PRELIMINARY DETERMINATION Shell Oil Products U.S. Martinez ... · PD_Shell Refinery_022818.doc January 25, 2019 Incident Investigation, Human Factors and Process Safety Culture Assessment

PRELIMINARY DETERMINATION

Shell Oil Products U.S. Martinez Refinery

3485 Pacheco Blvd.

P.O. Box 711

Martinez, CA 94553

Site ID: 729718

January 25, 2019

HAZARDOUS MATERIALS PROGRAMS

PD_Shell Refinery_022818.doc January 25, 2019

Preliminary Determination

Contra Costa County Health Services Hazardous Materials Programs (CCHSHMP) conducted a comprehensive audit/inspection of the programs, policies, and procedures developed by Shell Oil Products U.S. Martinez Refinery (SMR) in Martinez, California to satisfy the requirements of the California Accidental Release Prevention (CalARP) Program (Title 19 California Code of Regulations Division 2 Chapter 4.5) and Chapter 450-8 of County Ordinance 98-48 (ISO), as amended. The audit took place from February 28, 2018 through March 29, 2018. CCHSHMP is required to conduct an audit/inspection of SMR per Sections 2775.2 and 2775.3 of the (CalARP) Program Regulations (Title 19 Division 2 Chapter 4.5 of the California Code of Regulations), and per Chapter 450-8 §8.018(f) of the ISO. CCHSHMP conducted the audit/inspection in accordance with the Audit Plan for the California Accidental Release Prevention (CalARP) Program & Industrial Safety Ordinance (ISO) Program Audit/Inspection developed for SMR. This plan describes pre-audit, audit, and post-audit activities and is included in Attachment A. The completed questionnaires (e.g., “A37 – Process Safety Information”), including the basis for each recommended action item, are included as Attachment B. There may be questions receiving “R” answers that were not assigned an action. In these instances, a previous corrective action will address the identified deficiency. CCHSHMP also conducted interviews of approximately 14 (~5%) of operators, 6 (~5%) of maintenance, and approximately 25 “key personnel” (those employees with responsibility for developing and or implementing programs required by the CalARP Program and ISO regulations). CCHSHMP appreciates the cooperation from SMR management and personnel during the audit and interview process. The participants were open in their discussion and helpful in the audit process. During the field audits, employees and contractors all exhibited high safety awareness and generally are diligent in following company’s safety policies and procedures to create a safe work environment. CCHSHMP reviewed the management system at SMR responsible for overseeing the implementation of the CalARP/ISO Programs. CCHSHMP confirmed that SMR’s management system includes monitoring of the various CalARP and ISO programs in place at the refinery. Unfortunately, a number of areas were found not to be in full compliance with the new CalARP Program 4 requirements that became effective in October 2017. Although many of the Program 4 requirements have effective dates in the future, some requirements were in effect at the time of the audit. Examples of areas that need improvement include: 1) Major Change was not defined, 2) Major Incident was not defined, 3) expanded Employee Participation activities were not documented, 4) the Stop Work policy was not finalized, 5) the top-down approach for Hierarchy of Hazard Control was not fully implemented. These issues, and others, have been detailed within the completed questionnaires listed in this audit report CCHSHMP identified 3 deficiencies and 30 partial deficiencies in existing programs at the facility. The three deficiencies were found in the Contractor (1) and Process Safety Culture Assessment (2) program elements. CCHSHMP found that the following five program elements resulted in more than half of the partial deficiencies: eight within the Hierarchy of Hazard Control/Inherently Safer System Analysis (HCA/ISSA) program element; four within each of the

PD_Shell Refinery_022818.doc January 25, 2019

Incident Investigation, Human Factors and Process Safety Culture Assessment program

elements; and three within the Management of Change program element. The remaining partial

deficiencies were found within eleven other program elements. This audit report identifies the

corrective actions generated to correct the deficiencies in Attachment C.

CCHSHMP also generated 52 corrective actions to improve upon programs that already comply

with the requirements of the CalARP Program Regulations and County Ordinance 98-48, as

amended. These corrective actions begin with “consider” and are optional for SMR to

incorporate (e.g., consider updating the PHA policy to reference the current database tool used

for action item tracking). This audit report identifies the suggestions to improve upon programs

that already comply with the requirements of the CalARP Program Regulations and County

Ordinance 98-48, as amended, in Attachment D.

Upon completion of addressing the action items, SMR will provide CCHSHMP with a resolution

status update. The status update does not need to include the actual copies of the proposed

remedies (i.e. studies, updated policies, training documentation, etc.), but rather an overview of

the actions taken by SMR to complete the action items and actual dates of completion.

Audit Reporting Process

Once CCHSHMP completes an audit, an Administrative Draft of the Preliminary Determination

report is issued, and the audited Stationary Source has 14 days to respond in writing to identify

any technical or factual inaccuracies. If no written technical or factual inaccuracies are received,

the Administrative Draft will then become the Preliminary Determination report. Once the

Preliminary Determination has been issued, the Stationary Source has 90 days to respond in

writing and provide proposed remedies and due dates to address the identified corrective actions.

The Stationary Source can also identify which recommendations, if any, will be rejected in

whole or in part. For those recommendations rejected, the Stationary Source shall explain the

basis for the rejection and provide substitute revisions.

Upon receipt, CCHSHMP reviews the proposed remedies, due dates, and any rejections

proposed and will communicate any final revisions to the Stationary Source. Once CCHSHMP

is in agreement, the Summary of Actions Items Table contained within Attachment C and the

Summary of Consider Items Table contained within Attachment D are modified to include the

proposed remedies, due dates, and other approved revisions. A 45-day public review process

begins after this time. As required by the County’s ISO, a public meeting must be held to allow

review and comment on the issues found during the audit. After the conclusion of the public

notice period and incorporation of any relevant public comments, this final document is

considered to be the Final Determination.

Upon completion of the action items, the stationary source will provide CCHSHMP with a status

update. The status update does not need to include actual copies of the documented resolutions

(i.e. studies, updated policies, training documentation, etc.), but rather an overview of the actions

taken to address the action items along with actual dates of completion.

ATTACHMENT A

Audit Plan for the California Accidental Release Prevention (CalARP)

Program & Contra Costa County Industrial Safety Ordinance (ISO) Program

Audit/Inspection

Audit/Inspection Plan for the California Accidental Release Prevention (CalARP) Program

& Industrial Safety Ordinance (ISO) Program

Prepared for:

Shell Oil Products U.S. Martinez Refinery 3485 Pacheco Blvd.

P.O. Box 711 Martinez, CA 94553

Site ID: 729718

January 31, 2018

Prepared by:

HAZARDOUS MATERIALS PROGRAMS

CalARP/ISO/RISO Audit Plan January 31, 2018 1

I. INTRODUCTION This document describes the plan for conducting a comprehensive audit/inspection of the programs, policies, and procedures developed by Shell Oil Products U.S. Martinez Refinery (SMR), located in Martinez, California, to satisfy the requirements of the California Accidental Release Prevention (CalARP) Program (Title 19 California Code of Regulations, Division 2 Chapter 4.5) and either Chapter 450-8 of County Ordinance 98-48, as amended, (hereafter referred to as ISO) or Chapter 6.43 of the City of Richmond Industrial Safety Ordinance 42-01, as amended, (hereafter referred to as RISO). A generic audit plan, including pre-audit/inspection, on-site audit/inspection, and post audit/inspection activities is included in Appendix A. This audit plan describes the pre-audit/inspection activities for the SMR. II. ALLOCATE RESOURCES Accidental Release Prevention Engineers Michael Dossey, Habib Amin, Nicole Heath, Cho Nai Cheung, Robert Long, Jessica Droege, and Kevin Ong will conduct the audit/inspection. The audit team will conduct quality assurance/quality control (QA/QC) on the work plan and Written Preliminary and Written Final Determinations. The audit responsibilities will be distributed through the completion of the following questionnaires:

Questionnaire Program Level 1

Responsibility

A37 – Process Safety Information 4 Long A38 – Process Hazard Analysis 4 Heath A39 – Operating Procedures 4 Amin A40 – Training 4 Dossey A41 – Mechanical Integrity 4 Long A42 – Management of Change 4 Amin A43 – Pre-Startup Safety Review 4 Ong A44 – Compliance Audits 4 Long A45 – Incident Investigation 4 Droege A46 – Employee Participation 4 Cheung A47 – Contractors 4 Long A48 – Emergency Response Program 4 Droege A49 – Section A: Management System 4 Cheung A50 – Section B: HFP & Latent Conditions 4 Dossey A51 – Section B: PHA's & SPA 4 Heath A52 – Section B: Incident Investigation 4 Droege A53 – Section B: Procedures 4 Amin A54 – Section B: MOC for Organizational Changes 4 Ong A55 – Section B: Employee Participation 4 Cheung A56 – Section B: Training 4 Dossey A57 – Section C: Root Cause Analysis 4 Droege A58 – Section D: HCA/ISSA 4 Dossey A59 – Section F: Process Safety Culture Assessment 4 Ong S1 – Hot Work Permit 4 Amin S3 – Lockout / Tagout 4 Ong

1 - CalARP Program 4 questionnaires include ISO requirements


Contra Costa Hazardous Materials Programs (CCHMP) will require one meeting room to accommodate the audit team members (i.e., ideally the room would be equipped with a table and sufficient electrical outlets for laptop computers). CCHMP will also require two or more meeting rooms to accommodate simultaneous employee interviews on scheduled days. III. PURPOSE & SCOPE The primary purpose of this audit/inspection is to evaluate SMR’s capability to effectively meet the requirements of the CalARP Program 4 regulations and ISO, to verify the status of previous audit action items, and to identify potential regulatory deficiencies or areas where improvement is warranted. A secondary purpose of the audit is to ensure that the Risk Management Plan (RMP) and Safety Plan accurately describe the accidental release prevention programs and safety programs currently being implemented at SMR. Finally, CCHMP may identify areas of the accidental release prevention program and safety program that may be improved based on generally accepted practices and guidelines. All non-mandatory action items will begin with “Consider…”. The physical scope of the SMR audit/inspection includes all processes located within the refinery per Program 4 requirements. The historical scope of this audit/inspection is from the effective date of the CalARP Program regulations, August 19, 1996 and October 1, 2017 for Program 4, and the ISO, January 15, 2000, to February 28, 2018, the starting date of this audit/inspection. The regulatory scope of this audit/inspection includes the requirements included within the CalARP Program regulations (T19 CCR Division 2 Chapter 4.5) and either the ISO or RISO. The CalARP Program regulations also reference the following regulations: T8 CCR §3220 Emergency Action Plans T8 CCR §5192 Hazardous Waste Operations and Emergency Response T8 CCR §5189 Hot-Work Permits/Procedures T8 CCR §5156/5157/5158 Confined-Space Regulations T8 CCR §5194(g) MSDS Requirements under Hazard Communications T8 CCR §2320/3314 Lockout/Tagout T8 CCR §3329/6815/6816 Line Opening In addition to the preceding requirements, the following sources will be utilized in assessing compliance and formulating action items during the audit: • Contra Costa County CalARP Program Guidance Document • Contra Costa County Safety Program Guidance Document • Accidental Release Prevention Requirements: Risk Management Programs Under the Clean

Air Act, Sections 112(r)(7) Parts III and IV of 40 CFR Part 68 • Pre-amble Part III of 40 CFR Part 68 • CAA Section 112(r) Frequently Asked Questions • Sections 25531-25543.3 of the California Health and Safety Code • Pre-amble to the OSHA PSM standard, 29 CFR §1910.119


• Questions and Answers to the Cal/OSHA PSM standard, T8 CCR §5189 • OSHA Instruction CPL 2-2.45A CH-1 Program Quality Verification Checklist • OSHA 3132, Process Safety Management, 1994 (Compliance Audits) • OSHA 3133, Process Safety Management Guidelines for Compliance, 1994 (Compliance

