018CCHMP reviewed PNP 10.0-1 Incident Management Policy which details the approach taken to document near miss or MCAR investigations. In section D2, Incident Classification and Risk Ranking, there is a list of classifications that provide a guide to help the facility adopt the best approach for investigating

incidents. Per CCHMP review of the report for Coker Antifoam Fire (IMPACT ID # 253782), the facility addressed human factors in accordance with PNP 10.0-1 which may have contributed to the MCAR. In Section B Chapter 5, the Safety Program guidance document states:

"Stationary Sources must have a process in place to identify near miss MCARs."

Per SME interview, the facility does not directly track or classify incidents as near miss MCARs.




Ensure the Maintenance Procedure Risk Based Assessment is used to evaluate maintenance tasks associated with key equipment, repetitive inspections, preventative maintenance, testing, and repair tasks.

The site will conduct training for maintenance procedure writers and affected employees on the use of the Maintenance Procedure Risk Based Assessment, Identify tasks associated with key equipment, inspections, preventative maintenance, testing, and repairs and evaluate them using the process.

5/1/2018P&P 6.1-2 'Operating Development and Document Management', rev. 09/01/2017, describes the process for evaluating operational tasks. Within the policy the facility has developed a 'Procedure Development Work Flow' which establishes criteria to determining which tasks require written procedures. Per P&P 6.1-3 'Operating Procedure Assessment', rev. 06/30/2016, all newly identified tasks go through a Risk Assessment comprised of a minimum of two people. The facility has developed a 'Procedure Risk Based Matrix', that determines the Risk Classification of a task by quantifying the following three parameters: complexity, task frequency, and potential consequences. Complexity is measured on a scale of Low (performed with little assistance), Moderate (console to field, field to field communication), High (likely to involve multiple shifts). Frequency is measured as Frequent (daily/weekly), Infrequent (greater than weekly - less than annual), Rare (annual or greater); and Potential Consequence is measured as Low, Moderate, Severe (offsite impact, asset damage >$1MM).




Maintenance Procedures: The facility has written a total of 158


ID# Question Actions Proposed Remedy Due DateFindingsmaintenance procedure, 54 of those procedures are task-based which can be executed by craft personnel. The remaining 104 are policy/administrative based.

Per the Maintenance Procedure Policy No. 1.01 (dated 5/11/16), "Maintenance procedures are developed for key equipment to provide helpful recommendations to improve performance of the equipment, and non-specific instructions for repetitive inspections, preventative maintenance, and testing and repair tasks." In the latest revision to the policy the facility included, "Maintenance Procedure Risk Assessment" R-116 similar to the operating procedure risk assessment. As described in the policy, the maintenance risk assessment ranks task on a scale of 1-3 based on the complexity, frequency and potential consequence; 'Risk 1' tasks do not require a written procedure, Risk 2 tasks require a procedure to be developed, and Risk 3 tasks require the development of procedure and signature signoff. Per interviews with maintenance personnel and SME's, the Maintenance Procedure Risk Assessment is currently not in use and some personnel are unaware of its existence. The facility should identify tasks associated with key equipment, inspections, preventative maintenance, testing, and repairs and evaluate them using the Maintenance Procedure Risk Based Assessment.



A29-05 Has the Stationary Source developed and implemented a method to ensure that they clearly understand their existing situation prior to making the organizational change? [Section B: Chapter 7.2 of the CCHMP Safety Program Guidance Document]

Ensure the MOOC team clearly understands the existing situation prior to making the organizational change by reviewing the job responsibilities/tasks for the affected personnel, complete all 'Impact Assessments', complete all appropriate signoffs and maintain the documentation. (Modified Repeat)

Revise and improve the MOOC training curriculum and conduct just-in-time training to employees involved in the MOOC teams. Just-in-time training is conducted during the first meeting of an MOOC team and documented using an R-506 Form.

10/1/2018'Section E' of policy P&P 5.0-4 states, "the team must clearly understand the responsibilities of each position affected by the change. Additionally, if the change involves elimination of a position or significant changes to individual job responsibilities and job tasks, these are described along with a disposition for each task/responsibility." Per interview with the HSE Manager and SME, the MOOC team reviews the completed R-761 "Understanding the Organizational Change" along with a description of the position's responsibility and tasks. During the CalARP/ISO audit, CCHMP was not provided copies of job responsibilities and job tasks used by the MOOC review team.

The "Position Screening" process as described in the section E.5.b. of P&P 5.0-4, requires the team to complete the "Safety and Environmental Responsibility Mapping Chart" form, R-765 p. 2, and the "Identifying Potential Safety, Health and Environmental Impacts" form, R-765 p.3 (formerly R-764).

Per policy a HSE Impact study required to be completed for all MOOC and is intended to identify groups with similar positions that may be impacted by the change. Positions Affected by the change are listed on the form along with a "description", the "potential safety impact" and priority "ranking". Priority ranking are given on a high, medium, low scale. CCHMP reviewed the six MOOCs and determined the majority of the Impact Studies were incomplete, below is a summary listed by MOOC IMPACT number:

-- IMPACT #33133 - "positions affected" were not identified, description is left blank for all entries, priority ranking was left blank for all entries;-- IMPACT #33332 - the "Description" column was left blank for all entries;-- IMPACT #32917 - identified "SRP OP2" in the "position affected" column but there is no description, potential safety impact or priority identified;-- IMPACT #34499 - "positions affected" left blank for all positions, "description" left blank for all entries, "priority" left blank for all entries.-- IMPACT #34678 - "positions affected' left blank, "description" column left blank, "priority left blank'

Per P&P 5.0-4, the MOOC Team leader is required to track the progress of MOOC in the "Management of Organizational Change

Procedure" R-765 form. The following steps require Date Completed and Signatures: 1. Purpose and Scope of Change; 2. Position Screening/Job Duty

Disposition; 3. Health and Safety Impact Assessment; 4. Action


ID# Question Actions Proposed Remedy Due DateFindings Plan Review; 5. Action Plan Tracked; 6. Completion of Pre-

Change Action Items. Per CCHMPs review the majority of the signatures were missing including the 'Final Review/Approval' signature from the HSE Manager. The facility is missing completion signatures on the majority of the steps and final approval. The MOOC documentation was missing 32 signatures out of 42 for the 6 MOOCs reviewed, below is a list organized by IMPACT number:

-- IMPACT #32917 - Step 5, -6, and Final Review/Approval was not signed complete-- IMPACT #33332 - All Steps and Final Review/Approval was not signed complete-- IMPACT #195769 - Final Review/Approval was not signed complete-- IMPACT #34499 - All Steps and Final Review/Approval was not signed complete-- IMPACT #34678 - All Steps and Final Review/Approval was not signed complete-- IMPACT #33133 - All Steps and Final Review/Approval was not signed complete



A29-08 Does the Stationary Source document the effects of the organizational change and potential action items to mitigate the consequences of the change? [Section B: Chapters 7.4 and 7.5 of the CCHMP Safety Program Guidance Document]

Ensure that MOOC action items are completed, verified and supporting documentation attached.

Revise and improve the MOOC training curriculum and conduct just-in-time training to employees involved in the MOOC teams. Emphasize the importance of sufficient documentation to action item approvers and responsible parties. Final MOOC approval will include a verification that sufficient documentation has been provided.

10/1/2018Action items developed from the MOOC are listed in the facilities action item database. CCHMP reviewed a sample of the MOOC action items and determined the closure and verification process needs improvement. In summary CCHMP reviewed 10 action items and found issues with three; two action items were completed but supporting documentation was not attached for verification, and one instance the attached documentation did not support the closure of the action item. The facility should ensure action items are completed and verified ins Below is a summary of the deficiencies identified by the corresponding IMPACT # and Action Item #:

-- IMPACT #33133; Action Item 197202 states, "Define job description and responsibilities of U80/80 CCR operator and include in CCR training for operators." Resolution: "see attachment [CCRduties.docx]" . [CCHMP reviewed the attached document which contained a job description for the CCR operated in list format. One of the duties in the job description stated "4 hour gauging? - not sure how this will work with new gauging system". The attached documentation does not support the closure of this action item].

-- IMPACT #33133; ACTION ITEM 197203 states, "Develop CCR training manual for future qualifications before initial CCR training for operators"; Resolution: "training manual completed. Started using it during initial CCR on 9/14." [CCHMP found the action item was closed but supporting documentation was not attached].

-- IMPACT #33332; ACTION ITEM 197914 states, "Ensure that MT Dock Operators are TPIC trained"; [CCHMP found the action item was closed but supporting documentation was not attached].



A30-05 Does the Stationary Source ensure that employees and their representatives review the written human factors program on an established frequency and that any necessary revisions are incorporated? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

Ensure that the LCC checklists are reviewed for modifications per P&P 3.0-2 and include a represented employee. (This is a repeat ensure)

Review the LCC checklist with a team that includes a represented employee.Review was completed on October 4, 2017 and documented on an R-506 Form.

