www.csb.gov

CAER-CCCRichmond, CA

DEcember 16, 2013

The Safety Case Regulatory Regime 21st Century Major Accident Prevention

The CSB Chevron Investigation

Rafael Moure-Eraso, Ph.D., Chairperson

www.csb.gov

Chevron Refinery Richmond CaliforniaAugust 6th, 2012-- Pipe Rupture and Fire

• Pipe rupture in Crude Unit

• Formation of Hydrocarbon Vapor Cloud

• Nineteen (19) Chevron Fire fighters and Operators engulfed

• Vapor cloud ignited – One mile high plume

• >15,000 residents sought medical attention

www.csb.gov

www.csb.gov

www.csb.gov

5

www.csb.gov

Refinery Safety is a National Problem

• The CSB has noted a considerable trend of significant and deadly incidents at petroleum refineries over the last decade.

• In 2012 alone, the CSB tracked 125 significant incidents at US petroleum refineries. Seventeen of these took place in California.

“The U.S. refining sector has more than three times the rate of property losses of refineries overseas.” Swiss Rae, 2011

www.csb.gov

Refinery Safety CSB Focus (I)

The CSB has investigated many refinery incidents:

•Tosco Avon Refinery (1999, 4 fatalities)

•Motiva Enterprises Refinery (2002)

•BP Texas City (2005, 15 fatalities)

•Valero Refinery (2005, 2 fatalities; 2007)

7

www.csb.gov

Refinery Safety CSB Focus (II)

The CSB has investigated many refinery incidents

•Silver Eagle Refinery (2009)

•CITGO Refinery (2009)

•Tesoro Anacortes Refinery (2010, 7 fatalities)

•Chevron Richmond (2012)

www.csb.gov

Deepwater Horizon Incident Investigation

The safety case regime is a more

effective approach for preventing

major accidents at U.S. refineries than

current U.S. regulatory systems.

www.csb.gov

Chevron First Report Chevron 1(Interim)

www.csb.gov

Chevron First Report (April 2013) Key Findings

• Sulfidation caused extreme pipe thinning

• Lack of damage mechanism hazard review

• Internal Chevron Recommendations not implemented

• Insufficient application of inherent safety

www.csb.gov

Recommendations Chevron First Report

California State Legislature to California refineries to:

•Perform damage mechanism hazard reviews;

•Identify and report leading and lagging process safety indicators;

•Document recognized methodologies, rationale, and conclusions used to verify that safeguards in place indeed control hazards;

•ALARP--Document their inherently safer systems analysis and the hierarchy of controls with the goal of reducing risks to As Low As Reasonably Practicable

www.csb.gov

Chevron First Report ConclusionsThe CSB committed to investigate additional issues:

•Emergency Planning and Reporting;

•Emergency Response;

•Safety Culture; and

•Regulatory Oversight of Petroleum Refineries

•Chevron Regulatory Report Draft—Chevron 2•Examines the safety case regime as an alternative regulatory model for accident prevention for California petroleum refineries.

www.csb.gov

Process of Releasing Chevron 2 Regulatory Report

• Preliminary press conference today (12/16/13) at Hilton Hotel Concord, CA to open Chevron 2 -- Regulatory Report for public discussion

• Comments can be submitted to: chevroncomments@CSB.gov until 1/5/2014

• Release of Regulatory Report Chevron 2 at Public meeting after CSB Board vote: January 15th, 2014 in Richmond CA—See Federal Register Announcement for Public Meeting

www.csb.gov

Chevron Regulatory Report Chevron 2

Staff Draft Report for Public Comment

www.csb.gov

Chevron 2 Regulatory Report Findings (I)

Chevron internal recommendations not implemented• 100% component inspections • Inherent Safety

PHA Safeguards not evaluated– Chevron experts had limited participation – Deficiencies were not citable by the regulator

No requirement to reduce risks to as low as reasonably practicable, or ALARP.

No requirement to implement inherent safety

www.csb.gov

Chevron 2 Regulatory Report Findings (II)

Regulators lack the technical staff with the necessary

• skills• knowledge, and • industry experience

These are essential to provide sufficient direct oversight of petroleum refineries in California.

www.csb.gov

Regulatory Report Key FindingsThe CSB has made a number of process safety-

related recommendations to OSHA and the EPA.

• None of these recommendations have been implemented

•There have been no significant changes made to the PSM and RMP regulations.

• The CSB believes:– Tweaking PSM regulations only incorporates learnings from most recent accidents –A new approach: The safety case regime is proposed as an effective alternative for prevention

www.csb.gov

Regulatory Report Key FindingsAvailable data from Norway and the United Kingdom

(UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime.

www.csb.gov

Chevron 2 Regulatory ConclusionsThe existing regulatory regimes for onshore petroleum refineries

in the US and California:

• PSM is primarily activity-based (12 elements) rather than goal-based ( only 2 PHA-Mechanical Integrity)

• Do not require risk reduction to ALARP

• Do not ensure continuous improvement

• Are static, unable to adapt to innovation and advances

• Place the burden on the regulator to verify compliance

• Do not effectively incorporate lessons learned from major accidents

• Do not effectively use indicators to reduce risk to ALARP

www.csb.gov

PSM Gaps and Weaknesses

www.csb.gov

PSM Gaps and Weaknesses

• Do not require the use or implementation of inherently safer systems

• Do not effectively involve the workforce in hazard analyses • Do not grant the regulator the authority to accept or reject a

company’s hazard analysis, risk assessment, or proposed safeguards; and

• Lack a sufficient number of staff with the technical skills, knowledge,

and industry experience to provide direct safety oversight of petroleum refineries.

