PSM/RMP Modernization Programs in California (New Developments and Correlation to Evolution at the Federal Level)

Transcription

1 PSM/RMP Modernization Programs in California (New Developments and Correlation to Evolution at the Federal Level) Steven T. Maher, PE CSP Aleksandar Metulev Risk Management Professionals Prepared for Presentation at 12 th Global Congress on Process Safety Houston, Texas April 10-13, 2016 UNPUBLISHED AIChE shall not be responsible for statements or opinions contained in papers or printed in its publications

2 PSM/RMP Modernization Programs in California (New Developments and Correlation to Evolution at the Federal Level) Steven T. Maher, PE CSP Aleksandar Metulev Risk Management Professionals Keywords: PSM, RMP, CalARP, Cal/OSHA, , OSHA, EPA, Process Safety Abstract Since August 2012, significant changes have been proposed by a number of agencies to Safety Management Systems (SMS) Programs, e.g., Process Safety Management (PSM), Risk Management Programs (RMP), and related SMS Regulatory Requirements. Many of these are framed within OSHA's and EPA's PSM/RMP Modernization/Expansion Programs, and key technical and regulatory changes are being proposed by Federal OSHA, U.S. EPA, Cal/OSHA, Chemical Safety Board (CSB), California Office of Emergency Services (CalOES), California EPA (CalEPA), and other agencies. As part of these SMS Regulatory Program Modernization Initiatives, on September 24, 2015 and October 26, 2015, Cal/OSHA and CalEPA issued the latest updates to its proposed regulations for "Process Safety Management for Refineries" (CalPSM-R) and for the California Accidental Release Prevention (CalARP) Program, and on March 14, 2016, U.S. EPA issued its proposed updates to the Risk Management Program (RMP) Rule. Federal OSHA has not yet issued a response to its December 2013 Request for Information; however, several Letters of Interpretation have addressed key elements, and the other agencies are moving towards promulgation in Spring/Summer The changes being proposed for these programs are extensive, currently being formulated, and are not synchronized between the various agencies. The focus of this paper will be to provide relevant background information, a summary of the proposed changes, and tips for addressing key technical and regulatory challenges, as well as providing the reader with a "roadmap" for effective implementation. This paper is designed to address the regulatory environment in April 2016, will be updated periodically to reflect this moving target, and key topics include: Background Pre-2012 PSM/RMP Universe Overview of Key Safety Management System Program Modernization Initiatives Key Elements of the Various SMS Regulatory Initiatives SMS Modernization Status and Potential SMS Program Impact What Should I Be Doing Now? It is also worth noting that related regulatory changes involve clarification of General Duty for California Facilities (SB-612, Hazardous Materials ) [42] ; however, this will be the subject of a future paper, and here we will focus on PSM, RMP, and CalARP.

3 1. Background Pre-2012 PSM/RMP Universe The December 2, 1984 Methyl Isocyanate (MIC) release from the Union Carbide Bhopal Facility is considered a pivotal event in catalyzing the application of Safety Management System (SMS) approaches to enhance process safety. Referencing the analogies in Figure 1.1, the MIC release resulted from the concurrent alignment of several holes, and the magnitude of the tragedy (3928 fatalities and over 100,000 permanent injuries are estimated) [1], drew the attention of industry, the public, and the regulatory community to the potential consequences associated with process safety events (Figure 1.2). Industry was quick to realize the significance of the event, with respect to the need to create and implement SMS mechanisms at highly-hazardous facilities, and the importance of developing mechanisms to control process safety. Industry s response was swift and definitive. The American Institute of Chemical Engineers (AIChE) founded the Center for Chemical Process Safety (CCPS) in 1985, recognizing that the most effective mechanism for addressing process safety was not the application of additional prescriptive mechanisms, or by addressing any specific action, but by effecting changes in the way business is done (i.e., safety culture and management systems). CCPS Guidebooks are currently considered key references in conveying the technologies needed for process safety, and the very first guidebook ( Guidelines for Technical Management of Chemical Process Safety [2] ) published in 1987 was designed to address this pressing need. Shortly thereafter, the American Petroleum Institute (API) distilled its version of Safety Management Systems FIGURE 1.1 Swiss Cheese and Spinning Disk Models for Accident Causes API RP 754 FIGURE 1.2 Tragedies to Avoid and issued Recommended Practice 750, Management of Process Hazards [3] in The following characteristics have remained consistent from the onset: All segments of the process industries correctly identified SMS as the primary and most effective mechanism for addressing core issues associated with process safety incidents.

4 Although some details differ between the above two documents, and also between the current requirements of OSHA s Process Safety Management (PSM) Program [4], U.S. EPA s Risk Management Program (RMP) [5], and the Bureau of Safety and Environmental Enforcement s (BSEE s) Safety and Environmental Management Systems (SEMS) Program [6], the same key Safety Management System elements are at the core of PSM, RMP, and SEMS, spanning an entire spectrum of facility types and geographic application. Figure 1.3 illustrates the parallel evolution of PSM, RMP, and SEMS Programs. It s interesting to note that although PSM and RMP were catalyzed by an onshore tragedy and focus on onshore facilities in the United States, and SEMS was catalyzed by an offshore-us tragedy and focuses on offshore facilities in waters off the coast of the United States, the key prevention program elements are nearly identical (see the key elements of PSM in Figure 1.4). This parallel evolution and resultant overlap are important to note for several reasons: FIGURE 1.3 Evolution of Select SMS Guidelines Although these regulatory programs were developed independently, at different times, and in different locations, industry and the regulatory community noted the importance of SMS application across all facility types. As performance-based regulatory requirements continue to evolve, the same phenomenon associated with the effectiveness of key SMS elements will gravitate the programs towards synchronization. The Richmond Refinery Fire on August 6, 2012 and West (Texas) FIGURE 1.4 Key PSM Elements Ammonium Nitrate Explosion (April 17, 2013) triggered a fresh look at the different SMS programs and resulted in several proposals for the modernization of PSM and RMP.