10/4/2017CCHMP has reviewed P&P 3.0-2, Human Factors Program last revised on 04/01/2016. Per this policy, the Latent Conditions Checklist "will be reviewed on a 3 year basis coinciding with the policy update utilizing a team which will include representative employees to determine if the checklists reflect current conditions and if revisions are necessary."

Per CCHMP review, the policy was last updated 04/01/2016 which would make the next policy update due on 04/01/2019.

Per CCHMP review and per interview it could not be verified that a team which included a represented employee reviewed the LCCs for necessary updates per the Human Factors Policy. This was an ensure item from the previous audit. The MOOC checklist has been updated in 12/2016.




Ensure that PNP 2.0-7 is consistently followed to document an ISS risk code within the existing process PHA node if an ISS item could eliminate or reduce the potential of an MCAR.

Ensure that major change is defined in the context of evaluating for ISS associated with recommendations from MOC or incident investigation/RCA reports.

Revise and improve the policy and training provided to the PHA team on the use of the ISS risk matrix checklists. P66 is implementing changes to meet the new California PSM for Refineries and Cal ARP Program 4 regulations that contain new requirements for when to conduct a Hierarchy of Controls Analysis (HCA). The HCA is similar to the ISO’s Inherently Safer Systems (ISS) analysis but will require more documentation. The definition of major change from the new California PSM for Refineries and Cal ARP Program 4 regulations will be incorporated into all applicable site policies.

10/1/201810/1/2018

Existing Process:A minor discrepancy was noted between the PHA and ISS PNPs. Specifically, section E.2.f.i of PNP 2.0-6 (PHA) identified that the existing process ISS "team members (number and composition)" are different than that used for the PHA team. Section E.3.a of the PNP 2.0-7 (ISS) identified that the existing process ISS team is similar in composition to PHA team. Per interviews and review of 5 existing ISS analyses contained within the PHAs, the ISS team is comprised of the same people as the PHA team.

As described in A34-11, the facility conducts existing process ISS analyses during the PHA with the same PHA team members. This is documented within the individual PHA reports including team members qualifications and experience. In each case the ISS Checklist was used to document the ISS analysis. Section E.5.a.ii of PNP 2.0-7 identified that the ISS Checklist would document that "sufficient ISS design has been utilized or if implemented could eliminate or reduce the potential of an MCAR". The PNP further identified that if "an MCAR cannot occur or implementation of the ISS design would not eliminate or reduce the MCAR potential, the team will document this result in the checklist". "If the ISS on the checklist may eliminate or reduce the potential of an MCAR, the team will then determine if an MCAR could reasonably occur by using the ISS risk matrix (Attachment 4)." Using this risk matrix results in an ISS Risk Code of 'H' or 'L'. An 'H' code means that an MCAR could reasonably occur and require an inherent or passive ISS opportunity to be implemented. "If an MCAR could not reasonably occur - ISS Risk Code "L", then the ISS "L" risk ranking will be provided in either the completed checklist of the worksheets and no further review by the team is required." CCHMP reviewed the 5 existing process ISS studies and was unable to confirm the site's practice consistently follows the policy. For example, Unit 248, Node 16, consequence 5.1.16(r), 5.2.10(k), 5.2.14(p); Unit 244, Node 19, consequence, 2.1.5(j); Unit 228, Node 24, deviation 5, consequence 4(d). Most of the ISS items were documented as installed, were being managed on the process, or were not applicable. There were occasional examples where this was not the case and the ISS Risk Code was not provided in the ISS Checklists. As specified in the PNP, if an ISS item could eliminate or reduce the potential of an MCAR, an ISS risk code needs to be documented. CCHMP was also informed during the audit that the facility does not track MCAR incidents or near misses (this is further described in A27-01 and A27-04). Not tracking MCARs would make complying with PNP 2.0-7 difficult. An ensure item was listed in A27-04 for the site to track near miss MCAR situations.


ID# Question Actions Proposed Remedy Due DateFindingsMOC:PNP 2.0-7 identified that the facility would "determine ISS feasibility for situations, such as a major change or a recommendation from an incident investigation report, where a Major Chemical Accident or Release (MCAR) could reasonably occur". As listed in A27-04, the facility does not specifically track MCARs or near miss MCARs. Although the ISS policy (PNP 2.0-7) contains a number of definitions, major change is not defined. Nevertheless, CCHMP was unable to locate any MOCs that identified significant recommendations that would likely be considered a major change.

II/RCA:As described previously under MOC, the facility's PNP 2.0-7 contains wording that ISS would be evaluated associated with a recommendation from an incident report where a MCAR could reasonably occur. CCHMP was informed that no such recommendations have been generated.


Ensure to document the SCA participation level targeted from each workgroup.

The level of participation from each work group will be established and published with the survey data. Revise the P66 policy for Safety Culture Assessments to include a template of the required information for the SCA report and include the target participation levels.

5/1/2018Per review of the 2015 SCA Report, the facility achieved a participation rate of 90 percent for P66 employees and 68 percent for contractors. Bureau Veritas administered the survey to all employees including contractors that were onsite at the time of the survey. Per interview with SME, the facility did not establish a target participation rate for the 2015 SCA however the survey was distributed to everyone onsite. The facility achieved an overall combined (P66 and Contractors) participation rate was 83.7% percent. The workgroup that represented the lowest participation rate was P66 "Health & Safety Employees" 66.7 percent (10 out of 15).





Ensure future SCA reports include the action plan for areas that need improvement when they are communicated to the workforce.

P66 will revise the SCA policy to establish the timeframes and specific requirements for the SCA report.

5/1/2018Per interview with SME, the data collection period for the Safety Culture Assessment was completed in the months of October, and November. The SCA findings were communicated to the workforce in a letter dated July 11, 2016. The letter appeared in the "SaFeR Connections" (Summer 2016), refinery publication bulletin. The letter included a link with full access to the survey results and the full SCA Report.






Ensure to develop metrics to monitor the effectiveness in achieving the facility’s stated goals for the safety culture program. (Modified Repeat)

The facility will review the improvement plan with a representative cross section of employees after 1 ½ years of implementation to determine if any modifications are needed. The results and recommendations for modification will be appended to the SCA

10/1/2018The facility finalized the Improvement Plan and action items on 1/24/17, during the CalARP/ISO audit and 6 months after the report was initially communicated to the workforce. Per CCHMP guidance document, the Improvement Plan should ne implemented within 3-months of the report presentation.



ATTACHMENT D

Summary of Consider Items

Summary of Consider Items and Proposed Remedies

ID# Question Consider Proposed Remedy Due DateFindings

A12-08 Do the PHA(s) address the identification of any previous incident which had a likely potential for catastrophic consequences? [T19 CCR §2760.2(c)(2) & Section 450-

Consider including a reference within the appropriate HAZOP node(s) that documents adequate safeguards relating to a past incident.

P66 declines to implement this item. P66 will continue to include incidents of significance in the Incident node of the HAZOP Worksheets.

10/1/2017Each of the PHAs reviewed contained a list and description of the incidents reviewed as part of each study. The applicable incidents were summarized within a table at the beginning of the report. Reviewing this table CCHMP found that statements such as, "Loss of fuel gas is adequately covered in Node 14 with adequate safeguards." Although not required, CCHMP was unable to locate statements within the referenced node that referenced back to the past incident for the following PHAs: Unit 228, 244, 246 and 248. Only the Unit 267 PHA contained such references.

CCHMP also found that each PHA report included a node titled "Incidents" within the HAZOP worksheets. The list of incidents is conservative as it includes a variety of smaller events not classified as catastrophic or potentially catastrophic.



A12-17 Was the PHA performed by a team with expertise in engineering and process operations? [T19 CCR §2760.2(d) & Section 450-8.016(d)(1)]

Consider striving for full participation on the PHA Team for the Unit/Process Engineer.

P66 has always worked to have full participation of PHA teams. At times, operational demands and schedules interfere with scheduled PHA sessions. When this occurs, we re-schedule the PHA session until the minimum team participants are available.The PHA procedure will be updated to reflect that qualified (experienced and knowledgeable) Operations engineers or Process engineers may participate on the PHA team.

3/1/2018CCHMP reviewed the facility's PHA policy, PNP 2.0-6, last reviewed 11/7/16. Section E.2.a.i identified, "PHA team shall be comprised of at least three full time members, namely the Leader, Unit Operator, and Process Engineer. (Other full time members may be required to meet expertise and experience requirements.)" Section E.2.a.iii identified, "Either the Unit Operator or another full time Operations Representative shall have at least 5 years experience working on the process under review in the PHA (unless the process is less than 5 years old) and shall be familiar with current operation."; also, "The combined experience level between the Unit Operator, other full time Operations representatives such as the Operations Supervisor, and Process Engineer shall be at least 8 years working on the process under review (unless the process is less than 5 years old)."



