The Safety Case Regulatory Regime
21st Century Major Accident Prevention
The CSB Chevron Investigation
Rafael Moure-Eraso, Ph.D., Chairperson
CAER-CCC
RICHMOND, CA
DECEMBER 16, 2013
www.csb.gov
Chevron Refinery Richmond California
August 6th, 2012-- Pipe Rupture and Fire
• Pipe rupture in Crude Unit
• Formation of Hydrocarbon Vapor Cloud
• Nineteen (19) Chevron Fire fighters and
Operators engulfed
• Vapor cloud ignited – One mile high plume
• >15,000 residents sought medical attention
www.csb.gov
www.csb.gov
www.csb.gov
5
www.csb.gov
Refinery Safety is a National Problem
• The CSB has noted a considerable trend of
significant and deadly incidents at petroleum
refineries over the last decade.
• In 2012 alone, the CSB tracked 125 significant
incidents at US petroleum refineries. Seventeen
of these took place in California.
“The U.S. refining sector has more than three times
the rate of property losses of refineries overseas.”
Swiss Rae, 2011
www.csb.gov
Refinery Safety CSB Focus (I)
The CSB has investigated many refinery incidents:
• Tosco Avon Refinery (1999, 4 fatalities)
• Motiva Enterprises Refinery (2002)
• BP Texas City (2005, 15 fatalities)
• Valero Refinery (2005, 2 fatalities; 2007)
7
www.csb.gov
Refinery Safety CSB Focus (II)
The CSB has investigated many refinery incidents
• Silver Eagle Refinery (2009)
• CITGO Refinery (2009)
• Tesoro Anacortes Refinery (2010, 7 fatalities)
• Chevron Richmond (2012)
www.csb.gov
Deepwater Horizon Incident Investigation
The safety case
regime is a more
effective approach
for preventing
major accidents at
U.S. refineries than
current U.S.
regulatory
systems.
www.csb.gov
Chevron First Report
Chevron 1
(Interim)
www.csb.gov
Chevron First Report (April 2013)
Key Findings
• Sulfidation caused extreme pipe thinning
• Lack of damage mechanism hazard review
• Internal Chevron Recommendations not
implemented
• Insufficient application of inherent safety
www.csb.gov
Recommendations
Chevron First Report
California State Legislature to California refineries to:
•Perform damage mechanism hazard reviews;
•Identify and report leading and lagging process safety
indicators;
•Document recognized methodologies, rationale, and
conclusions used to verify that safeguards in place
indeed control hazards;
•ALARP--Document their inherently safer systems
analysis and the hierarchy of controls with the goal of
reducing risks to As Low As Reasonably Practicable
www.csb.gov
Chevron First Report Conclusions
The CSB committed to investigate additional issues:
•Emergency Planning and Reporting;
•Emergency Response;
•Safety Culture; and
•Regulatory Oversight of Petroleum Refineries
•Chevron Regulatory Report Draft—Chevron 2
•Examines the safety case regime as an
alternative regulatory model for accident
prevention for California petroleum refineries.
www.csb.gov
Process of Releasing Chevron 2 Regulatory Report
• Preliminary press conference today (12/16/13)
at Hilton Hotel Concord, CA to open Chevron 2
-- Regulatory Report for public discussion
• Comments can be submitted to:
chevroncomments@CSB.gov until 1/5/2014
• Release of Regulatory Report Chevron 2 at
Public meeting after CSB Board vote: January
15th, 2014 in Richmond CA—See Federal
Register Announcement for Public Meeting
www.csb.gov
Chevron Regulatory Report
Chevron 2
Staff Draft Report for
Public Comment
www.csb.gov
Chevron 2 Regulatory Report Findings
(I)
Chevron internal recommendations not implemented
• 100% component inspections
• Inherent Safety
PHA Safeguards not evaluated
– Chevron experts had limited participation
– Deficiencies were not citable by the regulator
No requirement to reduce risks to as low as
reasonably practicable, or ALARP.