5 2. Overview of Key Safety Management Systems Program Modernization Initiatives Since August 2012, significant changes (see Figure 2.1) have been proposed by a number of agencies to Safety Management Systems (SMS) Programs. After various high-profile incidents occurred, Executive Order was signed by President Obama on August 1, 2013 to emphasize the importance of various agencies working together towards the common goal of improving process safety, as well as modernizing the current standards [7]. In addition to Executive Order mandating increased coordination amongst federal agencies, the Chemical Safety Board (CSB) investigated the FIGURE 2.1 Types of Changes Richmond Refinery Fire, and identified improvement areas [8,9,10] for both PSM/RMP implementation at the facility, as well as agency oversight and cooperation (eventually forming the Interagency Refinery Task Force). As a result, there have been changes proposed for the following programs: Federal OSHA PSM [11], U.S. EPA RMP [12], Cal/OSHA PSM [13], and CalARP [37, 43].. TABLE 2.1 SMS Program Overlap Matrix (April 2016) Element Fed-OSHA Cal/OSHA U.S. EPA CalOES/CalEPA (PSM) (PSM) (RMP) (CalARP) (Process) Safety Information (d) 5189 (d) Process Hazard Analysis (PHA) (e) 5189 (e) Operating Procedures (f) 5189 (f) Training (g) 5189( g) Mechanical Integrity (j) 5189 (j) Management of Change (l) 5189 (l) Pre-Startup Safety Review (i) 5189 (i) Compliance Audits (o) 5189 (o) a Incident Investigation (m) 5189 (m) Employee Participation (p) 5189 (p) Hot Work Permit (k) 5189 (k) Contractors (h) 5189 (h) Emergency Planning and Response (n) 5189 (n) Off-site Consequence Analysis a Captured as part of the Injury and Illness Prevention Program Subsection. Table 2.1 (above) identifies the key elements of the California SMS regulatory elements that are in-place (April 2016). Table 2.2A (below) summarizes and compares the various changes being proposed (April 2016) for the various SMS Regulatory Program Modernization Initiatives. Table 2.2A also delineates the various topics by the type and magnitude of the impact on RMP and PSM Programs. Table 2.2B lists Fed-OSHA PSM Initiatives that are being or may be handled by Letters of Interpretation. References 11, 12, 13, 37, and 43 may be reviewed for more complete details, and Section 3 is designed to provide additional background on the proposed changes listed in Table 2.2A. Many of these additional requirements overlap, and with some planning, existing PSM, RMP, and CalARP efforts can be slightly modified to address some of the more significant new

6 requirements with minimal effort. The focus of this paper will be to summarize the more significant changes proposed by the various agencies, and provide readers with a roadmap of how to effectively implement these changes in as efficient a manner as possible. TABLE 2.2A Current CalPSM-R, CalARP, and U.S. EPA RMP Drafts, and Fed-OSHA PSM Initiatives Subset Topic Cal/OSHA CalPSM-R (Draft) [13] CalOES/CalEPA CalARP-P4 (Draft) [37,43] U.S. EPA RMP-P2/3 (Draft) [12] Fed-OSHA PSM (RFI) [11] 1 Process Safety Information (PSI) (including confirmation of RAGAGEP adherence) (d) Topic 7 2 Process Hazard Analysis (PHA) (e) Safeguard Protection Analysis (SPA) (CA-Only) / Operating Procedures (OP) (f) Training (TRN) (g) / Contractors (CON) (including safety research & documentation) (h) Pre-Startup Safety Review (PSSR) (i) Mechanical Integrity (MI) (j) Damage Mechanism Review (DMR) (CA-Only) (k) Topic 9 Inherently Safer Technology (IST) / Hierarchy of 3 Hazard Control Analysis (HCA) / Safer Technology (l) and Alternatives Analysis (STAA) 1 Hot Work (HW) (m) Management of Change (MOC) (n) Incident Inv. Root Cause Analysis (II-RCA) (o) Emergency Planning and Response (EP&R) (p) / /96 Topic 11 1 Employee Participation (EP) (q) Process Safety Culture Assessment (PSCA) (r) Human Factors (HF) (s) Management of Organizational Change (MOOC) (t) Topic 10 2 Compliance Audits (CA) (Fed Rqmt. for 3 rd Party 68.58/59, (u) Auditor that is familiar with RAGAGEP) 68.79/80 Topic 12 2 Process Safety Management Program (PSMP) (v,w) Topic 6 Description of Subset Categories Subset Categories 1 Minimal changes to regulation or minimal effort needed for compliance 2 Moderate changes to regulation or moderate effort needed for compliance 3 New element or significant effort needed for compliance TABLE 2.2B Fed-OSHA PSM Initiatives Potentially Handled by Letters of Interpretation Status Topic Fed OSHA [11] LoI 02Feb03 Atmospheric Tank PSM Exemption Clarification Topic 1 Pending Inclusion of Oil/Gas-Well Drilling & Servicing Topic 2 Pending Inclusion of Oil/Gas-Production Facilities Topic 3 Pending Expand Coverage & Requirements for Reactivity Hazards Topic 4 Pending Updating the List of Applicable Chemicals / Threshold Quantities Topic 5 LoI 05Jun13 Adding a Definition for Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) This has already been incorporated into the CalPSM-R and CalARP draft Topic 8 updates. Pending Expanding the Requirements of to Cover Dismantling and Disposal of Explosives, Blasting Agents, and Pyrotechnics Topic 13 Pending Updating and Based on the Latest Applicable Consensus Standards Topic 14