In reviewing the Unit 248 PHA, CCHMP was unable to confirm that the proper team members were present on all of the six PHA session dates. For example, on 1/30/15 only the facilitator and the PHA Coordinator were present (i.e., no process engineering or operational expertise were present). The unit Process Engineer was only present at 1 of 6 (17%) session dates. One Operator was present for 5 of 6 session dates (missed 1/30/15) and another Operator attended only part of one session (2/24/15). Two Area Supervisors were listed on the team although each of them only attended part of one session on different days and they were not present when both Operators were missing on 1/30/15. Per interviews and file review, the PHA report mistakenly listed that a session took place on 1/30/15 when in fact there was not. Also, other engineers knowledgeable in process operations were present in the PHA when the Process Engineer was not.

In reviewing the Unit 244 PHA, the report documented that Operators were present for each session although not for the Process Engineer. The Process Engineer was only present on 1 of 7 (14%) sessions dates. An Ops Engineer was present for 3 of 7 session dates. Between the Ops Engineer and the Process Engineer, a total of 4 of 7 session dates were attended. Per


ID# Question Consider Proposed Remedy Due DateFindingsinterviews, the remaining three session dates included additional personnel with process engineering expertise.




A12-20 Has the stationary source established a system to document what actions are to be taken; develop a written schedule to complete these actions within two and one-half (2.5) years of performing the PHA, or the next planned turnaround (for those items requiring a turnaround); document the final resolution taken to address each recommendation and the actual completion date? [T19 CCR §2760.2(e)]

Consider modifying PNP 2.0-6 to clarify that PHA recommendations must be completed within 2.5 years of performing the PHA, or the next planned turnaround (for those items requiring a turnaround).

As suggested, Policy 2.0-6 will be modified to state that a PHA recommendation must be completed within 2.5 years of performing the PHA, or the next planned turnaround (for those items requiring a turnaround).

3/1/2018Each of the PHA reports identified that recommendations would be identified based upon the assessed risk ranking of the severity/likelihood pair. The facility uses a 5x5 matrix of severity/likelihood pairs that result in a total of four overall risk rankings of Category I (low), II (medium), III (significant), IV (high). These are defined as:-- I - fine as is with no recommendation required -- II - no recommendation needed if "controls can be verified as functional"-- III - recommendation must be developed and implemented with priority-- IV - recommendation must be developed and implemented with highest priority.

Per PNP 2.0-6 (PHA policy), any Category IV scenario must be immediately communicated to the Operations Manager and "require temporary/interim risk reduction measures within 30 days of identification to reduce the short term risk to the equivalent of a Category III or lower, until the permanent risk reduction measure can be implemented."

PNP 2.0-6 identified that a "PHA recommendation is not completed until the physical addition/ replacement/ revision (via MOC as may be required) or administration action is completed and is permanently in place with PSI updated, training completed, etc. or the recommendation is rejected with a documented basis."

PNP 2.0-6 also identified that to comply with the Contra Costa County Industrial Safety Ordinance (ISO), "all PHA recommendations must be mechanically complete and/or resolved within one year after completion of the PHA study", or next regularly scheduled turnaround if one is required to implement the recommendation. Wording is also included in the PNP that CCHMP must be contacted to extend completion dates. In addition, "The PHA study is considered complete after the management review of the study or no more than the PHA report communication plan date." Compliance with this requirement is described in A33-04.

Although not directly applicable to the P66 Rodeo Refinery, the PNP included language that PHA recommendations associated with Category II risks have a maximum target resolution date of within 3 years. As stated in the question, the CalARP regulations were modified, effective January 1, 2015, that requires a shorter PHA recommendation resolution date. CCHMP suggests that the PHA policy be modified for all Phillips 66 refineries within California.



CCHMP was informed that PHA recommendations are discussed during the Manager's Meeting and initial time frames for completion are assigned based on an assessment of the task. Since the facility is subject to the county's Industrial Safety Ordinance, this starts with a 1-year clock (see A33-04 for more detail). If those present in the Manager's Meeting believe the task must be resolved when the equipment is down then it is assigned to the next available turnaround. Target dates for all PHA recommendations are entered into Impact and assigned to a responsible party. CCHMP reviewed the closure status of 24 (all) PHA recommendations from the 5 PHAs listed in A12-05. A total of 3 recommendations remain open and are scheduled to be completed during turnarounds, 1 was rejected due to factual errors, and the remaining 20 have been completed. Most of the completed recommendations were closed within 1 year. A total of 4 recommendations received a variance request which is further described in A33-04.

A12-22 Has the stationary source established a system to communicate the actions to operating, maintenance, and other employees whose work assignments are in the process and who may be affected by the recommendations or actions? [T19 CCR §2760.2(e) & Section 450-8.016(d)(4)]

Consider communicating PHA recommendations and actions to those affected by them within two months after the managers meeting used to accept the PHA.

P66 declines to implement this item. PHA reports that include the recommendations are made available to all affected employees when the report is published. PHA recommendations are entered into the IMPACT system for tracking. When entered, the responsible person receives a notification from the system. The PHA recommendations are also tracked in a monthly report that is sent to all responsible parties.

10/1/2017CCHMP reviewed packages for communicating PHA results to the workforce for each of the five PHAs reviewed. Documentation included sign-in sheets for operations and maintenance personnel and emails to Area Supervisors. In reviewing when these communications took place, CCHMP found that the majority of them took place within one month of the managers meeting that approved the PHA report. CCHMP noted that communicating the Unit 246 PHA took up to 6 months and up to 9 months for the Unit 228 PHA. Further review found that none of the PHA recommendations for these two units were resolved sooner than this time period. Nevertheless, since PHA recommendations need to be addressed within one year to comply with the county's ISO, it is suggested that this communication consistently take place in the fist couple of months after the managers meeting if at all possible.



A12-26 Has the PHA been updated and revalidated by a team meeting the requirements of §2760.2(d) at least every five years after the completion of the initial PHA to assure that the PHA is consistent with the current process? [T19 CCR §2760.2(f) & Section 450-8.016(d)(2)]

Consider verifying the last PHA start date in 2015 for Unit 248 and the next PHA start date in 2020 to confirm its accuracy.

Review and verify the Unit 248 PHA start date and revise as appropriate.

3/1/2018As identified in A12-05, 4 of the 5 PHAs reviewed were re-do studies and 1 was a revalidation. CCHMP was informed that the facility uses the PHA session start date as the 5-year clock date. CCHMP was provided with a schedule of performing all PHAs onsite. Due dates were listed for the previous PHA and the next PHA for each plant five years into the future. For the 5 PHAs reviewed, the following dates were listed:-- Unit 228; 2/17/14, 2/17/19-- Unit 244; 1/21/15, 1/21/20-- Unit 246; 6/24/14, 6/24/19-- Unit 248; 1/28/15, 1/28/20-- Unit 267; 7/20/15, 7/20/20

In reviewing the PHA reports, the first session date listed for the 2015 Unit 248 PHA started on 1/27/15 instead of 1/28/15 as listed in the facility's EUPHA (Existing Unit PHA). The remaining dates matched.

A16-08 Are employees involved in operating a process informed of, and trained in, the change prior to start-up of the process or affected part of the process? [T19 CCR §2760.6(c) & Section 450-8.016(a)(6)(C)]

Consider documenting the different dates training occurred for MOCs on the R-506 vs stating various dates.

Consider investigating the possibility of having KMS track MOCs sent to operators via email to enhance accountability.

P66 declines to implement this item. The current system requires documentation of training or informing affected employees prior to approval for start-up. The Area Supervisor is responsible for verifying this in KMS. KMS also requires an approval, prior to closing the MOC, to verify that all training and informing of affected employees has been completed. The MOC auditing process has been useful in identifying the MOCs that may have less than adequate documentation and correction of the documentation.

P66 declines to implement this item. It would be tedious to use the KMS system in this way and provide little improvement over the current system.

10/1/201710/1/2017

Per CCHMP review of 17 completed MOCs, CCHMP noted various inconsistencies with the training documentation. This includes some MOCs stating there was an R-506 training form and the documentation uploaded did not include such form (per interview this is an optional requirement for that MOC so CCHMP was unable to verify if they had chose to fill out an R-506 and didn't upload it or if the MOC mistakenly said an R-506 should be there). Another item noted by CCHMP in 3 MOCs was that the training documentation form R-506 did not list exact dates of the training but rather stated "various dates", based on this CCHMP was unable to verify that training was completed in the proper MOC time frame.

Additionally CCHMP noted that for MOC where the training was simply a notification to operators the documentation in KMS is a screen shot of the night notes informing operators of the MOC. There is a section in the night notes where operators are supposed to check that they have read the MOCs but there is no system to ensure they do or hold them accountable.

The issues noted by CCHMP are not indicators that employees are not trained prior to the start-up of the process rather they are areas for improving the program to ensure that P66 is able to verify that training was done appropriately, therefore only consider items have been issued for these.



A18-04 Does/did the stationary source promptly determine and document an appropriate response to each of the findings of the compliance audit and complete the resolution of these findings within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround? [T19 CCR §2760.8(d) & Section 450-8.016(a)(8)(D)]

Consider updating P&P 14.0-6 to include the requirement to determine and document an appropriate response to each of the findings of the compliance audit and complete the resolution of these findings within one and one half (1.5) years after performing the compliance audit or the next planned turnaround for items requiring a turnaround.