Audits) • Guidelines for Auditing Process Safety Management Systems, Center for Chemical Process

Safety, AIChE, 1993 Acceptance criteria for the audit/inspection will be determined on a case-by-case basis. CCHMP will determine whether the deficiencies represent isolated incidents (in which individual deficiencies would be identified to correct) or trends (in which program deficiencies would be identified to correct). CCHMP may take photographs in the field as part of the facility audit records. IV. QUESTIONNAIRES The entire stationary source is subject to CalARP Program 4 and the requirements of ISO. Questionnaires associated with CalARP Program 4 and the ISO program will be completed and were identified in Section II of this Audit Plan and are included in Appendix B. The sampling size for the records will be determined on a case-by-case basis. CCHMP shall document the findings, including documents reviewed (see Appendix D) and records sampled, in the “Findings” column. The “Clarifications” column provides guidance to the auditors including suggested documents to review and interpretations from CalARP Program 4, the ISO Program and Guidance, federal OSHA and federal EPA. CCHMP shall then provide the answer to the question in the “Answer” column. The following codes shall be applied: • Y Full compliance with all requirements of the question • N No compliance with the question’s requirements • P Partial compliance with the requirements • R An action item is listed elsewhere with cross reference • N/A The question is not applicable to the facility CCHMP shall develop a list of actions to resolve potential deficiencies in the risk management program or to resolve discrepancies between the risk management program and the RMP and Safety Program and the Safety Plan. These and other regulatory deficiencies are required to be addressed and will begin with “Ensure”. CCHMP may also develop a list of actions to improve a risk management program based on generally accepted practices or guidelines. These actions are non-mandatory and will begin with “Consider”. If no actions are developed, CCHMP shall enter “None”. V. EMPLOYEE & “KEY PERSONNEL” INTERVIEWS CCHMP shall meet with SMR personnel to review an organizational chart of employees and the existing shift schedule. CCHMP shall then identify approximately 1-5% of the employees to interview including personnel from operations, maintenance, and engineering. Employees shall also be notified that they may have union representation present, if they choose. Any employee not selected, but whom would like to be interviewed, will also be interviewed. Interviews will last


approximately 30 minutes. CCHMP shall also meet with “key personnel” responsible for each CalARP Program and Safety Program requirement. The following “key personnel” were identified in Section 4.1 of the RMP: • Process Safety Manager • Production Manager • HSSE Manager • HR Manager • Engineering Manager • Technology Manager • General Manager

CCHMP will conduct procedural and/or P&ID walk-downs with qualified operators in the field during this audit. These walk-downs are anticipated to be in lieu of some or all of the sit down employee interviews and include an assessment of the relative accuracy of the written documents based on field observations and input from site personnel. Written notes of these walk-downs will be provided to SMR for their records. These walk-downs should be treated as personnel interviews and be without the presence of management and supervision. CCHMP will meet with local union representatives, as applicable, at the stationary source at the beginning of the audit/inspection. CCHMP will also meet with personnel to discuss the management system in place necessary to implement the CalARP Program and include a summary of this in the completed audit report. In addition CCHMP shall meet with a representative(s) from the Process Engineering/ Capital Improvements/Long Range Planning department(s) or corporate equivalent to understand if there may be new processes being considered for the facility, where ISS should be applied in the early stages of the project conception, scoping and design. VI. AUDIT SCHEDULE CCHMP will begin the audit/inspections with an opening meeting to discuss the audit process and answer any specific questions by SMR. CCHMP encourages the attendance of all SMR CalARP and Safety Program key personnel, management staff, and union representatives. Tentative Overall Schedule The on-site audit/inspection activities will start: February 28, 2018: 9:00 a.m. – 11:00a.m. CCHMP Safety Orientation @ SMR 11:00 a.m. – 12:00 p.m. Opening meeting. An agenda is included in

Appendix D.


1:00 p.m. – 4:30 p.m. Audit CCHMP shall schedule weekly debriefings with SMR representatives, beginning the week of March 5, 2018. Preferably, the debriefings will be held in the late afternoon. During the debriefings, CCHMP will discuss their current draft findings and action items. Completion of all on-site audit/inspection activities is anticipated to be on or before March 29, 2018. This date may change depending on the circumstances. SMR may be able to rectify potential deficiencies before the conclusion of the audit/inspection. These deficiencies will still be included in the written report, however, they will be identified as rectified. VII. DOCUMENTS TO BE REVIEWED CCHMP may request and review the documents listed in Appendix C during the on-site portion of the audit/inspection. SMR is expected to have this information compiled and available prior to the audit/inspection.

VIII. PUBLIC COMMENTS CCHMP has concluded the public notice/comment period per §2745.2(c) and §2745.2(d) of the CalARP Program regulations for SMR’s RMP on June 6, 2017 and no comments were received. IX. SITE SAFETY PLAN CCHMP shall wear personal protective equipment (PPE) as appropriate (i.e., hard hat, safety glasses/goggles, steel toed shoes, Nomex coveralls, hearing protection). CCHMP will not enter any areas where respiratory protection is required. CCHMP shall be escorted throughout the facility by personnel who are knowledgeable of the facility’s emergency action plan (i.e., evacuation routes, headcounting procedures, alarms).

CalARP/ISO/RISO Audit Plan A - 1

APPENDIX A OVERALL AUDIT PLAN

AUDIT ACTIVITIES CCHMP followed the internal procedure, “Conducting Audit/Inspection Protocol”, adapted from the Guidelines for Auditing Process Safety Management Systems (Center for Chemical Process Safety, AIChE, 1993) for developing this work plan and for conducting the audit. This procedure includes specific tasks for three phases of the audit: Pre-Audit/Inspection, On-site Audit/Inspection, Post-Audit/Inspection. The specific tasks to be completed are as follows: Pre-Audit/Inspection Activities Allocate resources

a. Select audit team members with the following attributes: auditing skills, knowledge of the process, diligence, perceptiveness, thoroughness, objective, unbiased

b. Provide audit team members as needed with copies of the audit/inspection questionnaires, objectives, sampling strategies, and secondary reference materials

c. Schedule the conference and meeting rooms required for the initial, daily, and closing debriefing sessions; the employee interviews; and team meeting rooms

d. Acquire any required audit equipment/software (i.e., computers, software for recording, documentation forms, printers, copiers)

Clearly identify objectives of the audit/inspection

a. Assign audit/inspection team members to programs to be reviewed based on familiarity with the CalARP Program regulations, ISO/RISO, and the processes, and availability

b. Clearly identify “final products” from each of the audit/inspection team members (i.e., agree on documentation format and ensure consistency with audit/inspection report and the trade secret policy)

Determine the scope of the audit/inspection

a. Identify the physical scope of the audit/inspection – clearly identify the covered processes and ISO/RISO covered processes that will be included in the evaluation and their boundaries

b. Identify the historical scope of the audit/inspection under the CalARP Program – the starting date of the program is August 19, 1996, the effective date of the CalARP Program regulation. The starting date of subsequent audits, perhaps due to covered process modifications, will be determined.

c. Identify the historical scope of the audit/inspection under ISO – the starting date of the initial audit will be January 15, 1998, the effective date of ISO. The starting date of subsequent audits, perhaps due to ISO covered process modifications, will be determined.

d. Identify the historical scope of the audit/inspection under RISO – the starting date of the initial audit will be December 18, 2001, the effective date of RISO. The starting


date of subsequent audits, perhaps due to RISO covered process modifications, will be determined.

e. Identify the regulatory scope of the audit/inspection – the audit/inspection includes the requirements of the CalARP Program regulation, Title 19, Division 2, Chapter 4.5. The CalARP program regulation also references the following regulations:

T8 CCR§3220 Emergency Action Plans T8 CCR§5192 Hazardous Waste Operations and Emergency

Response T8 CCR§5189 Hot-Work Permits/Procedures T8 CCR§5156/5157/5158 Confined-Space Regulations T8 CCR§5194(g) MSDS Requirements under Hazard Communications

f. Determine acceptance criteria for the audit (i.e., if one record out of 100 sampled

shows that the written procedure was not followed does this constitute a finding and warrant a recommendation)

Plan and organize the audit/inspection

a. Develop (i.e., identify and revise as necessary) the questionnaires to be used by the audit team members. When auditing/inspecting an ISO/RISO regulated source all processes are to be audited/inspected against Program 3 requirements. This includes all questionnaires listed in Appendix B.

b. Compile all secondary reference materials (e.g., OSHA Instruction 2-2.45A CH-1, CAA Frequently Asked Questions, industry standards and techniques from professional groups such as AIChE, ASME, Chlorine Institute, IIAR)

c. Determine documentation methodology (i.e., consistency in use of wording and columns) and audit team member’s deliverables (e.g., working papers, software printout, interview information)

d. Determine sampling size and strategy for records (e.g., stratified). e. Schedule employee interviews and meetings with key personnel f. Schedule opening and closing meeting start times and participants g. Schedule debriefing meetings, as needed.

Collect background information, as needed, from the list in Attachment G of Conducting Audits/Inspection Protocol (see Appendix D) Stationary sources may elect not to submit confidential business information (CBI) to CCHMP prior to the on-site portion of the audit. These documents will therefore need to be reviewed during the on-site portion of the audit, possibly increasing the duration of the audit. If the stationary source elects to submit CBI to CCHMP, it will be handled in accordance with the Trade Secret Policy.

Review public comments and written responses developed in accordance with Section 6.6 of the RMP/Safety Plan Completeness Review Protocol Also review any other comments or questions submitted by the public regarding the regulated source or ISO/RISO regulated source. All of the public comments should be available in each regulated source’s or ISO/RISO regulated source’s files under RMP/Safety Plan Completeness Review and


Public Notices and Comments, and Written Responses to Comments. Finalize audit/inspection scope, objectives, and methodology

a. Develop a written audit plan. Follow the format included in Attachment I of Conducting Audits/Inspections Protocol.

b. Circulate the written audit plan to audit team members and to the regulated source or ISO/RISO regulated source

c. Revise the written audit plan to reflect the audit team members’ and the regulated source’s or ISO/RISO regulated source’s comments

On-site Audit/Inspection Activities The audit team leader is responsible for ensuring that the audit team members conduct the following activities/tasks. Conduct opening meeting

a. Discuss the audit objectives, scope, methodology, and schedule for the audit b. Conduct a tour of the stationary source with stationary source escorts (optional) c. Identify personnel who are responsible for the implementation of the various

elements of the program. Establish schedule, as necessary, for audit team members to meet with personnel to discuss the programs and review records, and to conduct P&ID and/or Procedure walk-downs as applicable

d. Receive any necessary safety training (emergency evacuation procedures) and specialty PPE (e.g., alert monitors, escape respirators)

Review programs, policies, and procedures associated with the CalARP program and the Safety Program (if applicable) including, but not limited to, those documents listed in Attachment G of Conducting Audits/Inspections Protocol

a. Identify any findings or potential deficiencies between the existing programs, policies, and procedures and the developed protocol

b. Identify any findings or inconsistencies between the existing programs, policies, and procedures and the written RMP and Safety Plan (if applicable)

c. Formulate action items to rectify any identified potential deficiencies or inconsistencies

Collect and record data to verify that the regulatory requirements are being met and that the stationary source programs, policies, and procedures are being implemented

a. Perform records reviews using the selected sampling strategies discussed in Attachment H of Conducting Audits/Inspections Protocol

b. Conduct an on-site conditions inspection c. Perform interviews with selected management, operations, and maintenance

personnel d. Perform and document the activities denoted with an asterisk (*) in the Clarifications

column of the protocol. The Clarifications column includes information from OSHA, EPA, OES, and professional organizations that may or may not be applicable to the stationary source being audited. The auditors should use judgement in


applying the guidance. e. Conduct procedural walk-downs in the field with qualified personnel as appropriate

to verify accuracy of select procedures f. Conduct P&ID walk-downs in the field with qualified personnel as appropriate to

verify accuracy of select P&IDs

Document the audit/inspection a. Audit findings and action items should be written to “stand alone” b. The regulatory basis that supports the ensure action items (e.g., §2755.1) must be

identified in the question, findings, or referenced at the end of the ensure action c. Action items should not be written to constrain the regulated source or ISO/RISO

regulated source, in the event that better alternatives may be available d. Clearly differentiate between action items necessary for compliance and items

beneficial to safety but not necessary for compliance (These actions are non-mandatory and will begin with “Consider”)

e. Audit findings and action items should be objectively documented. Avoid making legal conclusions, characterizing conduct, or inappropriate connotations (e.g., grossly negligent, unprofessional operating practices, appalling)

f. Ensure that all findings and action items are true. Avoid speculating (e.g., “it appears”) or expressing opinions (e.g., “I believe”)

Evaluate audit information by applying the acceptance criteria Document “Y”, “P”, “N”, “R”, “N/A” in the “Answer” column of the questionnaire for each question. Avoid making conclusions based on a statistical summary (e.g., the stationary source is 60% in compliance with the CalARP Program regulation or Safety Program Elements of ISO/RISO) because some audit questions are more indicative of a successful accidental release prevention program than others.

a. Acceptable (i.e., full compliance with the acceptance criteria): “Y” b. Incomplete (i.e., partial compliance with the acceptance criteria): “P” c. Negative (i.e., no compliance with the acceptance criteria): “N” d. Cross Reference (i.e., an action item is listed elsewhere): “R” e. Not applicable (i.e., acceptance criteria not applicable): “N/A”

Incorporate public comments into the questionnaires where appropriate.