No requirement to implement inherent safety
www.csb.gov
Chevron 2 Regulatory Report Findings
(II)
Regulators lack the technical staff with the necessary
• skills
• knowledge, and
• industry experience
These are essential to provide sufficient direct
oversight of petroleum refineries in California.
www.csb.gov
Regulatory Report Key Findings
The CSB has made a number of process safetyrelated recommendations to OSHA and the EPA.
• None of these recommendations have been implemented
• There have been no significant changes made to the PSM
and RMP regulations.
• The CSB believes:
– Tweaking PSM regulations only incorporates
learnings from most recent accidents
–A new approach: The safety case regime is
proposed as an effective alternative for prevention
www.csb.gov
Regulatory Report Key Findings
Available data from Norway and the United Kingdom
(UK) shows a reduction in hydrocarbon releases
offshore under the safety case regulatory regime.
www.csb.gov
Chevron 2 Regulatory Conclusions
The existing regulatory regimes for onshore petroleum refineries
in the US and California:
•
PSM is primarily activity-based (12 elements) rather than
goal-based ( only 2 PHA-Mechanical Integrity)
•
Do not require risk reduction to ALARP
•
Do not ensure continuous improvement
• Are static, unable to adapt to innovation and advances
• Place the burden on the regulator to verify compliance
• Do not effectively incorporate lessons learned from major
accidents
• Do not effectively use indicators to reduce risk to ALARP
www.csb.gov
PSM Gaps and Weaknesses
www.csb.gov
PSM Gaps and Weaknesses
The existing U.S. and California Process Safety Regimes:
• Do not require the use or implementation of inherently safer systems
• Do not effectively involve the workforce in hazard analyses
• Do not grant the regulator the authority to accept or reject a
company’s hazard analysis, risk assessment, or proposed
safeguards; and
• Lack a sufficient number of staff with the technical skills, knowledge,
and industry experience to provide direct safety oversight of
petroleum refineries.
www.csb.gov
Process Safety Gaps Led to Chevron
Refinery Incident
• Damage mechanism hazard reviews were
not performed
• Internal Chevron recommendations were
not implemented
• Safeguard effectiveness was not rigorously evaluated
• Inherently safer design was not effectively employed
• MOCs and incident investigations did not control
recognized hazards
www.csb.gov
CSB’s Proposed PSM Regulatory System
Conclusions
Tweaking current OSHA-PSM and EPA-RMP
regulations only incorporates learnings from most
recent accidents. This is performed at a very slow rate,
if at all.
The safety case regime proposed in the
report requires continuous risk reduction
and is a more effective approach to prevent
major incidents in petroleum refineries.
www.csb.gov
SAFETY CASE REGULATORY
REGIME
www.csb.gov
Definition
Andrew Hopkins:
Lessons from Esso Gas Plant Explosion, ANU 2013
“A verifiable case which the operator of a hazardous facility
makes to a regulator, setting how safety is to be
managed. Includes:
– Identification of Hazards and controls
– Operator has to convince regulator that its strategy for
managing safety is satisfactory
– Operators are expected to adopt best practices on risk
management”
www.csb.gov
Key Features of an Effective
Safety Case Regime
• Duty Holder Safety Responsibility, including a
Written Case for Safety
• Continuous Risk Reduction to ALARP
• Adaptability and Continuous Improvement
• Active Workforce Participation
• Process Safety Indicators that Drive
Performance
• Regulatory Assessment, Verification, and
Intervention; and an
• Independent, Competent, Well-Funded
Regulator
www.csb.gov
www.csb.gov
Duty Holder Safety Responsibility
and Written Case for Safety
Written safety case report that describes how
hazards and risk are reduced to ALARP
•
• Must demonstrate how inherently safer design
concepts have been applied
• Should be an evergreen document
• Regulators must “accept” the safety case report
• Submitted to the regulator at least every five years
www.csb.gov
Continuous Risk Reduction to ALARP
• Duty on owners or operators of covered facilities
to reduce risks to ALARP or equivalent
• CCPS definition of ALARP:
“a risk reduction goal, where risk reduction efforts are
continued until the incremental effort to further reduce risk
becomes grossly disproportionate to the level of additional risk
reduction.” Center for Chemical Process Safety (CCPS).