P66 declines to implement this item. P66 is implementing the new California PSM for Refineries and Cal ARP Program 4 regulations and will update the Compliance Audit policy, 14.0-6, to include the appropriate action item deadlines.

10/1/2017Per P&P 14.0-6 (rev. 12/28/2016), Process safety related HSE audit non-conformances shall be identified and managed per the Phillips 66 Corporate HSE-Process Safety Incident Reporting Procedure. Per review of the third party audit report, a total of 10 recommendations were identified in the report by topics. Per interview with SME, the facility received the August corporate audit report on January 17, 2017 and therefore have not documented the response. There were no documented response to the Aug 2016 findings that were identified in the third party audit report. The due date for resolutions of these recommendations should be by 2/5/2018.

A19-10 Did/does the stationary source promptly address and resolve the incident report findings and recommendations and document the resolutions no later than one and one-half (1.5) years after the completion of the incident investigation, or two (2) years after the date of the incident, whichever is the earlier of the two dates, or the next planned turnaround for those items requiring a turnaround? [T19 CCR §2760.9(e) & Section 450-8.016(a)(9)(D)]

Consider updating Policy 10.0-1 to reflect the new action item deadlines required by the CalARP 2015 updates.

P66 is implementing the new California PSM for Refineries and CalARP Program 4 regulations and will update the Incident Management policy, 10.0-1, to include the appropriate action item deadlines.

10/1/2017Per CCHMP review, the Incident Investigation policy 10.0-1 does not state that recommendations be resolved in 1.5 years after the completion of the investigation or 2 years after the date of the incident.

Per CCHMP review of 23 investigations from 2015-2017, IMPACT records the action item, assigned date, target date, and completed date. Per CCHMP review, only one action item from all the reports did not have a completed date that fell in the new 2015 CalARP regulatory update requirements. The action item exceeded the 1.5 year timeframe by 20 days. CCHMP does not feel this warrants an action item.

A19-16 Do the submitted RMP accurately reflect the existing Incident Investigation Program at the stationary source? [T19 CCR §2745.2(d) & Section 450-8.016]

Consider updating the RMP to include the new action item completion timeframes from the 2015 CalARP updates.

P66 declines to implement this item. The CalARP Program 4 regulations specify that the RMP will be updated as described in section.2745.1 (a).

10/1/2019The submitted 2014 RMP accurately reflects the Incident Investigation program at P66.



A21-05 Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job? [T19 CCR §2760.12(c)(1) & Section 450-8.016(a)(11)]

Consider including the requirements of H&SC Section 25536.7 for qualification of new contractors as part of the contractor program policy.

Consider modifying the facility contractor program policy to require sufficient office audits of contractor programs so as all higher risk contractors are audited for their training within a reasonable timeframe of a maximum of 5 to 7 years.

P66 will revise the contractor safety policy to include the appropriate sections of HSC Section 25537.5.

P66 will revise the contractor safety policy to include more office audits of higher risk contractor companies.

3/1/20183/1/2018

As referenced in contractor policy, Contractor safety office audits address the contractor HSE management system including the contractor documented training/certification of contractor employees. Per the P&P Manual Section 6.3-1, Section G.6, "In addition to the initial review conducted during the prequalification process, the Contractor Safety Coordinator will coordinate a Contractor Safety Program Office Audit, of Category 3 & 4 (Significant and High Risk) Contractor Companies every 3 years using R-995 Form."



CCHMP inquired for information on how P66 addresses H&SC Section 25536.7 requirements. Per interview, contracts with the facility contractors were signed for 5 years before January 2014. There has been at least one new contract signed in 2016 by P66 and the requirement of H&SC Section 25536.7 apply to this contract employee qualification which utilized boiler makers and welders. Per interview and a review of the contract employees provided to P66 by the contractor, more than 90 percent of the skilled journeypersons were graduates of an apprenticeship program for the applicable occupations. The SB54 requirements were well met by this contract as the required percentage is 60 percent for the contractors hired after January 1, 2016. Per CCHMP review, the current contractor policy does not address the requirements of H&SC Section 25536.7 as part of the qualification of the contractors hired after January 1, 2016. Per interview, all of their remaining contracts with various contracting companies are existing and the terms do not expire until 2018.



A22-11 Does the emergency response program include training for all employees in relevant procedures and relevant aspects of the Incident Command System? [T19 CCR §2765.2(a)(3) & Section 450-

Consider conducting a scheduled periodic review after the 3rd quarter training to ensure that all fire response personnel have attended the required training.

P66 will conduct additional reviews of training status to ensure personnel attend required training.

10/1/2017CCHMP reviewed P&P 8.0-7 'Emergency Response Team Participation Criteria (rev. 7/29/2016) section D specified the emergency response team members must attend and pass the training as defined in the San Francisco Refinery Emergency Response Plan. It further specified that ERT members who are members of Fire Brigade must attend:-annual Fire School,-quarterly ERT training-a minimum of 75% of monthly ERT Training sessions-a minimum of 75% of ERT Leader classes (if working ERT Leader)

Specialty Team members must:-pass a certified course to the technician level-attend 75% of quarterly team training sessions-pass an annual Individual skills demonstration and-may be assigned an emergency response pager

Emergency response team members must pass the Emergency Response Team physical. Fire Brigade leader must be trained and qualified for their role. Incident commanders must complete training that meets the requirements as defined in the HAZWOPER standard. Per interview with Fire Chief, training records are maintained to track personnel for their role which consist of fire brigade member, hazardous materials response, oil spill response, rescue, medical respond and incident command.

CCHMP reviewed training record for 5 randomly selected emergency response team members. This included the annual fit test reports for the most recent 2 years and training records for the quarterly team training sessions. CCHMP noted that of the record reviewed, one or 2 are missing some of the quarterly team training sessions.

CCHMP also reviewed Annex 5, section A.5.2.6 listed training for fire brigade responders as "trained personnel will have initial fire fighting training as specified in OSHA Fire Brigades California Code of Regulations 3411. Annual fire schools will be conducted to meet the requirements of the standard. Brigade members are required to attend an off-site school training every other year.

CCHMP also reviewed record of the 2016 evacuation drill and floor monitors drill.




Consider modifying the title of PNP 1.0-3, Procedures for Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard, to emphasize stop work authority more.

Consider revising the Exception Process Approval Forms within the Fatigue Management Standard to clarify that an exception authorization is required in excess of the stated maximums in the PNP (e.g., in excess of 7 consecutive shifts instead of exceeding 8 consecutive shifts).

P66 declines to implement this item. The title of this policy is appropriate because the policy is written to the requirements of state and federal laws;California Labor Code Section 6311, 6400, Federal OSHA 29 CFR 1977.12.P66 is implementing the new California PSM for Refineries and CalARP Program 4 regulations which require the development and implementation of effective stop work procedures in accordance with section 2762.16(f)(1).

P66 will revise the Fatigue Management Exception Process Approval Forms to clarify the required authorizations needed.

10/1/201710/1/2018

Per interviews with select RLT members, CCHMP was informed that safety is an item that is constantly discussed. For example, each meeting typically starts with a safety moment; daily morning meetings discuss safety as the first topic; company newsletters promote good examples of using stop work authority and near miss investigations; life saving rules are discussed and if not followed are written up as an incident.


P66 has a stop work program where an employee can stop a job if it is perceived as unsafe. CCHMP reviewed PNP 1.0-3, Procedures for Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard, last reviewed 11/10/16. CCHMP interviewed front line operators and maintenance personnel as well as management and consistently was informed that the stop work program onsite is effective and allows anyone (employee or contractor) to pause work if they believe something is unsafe. Positive examples of stopping work have been communicated in weekly newsletters to employees to encourage others to use this practice to make sure that all work is performed safely. The concept is promoted by the Plant Manager in the orientation video provided to visitors and contractors. Nevertheless, CCHMP believes that the title of the standard could be improved. Specifically, the title, "Handling Refusal to Work on Grounds of a Perceived Safety or Health Hazard", seems to be focused on an employee refusing to do work instead of a perception of trying to stop and correct an unsafe situation. CCHMP believes there is a difference between refusing to work and convincing others there is something unsafe than having the authority to stop work to make sure tasks are performed safely.

CCHMP was informed that the facility has a Fatigue Management Standard policy (PNP 1.1-22, latest revision 12/1/16). The intent of


ID# Question Consider Proposed Remedy Due DateFindingsthe Fatigue Management Standard is to improve safety at the facility by minimizing impacts associated with worker fatigue. In reviewing this PNP, CCHMP confirmed that the facility has adopted API RP 755 on fatigue risk management (e.g., for 12-hour operations: maximum 7 consecutive shifts during normal operations; and a maximum of 14 consecutive shifts during outage, turnaround and special projects). The facility's PNP contains an exception process for the limits listed in the fatigue policy. In reviewing select Exception Process Approval Forms, CCHMP was unable to confirm that the facility's PNP is being followed. Specifically, the PNP identified that the Plant Manager is to authorize a worker to exceed the maximum number of consecutive shifts although in documentation reviewed for December 2016 and January 2017 none of the forms were signed by the Plant Manager; instead they were signed by a Health & Safety Supervisor and Process Shift Supervisor. The exception form identified that the Plant Manager is to authorize the employee to work if the employee is to exceed 8 consecutive shifts, which means if working 9 or more shifts. It is also unclear to CCHMP why no fatigue exception is required for 8 consecutive shifts (versus exceeding 8 consecutive shifts) when the listed maximum is 7 consecutive shifts. CCHMP found that one exception form was completed for someone working 8 consecutive shifts, which is consistent with management interviews.