7 TABLE 2.2B Fed-OSHA PSM Initiatives Potentially Handled by Letters of Interpretation Status Topic Fed OSHA [11] Pending Regulations Addressing the Storage, Handling, and Management of Ammonium Nitrate Topic 15 LoI 22Jul15 LoI 23Dec15 LoI 05Jun15 Enforcement of the Exemption for Retail Facilities Topic 16 Enforcement Policy for Highly Hazardous Chemicals Without Specific Concentration Thresholds 3. Key Elements of the Various SMS Regulatory Initiatives The key elements of the various Safety Management System (SMS) Regulatory Initiatives identified in Table 2.2A have been categorized into three subsets to facilitate understanding and the development of implementation strategies. 3.1 SMS Program Modernization Initiatives Subset 1 Subset 1 topics in Table 2.2A were judged to have only minimal changes to regulation or minimal effort needed for compliance. 1. Process Safety Information (PSI) Minimal Changes 2. Training (TRN) Minimal Changes 3. Contractors (CON) Some additional requirements are placed on both the facility and the contract owner regarding training verification and hazard identification. 4. Pre-Startup Safety Review (PSSR) Minimal Changes 5. Hot Work Minimal Changes 6. Employee Participation Minimal Changes 3.2 Safety Management System Program Modernization Initiatives Subset 2 Subset 2 topics in Table 2.2A were judged to have a potential for moderate changes to regulation or moderate effort needed for compliance. Topic Process Hazard Analysis (PHA) / Safeguard Protection Analysis (SPA) The primary changes proposed for CalPSM-R and CalARP-P4 include recommendation closure timelines and the performance of Safeguard Protection Analysis (SPA). The SPA is a new element with the objectives of assessing the effectiveness of existing and combined safeguards for each failure scenario identified in the PHA, and assuring that safeguards are independent of the initiating event and each other. Passive, Active, or Procedural Safeguards are evaluated by the SPA using LOPA or an equally effective method. The SPA report can be standalone or part of the PHA. Specific implementation tips are offered in Section of this paper. Timing: Conduct SPA and complete report within 6 months of finalizing a PHA.

8 SPA reports must be retained for the life of the process. 2. Operating Procedures (OP) The primary changes to the Operating Procedures requirements for CalPSM-R and CalARP-P4 address additional details associated with Emergency Operations. No implementation timing changes are identified. 3. Management of Change (MOC) The primary changes to the MOC element for CalPSM- R and CalARP-P4 address the depth of assessment performed during the MOC process: Performance of a Hierarchy of Hazard Control Analysis (HCA) prior to implementing a major change, with the findings and recommendations of the HCA included in the MOC documentation Use of qualified personnel and appropriate methods for all MOCs, based upon hazard, complexity and type of change Provisions for employee participation throughout the MOC process 4. Incident Investigation (II) Root Cause Analysis (RCA) The primary changes to the II element for CalPSM-R, CalARP-P4, and EPA RMP is the requirement for the application of the RCA technique for more serious events (i.e., resulted in or could reasonably have resulted in a catastrophic release). Other changes: CalPSM-R/CalARP-P4 Complete an HCA in a timely manner for all recommendations that result from the investigation of a major incident. CalPSM-R/CalARP-P4 Additional employee participation requirements CalARP-P4 The local Unified Program Agency may perform an independent PSCA, Incident Investigation, and Human Factors Analysis after a major incident. The owner or operator shall assist the UPA in conducting the independent analysis. The costs of the independent analysis shall be paid by the owner or operator. CalARP-P4 UPA to post reports from investigations of major incidents on the agency s website within 30 days of receipt New timelines: RMP Incident Investigation Report completion within 12 months of the incident RMP Implementation of RCA requirements within 4 years of the effective date of the regulation CalPSM-R/CalARP-P4 Investigation report completion within 90 calendar days of the incident If the team demonstrates in writing that additional time is needed due to the complexity of the investigation, the team shall prepare a status report within ninety (90) calendar days of the incident and every thirty (30) calendar days thereafter until the investigation is complete. The team shall prepare a final investigation report within five (5) months of the incident. CalPSM-R/CalARP-P4 - Incident investigation reports shall be retained for the life of the process unit. 5. Compliance Audits (CA) The changes proposed by CalPSM-R and CalARP-P4 are relatively minor (e.g., retaining the 3 most recent compliance audit reports, instead of 2); however, the proposed RMP Updates require the use of a third-party auditor, for both Program 2 and Program 3 facilities, if an applicable accidental release has occurred, or if