Post-Audit/Inspection Activities The audit team leader is responsible for ensuring that the audit team members conduct the following activities/tasks. Prepare audit/inspection report and send to stationary source

a. Gather all audit/inspection documentation from audit team members b. Consider all public comments on the RMP or Safety Plan formulated during the

formal public review (§2745.2 of the CalARP program regulations, ISO Chapter 450-8.018(A), RISO Section 6.43.100)

c. Generate a “written administrative draft preliminary determination” of necessary


revisions, including an explanation for the basis of the revisions, reflecting industry standards and guidelines (such as AIChE/CCPS Guidelines and ASME and API standards) to the extent that such standards and guidelines are applicable.

d. Distribute the written administrative draft preliminary determination to at least one other member of the audit team for that stationary source for a quality control review.

e. Address technical or factual inaccuracies, if necessary, in the written administrative draft preliminary determination as appropriately identified by the stationary source and then issue the written preliminary determination. Both the written Administrative Draft and the Preliminary Determination should be sent to the stationary source via email or certified mail.

f. Work with each regulated source and ISO/RISO regulated source to ensure the accuracy of the written preliminary determination. The regulated source or ISO/RISO regulated source may reject revisions, in a written response, and may propose a substitute recommendation. Documentation of meetings, including all agreements and points of contention shall be documented and maintained in each regulated source’s (including ISO/RISO regulated source’s) file. Unresolved issues between the CalARP team members and the regulated source or ISO/RISO regulated source will be handled in accordance with the Dispute Resolution Policy.

g. Both the written administrative draft preliminary determination and the written preliminary determination are public documents and shall be made available for review upon request.

Verify the implementation of proposed corrective actions from the stationary source CCHMP will review proposed remedies and due dates from the stationary source identified to address the action items and consider items formulated from the audit/inspection. The status of each resolution should be recorded in the appropriate column of the report. CCHMP will take enforcement action, in accordance with the Enforcement Policy, if the resolution status review demonstrates that the Stationary Source is not implementing the action items in a timely fashion as agreed upon.

CalARP/ISO/RISO Audit Plan B - 1

APPENDIX B QUESTIONNAIRES

Copies of the complete questionnaires are included in this Appendix. The column titled “Type” identifies whether a question is included as an abridged question by the “Abr” notation and whether it is a new Program 4 question by “New”. For this audit, CCHMP will focus on answering those questions with the “Abr” and “New” notations; however, retains the discretion to answer additional questions or even entire questionnaires based on information uncovered during the onsite audit.

(Blank questionnaires are not included within the final report)

CalARP/ISO/RISO Audit Plan C - 1

APPENDIX C DOCUMENTATION TYPICALLY REVIEWED DURING AN AUDIT

The following is a list of documents normally reviewed during a CalARP Program audit/inspection. Information tagged with a (*), or samples of this information, may be asked for in advance of the audit/inspection. All other information should be available for review during the audit/inspection. The documentation shown in bold may be available, to some extent, in the RMP; however, more detailed information may be required. Stationary sources may elect not to submit confidential business information (CBI) to CCHMP prior to the onsite portion of the audit. Background Information * Plant/process descriptions * Plant plot plan * Plant CalARP program manual * Plant organization chart * List of covered chemicals * Rationale for covered and non-covered processes * Rationale for any claimed regulatory exemptions Management System * Description of CalARP Program * Designation of responsible management * CalARP program policy statement and the Environmental Health and Safety Policy • Plant policies manual • Objective evidence of management commitment and leadership * CalARP program performance criteria * CalARP program progress reports * Description of system to track CalARP program action items • Records from tracking CalARP action items • Injury and illness log for employees • Evidence of communications of the CalARP program within and outside the company Process Safety Information/Safety Information * PFD's or block flow diagrams • Process chemistry • Maximum intended inventory • Safe upper and lower limits for key operating parameters • Evaluation of consequences of process deviations • Materials of construction • P&ID's • Electrical classification * Process descriptions for covered processes • MSDS's for regulated substances • Engineering documents that list/show:

- codes and standards used in design and construction


- ventilation system design for process buildings, control rooms, other areas where people may be located

- relief system design and design basis (more detailed than just data sheets) - material and energy balances - safety systems (e.g., interlocks, detection and shutdown systems)

• Documentation that equipment complies with recognized and generally accepted good engineering practice (RAGAGEP)

* Damage Mechanism Reports * Listing of names of operators * Listing of names of engineers and areas of responsibility * Listing of names of maintenance technicians and engineers and areas of responsibility Process Hazard Analysis/Hazard Review * Priority order for plant PHA's and documentation thereof * Schedule for plant PHA's * PHA manual or procedure * Rationale for selecting PHA technique(s) used • PHA reports (current and all previous) • PHA worksheets (current and all previous) and associated supplementary data * Listing of PHA team members with areas of expertise (may be part of PHA reports) • Documentation of PHA training for team members and team leaders * Description of system used to manage PHA recommendations • Records from managing PHA recommendations Operating Procedures * Guidelines for generating, modifying and controlling operating procedures including format

and content * List of operating procedures for initial startup, normal operations, temporary operations,

emergency shutdown, emergency operations, normal shutdown, startup following a turnaround, startup after an emergency shutdown

* List of safe work practices including lockout/tagout; lifting equipment over process lines; capping over ended valves; opening process equipment or piping; excavation; control over entrance into a facility by maintenance, contractor, or other support personnel

* List of safe work practices for contractors • Annual certification of procedures • Operating procedures Training * Description of training program (initial and refresher) • Training materials (initial and refresher) • Records of employee training (initial and refresher) • Certification of training where appropriate • Frequency of refresher training and documentation of employee consultation


Contractors * Contractor safety program • Records on contractor selection • Records on contractor use • Documentation of information communicated to contractors * Safety Manual for contractors (both employer and contractor) • Documentation of periodic contractor CalARP performance evaluation • Documentation of periodic contractor CalARP training evaluation • Documentation of actions taken to correct contractor deficiencies • Documentation showing control of contractor plant entry and egress • Injury and illness log for contract employees • Records of training of contractors (from Contract Employer) • List of names of contractor employees used Pre-startup Review * PSR procedure * PSR checklists • Completed PSR's Mechanical Integrity/Maintenance * MI program management policy document or procedure * Rationale for exclusion of any systems, equipment, or instrumentation • Relevant portions of manufacturers' manuals, codes and standards * List of maintenance procedures • Maintenance procedures • Documentation on use of MI procedures * Description of training program for process maintenance activities • Training materials • Records of employee training • Training certification documents for employees where appropriate • Inspection and test procedures (including instrumentation) • Records, including results, of inspection and testing • Description of system used to track the mechanical integrity program • Description of system used to track Safeguards identified in PHAs • Records on correction of deficiencies * Quality assurance program and procedures for new plants and equipment • Quality assurance records * Procedures for control of spares and other equipment and materials Hot Work Permit * Hot work permit procedure • Completed permits * Description of training for hot work activities • Records of employee training • Training certification documents for employees where appropriate


• Documentation of communication to contractors on hot work permitting programs Management of Change * MOC procedure • MOC records Incident Investigation * Description of II procedure * Lists of names for any II teams, past and present * Listing of incidents • Incident investigation reports * Description of system used to manage II findings • Records from tracking II report findings • Documentation on consultation with affected employees and contractors on II results Compliance Audits * Audit procedure * Copies of any previous compliance audits (at least the two most recent audits) * Action plans from any previous audits * List of auditors and their areas of relevant expertise for previous audits • Records from tracking compliance audit findings • Triennial certification Employee Participation * Employee Participation Plan • Records of employee participation in the prevention program elements of the CalARP

program Root-Cause Analysis – ISO/RISO Regulated Sources only * Description of root-cause analysis method applied Emergency Response Program * ER plans • Evidence of compliance with T8 CCR 5192 where applicable * Designation of personnel who will respond to an emergency • Training records for these personnel * Designation of personnel who will assist with emergency evacuation • Training records for these personnel • Records documenting communication of ER plan to employees * Description of alarm system • Test and maintenance records for alarm system • Debriefings on any ER plan activations • Debriefings on any ER drills or exercises • Documentation of inspection, testing, and maintenance of emergency equipment • Copy of Consolidated Contingency Plan if applicable

CalARP/ISO/RISO Audit Plan D - 1

APPENDIX D OPENING MEETING AGENDA/REMARKS

I. Introductions II. Assess compliance of programs with CalARP regulations and ISO & confirm accuracy of the RMP

and Safety Plan. A. CalARP Program 4 Regulations

1. Entire stationary source B. Safety Program (ISO)

1. All of the process units C. May identify “non-compliance” findings and develop “non-mandatory” action items. These

will be included in the report and begin with “consider”. CalARP Program regulations requires that we provide the basis for all ensure action items

D. If there is an action item that is resolved before the conclusion of the onsite audit, the action item will still be included in the report, but will be modified to identify it has already been resolved

III. Approach – standard audit using all abridged and New questionnaires A. NEW – All audit questionnaires were modified to incorporate CalARP Program 4

requirements along with ISO B. Conduct operating procedure and P&ID walk-downs C. Review documentation and meet with Key Personnel (To find out how the programs are

designed/supposed to function) 1. Schedule meetings with Key Personnel

D. Verification of documentation 1. Sample records – sample size will depend on number and importance of the records 2. Conduct employee interviews – look for any trends

a. Schedule/ random selection (different shifts, different jobs, various lengths of employment, etc.) – ideally 1-5%

b. If any employees want to talk with us that are not selected, let them know they can schedule time with us

c. Employees interviews are confidential – “no right or wrong answers”; the main purpose is to verify if employees were involved in certain tasks that are required by regulations such as incident investigations, PHA teams; no “trick questions”; we take notes but names are not written down; interviews usually lasts approximately 30 minutes

E. Expected duration of the on-site portion of the audit is 4 weeks. CCHMP may take photographs in the field as part of the facility audit records

F. Weekly debriefings to discuss findings G. Complete questionnaires (same format as RMP/SP completeness review) H. March 29, 2018 is the expected audit completion date and closing meeting I. Administrative Draft “Preliminary Determination” within eight to twelve weeks J. Facility will have fourteen days to review draft for factual inaccuracies K. “Preliminary Determination” issued and facility will have 90 days to submit proposed

remedies and due dates to address any deficiencies L. Begin 45-day public notice period after CCHMP agrees to proposed remedies and due dates M. Schedule public meeting

ATTACHMENT B

Completed Questionnaires

A37 - CalARP Prevention Program: Process Safety Information (Program 4)ID# Category Question Clarifications Findings Answer ActionsType

A37-02 Program 4 CalARP & ISO

Did the PHA, HCA. SPA & DMR team members have access to the compiled PSI while conducting the studies? [T19 CCR §2762.1(a) & ISO Section 450-8.016(a)(1)(A)]

* Review the reports and interview members of the teams to ascertain whether PSI was made available during the studies.