A24-27 Does the submitted Safety Plan accurately reflect the existing management system at the Stationary Source? [Co. Ord. Section 450-8.016 and Section E.2 of the CCHMP Safety Program Guidance Document]

Consider updating the Safety Program Management section of the Safety Plan to clarify that senior staff are members of the JH&SC instead of specifying a specific number.

The Safety Plan will be updated as suggested at the time of our next submittal.

10/1/2018The Safety Plan submitted to CCHMP on 8/7/15 accurately reflects the existing management system onsite with one exception. Page 43 of the SP identified that two members of the senior staff are members of the JH&SC; whereas CCHMP found that three members have been attending these meetings. CCHMP does not believe it is necessary to list the number of senior staff on the committee in the RMP.




Consider providing just in time specialized training or refresher training for those employees who do not routinely complete a latent conditions checklist, just prior to applying the checklist for PHAs.

P66 will revise and improve the LCC checklist training and ensure employees receive the training prior to applying the checklists for PHAs.

10/1/2018The facility provides employees and their representatives with specialized initial and refresher training on writing effective procedures for operating procedure writers every three years and this training includes addressing latent conditions checklist for procedures. This training is refreshed every three years for the procedure writers who remain in this role. CCHMP reviewed a list of procedure writers who had completed this training and noted that about 30 procedure writers remain up to date on their CBT or live refresher training. Per a review of 10 new or revised procedures prepared in the last three years, LCCs were completed for each procedure and these were completed by employees that received specialized training on writing effective procedures per a review of the list of up to date trained operations staff listed in the roster of procedure writers who had completed the training.


The facility also provides specialized training on completing latent conditions checklists for PHAs and these are completed in time and copies of completed LCCs by operations staff and signed rosters of training are included in Appendix C of each of the five PHAs reviewed (see A25-08 for PHAs reviewed). Just in time training for PHAs included addressing a human factors checklist derived from the County LCC checklist and included 68 questions. CCHMP noted that just in time training for four out of five PHAs were completed from a few weeks to near 2.5 years before completing the LCCs. For the 5th PHA, just in time training was done more than 2.5 years before. For those employees who do not routinely complete a latent conditions checklist, refresher specialized training should occur just prior to applying the checklist.


For incident investigations, Policy 10.0-4 requires special handling


ID# Question Consider Proposed Remedy Due DateFindingsof a Major Chemical Accidental Release (MCAR), as defined by the Contra Costa County Industrial Safety Ordinance. For any situation that did or could reasonably have resulted in a MCAR, the team may conduct training on the Human Factors Prechecklist for incident investigations (Form R-10.0-7) before conducting the root cause analysis (RCA). Per the policy, this form will be completed before conducting the RCA when training is needed based on the experience of the team members. The current TapRoot incident investigation software is capable of addressing human factors and per a review of Form R-10.0-7, the LCC questions are addressable by TapRoot. There are currently about 30 staff at the refinery with about 5 who have the training to be an incident investigation facilitator.



A25-10 Does the Stationary Source ensure a formal "feedback" loop is developed to inform personnel of the recommendations from the checklist and to ensure that the recommendations developed will adequately address the concerns? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

Consider highlighting the latent conditions deficiency recommendations when instructing affected personnel that PHA recommendations are available for review.

P66 declines to implement this item. The California PSM for Refineries and CalARP Program 4 regulations are being implemented at Rodeo refinery. There are new requirements to evaluate and implement. The highlighting of recommendations based on the source is not needed in the communication to affected personnel that a PHA report has been published and contains recommendations.

10/1/2017For PHAs, a formal feedback loop has been developed to inform the PHA team of the recommendations from the LCCs completed in the PHA. The recommendations from the LCCs are brought forward to a node on Human Factors in the PHA HAZOP nodes and shared with the PHA team. This would enhance the team communication to adequately address the corrective action proposed to resolve a human factors latent condition.

For procedures, a formal feedback loop is developed by including a procedure writer, an SME and an area supervisor for completing and reviewing the procedure and addressing any concerns from the LCC completed.


CCHMP reviewed emails that were issued from the PHA coordinator to the Unit Supervisors after a PHA was completed for the five PHAs reviewed and referenced in A25-06. Based on this review, the email to the unit supervisor and the rosters signed by operational staff confirmed that the PHA actions are reviewed with the relevant operation staff and if there have been LCCs that identified concerns and the human factors node of the PHA identified actions to take, those were identified in the PHA action items provided to be reviewed by affected operators. However, CCHMP could not confirm that the human factors concern items identified in LCCs are consistently documented to address all of LCC concerns. See A26-08 for a consider item on this issue. The facility should consider highlighting the latent conditions deficiency recommendations when instructing affected personnel that PHA recommendations are available for review.




Consider using a 2 guideword approach when evaluating Procedural PHAs (e.g., "Step not performed" and "Step performed wrong").

P66 has devoted time and resources to develop and implement the procedural risk assessment process to identify which procedures contain steps that could lead to active failures that could result in an MCAR.The county refers to these situations as “high active failure likelihood and high hazard potential”.It is not reasonable to assume that every step of a procedure would result in a high hazard potential if performed poorly. It is also critical to identify the existing safeguards in the process to determine if the active failure likelihood is high. P66 has implemented many safety instrumented systems to prevent the high active failure likelihood scenarios that require a procedural PHA.P66 will incorporate the recommended CCHMP 2 guideword approach at the time of the next policy review.

3/1/2018As described in A28-02, the facility developed a process to evaluate tasks to determine whether a written operating procedure is required. Associated with this process, procedures that are classified as being of low frequency, high consequence and high criticality are classified as level 4 and require a procedural PHA be applied to them. To complete the procedural PHA the stationary source used the guide word HAZOP approach.

In previous audits CCHMP was provided with a list of 48 Procedural PHAs. Currently, due to the implementation of additional safeguards on existing process equipment, a total of 9 procedures have been identified as needing procedural PHAs. CCHMP reviewed 5 out of this 9. Other refineries had an average of 110 Procedural PHAs, with some doing fewer and others doing more. CCHMP recognizes that Phillips 66 has performed significant research in determining a method to select procedures for procedural PHAs, nevertheless there is a significant gap between refineries within the county on the number of procedures ultimately selected. CCHMP suggests that this topic be further explored when the county's Safety Program Guidance document is amended. CCHMP reviewed a total of 5 of the 9 procedural PHAs. In the Health, Safety and Environmental Precautions section of each, the Procedural PHA identified those steps that were evaluated if the PHA team elected not to re-evaluate the entire procedure. The following summarizes those procedural PHAs reviewed: -- NOP-700-SPP (Procedural PHA on steps 1.4, 4.0, 4.1.1 out of a total of 46 steps) completed 3/10/14 -- NOP-309-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-310-MTC (Procedural PHA included all steps) completed 8/8/14 -- NOP-104-MTC (Procedural PHA on steps 3.3, 3.7, and 4 out of a total of 17 steps)

-- NOP-108-MTC (Procedural PHA on step 2.3) CCHMP was informed that the facility completed Procedural PHAs based on the overall risk of the procedure and at times only on certain critical steps of a procedure if performing the step wrong could lead to a significant incident (e.g., MCAR) and this process was previously discussed with CCHMP. Although meetings were


ID# Question Consider Proposed Remedy Due DateFindingsheld on this topic, CCHMP does not believe that only reviewing select steps of a procedure is consistent with the concepts of a procedural PHA. The facility needs to include every step of the procedure in the Procedural PHA and not just the high risk steps.


CCHMP has been informed of good success in using a 2 guideword approach that takes less time to complete and still obtains similar results. The 2 guideword approach uses the following steps: "Step not performed" and "Step performed wrong".



A26-08 Does the Stationary Source manage the active failures and latent conditions by formulating and implementing action items in accordance with Section 450-8.016(d)(4) of the ordinance? [Section B: Chapter 4.1 of the CCHMP Safety Program Guidance Document]

Consider consistently documenting within the PHA whether a latent condition exists or not between the hand written LCC and the Human Factors Node in the HAZOP worksheets.

P66 will improve the just in time training provided to employees who complete the latent conditions checklists and improve documentation of the latent conditions identified. Not all latent conditions will generate a PHA recommendation since lower risk items are usually corrected by the area supervisor. The documentation of these items will be more consistent with the improved training.

10/1/2018All 5 PHA's were reviewed and found to have used a LCC to assess human factors issues. Several PHAs identified that active failures could exist and recommendations were listed to address those.

For example, CCHMP reviewed Unit 244 Reformer PHA completed 2/24/15.