9 justified by the implementing agency. The proposed RMP Updates include specific auditor qualifications, independence and impartiality requirements, specifications for the audit report, and specifications for recordkeeping. Timing for audit, report, and submittal to the implementing agency: Within 12 months of request/requirement Within 3 years of completion of the previous compliance audit 6. Process Safety Management Program (PSMP) A Management Program/System is a new element required of CalPSM-R and CalARP-P4. Both have specifications for recommendation implementation timing (typically 2.5 years) and detailed criteria for rejecting recommendations. CalARP-P4 also includes provisions for a written Stop Work Procedure, a written Hazard Reporting Plan, a system for documenting work refusals for process safety concerns, and for the development and tracking of Process Safety Performance Indicators. Timing: Immediate Completion of corrective actions addressing process safety hazards 18 Months Completion of corrective actions from a CA or PSCA 18 Months Completion of corrective actions from a II (or two years after the incident, whichever is earlier) 30 Months Completion of corrective actions not requiring a process shutdown Triennial Management Program/System review and update First Regularly-Scheduled Turnaround Completion of corrective actions requiring a process shutdown CalARP-P4 14 Days After Completion Findings/Recommendations from PHA, DMR, HCA, II, PSCA, CA, and SPA must be provided to the facility owner CalARP-P4 30 days - time to respond in writing to written hazard reports submitted by employees or employees of contractors. CalARP-P4 90 days from effective regulation date Develop a system to effectively document work refusals for process safety concerns, written employee reports of process safety hazards, recommendations to shut down an operation or process, and the actual shut down of an operation or process that occurs pursuant to a Stop Work procedure. 3.3 Safety Management System Program Modernization Initiatives Subset 3 Subset 3 topics in Table 2.2A identified a new element or changes that were judged as having a potential significant effort needed for compliance. 1. Mechanical Integrity (MI) / Damage Mechanism Review (DMR) DMR is a new element for CalPSM-R and CalARP-P4, with the objective to identify any vulnerabilities associated with damage mechanisms, defined as the mechanical, chemical, physical, or other process that results in equipment or material degradation. This effort should involve a broad team, including inspection and damage/failure mechanism experts, using process flow diagrams, materials of construction, process conditions, and chemical substances to determine potential damage/failures. Specific implementation tips are offered in Section of this paper. At a minimum, the following should be evaluated:

10 Mechanical Loading Failure Ductile fracture, brittle fracture, buckling, mechanical fatigue Erosion Abrasive wear, adhesive wear, fretting Corrosion Uniform corrosion, localized corrosion, pitting Thermal-Related Failure Creep, thermal fatigue, transformation Cracking Stress-corrosion cracking Embrittlement High Temperature Hydrogen Attack (HTHA) Timing In conjunction with any PHA and prior to changes affecting chemistry, metallurgy, or operating limits, and the initial DMR to take place at the earliest of the following: Within 5 years (50% within 3 years and all within 5 years of CalARP-P4/CalPSM- R promulgation) Revalidated every 5 years or prior to a major change Reviewed as part of an incident investigation DMR reports must be retained for the life of the process. 2. Inherently Safer Technology (IST), Hierarchy of Hazard Control Analysis (HCA), and Safer Technology and Alternatives Analysis (STAA) For contemporary hazard reviews, IST evaluations are performed as a best-practice [18]. CalPSM-R and CalARP-P4 require the performance of HCA, and the proposed RMP Update requires the performance of STAA, to evaluate hazard prevention and control measures, in priority order, to eliminate or minimize a hazard, ranked from most preferred to least preferred: First Order Inherent Safety Prevents a major incident by eliminating or reducing the hazard (e.g., changing to a safer chemical) Second Order Inherent Safety Reduces the severity or likelihood of a release without the use of add-on safety devices (e.g., changing operating parameters to safer levels, such as lower pressures or temperatures) Independent Protection Layers Reduces the likelihood or consequence of a major incident through the application of add-on safety devices, from most preferred to least: Passive safeguards (e.g., double-walled vessels) Active safeguards (e.g., PSVs or automated shutdowns) Procedural safeguards (e.g., emergency response plans) Specific implementation tips are offered in Section of this paper. Applicability of the CalPSM-R and CalARP-P4 is currently focused on California Refineries, whereas the proposed RMP Update broadens application to any Program 3 NAICS 322/324/325 Facility (i.e., Paper Manufacturing, Petroleum and Coal Products Manufacturing, Chemical Manufacturing). The following timing applies for conducting the HCA/STAA: CalPSM-R/CalARP-P4 (HCA) All existing processes (50% within 3 years and all within 5 years of CalARP/CalPSM-R promulgation), with a 5-year revalidation CalPSM-R/CalARP-P4 (HCA) Applicable for all PHA recommendations addressing a major incident potential