Per interview with a corrosion and materials engineer (CME), the CCD (corrosion control document)/DMR (damage mechanism review) team has access to the compiled PSI during the CCD review. CCHMP attended a CCD meeting that was focused on the flexicoker/coker gas plant. During that meeting, the CCD team had hard copies of equipment files, P&IDs and other PSI related information which facilitated the CCD process.

Per review of several PHAs, there is a list of PSI information in Appendix E. This is a list of PSI information that was available during the PHA, not the actual documents themselves.

Per review of HCA and SPA meeting sign-in sheets, there were PSI SMEs at every meeting. These SMEs provided whatever PSI information was needed for a given topic.

Y NoneAbr

Page 1 of 13Shell Refinery - 2018 CalARP Audit Findings25-Jan-19

ID# Category Question Clarifications Findings Answer ActionsType


Does the information pertaining to the hazards of the regulated substances include reactivity data? [T19 CCR §27621(b)(7)& ISO Section 450-8.016(a)(1)(A)(i)]

1. SDS's must be supplemented with process chemistry information, including runaway reaction and overpressure hazards, if applicable [OSHA 3133, PSM Guidelines for Compliance, 1994] or [29 CFR 1910.119 Appendix C].

Per review of the SDS CHIT internal database, SMR has compiled SDSs for all of the process equipment in the plant. This database is used to locate chemicals that are used in a particular unit. The SDSs reviewed below all contained reactivity, toxicity, physical, thermal and chemical data, and incompatibility hazards.

-- Reformate (catalytic reformer) 3/12/15-- Fluid cat cracker spent catalyst 8/8/16-- Spent SRU catalyst 1/4/99-- Light hydrocracked naphtha 3/19/15-- Iso octane 3/8/16-- DN-3330 catalyst 2/1/16

Per interview with the Industrial Hygienist, many of the SDSs in CHIT meet the Global Harmonization Standard but there are still older MSDSs that do not have this information.

Y NoneAbr


Does the information pertaining to the hazards of the regulated substances include thermal and chemical stability data? [T19 CCR §2762.1(b)(6) & ISO Section 450-8.016(a)(1)(A)(i)]

See A37-06 for information on thermal and chemical stability data.

Y None


Does the information pertaining to the hazards of the regulated substances include the hazardous effects of inadvertent mixing of different materials that could foreseeably occur? [T19 CCR §2762.1(b)(8) & ISO Section 450-8.016(a)(1)(A)(i)]

* Look for written information regarding chemical incompatibility or reactive chemistry.

1. Most SDSs do not list all other chemicals that could be at the stationary source. If documentation is not found, recommend that the owner or operator “consider” developing an “incompatibility or reactive chemical matrix”. [CCHMP Interpretation]

Per interview with the industrial hygienist and review of the CHIT database, SDSs do not contain detailed information on the inadvertent mixing of incompatible materials. SMR uses a PhD chemist to determine chemical incompatibility issues. Per SME, there is no compatibility table or database that is available for people to use.

Y None




Does the information pertaining to the technology of the process include the maximum intended inventory? [T19 CCR §2762.1(c)(3) & ISO Section 450-8.016(a)(1)(A)(iii)]

1. Sources for vessel maximum capacity information could include a placard attached to the tank, documents from the manufacturer of the tank, log sheets, and the business plan.2. Trade association or industry standard may recommend limiting the usable volume of a vessel (e.g., tank not to be filled to more than 85% capacity). [CCC CalARP Program Guidance Document]

Per live navigation of the CHIT Equipment Information database, the maximum intended inventories are recorded for every vessel and reactor used in the process units. This data reflects what is reported as the maximum inventories in CERS.

Y NoneAbr


Does the information pertaining to the technology of the process include safe upper and lower limits for process variables such as temperatures, pressures, flows, levels, and compositions? [T19 CCR §2762.1(c)(4) & ISO Section 450-8.016(a)(1)(A)(iii)]

Process variables from DMRs need to be extracted from reports and incorporated into appropriate locations for employees (e.g., integrity operating window). [CCHMP interpretation] [2762.1(a)(4)]

Per interview with the ESP (ensure safe production) SME, SMR uses ACM (Alarm Configuration Manager) to monitor and input data for process units. The ESP SME sets up and modifies Integrity Operating Windows for different parameters. These include temperature, pressure, conductivity, volume (height or tank level), flow rates, and other parameters. The board operator can go to the UTL (Universal Tag Locator) for the unit which will display the operating parameters and the deviations that approached or breached some of the windows. Per live navigation with SME, there are critical parameters or design operating windows (DOW) that should not be exceeded. If a process goes outside of a DOW, the PEI team would need to determine whether a pressure vessel was fit for service. In order to adjust the critical parameters in the ACM, an MOC has to be approved by a team that would include a CME (corrosion and materials engineer) if the result would increase flow rates and operating parameters which could cause increased degradation to pressure equipment and piping.

Y NoneAbr




Does the information pertaining to the technology of the process include an evaluation of the consequences of deviations, including chemical mixing or reactions that may affect the safety and health of employees or the public? [T19 CCR §2762.1(c)(5) & ISO Section 450-

1. A written evaluation should be made of the potential consequences that may result if the safe operating limits are violated. Typically an evaluation of consequences of deviation from safe operating limits is included in a PHA [OSHA Training Material Reference Manual (Draft)].2. An evaluation of the consequence of deviations for the process may or may not be the same as provided in the operating procedures. The consequence of deviation needs to be available for the PHA and the operating procedures. Sometimes the PHA is done prior to the operating procedures have been written. Since operating procedures are not listed as part of the PSI, this question is different than provided in the Operating Procedure questionnaire, A39-10. [CCHMP Interpretation]

Per review, ESP-003, Variable Limits, section 6.2, Master Alarm Database, provides information on the consequences of deviation, the recommended operator responses, and other operational guidance.

Per review of the CCD reports, the consequences of deviation are addressed as part of the evaluation of the different corrosion loops in each process. The CCD tables include piping, heat exchangers, vessels, pumps, compressors, and specialty equipment that could be damaged by processes that go outside of the DOW.

Per interview with SME, reactive chemistry is evaluated by a PhD chemist. SMR does not have comprehensive compatibility data readily available. Per SME, this is due to the volume of chemicals (about 445) on site.

Per interview with SME and a live navigation of the Master Alarms Database, the UTL page has information on the IOWs, critical limits, and Hi limits, Hi Hi limits, low and low low limits. It also contains information on the actions that should be taken in order to prevent a situation from progressing to the next level. These limits included IOW (integrity operating window), DOW (design operating window), SIF (safety instrumented function), Critical limits, Standard limits, Target limits. -Target limits - limits of the range that business and operating targets may be set within. -Critical limits - value at which operator has a last opportunity to timely diagnose situation and respond-Standard limits - where sustained or recurring short term operating will

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypecause cumulative degradation-IOW - limits required to "control corrosion and equipment degradation"-DOW - final limits for safe operation




Does the information pertaining to the equipment in the process include materials of construction? [T19 CCR §2762.1(d)(1) & ISO Section 450-8.016(a)(1)(A)(iv)]

1. Materials of construction in the process needs to be consistent with the DMR report findings. [CCHMP interpretation]2. Old/used equipment: analysis and/or testing appropriate to the new service with revised documentation of PSI is required [OSHA co-sponsored PSM workshops in Spring, 1993] [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM standard, September 13, 1994].

Per review, the following P&ID drawings had the materials of construction specified (using the document control numbers):

-- #628481 (revised 5/20/15, revision 31) DSU Feed and Reaction section/E-15106.-- #628475 (revised 5/20/15, revision 25) DSU Separation and Compression Section /J-172 - no materials of construction listed-- #639476 (revised 9/12/17, revision 7) C3/C4 Amine Contractor DCU-- #581757 (revised 01/13/11, revision 13) SRU-4 Scot Stripper and Reboiler-- #570700 (revised 3/31/14, revision 12) DHT Feed/Effluent Exchangers

The CCD reports contain information about the material of construction for pressure vessels, piping, and PSVs for each corrosion loop. For example, for the boiler feed water, steam and condensate equipment in the DCU, there is a list called Equipment and Materials that details the materials for the exchangers, the vessels, and the piping for this part of the DCU. CCHMP compared the CCD reports with the material of construction specified on the drawings above and found that the two were consistent.

Per review of documents for process pumps and compressors, each file has data on the materials of construction for the case, seals, gaskets, and other components of the compressor or pump. The pump and compressor data are reviewed regularly to determine the effectiveness of the materials. Per SME, if there is a change in service, the equipment would be monitored closely in case that there was a compatibility or wear issue caused by the new process.

Y NoneAbr




Does the information pertaining to the equipment in the process include:a) Electrical classification; andb) Electrical supply and distribution systems? [T19 CCR §2762.1(d)(3 & 9) & ISO Section 450-8.016(a)(1)(A)(iv)]

1. Electrical classification of equipment applies to equipment in flammable/ combustible service.

Per review, the following drawings provide information on the electrical classifications at SMR:-- DCN D-573901 (revision 6, dated 4/25/12) DCU-- DCN MZR-541100 (revision 14, dated 9/19/16) DSU-- DCN 571091 (revision 5, dated 12/22/09) DHT-- DCN D12-0004 (revision 2, no date) SRU-4

Per interview with the SME for DCU and OPCEN, the electrical supply and distribution system diagrams are current and are available for all electrical systems for these units. The SME provided a drawing called Martinez Electrical System Overview that shows the three sub-stations for SMR and how these sub-stations are connected to different areas of the refineries.

Per SME, the substations are as follows:Substation 1 - 20 MW steam turbineSubstation 2 - 40 MW gas turbineSubstation 3 - 40 MW gas turbineCCHMP did a live navigation of the MRC Electrical Distribution System which displays data for all of the electrical and power systems in the facility. SMR uses a control system to monitor the power coming from PG&E and the power being generated by the facility. Per SME, in order for the facility to run, it must receive 105 MW of power. It cannot run the entire plant using just the substations. This combined power is routed to nine 12kV power stations. The stations rout power to transformers which reduce the voltage in order to make it compatible with the demand of the equipment. CCHMP viewed the power and distribution systems for the SRU-4 and

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsTypethe DCU.

Per review of the AIM system, the Electrical and Mechanical group, which is responsible for monitoring power supply throughout the facility, can access electrical drawings for each piece of equipment in any unit in the facility that draws power.


Does the information pertaining to the equipment in the process include relief system design and design basis? [T19 CCR §2762.1(d)(4) & ISO Section 450-8.016(a)(1)(A)(iv)]

* Review PRV design and design basis as it needs to be consistent with the DMR report findings (e.g. material of construction limits that may impact relief capacity, etc.). [CCHMP interpretation]

1. PSV's are critical safety equipment and information that supports PSV design and specification are critical to maintain - simple data sheets are not enough, calculations or other detailed documents are required [OSHA co-sponsored PSM workshops in Spring, 1993] [OSHA Region VI presentation on PSM in January, 1994].