The HF findings were as follows: -"D506 block valves need to be ¼ to avoid pinch points." *This item was closed 2/10/16 -"Utility water to E503 downstream valve needs to be ¼ turned to avoid pinch points." *This item was closed 2/10/16 -"G510 A&B BFW pumps start/stop switch needs ID plate." *This item will be closed during the next turnaround.

In reviewing the PHAs, a number of the hand written LCCs completed by the operator(s) prior to the PHA sessions contained notations indicating latent condition concerns. CCHMP was informed that once the LCC is brought to the PHA team, the LCC is discussed and issues are copied into the Human Factors node of the PHA worksheets. CCHMP noted that a number LCC concerns listed on the hand written LCC were crossed off and still others were not. In reviewing the Human Factors nodes for the various PHAs, a number of the items crossed off the hand written LCC were identified as "operational concern" and no recommendation was listed. In a some cases, an issue on the hand written LCC was risk ranked and some concluded with recommendations for resolution. This is an acceptable practice. In two PHAs, it was less clear to CCHMP whether a latent condition was identified or not given the little documentation maintained. For example:

-- Unit 244 and 248 - The action items listed in the hand written LCCs were: "Refinery radio’s do not work, cut in and out and batteries don’t last" and "Radios don't work well". In each of the Human Factors nodes for these PHAs, it was described that radios do not work well and new radios will be ordered and old batteries removed and replaced. Each also identified that there was no recommendation.

During the 2017 audit, CCHMP was informed that the facility purchased radios for the entire facility soon after these PHAs were


ID# Question Consider Proposed Remedy Due DateFindingsperformed. A consider item was issued to better document resolution to potential latent conditions.




Consider modifying the Procedure Risk Based Assessment so that a written procedure is developed for all tasks that have the potential to reasonably result in an MCAR (e.g. modify the consequence severity asset damage from $1MM to $500K).

P66 declines to implement this item. The question and ISO requirements for Operating Procedures do not set requirements to have a written procedure based on whether an MCAR is possible. An MCAR is only one of many potential consequences considered when evaluating tasks. The Procedure Risk Based Matrix was developed as a tool to guide the decision of whether a procedure is needed for the task. It uses consequence severity levels that are consistent with the P66 Risk Ranking Matrix. The risk ranking process is not aligned with specific characteristics associated with an MCAR. If a PHA scenario evaluates a scenario that may result in an MCAR, the associated safeguards would be evaluated to see if they are sufficient. A written procedure is not a preferred safeguard for a scenario that does not have sufficient safeguards, but may be used in some situations.

10/1/2017P&P 6.1-2 'Operating Development and Document Management', rev. 09/01/2017, describes the process for evaluating operational tasks. Within the policy the facility has developed a 'Procedure Development Work Flow' which establishes criteria to determining which tasks require written procedures. Per P&P 6.1-3 'Operating Procedure Assessment', rev. 06/30/2016, all newly identified tasks go through a Risk Assessment comprised of a minimum of two people. The facility has developed a 'Procedure Risk Based Matrix', that determines the Risk Classification of a task by quantifying the following three parameters: complexity, task frequency, and potential consequences. Complexity is measured on a scale of Low (performed with little assistance), Moderate (console to field, field to field communication), High (likely to involve multiple shifts). Frequency is measured as Frequent (daily/weekly), Infrequent (greater than weekly - less than annual), Rare (annual or greater); and Potential Consequence is measured as Low, Moderate, Severe (offsite impact, asset damage >$1MM).




Maintenance Procedures: The facility has written a total of 158


ID# Question Consider Proposed Remedy Due DateFindingsmaintenance procedure, 54 of those procedures are task-based which can be executed by craft personnel. The remaining 104 are policy/administrative based.

Per the Maintenance Procedure Policy No. 1.01 (dated 5/11/16), "Maintenance procedures are developed for key equipment to provide helpful recommendations to improve performance of the equipment, and non-specific instructions for repetitive inspections, preventative maintenance, and testing and repair tasks." In the latest revision to the policy the facility included, "Maintenance Procedure Risk Assessment" R-116 similar to the operating procedure risk assessment. As described in the policy, the maintenance risk assessment ranks task on a scale of 1-3 based on the complexity, frequency and potential consequence; 'Risk 1' tasks do not require a written procedure, Risk 2 tasks require a procedure to be developed, and Risk 3 tasks require the development of procedure and signature signoff. Per interviews with maintenance personnel and SME's, the Maintenance Procedure Risk Assessment is currently not in use and some personnel are unaware of its existence. The facility should identify tasks associated with key equipment, inspections, preventative maintenance, testing, and repairs and evaluate them using the Maintenance Procedure Risk Based Assessment.



A28-09 Has the Stationary Source trained employees responsible for developing and maintaining the procedures in rules for writing effective instructions? [Section B: Chapter 6.1.2.5 of the CCHMP Safety Program Guidance Document]

Consider updating 'action' words list in the Procedure Writing Guide to include words commonly used (e.g. establish, stroke, cascade).

P66 declines to implement this item. The question is concerned with whether employees who write operating procedures receive training. The finding describes in great detail some of the content in the training received by those employees. The examples provided do not seem to be prone to confusion as stated. Most of the examples show clarifying words rather than different terms that may be confused by an operator using the procedure (e.g. replacing “slowly open”. With “open” would not convey the same instruction to the person executing the procedure).

10/1/2017All operating procedure writers are required to complete an initial 2-day procedure writing course. Every three years the operation trainers are required to complete a refresher training for HF/Procedure Writing. The training is divided into to two sections, writing techniques and using the Mobil-Ops procedure platform. CCHMP identified two procedure authors that were on the list but had not received the training since 2010. Upon further investigation one person had retired while the other was no longer on the procedure. However in the procedure heading they were listed as the "procedure writer". The facility indicated that authors name remain on the document until the next major revision. The facility provided copies of older revisions of the procedure supporting evidence that the procedures were written within 3-years of receiving training and it appears there were no major updates to the procedure.

The facility developed an Operating Procedure Writing Guide (OPWG), dated 1/29/16 and P&P 6.1-4 'Operating Procedures Formatting and Writing Elements ', dated 12/13/2014. All procedures are required to include the following sections listed in order as they appear: PURPOSE, HSE PRECAUTIONS, SPECIAL MATERIALS, CONDITIONS, TASK SUMMARY, TASK AND STEPS ATTACHMENTS REFERENCES. The writing guide includes elements such as how to use caution, notice and warning statements.

The OPWG also has a list of defined 'action' words. CCHMP compared the defined 'action' words to the ones used in the procedure and determined that 'action' words (e.g. ESTABLISH, CASCADE) that were routinely used were not defined in OPWG. If the word does not have an equivalent in the OPWG then it should be added. Conversely, CCHMP identified many procedures that used ‘action’ words not defined in the OPWG but appear to have an equivalent already defined. For example procedure NOP-500-228 used; IGNITE, LIGHT and LIGHT-OFF but only IGNITE was defined. Using multiple ‘action’ words that have the same meaning only increase the opportunities for confusion. The following are more examples of ‘action’ words identified:

-- SLOWLY CRACK OPEN (NOP-215-228) vs. CRACK OPEN vs. OPEN -- CAREFULLY VERIFY (NOP-215-228) vs. VERIFY -- BRIEFLY OPEN (NOP-205-267) vs. OPEN -- PUT (NOP-203-244) vs. PLACE, SELECT, SWITCH -- PUSHING (NOP-704-248) vs. PRESS, DEPRESS -- OBSERVE (NOP-702-228) vs. MONITOR -- PERIODICALLY START (NOP-205-267)


ID# Question Consider Proposed Remedy Due DateFindings -- CONTINOUSLY CHECK (NOP-201-246) vs MONITOR vs. CHECK -- CONTINUOUSLY MONITOR (NOP-201-246) vs. MONITOR -- VISUALLY VERIFY (NOP-203-244) vs. VERIFY

CCHMP recognizes that many times, it is important to use ‘action’ words that are not defined in the OPWG, but when it is appropriate the facility should minimize the variability and use words that are defined in the OPWG.

As discussed in A25-06 one member of the training department provides assistance in formatting the procedures for the maintenance staff.



A28-12 Does the Stationary Source ensure that only current, approved versions of procedures are accessible to employees? [Section B: Chapter 6.1.4 of the CCHMP Safety Program Guidance Document]

Consider establishing and printing expiration dates on all uncontrolled printed procedures.

P66 declines to implement this item. The problem described and the point of the question is whether current, approved versions of operating procedures are accessible to employees. The finding describes the system used to make those current, approved procedures available. Each operating procedure is marked with the date that it was printed.

10/1/2017The facility maintains all the procedures in electronic form. The software platform, Mobil-Ops, that is used to write the operating procedures is also a database and web-publishing tool. Per interview with SME, this system enables the facility to make only the latest version of the procedure available to employees. Personnel can access active procedures through the company intranet. Procedures that are not active are designated as "ARCHIVE" and the hyperlinked to the procedure is inactive making the inaccessible to personnel. Archive procedure require an MOC to be completed prior to use.