11 CalPSM-R/CalARP-P4 (HCA) Applicable for all major changes (e.g., as part of MOC) CalPSM-R/CalARP-P4 (HCA) Applicable for all recommendations from the incident investigation report for any major incidents CalARP-P4 (HCA) Applicable for new processes (including making the HCA available to the public) RMP (STAA) 4 years from effective regulation date 3. Emergency Planning & Response CalPSM-R does not yet have any significant changes to these requirements; however, the proposed CalARP and RMP do contain significant additional requirements for: CalARP-P4 Annual update & submittal of the Emergency Response Program to the UPA CalARP-P4 For a designated geographic zone, development of a community outreach/notification program CalARP-P4 Provisions for the establishment of a Unified Command CalARP-P4 Provisions for ensuring sufficient emergency response resources CalARP-P4 Emergency response personnel training program CalARP-P4 Annual drills/exercises, with a triennial full-scale exercise CalARP-P4 Fixed and mobile, routine and emergency, air monitoring and detection systems RMP Emergency response coordination with local emergency planning & response organizations RMP For responding Program 2/3 facilities, annual review & update of Emergency Response program, including notification procedures and coordination with community emergency response plans RMP For all Program 2/3 facilities, annual notification exercises RMP For responding Program 2/3 facilities, annual tabletop exercises and field exercises once every five years Timing: CalARP-P4 Within 12 months of the effective regulation date RMP Compliance dates (4 years after effective regulation date) [ : Emergency Response Coordination Activities (1 year) LEPC Requires Compliance with (3 years) Emergency Response Exercises (4 years) 4. Process Safety Culture Assessment (PSCA) The PSCA is a new element of CalPSM- R and CalARP-P4 and requires an assessment of cultural safety practices at a facility. The Team should include one person knowledgeable in refinery operations and at least one employee representative. CalARP-P4 requirements also allow the UPA to perform its own PSCA after a major incident or any incident that could reasonably have led to a major accident, with the costs paid by the refinery owner/operator. Timing: Initial PSCA Within 18 months after the effective regulation date PSCA Updates Every five years

12 Evaluation of Recommendation Effectiveness Within three years of PSCA report completion 5. Human Factors (HF) HF is a new element of CalPSM-R and CalARP-P4 that requires, at minimum, the facility accounts for the complexity of tasks, levels of training and expertise required for employees, the human-machine interfaces are effective, and that the physical challenges of the work environment and effects of shift work and overtime are accounted for. 6. Management of Organizational Change (MOOC) MOOC is a new element of CalPSM-R and CalARP-P4 that requires the employer to designate a team to conduct a Management of Organizational Change (MOOC) assessment prior to reducing staffing levels, reducing experience levels of employees, changing shift duration, or increasing employee responsibilities. The employer shall provide for employee participation in this process, pursuant to subsection (q). The MOOC assessment is required for changes affecting operations, engineering, maintenance, health and safety, and emergency response. 4. SMS Modernization Status and Potential SMS Program Impact Figure 4.1 identifies Recent SMS Regulatory Activities, and Figure 4.2 depicts the different agencies involved in the current Safety Management System (SMS) Modernization Initiatives. Even though the ultimate performance objectives of each agency include accident prevention and consequence minimization, each of these agencies have a slightly different assigned mission and perspectives on the role they should play in SMS regulation implementation. Thus, at the time that this paper is written (April 2016), different agencies use different approaches, and apply different FIGURE 4.1 Recent SMS Regulatory Activities timelines. The following summarizes the current status and anticipated outcome.

13 Chemical Safety Board (CSB) [19] Three reports associated with the August 6, 2012 Richmond Refinery Fire were created by the CSB. Each report has specific recommended actions for industry and the regulatory community. Publications Interim Investigation Report, Chevron Richmond Refinery Fire, April [8] Regulatory Report, Chevron Richmond FIGURE 4.2 SMS Modernization Initiatives Refinery Pipe Rupture and Fire, I-CA, October [9] Final Investigation Report, Chevron Richmond Refinery Pipe Rupture and Fire, I-CA, January [10] Status No further CSB investigation efforts regarding the Richmond Refinery Fire are currently planned. CSB will continue tracking the implementation of their recommendations by industry and other agencies. California Interagency Refinery Task Force (IRTF) [20] The task force is composed of various federal, state, and local agencies with jurisdiction over refineries in California. Publication Improving Public and Worker Safety at Oil Refineries, February [21] Status Task Force meetings continue. Additional reports are not currently planned. Contra Costa County & City of Richmond Rule-Making June 2014 Contra Costa County Issued ISO ( Risk Management ) [38] June 2014 The City of Richmond Issued ISO 6.43 ( Industrial Safety ) [39] Status Current Initiative to Increase Involvement of Community Oversight Group in Process Safety Culture Assessments. U.S. Environmental Protection Agency (EPA) [22] Risk Management Program (RMP) Rule-Making Proposed RMP Rule, March 14, [12] Status EPA is currently soliciting comments due May 13, 2016.

14 Anticipated Outcome Promulgation of updated RMP requirements is estimated for Summer 2017, with the following compliance dates (years after effective regulation date) [12] : Third-Party Audit (4 years) Root Cause Analysis (4 years) STAA (4 years) Emergency Response Coordination Activities (1 year) LEPC Requires Compliance with (3 years) Emergency Response Exercises (4 years) Information Sharing (4 years) Update RMP (5 years) California Division of Occupational Safety & Health (Cal/OSHA) [24] Process Safety Management (PSM) Program Rule-Making Proposed General Industry Safety Order (GISO) , Process Safety Management for Petroleum Refineries, Version September 24, [13] Status Updates addressing petroleum refinery safety are in the final stages of rulemaking. Anticipated Outcome Final Regulation Promulgation Estimated Spring 2017 Initially, 2 Separate PSM Regulations in California for Petroleum Refineries (CalPSM-R), 5189 for Others Initially, Harmonization with CalARP, but No Planned Synchronization with Federal PSM/RMP Requirements Federal Occupational Safety & Health Administration (OSHA) [23] Process Safety Management (PSM) Program Publication Request for Information on Proposed Revisions to Federal OSHA s Process Safety Management Program Regulations, December 9, [11] Status OSHA is currently processing comments received by the March 31, 2014 deadline and formulating draft regulations (and Letters of Interpretation, as appropriate). Anticipated Outcome Promulgation of updated PSM requirements is anticipated to take several years to navigate through the current regulatory approval process.