Per review of the PSV design packages and interview with the PSV SME, the PSVs are based on calculations that come from the project group. These PSV calculations are then submitted to the PSV and flare design SME who certifies that the calculations and thus the selection and sizing of the PRV are valid and appropriate for the process. These PSV design packages are stored in the PEI file room which has controlled access.

CCHMP reviewed the following PSV packages that included the data sheets and the design basis for the valves:-- SV7000/7001 DSU-- SV7007/7008 DSU-- SV15724 DHT-- SV15617 DHT-- SV13905 DHT-- SV13988-1 (valve retired) DHT-- SVE2089 DHT

Y NoneAbr




Does the information pertaining to the equipment in the process include design codes and standards employed, including design conditions and operating limits? [T19 CCR §2760.1(d)(16)(F) & ISO Section 450-8.016(a)(1)(A)(iv)]

Per review of the DEPs (design and engineering practices) which is controlled by Shell global, SMR aggregates all of the design codes and standards in a central database and that database is used whenever a new project or piece of equipment is to be considered for development. The database also houses information on existing equipment within the facility.

Stationary equipment:-- ASME for Boilers and Pressure Vessels-- API for Pressure Vessels, PRVs and other equipment-- ASTM Materials Specifications and Testing Standards-- ASNT Codes, Standards, & Recommended Practices for NDT-- AWS Codes, Standards, & Recommended Practices for welding, brazing, and NDT-- PIP Process Industry Practices-- ASME B31.3 for Process Piping-- EJMA Standards of the Expansion Joint Manufacturers Association

Electrical equipment:-- API RP 686 Recommended Practices for Machinery Installation and Design

Rotating equipment:-- API RP 687 Recommended Practices for Rotor Repairs

Maintenance:-- NACE Codes, Standards, & Recommended Practices for surface preparation (coatings, linings, and cathodic protection specifications)

Per interview with SMEs from PEI, electrical and mechanical, and CMEs, the operating limits are determined during the design phase of a project based on information from industry and

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeOEM recommendations and these would be considered as part of the development of the ESPs for the process.


Does the information pertaining to the equipment in the process include material and energy balances for all processes? [T19 CCR §2762.1(d)(7) & ISO Section 450-8.016(a)(1)(A)(iv)]

1. ISO identifies material and energy balances are required for processes built after the ordinance was effective although P4 is more conservative by identifying this applies to all processes by 10/1/17. [T19 CCR §2762.1(d)(7) & ISO Section 450-8.016(a)(1)(A)(iv)]

Per interview with SME, the materials and energy balances are compiled for all processes and kept by the process/projects group. CCHMP observed a live navigation with the SME of the process modeling tool for the current material and energy balances for DCU and DHT. The tool generates a process flow diagram for the unit that includes vessels, streams, flow rate (lb/hr), constituency of the streams, and direction of flow from vessel to vessel throughout the unit. This tool provides information about the materials and energy balance for each piece of equipment in the units. If a change is made to a particular parameter such as increased flow or change to process chemistry, the process model will be modified

Y NoneAbr




Does the information pertaining to the equipment in the process include safety systems (e.g., interlocks, detection, or suppression systems)? [T19 CCR §2762.1(d)(8) & Section 450-8.016(a)(1)(A)(iv )]

Per interview with SME for ESP, operating parameters are given for each unit. These parameters can be found under UTLs and include operating ranges, critical ranges (high limits, and high highs as well as low and low lows). Along with the critical limits there are instructions about how to address certain alarms along with a timeline. A critical high high alarm would be addressed almost immediately. A critical high alarm would have more time. A low alarm would not be as critical but a low low would get a lot more attention. These alarms could be related to pressure, temperature, flow rate, and other sensitive parameters.

Per interview with SME for rotary equipment, the vibration data for pumps has critical limits that if breeched, would result in a shutdown. Due to occasional excursions caused by operating conditions or erroneous readings, the pumps would not automatically interlock; however, the unit operators are instructed to shutdown pumps if the vibration frequency goes beyond a certain limit.

Per interview with SME, the utilities department (air, nitrogen, water systems, cogen, and other areas) has established safety interlocks as part of an overall process safety team. For operating limits and alarms, the OSE (operations support engineer) would be responsible for monitoring and setting these alarms. Safety interlocks would be reviewed by a larger team consisting of the OSE, process safety group, controls engineering group, as well as others who have expertise in that particular area.

Per interview with SME, the SRU OSE

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypedetermines the operating limits and alarms for the process. The safety interlocks are developed during the design phase by a group of people similar to those used by the utilities group and the safety interlocks operate on a different system than the DCS that the operator uses. The safety interlocks would trigger a shutdown automatically if a particular operating parameter was reached. Not all units have safety shutdown systems.

Per interview with SME, the IPFs (Instrumented Protective Functions) group would determine the reliability required for a particular application and would then select an instrument with a proper SIL level. SIL 2 alarms would be applied to critical systems and functions such as the overspeed of a turbine, a level indicator that could have an atmospheric relief, low levels that could allow vapors to go into another system that may be sensitive to volume or pressure. These sensitive instruments would be incorporated into safety systems in order to improve the reliability of the instrumentation.

Per interview with SME, there are IPF interlocks for each of the process units. CCHMP reviewed IPF 18ES001, SRU4 Claus Thermal Reactor Shutdown, Revision 4, dated 7/18/11 which has a table that lists the transmitter tag number, description of tag, interlock and PIS class, trip value, trip delay (sec), low scale value, high scale value, LRV, URV, fail direction (upscale or downscale). These parameters include process air flow, acid gas flow, acid gas drum level, thermal reactor steam drum level, thermal reactor zone temperatures (zone 1-2), outlet temperature, and others.




Does the submitted RMP and Safety Plan accurately reflect the existing Process Safety Information Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]

1. P4 allows the stationary source up to 24 months to update the RMP, or until September 30, 2019. [T19 CCR §2745.1(a)]

Both the 2014 RMP and the 2016 Safety Plan accurately reflect the PSI program at the Shell Martinez Refinery at the time that they were revised. The Shell Martinez Refinery is aware that the new P4 requirements will require the facility to add information about DMRs in the next RMP.

Y NoneAbr

A37-28 Audit Follow-Up

Have all ensure action items associated with the previous CalARP/ISO audit of the stationary source been addressed within this prevention program questionnaire?

* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.

1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There was one ensure action item from the previous audit and it has been addressed.

Y NoneAbr


A38 - CalARP Prevention Program: Process Hazard Analysis (Program 4)



Did the owner or operator perform an initial process hazard analysis (PHA) for all processes? [T19 CCR §2762.2(a) and ISO Section 450-8.016(d)(2))]

1. Initial PHAs must be performed and documented for covered processes that are subject to P4 within 3 years from the effective date of P4, or by October 1, 2020. [T19 CCR §2762.2(a)] 2. The priority order for conducting PHAs shall be based on the extent of process hazards, number of potentially affected people, the age of the process, and process operating history. [T19 CCR §2762.2(a)]3. PHAs performed or revalidated at least once every five years (since the initial completion date) to comply with CalARP Program 3 requirements are acceptable as initial PHAs for P4. [T19 CCR §2762.2(a)]4. PHAs must cover all modes of operation. [T19 CCR §2762.2(a)]

Per CCHMP interview with the PSM Manager, SMR has been in the process of identifying PHAs that need to be completed as a result of the new P4 regulations. SMR has identified the additional PHAs to be completed and created a schedule with a full compliance date of 2020. See A58-11 for more details on the PHA schedule.

CCHMP reviewed policy I(A)-50. Per the policy, the purpose is to comply with various regulations (including CalARP, EPA, and OSHA). Section 3.0 states that the Process Safety Department maintains a listing of the covered process units as well as the Master PHA schedule. Per CCHMP review, the policy should be updated to reflect CalARP Program 4 regulations. CCHMP has compiled the different areas of the policy that should be updated and provided this to the SME.

Y None




Did the stationary source use one or more of the following methodologies that are appropriate to determine and evaluate the hazards of the process being analyzed: a) What-If b) Checklist c) What-If/Checklist d) Hazard and Operability Study (HAZOP) e) Failure Modes and Effects Analysis (FEMA) f) Fault Tree Analysisg) An appropriate equivalent methodology approved by the department prior to conducting the PHA? [T19 CCR §2762.2(b) & ISO Section 450-8.016(d)(1)]

1. PHAs must cover all modes of operation as specified in §2762.3(a)(1) to include:-

startup-normal operations-Temporary operations as the need arises-Emergency

shutdown-Normal shutdown-startup following a turnaround, a planned or unplanned shutdown, or after an emergency

shutdown. [T19 CCR §2762.2(a)]

CCHMP has reviewed 7 PHAs at SMR. Of the 7 PHAs reviewed only 2 PHAs were completed after the adoption of the P4 regulations. The PHAs reviewed by CCHMP are:

1) Pentane Storage and Loading completed June 2015

2) Sulfur Recovery Unit 4 (SRU 4) completed August 2016

3) Distillate Hydrotreating Unit completed August 2016

4) Delayed Coking Unit completed September 2016

5) Distillate Saturation Unit completed October 2016

6) Catalytic Gasoline Hydrotreating completed October 2017

7) CO Boilers completed December 2017

Per CCHMP review, the methodology used by SMR for the PHAs was HAZOP.

Y NoneAbr




Do the PHA(s) address the following:a) Hazards of the process? [T19 CCR §2762.2(c)(1) & ISO Section 450-8.016(d)(1)]b) Damage Mechanism Review (DMR) reports and Hierarchy of Hazard Control Analysis reports that are applicable to the process units? [T19 CCR §2762.2(c)(3)&(4)]

* Verify the DMR and HCA for that process unit was available to the team performing the PHA. [T19 CCR §2762.5(e)(4)]* Review a representative sample of process-related equipment to determine whether hazards have been identified, evaluated, and controlled (i.e., electrical classifications are consistent with flammability hazards, pressure relief valves are properly designed and discharge to a safe area, pipework is protected from impact) [CalOSHA Consultation, Guidelines for Process Safety Management, Part 1, June 1994].

1. Examples include: (a) failure of equipment to start, (b) operator stops equipment inadvertently, (c) valve mispositioned inadvertently, (d) possible exothermic reactions, (e) pressure relief, venting, or flare capacity inadequate or disabled, and (f) loss of utilities.2. Hazard analysis "by action items only", where the PHA includes only those hazards for which recommendations are made for safety improvements, and hazard analysis "by exception", where the PHA includes only those hazards for which the team felt there were significant consequences (e.g., explosions, toxic releases) are not acceptable. [OSHA Training Material Reference Manual].3. OSHA has not issued a clarification regarding "PHA by Exception"; however, OSHA Region VI issued a citation to Marathon Oil that used the specific phrase "HAZOP by Exception".4. The following question was answered by OSHA in a Beaumont, Texas meeting: In our PHA program, we concentrate on very serious hazards with potentially catastrophic consequences. Other hazards with less serious, non-catastrophic consequences are not included in the study and recommendations are not made as part of the PHA. We have other safety programs that address these hazards. Is this OK? Answer: The key thing is that only

Per CCHMP review all seven PHAs addressed the hazards of the process. Examples of hazards reviewed include failure of equipment, equipment inadvertently placed in the wrong position, and loss of utilities.

The CGH PHA and Utilities CO Boiler PHA were completed after the adoption of the P4 regulations. CCHMP has reviewed these two PHAs and found:

-Per interview with the operators who participated in the PHA, the Corrosion Control Documents (CCD is SMR nomenclature for DMR) were reviewed during the PHA. This was done via the node evaluation. The CCD was available to the team and if during the evaluation of a node the team came across a corrosion issue and needed more information than the CCD could provide, the team communicated with the corrosion engineer to answer their questions and then incorporate this into the PHA. Per CCHMP review of the PHA, this was not well documented and it was not apparent when the team addressed the CCD (DMR) in the PHA.