Procedures can be printed on demand from the LiveLink, the online document management system. The printed procedures are stamped with the current date. Per interview with SME, uncontrolled printed operating procedures currently do not have an expiration date. Per operator interviews, as a general practice operators use printed procedures within 30 days of the print date and older copies are discarded. The Guidelines for Risk Based Process Safety (CCPS, 2007) recommends that for operating procedures which are printed on demand are clearly marked 'uncontrolled' with a relatively short expiration date, which is often the same day. In order to control or limit out-of-date documents the facility should establish and print expiration dates on all uncontrolled printed procedures.

Per operator interviews, the emergency procedures are printed and made available in the control room. During the field procedure walk, CCHMP confirmed the procedures were located in the control room and current.

Per interview the with procedure writer/trainer SME, maintenance procedures are maintained in Word format. Maintenance procedures are converted to PDF and made available to craft personnel through LiveLink.



A28-14 Has the Stationary Source incorporated the following into normal procedures and emergency operating procedures:a) Procedure title and number (if appropriate) should be easy to locate;b) The last step of the procedure should be identified;c) Temporary procedures should be clearly identified;d) Each procedure should be written for the procedure user (i.e., engineer, operators, health and safety staff, level of experience);e) Each step should be written as a command;f) Use common words;g) Avoid vague terms (i.e., leave no room for guessing or interpreting word meaning);h) Spell out first use of acronyms and abbreviations; i) Each step should include only one action. This will help to ensure that employees will not “overlook” an assumed but unwritten step;j) Steps that should be performed in a particular sequence should be numbered and listed sequentially;k) Critical step sequencing should be preceded by a caution or warning;l) Whenever possible, the procedures should reference equipment or instrumentation by unique number or name;

Consider evaluating the use of board/field designations from a human factors perspective and apply the practice universally to all Operating Procedures.

Consider modifying the Operating Procedures to include both the 'board' and 'field' label/identifications for equipment/components.

Consider clarifying to the workforce the correct manner to sign and track procedural steps.

Policy 6.1-4 Attachment 6, Procedure Human Factors Checklist steps 17-19 are used to identify procedures that require more than one person and to ensure that the person responsible is identified if it is not obvious.The evaluation for the use of special designations is decided while completing the human factors checklist.

Policy 6.1-4 Attachment 6, Procedure Human Factors Checklist steps 21-23 are used to identify the need to include the field or board designation of equipment when appropriate.

Provide training to operators on the expectations concerning procedural sign-offs including the correct manner to sign and track procedural steps.

10/1/201710/1/201710/1/2018

The facility has developed a "Operating Procedures Minimum Content Requirements", included in the document. CCHMP reviewed the minimum contents along with the criteria within the question and found the following deviations.

Per interviews and review of the operating procedures, the facility started using symbolic icons (e.g. colored 'display monitors' and 'hard-hat'), within the procedural step to designate board/field operator responsibility. Some units have incorporated this practice while others determined it caused confusion when procedures were copied in black & white. Additionally some procedures have the role spelled out before the step. The facility should evaluate the use of board/field designations from a human factors perspective and consider applying the practice universally to all Operating Procedure.

The equipment ID’s written in the procedure are the same ID that the control board operators view of the equipment but this is not the same ID/label that is in the field. If the procedure included both board and the field ID it would reduce the risk of error especially for steps that require both board/field to complete (e.g. valve stroking).

Per operator interviews, it is a standard practice for operator to initial/mark procedural steps as they are completed. Traditionally procedural steps only had one spot to initial, but recently the Mobil-Ops software was updated and now there are two spots. As a result CCHMP identified multiple ways in which procedural steps are now being completed. Some operators continue to sign-off in the one spot, other use the second spot to track a second operators actions. Others used the second spot for verification during shift change. Per interview with SME, the change to the format was included in the software update per request from another facility, and thus the change is irreversible. The facility should consider identifying the appropriate manner to sign-off on the procedure and communicate it to the work force.


ID# Question Consider Proposed Remedy Due DateFindingsm) Page layout (i.e., line spacing, length of lines, and font size) should not negatively affect readability;n) Procedures should neither reference steps from nor excessively reference other procedures or documents;o) Precautionary statements (e.g., warning, caution) should be clearly defined and placed immediately before the step to which they apply; p) Precautionary statements should stand out from procedure steps;q) Procedure “branching” (e.g., return to step 3) should be minimized; r) Sign off should be required for verifying critical steps of a procedure;s) Steps within procedures to be performed by multiple employees should be clearly indicated and possibly require checklists or signoffs;t) Complex procedures or procedures that require more than one shift to perform should require check-off or sign-off;u) Steps that require contingencies or criteria to assist the employee should precede the action (i.e., if the temperature is above XX, set the flow rate to the following range YY-YYY);v) Formulas or tables should be included when procedures require calculations (i.e., minimize “in your head” calculations); w) Incorporate feedback


ID# Question Consider Proposed Remedy Due DateFindingsloops as appropriate in the procedure so that employees can verify that their activities were correct; x) Non-routine personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply (alternatively a step to don or use the PPE);y) Instructions and conditions when by-passing shutdown systems or interlocks is allowed should be specified; andz) Write all steps necessary for the operating task (e.g., do not list “startup compressor” if there is more than a simple push-button to press)? [Section B: Chapters 6.2 and 6.4 of the CCHMP Safety Program Guidance Document]

A28-17 Does the submitted Safety Plan accurately reflect the Procedures Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.3 of the CCHMP Safety Program Guidance Document]

Consider updating the Operating Procedure section of Safety Plan to correct the reference to the Operating Procedure Policy. (This was completed during the audit.)

No action needed. Safety Plan updated.

10/1/2017P. 48 of the Safety Plan, dated August 7, 2015, states: "The Operating Procedures Policy, found in the Policy and Procedures manual Section 4-1-0". Per CCHMP review the documentation, Operating Procedure Policy dated 9/1/2015 is identified as Element: 6.1-0. The facility should correct reference to "section 4-1-0" or remove it to avoid confusion.



A30-13 Does the submitted Safety Plan accurately reflect the Employee Participation Program at the Stationary Source? [Co. Ord. Section 450-8.016(b)(4) and Section E.3.5 of the CCHMP Safety Program Guidance Document]

Consider updating the SP to include a description of employee participation in maintaining the Human Factors Program.

The Safety Plan was updated on August 4, 2017 and accepted by the CCHMP.It describes the Human Factors Program on pages 44 to 47. It adequately describes the Employee Participation Program and participation in the Human Factors Program.

10/1/2017Per CCHMP review of the 2015 submitted Safety Plan (SP), the SP includes a description of employee participation for CalARP Prevention Program Elements but does not describe the employee participation in the Human Factors Program including latent conditions checklists beyond just a mention of the requirement that employees participate in maintaining the human factors program.

A32-03 Does the Stationary Source ensure that the final report containing the Root Cause Analysis will be submitted to CCHMP within 30 days of completion of the Root Cause Analysis? [Co. Ord. Section 450-8.016(c)(1) and Section C.2.2.4 of the CCHMP Safety Program Guidance Document]

Consider including the reporting requirements to CCHMP in the Incident Management Policy.

The reporting requirements in the Contra Costa County Hazardous Materials Incident Notification Policy will be included in the Incident Management policy.

3/1/2018CCHMP reviewed the Incident Management Policy (PNP 10.0-1) which addresses classification of incident reporting and closure times for each incident level. The Incident Management Policy does not clearly state what the reporting requirements are for CCHMP. According to the policy, as a category III or IV, a Full Team investigation is assembled to investigate MCARs but does not state the reporting requirements beyond the requirement of a

60 day closure. The 2015 Safety Plan does specify the 30 day reporting requirement to CCHMP. Per CCHMP review of the documentation for the Coke Antifoam Fire RCA, the 72 hour and 30 day reports were submitted on time.



A33-04 Did the Stationary Source complete the PHA recommended actions selected for implementation within one year after submittal of the original Safety Plan to CCHMP or after completion of the PHA and revalidation? [Section D.1.5 of the CCHMP Safety Program Guidance Document]

Consider establishing a practice to hold the managers meeting to approve the PHA within two months of the last PHA session date.

P66 declines to implement this item. The last PHA session date is not an indication that the PHA recommendations are ready for management approval. P66 is implementing the new requirements of the California PSM for Refineries and CalARP Program 4 regulations. §2762.16(e)(1) requires that “All findings and recommendations must be provided by the team to the owner or operator at the earliest opportunity, but no later than 14 calendar days after recommendations and findings are complete.” The last PHA session date does not accurately reflect when the recommendations are complete. The manager’s meeting to approve the PHA includes the acceptance and approval of the recommendations. The new time requirements discussed above apply to having the report ready for management review. The PHA recommendations alone would be meaningless without the context of the PHA report.

10/1/2017CCHMP reviewed five PHAs for Unit 228, 244, 246, 248, and 267. U244: There was one action item (5G-503A/B IPLs) remaining to be closed that received an extension from CCHMP. There are two other action items (5G-501 IPL and 5D-506 bottom IPL) waiting for the next turnaround. Both had a due date of 6/7/16. Unit 246: One needed a variance request from the CCHMP because the engineering was not done in time. The due date was 10/7/15. Units 248 and 267: The action items have been closed for these two units.