15 California Office of Emergency Services (CalOES) [25] and California Environmental Protection Agency(CalEPA) [40] California Accidental Release Prevention (CalARP) Program [26] Rule-Making CalARP Regulation Amendments 2015, January 1, [27] These requirements are relatively minor updates to the existing program. California Accidental Release Prevention (CalARP) Program Proposed Updates, September 24, 2015 and October 26, [37,43] Status Although CalARP regulatory requirements were updated for January 1, 2015 implementation, updates addressing petroleum refinery safety are in the final stages of rulemaking. Anticipated Outcome Final Regulation Promulgation Estimated Spring 2017 Single CalARP Regulation with Additional Requirements (Program 4) for High Hazard Facilities (initially petroleum refineries) Initially, Harmonization with CalPSM-R, but No Planned Synchronization with Federal PSM/RMP Requirements 4.1 Anticipated Near-Term Impact At this point, the most significant near-term impact on SMS Programs for California Facilities will be the promulgation of by Cal/OSHA and the new Program 4 elements of the CalARP Program. Both of these focus on petroleum refineries in California. The proposed updates to the RMP requirements will have a smaller impact, but some elements may apply to facilities other than refineries. California will have two PSM regulations (one for petroleum refineries and one for non-refineries). For California facilities, Federal OSHA (along with Federal PSM requirements) does not have direct jurisdiction; however, for refineries that have "sister facilities" that are part of the same company, but in other parts of the United States, PSM Program synchronization within the company may no longer be practical. In addition, although there is harmonization, the current organization of the PSM elements in is not quite the same as the Prevention Program 4 elements of CalARP, thus desynchronizing the programs and making implementation more challenging. In addition, and the CalARP Program 4 elements are not synchronized with the current U.S. EPA RMP requirements nor the proposed updated RMP requirements. Significant differences exist for both the element-specific requirements, implementation timeframes, and types of facilities. Figure 4.3 depicts the anticipated near-term regulatory framework, and highlights the updates to the U.S. EPA requirements in red lettering. In addition to SMS Program implementation challenges at the plant site, the existing decentralization of regulatory oversight in California for CalARP can present additional challenges. In California, CalARP oversight is provided by the Unified Program Agency (UPA) with jurisdiction over the facility. Commonly, the UPA is either a municipal-level or county-level

16 fire agency, and there are 97 in the State of California. Each UPA has one or more individuals involved in the CalARP Program, along with their other program responsibilities, so if the UPA is to retain their jurisdictional authority, significant training will be required to bring all of these responsible individuals up-to-speed with updated CalARP regulatory requirements. Another potential concern with multiple agencies having different programs with nearly identical objectives is the general nature of regulations in the United States, and especially in California, to gain momentum and become more complex. Although there are examples of regulations becoming less complex over time (e.g., the transition of the Risk Management and Prevention Program (RMPP) requirements to CalARP in 1999), the general tendency is for the regulatory environment to evolve towards increased complexity. As the application of the additional program elements being proposed for becomes more common-place for refineries, there is going to a natural inclination for regulators to encourage application to other hazardous materials facilities or require justification from the facility for not applying them CA SMS Regulatory Environment Another potential complexity for industry is the EPA General Duty Clause [28]. If a non-petroleum-refinery highly-hazardous facility does not apply elements that are Post-2016 Near-Term CA SMS Environment required (and implicitly considered a best practice) for other types of highlyhazardous facilities (e.g., a petroleum FIGURE 4.3 Current Modernization Plan refinery), could there be increased liability issues? At a minimum, it would seem prudent for the SMS Specialists at all facilities encompassed by PSM and RMP to at least understand the requirements for petroleum refineries in California and at least briefly document a position for why these requirements do not need to be implemented at their facility. It should be noted that a complex SMS Regulatory Environment can create implementation challenges for not only industry, but also for regulators providing oversight. It is an important objective for regulators to always minimize unnecessary complexity, which can erode some of the safety benefits desired from the promulgation of Modernized PSM/RMP regulations.

17 4.2 Anticipated Long-Term Impact Challenges with overlapping regulations from multiple agencies that are designed to achieve similar objectives is not a new phenomenon. For SMS Regulatory Requirements, this environment existed in California in the 1990s. In California, Risk Management and Prevention Program (RMPP) requirements were promulgated in 1986 [29] that were designed to provide a platform for the formulation of a prevention program to minimize the potential for accidents at highly-hazardous facilities. When PSM was promulgated in 1992, it created a similar challenge with overlapping, but desynchronized, SMS Regulatory 1992 CA SMS Regulatory Environment Requirements that were essentially trying to accomplish the same thing. This environment existed until 1999, when the CalARP Program was created to replace RMPP and synchronize key prevention program elements with EPA RMP requirements, which went into effect in This evolution is depicted in Figure 4.4. The net result were programs that were easier to manage, both for industry and for the regulatory community, thus becoming more effective in achieving their objectives of protecting workers, the community, and the environment. Although there will likely be several iterations in the current SMS Modernization Program initiatives, it would be appropriate to anticipate eventual program synchronization. The time period for this could only be the subject of speculation. 5. What Should I Be Doing Now? 1999 CA SMS Regulatory Environment FIGURE California SMS Regulatory Evolution 5.1 General Regulatory Program Compliance, Monitoring, and Awareness The January 1, 2015 CalARP Program Updates are promulgated and currently applicable for all CalARP-covered facilities, refinery and non-refinery. Thus, facilities must adhere to these relatively minor changes in the program at this time.