Per CCHMP interview with the operators who participated in the PHAs HCA(ISS) was not taken into account beyond filling out the ISS checklist. See A58 for a more detailed discussion of this checklist. CCHMP believes that per the program 4 regulations in addition to the HCA checklist PHA teams need to review any applicable HCAs for the unit that resulted from major changes or incidents.

P Ensure that PHAs address HCAs for the unit and that this is documented in the PHA.

Abr


ID# Category Question Clarifications Findings Answer ActionsType"catastrophic" possibilities are covered. Other possibilities still need to be addressed and documented as to why they are not catastrophic.5. Do observations of a representative sample of process-related equipment indicate that obvious hazards have been identified, evaluated, and controlled? (For example, hydrocarbon or toxic gas monitors and alarms are present, pressure relief valves are properly designed and discharge to a safe area) [OSHA Instruction CPL 2-2.45A CH-1 Appendix A].


Do the PHA(s) address:(a) relevant publicly documented incidents in the petroleum refinery and petrochemical industry sector; and (b) the findings of incident investigations relevant to the process. [[T19 CCR §2762.2(c)(2) & (c)(11) & ISO Section 450-8.016(d)(1)]

1. Catastrophic consequence is defined to be consistent with “catastrophic release” which means a major uncontrolled emission, fire, or explosion, involving one or more regulated substances that presents an imminent and substantial endangerment to public health and the environment. [T19

CCR §2735.3(m)]2. OSHA believes that it would be extremely useful if incident investigation report findings and recommendations were reviewed in the subsequent update or revalidation of the process hazard analysis (or hazard review) of the process [29 CFR 1910.119

preamble].

Per CCHMP review of the PHA policy, Procedure I(A)-50 (last revised 12/1/2016). Section 6.2.2, Review of Previous Incidents: "The PHA Facilitator leads the team in a review of the previous process safety incidents provided by the various sources. The discussion should focus on engineering and administrative controls to prevent, or minimize the consequences of, similar refinery incidents."

Per CCHMP review of the PHAs, Section 6.0 of the PHAs includes the previous incidents reviewed. The 7 PHAs that CCHMP reviewed each included a table with the incident summary. The incidents summaries included incidents from SMR, other Shell Refineries, CSB incidents and other related industry incidents. Newer PHAs had better documentation on the source of the incidents but all PHAs had some way to identify the source of the incident.

Y NoneAbr


Do the PHA(s) address the potential consequences of failures of process equipment? [T19 CCR §2762.2(c)(6)]

1. PHA(s) must address the consequences of failure of engineering and administrative controls? [ISO Section 450-8.016(d)(1)]

Per CCHMP review of the 7 PHAs reviewed, each PHA addressed the failures of process equipment. When reviewing the HAZOP worksheets, the causes section details equipment failures accounted for failures such as valve failure, fan failure etc.

Y NoneNew




Do the PHA(s) address facility siting, including the placement of processes, equipment, buildings, employee occupancies and work stations in order to effectively protect employees and the public from process safety hazards? [T19 CCR §2762.2(c)(7) & ISO Section 450-8.016(d)(1)]

1. The CalARP program regulations only require that stationary source siting be reviewed. CCHMP has expanded this requirement to include a siting evaluation for the covered processes. [CCHMP Interpretation]

CCHMP has reviewed 7 PHAs (see above questions for details on PHAs reviewed). Each PHA reviewed discussed facility siting in the external events node and also referenced the overall facility siting report that was completed for SMR.

CCHMP noted that the December 2017 CO Boilers PHA Appendix E included a summary of the Facility Siting Review. This summary included the buildings considered, the threats from the unit to other close occupied buildings, and threats to the Operators shelter. This review resulted in two recommendations. This type of detailed discussion suffices for the new P4 wording regarding facility siting.

CCHMP has reviewed the facility siting study created for SMR (SR.15.01465, completed March 2015). The siting study reviewed the following: building occupancy, explosion risk, the previous study.

Y NoneNew


Do the PHA(s) address human factors? [T19 CCR §2762.2(c)(8) & ISO Section 450-8.016(d)(1)]

1. Such factors may include a review of operator/process, operator/operator and operator/equipment interface, the number of tasks operators must perform and the frequency, the evaluation of extended or unusual work schedules, the clarity and simplicity of control displays, automatic instrumentation versus manual procedures, operator feedback, clarity of signs and codes (etc.) [OSHA Instruction CPL 2-2.45A CH-1: Appendix A PSM Audit Guidelines].2. The Human factors review shall be performed pursuant to T19 CCR §2762.15 which is addressed in the A50 questionnaire.

Each PHA reviewed by CCHMP included a completed latent conditions checklist. See A51 for more details.

Y NoneAbr




Do the PHA(s) include a qualitative evaluation of the types, severity, and likelihood of possible incidents that could result from a failure of a process or of process equipment? [T19 CCR §2762.2(c)(9)]

1. PHA(s) must include a qualitative evaluation of a range of the possible safety and health effects of failure of controls? [ISO Section 450-8.016(d)(1)]

CCHMP has reviewed 7 PHAs, the PHAs range in date from 2015-2017. Each of the PHAs include a risk ranking for each deviation in the PHA. Per CCHMP review, the PHAs did not always document the risk ranking in the same way despite all of them referencing the same risk ranking table.

Per CCHMP interview during the time of the 2015 PHA, PHA teams at SMR were only risk ranking by severity and this dictated when recommendations would be needed.

In 2016 PHA teams were documenting the severity and the consequence and sometimes documented the likelihood

In 2017 PHA teams documented the severity, consequences, and likelihood.

Per CCHMP review, the evaluation did lead to the PHA team producing recommendations for hazards and has improved over time so no action item is warranted.

Y None




Do the PHA(s) address potential effects of external events, including seismic events, if applicable? [T19 CCR §2762.2(c)(10) & ISO Section 450-8.016(d)(2)]Did the seismic assessment conducted conform to Appendix B of the Contra Costa County CalARP Program Guidance Document? [Section D of the CCHMP Safety Program Guidance Document]

* Review written documentation of seismic review and compare against seismic guidelines.* Review external event considered (use of a checklist is acceptable). Documentation by exception is not sufficient.* Verify the facility performs a facility/equipment check after a seismic event to assess for potential damage. 1. External events include nearby pipeline accidents, releases of chemicals, sabotage, seismic activity, transportation accidents, maintenance activities, external flooding/landslides, extreme winds, fire, fog, high/low temperatures, internal flooding. [Section 7.3.4 of CCHMP’s CalARP Guidance Document]2. ISO regulated facilities, external events, including seismic, shall be considered for all covered processes containing a regulated substance, if a public receptor is within the distance to a WCS toxic or flammable endpoint. [ISO Section 450-8.016(d)(2)]

CCHMP has reviewed 7 PHAs, each PHA CCHMP reviewed included a seismic assessment for each unit in the appendix of the PHA.

Per CCHMP review, the seismic assessments conducted for all 7 PHAs conformed to Appendix B of the CCHMP Guidance Document. The methodology consisted of a walk down and focused on those areas that may have been designed with no consideration of seismic loads.

Y NoneAbr


Did the PHA team have experience and knowledge specific to the process being evaluated including at least one current operating employee from the unit? [T19 CCR §2762.2(d) & ISO Section 450-8.016(d)(1)]

1. The operating employee on the PHA team must currently work or provides training in the unit at the time of the PHA, and has experience and knowledge specific to the process being evaluated. [T19 CCR §2762.2(d)]

CCHMP has reviewed 7 PHAs. 5/7 PHAs were completed before the P4 regulations came into effect when the regulations stated: "Did at least one employee on the PHA team have experience and knowledge specific to the process being evaluated". For these 5 PHAs, CCHMP ensured that there was at least one employee on the team with experience and knowledge specific to the process.

Per CCHMP review of the 2 post P4 PHAs, the PHAs did include one team member who was a current operating employee on the unit. CCHMP interviewed both of these employees to ensure that at the time of the PHA they were current operators. At the time of the audit one of the operators was more in a staff role but was not during the PHA.

Y NoneAbr




Was the PHA performed by a team:-with expertise in

engineering and process operations; and-include

consultation with individuals with expertise in damage mechanisms, process chemistry, and control systems as necessary? [T19 CCR §2762.2(d) & ISO Section 450-

8.016(d)(1)]

1. The team with expertise in engineering and process operations should have experience and knowledge specific to the process being evaluated. [T19 CCR §2762.2(d)]

CCHMP has reviewed 7 PHAs. 5/7 PHAs were completed before the P4 regulations came into effect when the regulations stated: "Was the PHA performed by a team with expertise in engineering and process operations"

Per CCHMP review of the 5 PHAs all were performed by a team with expertise in engineering and process operations. Teams consisted of engineers, operations and other subject matter experts as necessary such as corrosion engineers, industrial hygienists, and inspectors.

For the 2 PHAs completed after the adoption of P4, the PHAs did consult individuals with expertise in damage mechanism, process chemistry, and control systems as necessary. For example the 2017 CGH PHA included a flare specialist, rotating equipment engineer, and control systems engineer.

Y NoneAbr


Did at least one member of the PHA team have knowledge in the specific PHA methodology used? [T19 CCR §2762.2(d) & ISO Section 450-8.016(d)(1)]

1. For PHA team leaders, OSHA will look for documentation of formal training - course certificates are acceptable [OSHA co-sponsored PSM workshops in Spring, 1993].2. Non-team leader previous participation in a PHA would not qualify a team leader to lead an initial or update PHA [OSHA co-sponsored PSM workshops in Spring, 1993].3. For PHA team leaders, qualification gained through experience as a team leader is acceptable - OSHA might want to see examples of PHA reports led by a team leader qualified in this manner [OSHA co-sponsored PSM workshops in Spring, 1993].

Per CCHMP review, the PHA facilitators all had many years (10+) experience as a PHA facilitator which includes knowledge of the PHAs methodologies including HAZOP.

Y NoneAbr




Has the owner or operator developed a documented corrective action work process to address findings and recommendations, including:a) Rejection of recommendations;b) Alternative safeguards;c) Written comments by team members on any rejected or changed findings and recommendations; andd) Final decision for each recommendation? [T19 CCR §2762.2(i), §2762.16(e) and ISO Section 450-8.016(d)(4)]

1. The team must provide to the owner or operator findings and recommendations at the earliest opportunity, but no later than 14 calendar days after recommendation and findings are complete. [T19 CCR §2762.16(e)(1)]2. To reject a team recommendation, the owner or operator must demonstrate in

writing that one of the following applies: a) The analysis upon which the recommendation is based contains material

factual errors; b) The recommendation is not relevant to process safety; or c) The

recommendation is infeasible; however, a determination of infeasibility shall not be based solely on cost. [T19 CCR §2762.16(e)(2)]3. To change a team recommendation, the owner or operator must demonstrate in writing that an alternative safeguard would provide an equally or more effective level of protection. [T19 CCR §2762.16(e)(3)]4. Any rejected or changed recommendation must be communicated to onsite team members and made available to offsite team members for comment. [T19 CCR §2762.16(e)(4)]

CCHMP has reviewed a print out of the 7 PHA action items which includes: action, due date, recommendation, and close out comments (if applicable, some items were not due at the time of the audit).

Per CCHMP review of this list CCHMP was able to find an example of a rejected recommendation:

Recommendation 925881, which was a seismic recommendation for the DCU to repair corrosion on sections of base directly supporting 3 pumps. Per CCHMP review this action was rejected as the pumps were mistakenly included in the seismic assessment. The pumps have been out of service for many years and will not be operated.

CCHMP also noted some examples of action items where an interim safeguard was put into place while additional studies were performed.

CCHMP has reviewed 7 closed PHA action items in detail. CCHMP was able to follow 6 of the action items to closure and ensure that the proper actions (e.g. update a P&ID, procedure, call card etc.) were completed.