Inherently Safer Chemical Processes – A Life Cycle Approach;
2nd ed., 2009; p 46.
• Regulator may accept good practice as ALARP
or may require additional measures be taken to
further reduce risk.
www.csb.gov
Adaptability and Continuous
Improvement
• Allows regulator to require facilities to go above
and beyond current good practices and standards
to achieve ALARP without requiring rulemaking
• Baker Panel definition of “continuous
improvement”
• Controls for process hazards
• Engineering to mitigate process hazards
• Going beyond compliance
www.csb.gov
Active Workforce Participation
• Key element of process safety and effective
major accident prevention.
• CCPS: Workforce involvement provides management a
mechanism for tapping into valuable expertise. Guidelines
for Risk Based Process Safety; March 2007.
•The PSM standard requires consultation with
employees
• The safety case goes further
•Provides for the election of safety representatives and
creation of safety committees.
•Uses tripartite approach with active and equal
participation from the regulator, industry, and labor.
www.csb.gov
Process Safety Indicators
OSHA recordable injury and illness rates (lagging
indicators) are not sufficient.
The Safety Case allows regulators to
• Collect and analyze a variety of indicator
data(leading and some lagging)
• Release the data and trends to the public
• Use the data to target inspections
• Drive continuous improvement
www.csb.gov
Leading Process Safety Indicators
Some Examples
Frequency of challenges to protection barriers
Number of non-planned “Shutdowns”
Number of Releases of hydrocarbons to atmosphere
Number and duration of use of equipment “out of service”
or temporary equipment
Number of applications on processes of recommendations
from Safety Function
www.csb.gov
In a “Safety Case Regime”: Regulatory
Assessment, Verification, and Intervention
Regulators review and accept safety case reports
Great emphasis is placed on inherent safety
The regulator may reject the safety case report and
require additional measures to further reduce risks
Preventative inspections and audits are conducted to
intervene before high-risk activities commence.
•This rarely happens in the US.
www.csb.gov
“Well-Funded and Qualified Regulator” in
Safety Case Regimes
The role of the safety regulator:
•Provide independent assurance that companies have
identified risks and put appropriate measures in place to
control the risks
•Retain a sufficient number of technically competent,
experienced, and well-trained staff that can critically assess
safety case reports and performance
• Can interact as equals with company management
www.csb.gov
U.S. Uses Safety Case Approach in
Other Industries
The safety case regulatory approach is not
foreign to the US:
The US already has the safety case approach:
• Nuclear Regulatory Commission (NRC)
• NASA
www.csb.gov
Safety Case Implementation Issues
1.
Has to link with current safety system already in place
– Conform with target structure, high quality hazard identification and risk
assessment, there has to be high linkage to actual safety systems
installed or to normal operations
2.
Currently not enough Professionals Understanding of how to use
–
Need to train practitioners on how to communicate to workforce and
contractors—UK, Norway, Australia resolving this issue by training
3. Avoid to reduce Safety Case as only a mean for regulatory compliance
– Should be “live” document , enforce requirement of keeping up with state
of the art (ALARP). Cannot be paperwork exercise, cannot be ignored by
line management and by facility managers/ supervisors
4.
Continuous updating
– Change is continuous – managed through MOC processes on the facility,
safety case can continuously updated to approach state of the art
www.csb.gov
Conclusion:
Draft recommendation for the state of California to
implement a safety case approach for refineries
• Reduction of Risk to As Low as Reasonable Practicable
(ALARP)
• System is adaptable for continuous improvement
without rulemaking
• Meaningful Workforce Participation in Tri-partite model:
workers, regulator, company.
• Development and Implementation of Key Process Safety
Indicators
• Competent regulator assessment of hazard reviews
• Independent, Competent, Well-Funded Regulator
www.csb.gov
Questions?
www.csb.gov