The existing U.S. and California Process Safety Regimes:

www.csb.gov

Process Safety Gaps Led to Chevron Refinery Incident

• Damage mechanism hazard reviews were not performed

• Internal Chevron recommendations were not implemented

• Safeguard effectiveness was not rigorously evaluated

• Inherently safer design was not effectively employed

• MOCs and incident investigations did not control recognized hazards

www.csb.gov

CSB’s Proposed PSM Regulatory System Conclusions

Tweaking current OSHA-PSM and EPA-RMP regulations only incorporates learnings from most

recent accidents. This is performed at a very slow rate, if at all.

The safety case regime proposed in the report requires continuous risk reduction

and is a more effective approach to prevent major incidents in petroleum refineries.

www.csb.gov

SAFETY CASE REGULATORY REGIME

www.csb.gov

DefinitionAndrew Hopkins:

Lessons from Esso Gas Plant Explosion, ANU 2013

“A verifiable case which the operator of a hazardous facility makes to a regulator, setting how safety is to be managed. Includes:– Identification of Hazards and controls

– Operator has to convince regulator that its strategy for managing safety is satisfactory

– Operators are expected to adopt best practices on risk management”

www.csb.gov

Key Features of an Effective Safety Case Regime

• Duty Holder Safety Responsibility, including a Written Case for Safety

• Continuous Risk Reduction to ALARP• Adaptability and Continuous Improvement• Active Workforce Participation• Process Safety Indicators that Drive

Performance • Regulatory Assessment, Verification, and

Intervention; and an• Independent, Competent, Well-Funded

Regulator

www.csb.gov

www.csb.gov

Duty Holder Safety Responsibility and Written Case for Safety

• Written safety case report that describes how hazards and risk are reduced to ALARP

• Must demonstrate how inherently safer design concepts have been applied

• Should be an evergreen document

• Regulators must “accept” the safety case report

• Submitted to the regulator at least every five years

www.csb.gov

Continuous Risk Reduction to ALARP

• Duty on owners or operators of covered facilities to reduce risks to ALARP or equivalent

• CCPS definition of ALARP:“a risk reduction goal, where risk reduction efforts are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction.” Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd ed., 2009; p 46.

• Regulator may accept good practice as ALARP or may require additional measures be taken to further reduce risk.

www.csb.gov

Adaptability and Continuous Improvement

• Allows regulator to require facilities to go above and beyond current good practices and standards to achieve ALARP without requiring rulemaking

• Baker Panel definition of “continuous improvement”

• Controls for process hazards• Engineering to mitigate process hazards• Going beyond compliance

www.csb.gov

Active Workforce Participation

• Key element of process safety and effective major accident prevention.

• CCPS: Workforce involvement provides management a mechanism for tapping into valuable expertise. Guidelines for Risk Based Process Safety; March 2007.

•The PSM standard requires consultation with employees

• The safety case goes further •Provides for the election of safety representatives and creation of safety committees. •Uses tripartite approach with active and equal participation from the regulator, industry, and labor.

www.csb.gov

Process Safety Indicators

OSHA recordable injury and illness rates (lagging indicators) are not sufficient.

The Safety Case allows regulators to • Collect and analyze a variety of indicator data(leading and some lagging)

• Release the data and trends to the public

• Use the data to target inspections

• Drive continuous improvement

www.csb.gov

Leading Process Safety IndicatorsSome Examples

Frequency of challenges to protection barriers

Number of non-planned “Shutdowns”

Number of Releases of hydrocarbons to atmosphere

Number and duration of use of equipment “out of service” or temporary equipment

Number of applications on processes of recommendations from Safety Function

www.csb.gov

In a “Safety Case Regime”: Regulatory Assessment, Verification, and InterventionRegulators review and accept safety case reports

Great emphasis is placed on inherent safety

The regulator may reject the safety case report and require additional measures to further reduce risks

Preventative inspections and audits are conducted to intervene before high-risk activities commence.

•This rarely happens in the US.

www.csb.gov

“Well-Funded and Qualified Regulator” in Safety Case Regimes

The role of the safety regulator:•Provide independent assurance that companies have identified risks and put appropriate measures in place to control the risks

•Retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess safety case reports and performance

• Can interact as equals with company management

www.csb.gov

U.S. Uses Safety Case Approach in Other Industries

The safety case regulatory approach is not foreign to the US:

The US already has the safety case approach:

• Nuclear Regulatory Commission (NRC)

• NASA

www.csb.gov

Safety Case Implementation Issues1. Has to link with current safety system already in place

– Conform with target structure, high quality hazard identification and risk assessment, there has to be high linkage to actual safety systems installed or to normal operations

2. Currently not enough Professionals Understanding of how to use

– Need to train practitioners on how to communicate to workforce and contractors—UK, Norway, Australia resolving this issue by training

3. Avoid to reduce Safety Case as only a mean for regulatory compliance

– Should be “live” document , enforce requirement of keeping up with state of the art (ALARP). Cannot be paperwork exercise, cannot be ignored by line management and by facility managers/ supervisors

4. Continuous updating– Change is continuous – managed through MOC processes on the facility,

safety case can continuously updated to approach state of the art

www.csb.gov

Conclusion:Draft recommendation for the state of California to

implement a safety case approach for refineries

• Reduction of Risk to As Low as Reasonable Practicable (ALARP)

• System is adaptable for continuous improvement without rulemaking

• Meaningful Workforce Participation in Tri-partite model: workers, regulator, company.

• Development and Implementation of Key Process Safety Indicators

• Competent regulator assessment of hazard reviews

• Independent, Competent, Well-Funded Regulator

www.csb.gov

Questions?