One action item reviewed by CCHMP (FAM#924544) was found by CCHMP to not be properly closed out. CCHMP notes that the recommendation states : "Consider adding a comment to the procedure DHT4115 to contact the unit PEI engineer/ technician every time there has been a loss of wash water." CCHMP has reviewed this procedure and notes that a similar statement was included in the supplemental notes section. Per CCHMP interview, the assurance team has reviewed this action item and noted that this PHA action closure was not effective.

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsTypeProper notice has been sent to operations to ensure their procedure is current and accurate. See A53-XXX for more details.

Per CCHMP interview, PHA action items are reviewed for effectiveness of close out. 100% is done by the PHA group and a subset of that is re-verified by the assurance group. Per CCHMP interview, closing out of action items should be timed in such a way that the person responsible for the action item closes the item out with time for the assurance team to review and give feedback (ideally 2-3 months ahead of the due date). For the action item that CCHMP reviewed this did not occur. The action was closed by the responsible part on the due date.



A38-20 Program 4 CalARP

Has the owner or operator developed a system to prioritize and promptly complete corrective actions addressing process safety hazards to prevent the potential for a major incident and to document corrective actions implemented for each accepted recommendation including completion date and assignment of responsibility? [T19 CCR §2762.2(h) & §2762.16(e)(7,10) and ISO Section 450-8.016(d)(4)]

* Request all stationary sources to consider using a single system to track and document the resolutions of all recommendations resulting from PHAs, incident investigations, compliance audits, etc.

1. Interim safeguards are to be completed to address process safety hazards with potential major incident pending permanent corrections. [T19 CCR §2762.16(e)(10)] 2. This question is for tracking actions taken.3. Refineries must complete PHA actions within one year as specified by ISO and RISO (see A38-23).4. Turnaround means a planned total or partial shutdown of a petroleum refinery process unit or plant to perform maintenance, overhaul or repair of a process and process equipment, and to inspect, test and replace process materials and equipment. Turnaround does not include unplanned shutdowns that occur due to emergencies or other unexpected maintenance matters in a process unit or plant. Turnaround also does not include routine maintenance, where routine maintenance consists of regular, periodic maintenance on one or more pieces of equipment at a refinery process unit or plant that may require shutdown of such equipment [T19 CCR §2735(www)].5. Corrective actions addressing process safety hazards to prevent the potential for a major incident may not be extended (See clarifications in A38-23).

Per CCHMP review of I(A)-50, "The PHA team shall develop recommendation for all scenarios that have the potential for a major uncontrolled release of hazardous materials, fires, or explosions that present serious danger to the employees in the workplace, or scenarios that have the potential for a release that could have off-site impacts, if it is determined that the existing engineering and administrative controls are inadequate."

The policy also states that recommendations need to be addressed within 1 year or the first regularly schedule turnaround if turnaround is required. Otherwise timing must be justified in writing and submitted to CCHMP for approval.

The policy also states: "PHA recommendation needing resources from Major Project Organization typically may require more than a year to complete. For PHA recommendation

Per CCHMP review of the PHA action items the action items were prioritized and closed out according to the action plan. The action plan included due date and person assigned responsibility.

Y NoneNew




For corrective actions not within the timeline listed in question A28-23, has the owner or operator implemented interim safeguards sufficient to prevent the potential for a major incident, pending permanent corrections, and documented:a) The rationale for deferring the corrective action(s); b) The documentation required under the MOC process; c) A timeline describing when the corrective action(s) will be implemented; and d) An effective plan to make available the rationale and revised timeline to all affected employees and their representatives? [T19 CCR §2762.16(e)(14)]

1.This applies to corrective actions that cannot be implemented in one year that did not require a process shutdown. [T19 CCR §2762.16(e)(11) and ISO Section 450-8.016(d)(4)]

CCHMP has reviewed a list of PHA action items and found an example of an action where an interim safeguard was implemented prior to the completion of the recommendation. This was for FAM#928895 which is scheduled to be completed 8/31/2020. The action items is to add instrumentation to enable independent shutdown of compressors. Per CCHMP review an interim mitigation item that has been completed was to have ESP low level alarms on LV-192.

Per CCHMP interview however there is not a concrete policy to ensure that interim safeguards are implemented when there is a potential for a major incident. Also the current deferral process does not include all the documentation listed in A38-21.

Y NoneNew


Has the stationary source made the PHA report available in the respective work area for review by any person working in that area and established a system to communicate the actions to operating, maintenance, and other employees whose work assignments are in the process and who may be affected by the recommendations or actions? [T19 CCR §2762.2(g) & ISO Section 450-8.016(d)(4)]

* Enquire during employee interviews the location of PHA binders/results.

1. Any person working in that area may include contractors. [CCHMP interpretation]2. PHA availability: Merely placing a copy of the PHA results in a common location is not enough [to satisfy ISO requirements] - must provide "substantial communication" [OSHA Region VI presentations on PSM in January, 1994].

Before the adoption of the P4 regulations the requirement was for the stationary source to establish a system to communicate the actions to operating, maintenance, and other employees whose work assignments are in the process and who may be affected by the recommendations or actions.

Per CCHMP review of the 5 Pre Program 4 PHAs, the PHA action items were reviewed with personnel and generally personnel knew what the PHA was although it was not all personnel.

Per CCHMP review of the 2 Post Program 4 PHAs the PHA reports are available in the work area as well as electronically. The PHA action items are reviewed quarterly via email. The quarterly update includes all units and shows which items are still open etc.

Y NoneAbr



A38-23 ISO Were recommended actions selected for implementation completed within one year after the completion of the PHA if shutdown was not required or during the first regularly scheduled turnaround if shutdown was required? [ISO Section 450-8.016(d)(4) and Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. For corrective actions that do not require shut down, P4 allows for 2.5 years to complete corrective actions from PHA recommendations that are not process safety hazards with potential major incident pending permanent corrections. However, ISO/RISO only allows for one year.2. For corrective actions addressing process safety hazards to prevent the potential for a major incident, timeline may be extended when Stationary Sources can demonstrate in writing to the satisfaction of CCHMP that such a schedule is infeasible.

Per CCHMP review of I(A)-50, "PHA recommendations need to be addressed within one year of PHA report issue date unless the action item requires a turnaround. If a turnaround is required, then the recommendation must be completed during the first regularly scheduled turnaround of the applicable process subsequent to the 1-year completion time frame. If a recommendation requires more than one year and a turnaround is not required, then the timing for completion must be justified in writing and submitted to the Contra Costa County Health Services Department (CCCHSD) for their concurrence and approval."

Per CCHMP review of the action items from the 7 PHAs reviewed. All of the action items are scheduled to be/were completed within 1 year or T/A.

CCHMP has reviewed examples of action items which did not fall into this timeline. See A38-21 for more details.

Y NoneAbr


Has the PHA been updated and revalidated by a PHA team at least every five years after the completion of the initial PHA to assure that the PHA is consistent with the current process including a review of Management of Change documents for the process unit that was completed since the last PHA? [T19 CCR §2762.2(c)(5), §2762.2(j) & ISO Section 450-8.016(d)(2)]

1. At a minimum, PHA revalidations should address the following questions: (a) Does the current PHA reflect all of the changes made since the last PHA? (b) Have any new requirements, either voluntary or non-voluntary, emerged since the last PHA? (c) Did the last PHA contain any omissions? (d) Have there been any incidents since the last PHA in the process unit to be revalidated, or in other process units/areas that affected the process unit to be studied? (e) Were there any new information (i.e. inspection data, operational observations, etc.) that would alter either the frequency or the consequence of the scenario being evaluated?2. The PHA team must meet the requirements of §2762.2.

Per the PHA Procedure (I(A)-50), "The PHA for covered processes shall be updated and revalidated at least once every five years to validate that the process hazard is consistent with the current process."

CCHMP has reviewed a schedule of all PHAs that are completed for SMR and the last revalidation date to ensure that PHAs are kept on a 5 year revalidation cycle. This schedule also indicates that the PHAs are revalidated every five years.

Per CCHMP review of the 7 PHA revalidations each of the revalidations reviewed the MOCs relevant to the process since the last PHA.

Y NoneAbr




Has the owner or operator retained copies of the PHA's and updates and revalidations for each covered process for the life of the process? [T19 CCR §2762.2(k) and ISO Section 450-8.016(d)(3)]

Per CCHMP review of the PHA program, copies of the PHAs are kept for the life of the process. PHAs are kept electronically on a shared network drive that can be accessed by all.

Y NoneAbr


Has the owner or operator retained copies of the documented resolution of the recommendations as appendices to the report for the life of the process? [T19 CCR §2762.2(k), §2762.16(e)(15) & ISO Section 450-8.016(d)(3)]

CCHMP reviewed 7 PHAs. 5/7 PHAs were completed before the P4 regulations came into effect. Based on this, the 5 PHAs were not required to have the recommendations kept as an appendix to the PHA. CCHMP was able to review a print out of the recommendations and documented resolution for the recommendations for all five of the PHAs.

For the 2 PHAs that were completed after the P4 regulations came into effect, CCHMP reviewed the PHA reports and notes that the action items are not due. Shell should create a process moving forward such that the documented resolution of the action items is included as an appendix to the report. If this is not performed before PHA recommendations are considered overdue, it will be an ensure item in future audits.

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the existing Process Hazard Analysis Program at the stationary source? [T19 CCR §2745.2(d), ISO Section 450-8.016 and Section E.5 of the CCHMP Safety Program Guidance Document]


CCHMP has reviewed the 12/5/2016 SMR RMP and 08/2016 SP and notes that it accurately reflects the existing PHA program at Shell with the exception of the description of action item timelines. The section should be amended to discuss how actions that have major incident potential will be resolved.

See A49 for a related action item.

R NoneAbr







There were no ensure action items from the previous audit associated with PHAs. This question does not apply.

N/A NoneAbr


Did the owner or operator provide effective training to employees and employee representatives before serving on a PHA team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions. [T19 CCR §2762.4(e)]

Per CCHMP review of 7 PHAs, each PHA included a record of training for the PHA team including employees. The PHA training included training on ISS, LCC, and PHA.

Y NoneNew




Did the PHA team document all findings and recommendations in a report and did the report

include:a) The method, analysis, and factors considered by the PHA team; b) The findings of the PHA

team; c) The PHA team’s recommendations? [T19 CCR

§2762.2(g)&(h)]

CCHMP has reviewed 7 PHAs. Each of the 7 PHAs follows the same format:

1) Management Summary

2) Introduction

3) PHA Methodology

4) Assumptions

5) PHA Results

6) Worksheets and P&IDs

7) Appendices

-Human Factors LCC-PHA Team Member Qualifications and Session Information-Seismic Evaluation Report-ISS Checklist-PSI

CCHMP has reviewed each of these sections and notes that recommendations fall under the PHA results tab. The table of recommendations contains recommendations from the PHA, LCC,ISS, and Seismic evaluations.

The method is described in the body of the report, analysis and factors considered by the team are included in the general assumptions and the PHA worksheets.

The PHA worksheets also include the full findings of the PHA team.

Y NoneNew


Did affected operating and maintenance employees and employee representatives effectively participate, throughout all phases, in performing PHAs? [T19 CCR §2762.10(a)(1) & ISO Section 450-8.016(a)(3)]

1. The intent of "consult" is to exchange information, solicit input and participation from the employees and their representatives. It requires more than simply informing employees [OSHA Instruction CPL 2-2.45A CH-1 Appendix B, September

1994].

This question only applies to the 2 PHAs from 2017. Per CCHMP review, operating employees did effectively participate in the following phases of the PHA: participation in the pre PHA activities (training and LCC), participation in the PHA (completion of nodes, additional checklists, and siting study) and the recommendation review.