18 Although the focus of the current SMS Modernization Program is on petroleum refineries in California, it is important for all U.S. highly-hazardous facilities to be carefully monitoring the proposed changes to CalARP, Federal PSM, California PSM, and RMP, and as changes are made, understanding the requirements and any potential for interpreting them as applying to your facility. Even if these new requirements do not directly affect your facility at this time, it is possible that: Applicability could be later expanded to other highly-hazardous facilities in California. Applicability could be later expanded to non-california petroleum refineries and other facilities. Inference could be made to the new requirements in California as best practice. General Duty Clause covenants could point to the new requirements in California. 5.2 Specific Program Implementation Tips At this time, the SMS Regulatory Program Modernization Initiatives are still a moving target. Many of the specific requirements are being formulated/finalized, and there are likely to be changes; however, there are several common elements between the different programs, which are also directly linked to CSB-identified SMS Program gaps and which are likely to be included in the final SMS Regulatory Requirements. This section will focus on these higher-priority elements and suggest high-value implementation strategies, such that substantive progress can be made on addressing important aspects of recommendations made by the CSB (i.e., could be considered best practice) in a focused manner. The specific tips offered will focus on streamlined approaches for adapting efforts currently expended on Process Hazard Analysis (PHA) to address and make progress on some of these new requirements. Although the initial focus of the SMS regulatory modernization programs will be on California petroleum refineries, applying these high-value elements to refineries in other U.S. locations and to other types of facilities may be prudent. One of the potential challenges identified by the regulatory community is a shortage of capable resources for some of these specialized areas to deal with the anticipated tight schedules, once the proposed regulations are promulgated. One key regulatory agency recommended applying High- Value/Priority elements now. Even if schedules are tight, if substantial progress has been made addressing the spirit of the new requirements, selective- grandfathering may be allowed Damage Mechanism Review (DMR) The complete implementation of DMR can require extensive resources, and Figure 5.1 depicts the range of approaches that can be used to address DMR requirements. The following resources clarify the challenge and provide some focused/practical approaches for implementation: FIGURE 5.1 DMR Implementation Spectrum

19 Maher, Nour, Schultz, Using PHA as a Framework for Effectively Addressing Evolving PSM/RMP Guidelines, Such As Damage Mechanism Hazard Reviews, Global Congress on Process Safety 2015 [30]. RMP/PSM Series Educational Webinars (March 26, 2015 and August 27, 2015) [41] Safeguard Protection Analysis (SPA) Safeguards effectiveness was identified as an important issue in CSB Recommendations I-CA-6 and I-CA-12, and SPA is specifically required by the proposed CalPSM-R (e) and CalARP Sections / to validate the effectiveness of safeguards for petroleum refineries. The CSB recommendations focus on documenting recognized methodologies, rationale, and conclusions used to claim that safeguards intended to control hazards will be effective, and a key objective of (e) is that All safeguards for each failure scenario shall be independent of each other and independent of initiating causes. Best practices for PHA implementation already include the Facilitator challenging the Team and only crediting effective, and typically independent, safeguards during the PHA. This objective can be achieved by careful application of PHA best practices by a qualified Facilitator during a PHA, and this can be accomplished especially well during an integrated HAZOP/LOPA exercise. The SPA is designed to validate that these best practices are adhered to. Thus, the balance of this subsection will provide tips on the performance of a quality PHA (which, of course, addresses the requirements of a SPA). Tips on maximizing the quality of your PHA effort can be found in a free on-line webinar series that addresses HAZOP/LOPA Facilitation Best Practices. [31] Module 11 is especially well-tuned to best practices that support SPA objectives. Practical PHA Facilitation Tips to Apply Best Practices and Address SPA Objectives: Clearly Identify and Document Transmitters/Controllers Affecting Causes & Safeguards Frequently Refresh the Team on Risk-Ranking Frequently Challenge the Team on Safeguard Effectiveness, Availability, & Reliability List/Partition the Safeguards as IPLs Group Alarms as a Single Safeguard, where Appropriate Apply Risk-Graph & LOPA to Provide Additional Insights Apply Risk-Graph & LOPA for High Consequence/Risk Scenarios to Identify if a Safety Instrumented Function (SIF) is Needed or to Validate that a SIF is Not Needed Considerations for Reliability & Timing of Operator Response to Alarms Present to Hear the Alarm Alarm Prioritization & Diagnosis Permission for Corrective Action