-There were a total of 24 action items for both PHA and LOPA.-There are a total of 3 action items waiting for T/A.-There were two action items that received a variance from CCHMP.-There were a total of 10 action items that went beyond one year to complete.

CCHMP was informed that the facility tracks the 1-year completion of each PHA recommendation based upon when the managers meeting takes place. Of the five PHAs reviewed, CCHMP found a large variety of time between the last PHA session and the managers meeting (actual dates listed in A12-05):-- Unit 228 - 0.5 months-- Unit 244 - 3.4 months-- Unit 246 - 1.6 months-- Unit 248 - 3.4 months-- Unit 267 - 2.6 months

CCHMP believes that, in general, the last PHA session date should ideally be used to start the one year clock for addressing PHA recommendations. CCHMP understands that there may be corrections needed to be made to the PHA based on QC and that additional time should be allowed for this. It is also common for sites to have a managers meeting to approve the PHA. As such, CCHMP believes it should be reasonable for sites to take two months after the last PHA session to begin their 1-year clock. Three out of the five PHAs took longer than two months to begin their 1-year clock. A consider item has been issued as this is not yet a requirement.




Consider updating the PHA PNP 2.0-6 to identify the ISS team consistent with that described in ISS PNP 2.0-7.

P66 is implementing the new requirements of the California PSM for Refineries and CalARP Program 4 regulations. Changes will be made to the PHA policy to address the Cal ARP Program 4 requirements. The wording in the PHA policy 2.0-6 and ISS Policy 2.0-7 will be made consistent for team participation.

3/1/2018Existing Process:A minor discrepancy was noted between the PHA and ISS PNPs. Specifically, section E.2.f.i of PNP 2.0-6 (PHA) identified that the existing process ISS "team members (number and composition)" are different than that used for the PHA team. Section E.3.a of the PNP 2.0-7 (ISS) identified that the existing process ISS team is similar in composition to PHA team. Per interviews and review of 5 existing ISS analyses contained within the PHAs, the ISS team is comprised of the same people as the PHA team.

As described in A34-11, the facility conducts existing process ISS analyses during the PHA with the same PHA team members. This is documented within the individual PHA reports including team members qualifications and experience. In each case the ISS Checklist was used to document the ISS analysis. Section E.5.a.ii of PNP 2.0-7 identified that the ISS Checklist would document that "sufficient ISS design has been utilized or if implemented could eliminate or reduce the potential of an MCAR". The PNP further identified that if "an MCAR cannot occur or implementation of the ISS design would not eliminate or reduce the MCAR potential, the team will document this result in the checklist". "If the ISS on the checklist may eliminate or reduce the potential of an MCAR, the team will then determine if an MCAR could reasonably occur by using the ISS risk matrix (Attachment 4)." Using this risk matrix results in an ISS Risk Code of 'H' or 'L'. An 'H' code means that an MCAR could reasonably occur and require an inherent or passive ISS opportunity to be implemented. "If an MCAR could not reasonably occur - ISS Risk Code "L", then the ISS "L" risk ranking will be provided in either the completed checklist of the worksheets and no further review by the team is required." CCHMP reviewed the 5 existing process ISS studies and was unable to confirm the site's practice consistently follows the policy. For example, Unit 248, Node 16, consequence 5.1.16(r), 5.2.10(k), 5.2.14(p); Unit 244, Node 19, consequence, 2.1.5(j); Unit 228, Node 24, deviation 5, consequence 4(d). Most of the ISS items were documented as installed, were being managed on the process, or were not applicable. There were occasional examples where this was not the case and the ISS Risk Code was not provided in the ISS Checklists. As specified in the PNP, if an ISS item could eliminate or reduce the potential of an MCAR, an ISS risk code needs to be documented. CCHMP was also informed during the audit that the facility does not track MCAR incidents or near misses (this is further described in A27-01 and A27-04). Not tracking MCARs would make complying with PNP 2.0-7 difficult. An ensure item was listed in A27-04 for the site to track near miss MCAR situations.


ID# Question Consider Proposed Remedy Due DateFindingsMOC:PNP 2.0-7 identified that the facility would "determine ISS feasibility for situations, such as a major change or a recommendation from an incident investigation report, where a Major Chemical Accident or Release (MCAR) could reasonably occur". As listed in A27-04, the facility does not specifically track MCARs or near miss MCARs. Although the ISS policy (PNP 2.0-7) contains a number of definitions, major change is not defined. Nevertheless, CCHMP was unable to locate any MOCs that identified significant recommendations that would likely be considered a major change.

II/RCA:As described previously under MOC, the facility's PNP 2.0-7 contains wording that ISS would be evaluated associated with a recommendation from an incident report where a MCAR could reasonably occur. CCHMP was informed that no such recommendations have been generated.

A36-03 Did the Stationary Source establish a methodology for evaluating work groups? [Section F.3 of the CCHMP Safety Program Guidance Document]

Consider developing a method to assess the Safety Culture of both resident (long-term) and transient (short-term) independent from each other.

P66 declines to implement this item. Our SCA Policy has us avoid turnaround time frames for many reasons. The evaluation of short term contractor’s perceptions is not a priority for evaluating the facility’s safety culture since they are not part of the facility’s normal work force.P66 is implementing the new requirements of the California PSM for Refineries and CalARP Program 4 regulations. Changes will be made to the SCA policy to address the new requirements.

10/1/2017Per interview with SCA SME, the written survey was made available to all employees, including all the units and all the shifts. P&P 15.0-1 requires the following groups to be included in the SCA: management, supervisors, operators, maintenance, engineering, health and safety personnel, and applicable contractors. CCHMP reviewed the 2015 SCA report, and the following groups were included in the survey: Production/Hourly, clerical/support staff, technical, supervisor, H&S employee, middle and senior management. These groups were used for both P66 employees and contractors. Per interview with SME, the facility scheduled 2015 SCA during normal plant operations, and not during a turnaround so that transient contractors would not disproportionately outweigh resident contractors and P66 employees. The facility should develop a method to assess the safety culture of both resident and applicable transient contractors, independent of each other. The facility may consider performing targeted SCA on transient (short-term) contractors during a turnaround.




Consider increasing the participation rate of Contractors in the SCA.

The responses from all groups exceeded the minimum needed for 95% confidence level of the results. P66 was also assigned an Ensure item on documenting a target participation level in this audit. See A36-04.

The SCA report documented that an appropriate participation rate was achieved for each selected work group and overall site. The statistical minimum participation rate needed to achieve a 95% confidence level is ~50% with a confidence interval of 5. Phillips 66 will document that rate as the target for future surveys.

The county ISO does not contain any requirement related to participation rates of work groups.

10/1/2017Per review of the 2015 SCA Report, the facility achieved a participation rate of 90 percent for P66 employees and 68 percent for contractors. Bureau Veritas administered the survey to all employees including contractors that were onsite at the time of the survey. Per interview with SME, the facility did not establish a target participation rate for the 2015 SCA however the survey was distributed to everyone onsite. The facility achieved an overall combined (P66 and Contractors) participation rate was 83.7% percent. The workgroup that represented the lowest participation rate was P66 "Health & Safety Employees" 66.7 percent (10 out of 15).





Consider presenting the SCA report to management and workforce within 6-months of collecting the SCA data.

P66 declines to implement this item. P66 is implementing the new requirements of the California PSM for Refineries and CalARP Program 4 regulations. Changes will be made to the SCA policy to address the Cal ARP Program 4 requirements including that a report is completed in 90 days and that the report is communicated within 60 days of completion.See section 2762.14(d) and 2762.14(h).

10/1/2017Per interview with SME, the data collection period for the Safety Culture Assessment was completed in the months of October, and November. The SCA findings were communicated to the workforce in a letter dated July 11, 2016. The letter appeared in the "SaFeR Connections" (Summer 2016), refinery publication bulletin. The letter included a link with full access to the survey results and the full SCA Report.






Consider implementing the Improvement Plan within 3 months of the SCA report presentation to the workforce.

Our Safety Culture Assessment Policy 15.0-1 will contain the expectation that the improvement plan should begin implementation within three months of the report presentation in section C.4. P66 is implementing the new requirements of the California PSM for Refineries and CalARP Program 4 regulations. Changes will be made to the SCA policy to address the Cal ARP Program 4 requirements including section 2762.14(e) that requires implementation of the corrective actions within 24 months of the completion of the report.

10/1/2017The facility finalized the Improvement Plan and action items on 1/24/17, during the CalARP/ISO audit and 6 months after the report was initially communicated to the workforce. Per CCHMP guidance document, the Improvement Plan should ne implemented within 3-months of the report presentation.



PRELIMINARY DETERMINATION Phillips 66 San Francisco ... · PRELIMINARY DETERMINATION . Phillips 66...

Documents

Transcript of PRELIMINARY DETERMINATION Phillips 66 San Francisco ... · PRELIMINARY DETERMINATION . Phillips 66...