20 Opportunities for Installing Inherently Safer Features Global Congress on Process Safety 2016 Initiating the Corrective Action Time for the Corrective Action to Mitigate the Event Inherently Safer Technology (IST) / Hierarchy of Hazard Control Analysis (HCA) / Safer Technology and Alternatives Analysis (STAA) The evaluation of inherently safer technologies was identified as an important issue in CSB Recommendations I-CA-7 and I-CA-13, HCA is specifically required by the proposed (l) and , and STAA is specifically required by the proposed RMP Section to identify the inherent safety features associated with the process and evaluate the feasibility of applying Inherently Safer Technology (IST). CSB s recommendations apply to all CalARP Facilities, the proposed CalPSM-Rand CalARP-P4 requirements are initially focused on California Refineries, and the proposed RMP Section applies to all U.S. Refineries and other identified highly hazardous facilities. The specific CSB guidance is to minimize risk to the public, personnel, and the environment by performing an ISS Analysis triggered by all MOC and PHA reviews. The stated objective of (l) is to: Eliminate hazards to the greatest extent feasible using first order inherent safety measures; Reduce any remaining hazards to the greatest extent feasible using second order inherent safety measures; Effectively reduce remaining risks using passive safeguards; Effectively reduce remaining risks using active safeguards; and Effectively reduce remaining risks using procedural safeguards. Best practices for PHA implementation already include the application of a module to perform an Inherently Safer Systems (ISS) Analysis. This is done during the course of the PHA, and there are many QRA / BCA Revalidation guidance documents and resources available. Reference 33 provides a Focused Human LOPA Management LOPA Factors of Change technical paper from GCPS-2011 that summarizes the use of a HAZID Focused Incident HAZID Study HAZOP Study HAZOP Study Facility Siting Investigation Study, HAZOP Study, and LOPA to generate ideas for Inherently Safer Designs, and identifies (See Figure 5.2) optimal timing for introducing the Conceptual FEED Detailed Design Procurement/ Plant Operating concepts into the design process. It Design Phase Phase Phase Construction Phase Life Cycle should be noted that the opportunity to cost-effectively make significant FIGURE 5.2 ISS Life Cycle changes to the process to introduce inherently safer design concepts decreases over time. References 19, 34, 35, and 36 provide guidelines and agency checklists for evaluating the feasibility of implementing ISS concepts into a process.

21 Practical PHA Facilitation Tips to Apply Best Practices and Address IST/HCA/STAA Issues: Provide a briefing during PHA Synchronization Training. Provide a list of IST Considerations in the PHA Quick Reference provided to the team. Minimize Substitute Moderate Simplify More Robust Simplify Human Factors Simplify Facility Siting Apply a Deviation to discuss IST/HCA/STAA issues in each node. At the end of the PHA, apply an IST Checklist and document as separate node. 6. Summary & Conclusions The aftermath of the August 2012 Richmond Refinery Fire resulted in the CSB and other agencies reflecting on industry's application of Process Hazard Analysis (PHA) and Mechanical Integrity (MI), as well as the agencies' oversight of PSM and RMP. This has resulted in a number of agencies proposing ideas for improvements in both the specific areas associated with the root cause(s) of the event and the application of other Safety Management System (SMS) elements. These SMS Program modernization initiatives have focused on PSM, RMP, CalARP, and Cal/OSHA s PSM, with a special emphasis on petroleum refineries in California. Although California Refineries are the current focus of CalPSM-R and CalARP-P4, and some elements are already included in the proposed RMP Update, it would be prudent to anticipate that many of these initiatives will eventually affect PSM/RMP facilities throughout the United States. The months to come are likely to see significant efforts by industry to implement changes, and even more significant will be the challenges to both industry and the regulatory community due to differences in implementation, timing, and the SMS elements included in the different regulatory requirements. The only certainty is the uncertainty in what will be the final outcome and when implementation will be required. Although there will likely be significant near-term variances in the different SMS Regulatory Requirements, it would be appropriate to anticipate a long-term movement towards synchronization. This paper has provided relevant background information, summaries of the various SMS Regulatory Program Modernization Initiatives, and tips for practical actions to take as part of current PSM/RMP/CalARP efforts. These tips are also conducive towards maximizing the value associated with the implementation of these best-practices and minimizing the later impact of these updated SMS Regulatory Requirements.

22 It is critical that the process safety and risk management industrial and regulatory community carefully monitor the modernization concepts being proposed and potential implementation timing (Figure 6.1). Process safety and risk management professionals at the plant sites should focus on charting the course for long-term success for their programs. Being aware of these upcoming changes will facilitate planning a strategy for effective implementation that will best serve the interests of those being regulated (and regulators), as well as minimizing risks to plant personnel, the public, and the environment. FIGURE 6.1 What Not To Do 7. References [1] Accessed on March 20, [2] CCPS Guidelines for Technical Management of Chemical Process Safety, [3] API RP 750, First Edition Management of Process Hazards, [4] PSM 29 CFR , Process Safety Management (PSM) of Highly Hazardous Chemicals, Explosives and Blasting Agents, [5] RMP 40 CFR Part 68, "Risk Management Programs (RMP) for Chemical Accidental Release Prevention," [6] SEMS Final Rule Federal Register Title 30, Code of Federal Regulations (CFR) Part 250 Oil and Gas and Sulphur Operations in the Outer Continental Shelf Safety and Environmental Management Systems, Federal Register, Vol. 78, No. 66, April 5, [7] Executive Order 13650: Actions to Improve Chemical Facility Safety and Security A Shared Commitment. [8] Interim Investigation Report, Chevron Richmond Refinery Fire, April [9] _post.pdf, Regulatory Report, Chevron Richmond Refinery Pipe Rupture and Fire, I-CA, October [10] Final Investigation Report, Chevron Richmond Refinery Pipe Rupture and Fire, I-CA, January [11] Request for Information on Proposed Revisions to Federal OSHA s Process Safety Management Program Regulations, December 9, [12] 40 CFR Part 68, Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act; Proposed Rule, March 14, [13] Petroleum-Refineries.pdf, Proposed General Industry Safety Order (GISO) , Process Safety Management for Petroleum Refineries, Version September 24, [14] Guidance on Hazard Assessment for Reactive Hazard Substances (RHS) and RHS