Y NoneNew


A39 - CalARP Prevention Program: Operating Procedures (Program 4)ID# Category Question Clarifications Findings Answer ActionsType


Are the written operating procedures consistent with the process safety information for the process? [T19 CCR §2762.3(a) & ISO Section 450-8.016(a)(2)(A)]

* Compare operating procedures to P&IDs, equipment data sheets, consequence of deviation, operating limits, etc.

Per interview with SME, the refinery has approximately 2400 operating procedures. CCHMP reviewed Procedure A(A)-32: "Controlling (Reviewing/Revising) Operating Procedures", rev.13, dated November 2016. The purpose of this procedure is to establish the requirements for controlling, reviewing and revising operating procedures (including Work Instructions) in accordance with MOC requirements. The scope includes conducting a proper review process including functional, technical and compliance (use of Latent conditions checklist) and conducting preliminary and final approval.

CCHMP reviewed about 25 operating procedures and found them easy to follow. The procedures reviewed were from the following process units:- Delayed Coking Unit (DCU)- Distillate Hydrotreater (DHT)- Distillates Saturates Unit (DSU)- Logistics - Tank Farm (Tank)- Sulfur Recovery Unit (SRU4)

Below are some of the operating procedures that were reviewed by CCHMP during the audit:- DCU 1130, Charge Heater F-13425 Cold Startup, revised 8/29/2018- DCU-6040, Open Delta Valve, reviewed 4/27/2015- DCU-3146, Coke Drum 1 Switching into Bypass, reviewed 2/1/2018- DCU-4100, Electrical Power failure, 2/23/2016- ISOM 3195, Hydrogen "A" Drier V-12547 Regeneration, reviewed 9/1/2017- DCU-3130, Switching Coke Drum 1 Into Coke Drum 2, 2/1/2018

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsType- SR4_3280, Sulfur Seal Pots Rodding, reviewed 7/13/2017- SR4-3501, V-14568 Ammonium Polysulfide Storage Truck Unloading, reviewed 12/22/2015- SR4-1100, SR4 Startup (Following Turnaround), reviewed 4/4/2017- SR4-2101, SR4 SWS6 Shutdown, 12/15/2016- SR$-3410, V-14618 and V-14621 Clause Converters #1 and #2 Hot Soak, 2/5/2018

- LPG-6001, Pentane/Amylene Tank Car Loading & Unloading System, reviewed 11/20/2014- Tank-4130, Pentane Spheres Water Deluge and Injection, 6/26/2017- Tank-3290, V-1533 Ethyl Mercaptan Inventorying, 2/16/2018

- DSU-3241, F-30 DSU Furnace Hot Re-Light, reviewed 1/30/2017- DSU-3240, F-30 Heater Operation, reviewed 6/5/2017- DSU-1100, Startup (Following Turnaround), reviewed 9/20/2017- DSU- 3250, J-171 or J-172 Recycle/Vent Gas Compressor Startup, 10/18/2016

- DHT-4115, Loss of Wash Water, reviewed 10/17/2017- DHT-1100, DHT Startup with Pre-Sulfiding, reviewed 9/12/2017- DHT-1110, DHT Startup with Pre-Sulfiding, reviewed 9/12/2017- DHT-3115, Place Gas Oil Filter V-17409 On-Line, 8/3/2017

CCHMP reviewed the Procedure DSU-3240: F30 Heater Operation, revised 6/5/2017 with P&ID 5846, Sheet 3-4 of 13, No. 626847 dated 3/3/16 and confirmed step 3.4 of the procedure “Verify FV-277 and FV-301 are blocked in with the control valve closed in manual” was reflected correctly on the


ID# Category Question Clarifications Findings Answer ActionsTypeP&ID.


Do the procedures address startup operations, including startup following a turnaround or a planned or unplanned shutdown? [T19 CCR §2762.3(a)(1)(A & F) & ISO Section 450-8.016(a)(2)(A)(i)]

Examples include: (a) preparation of utilities, process lines, and instruments (b) equipment preparation and testing (c) inerting/purging of equipment [OSHA Training Material Reference Manual].

The procedures address startup operations, including startup following a turnaround or a planned or unplanned shutdown. The procedures reviewed and referenced in A39-02 include three startup procedures following a turnaround and additional examples include equipment preparation and testing provided below:- SR4-1116, V-14690 Vent Gas Ammonia Scrubber Startup- SR4-1102, SCOT4 - Startup- DSU-1102, Catalyst Dryout- DSU-1132, Emergency Depressuring Valve Checklist

Y NoneAbr


Do the procedures address temporary operations? [T19 CCR §2762.3(a)(1)(C) & ISO Section 450-8.016(a)(2)(A)(i)]

1. Examples may include special conditions where safeguards may be bypassed, loading/unloading of catalyst into/out of a reactor, sampling, and equipment bypassing [OSHA Training Material Reference Manual].

The procedures address temporary operations. Examples include the following:- LPG-6001, Pentane/Amylene Tank Car Loading & Unloading System- SR4-6007, New Sulfur Truck Driver Loading Instructions- SR4-3263, F-14660 Thermal Oxidizer Light Off

Y NoneAbr


Do the procedures address emergency shutdown, including conditions under which emergency shutdown is required, provisions granting the authority of the qualified operator to shut down the operation or process, and the assignment of shutdown responsibility to qualified operators to ensure that emergency shutdown is executed in a safe and timely manner? [T19 CCR §2762.3(a)(1)(D) & ISO Section 450-8.016(a)(2)(A)(i)]

1. Examples may include conditions requiring emergency shutdown, and operating procedures or steps to take to control or mitigate an emergency condition [OSHA Training Material Reference Manual].

The procedures address emergency shutdown, including conditions under which emergency shutdown is required. Examples include the following:- DCU-4182, Emergency Shutdown of Active Drum. 12/12/2016- DHT-4000, Electrical Power Failure, 10/16/2017- DSU-2101, Short Unit Shutdown Following Emergency or Planned, 1/1/2016

Y NoneAbr




Do the procedures address emergency operations for each process, including any response to the over-pressurizing or overheating of equipment or piping, and the handling of leaks, spills, releases and discharges? [T19 CCR §2762.3(b) & ISO Section 450-8.016(a)(2)(A)(i)]

* Verify procedures exist to address complete and partial loss of power to the site/unit.

1. P4 states: “These procedures shall be consistent with the procedures developed as required by subsection (a)(1)(D) [emergency shutdown] and shall provide that only qualified operators may initiate these operations and that prior to allowing employees in the vicinity of a leak, release or discharge, the owner or operator shall at a minimum do one of the following: (a) Shutdown and depressurize all process operations where a leak, release or discharge is occurring; or (b) Isolate any vessel, piping, and equipment where a leak, spill or discharge is occurring; or (c) Follow established criteria for handling leaks, spills, or discharges that are designed to provide a level of protection that is functionally equivalent to, or safer than, shutting down or isolating the process.” [T19 CCR §2762.3(b)(1)(3)]2. Examples include procedures for loss of a utility such as process air, instrument air, cooling water, steam, nitrogen, power, etc.

The procedures address emergency operations for each process, including any response to the over-pressurizing or overheating of equipment or piping, and the handling of leaks, spills, releases and discharges:- DHT-4115, Loss of Wash Water, reviewed 10/17/2017- DCU-4100, Electrical Power failure, 2/23/2016- Tank-4130, Pentane Spheres Water Deluge and Injection, 6/26/2017

CCHMP reviewed the above limited number of emergency procedures with P4 requirements and noted that no changes appeared to be required.

Y NoneAbr


Do the procedures address startup after an emergency shutdown or partial shutdown? [T19 CCR §2762.3(a)(1)(F) & ISO Section 450-8.016(a)(2)(A)(i)]

1. Examples may include identifying the allowable process conditions for which emergency startup is permissible [OSHA Training Material Reference Manual].

The procedures address startup after an emergency shutdown or partial shutdown. Examples include the following:- DSU-1900, Startup following Unplanned Shutdown, 5/2/2017- DCU-1102, DCU State of Stability Check after an Unplanned Shutdown, 2/13/2017- SR4-1900, Startup following Unplanned Shutdown, 5/2/2017

Y NoneAbr




Do the procedures address consequences of deviations and steps required to correct or avoid deviating set operating limits? [T19 CCR §2762.3(a)(2) and §2762.1(c)(5) & ISO Sections 450-8.016(a)(2)(A)(i) and 450-8.016(a)(1)(A)(iii)]

1. The consequences of deviating beyond the parameter ranges should be consistent with the results of the process hazard analysis [OSHA Training Material Reference Manual].

The operating procedures include cautionary statements that highlight precautions for the operator, identify how operating conditions could change, and provide instructions for how to avoid potential incidents. The refinery also includes some Consequence Of Deviation (COD) information as part of the Ensure Safe Production (ESP) variable tables. CCHMP viewed select ESP variable tables for the DCU and SRU4 that contained alarm limits and consequence information.

Y NoneAbr


Do the operating procedures include safety and health consideration such as precautions necessary to prevent exposure, including engineering controls, administrative controls, and personal protective equipment? [T19 CCR §2762.3(a)(3)(B) & ISO Section 450-8.016(a)(2)(B)]

* Review training records to ensure that employees have been trained in proper use of PPE. 1. Engineering controls include passive and active safeguards and administrative controls include procedural safeguards.2. SDS may be referred to or attached to satisfy the personal protective equipment portion of this requirement. If SDS are referenced in the operating procedures, the document containing the SDS will be required to be annually certified to be current and accurate per §2760.3(d). [CCHMP Interpretation]

Each operating procedure includes on the first page a section on HSE Precautions and a section on Personal Protective Equipment. The HSE Precautions section references SDS on title page and also references a H&S Consideration or Hazard document for each unit. SDSs are maintained current on a database that is maintained by the industrial hygienist for the refinery and is available on the facility server. CCHMP reviewed the H&S Considerations documents for SR-4, DHT and DSU and each provided a summary of the hazards of the chemicals involved and possible controls for them at the unit and how to access the SDSs on personal computers at the unit control center.

The Personal Protective Equipment section of each procedure addresses the PPE required for the procedure and any unique situations that may require additional precautions.

Y NoneAbr




Do the operating procedures include safety systems and their functions? [T19 CCR §2762.3(a)(4) & ISO Section 450-8.016(a)(2)(C)]

The procedures reference safety systems and their functions in the Safety systems documents and hazard documents. CCHMP reviewed an example Safety Systems document for OPCEN North Hydrogen Plant #2 that described the various safety systems and their functions. The information included seven Protective Instrument Systems, flow overrides, 39 PSVs, 3 depressure valves, and an evacuation siren. This type of document is used for operator turnover and refresher training and is kept in a reference file to be accessed and used as needed.

Y NoneAbr


Are the operating procedures readily accessible to any person who works in or near the process area or any person who maintains a process? [T19 CCR §27602762.3(b & c) & ISO Section 450-8.016(a)(2)(D)]

1. A copy of the operating procedures must be readily accessible to employees who work in or near the process area, to personnel maintaining the process, and to any other person who works in or near the process area. [T19 CCR §2762.3(c)]

The operating procedures are readily accessible to any person who works in or near the process area or any person who maintains a process. These are kept on line and operations staff have access to them. See A53-12 for additional reference to hard copy emergency procedures maintained in a red binder at each of the production departments.

Y NoneNew




Did/does the owner or operator annually certify that the operating procedures are current and accurate? [T19 CCR §2762.3(d) & ISO Section 450-8.016(a)(2)(E)]

1. Sources are also to ensure that procedures are reviewed as often as necessary to assure that they reflect current safe operating practice (including changes that result in changes in process chemicals, technology, personnel, process equipment, or other changes to the stationary source. [T19 CCR §2762.3(d) & ISO Section 450-8.016(A)(2)(E)].

Production Department Mentors are responsible to certify annually that the operating procedures are current and accurate. Training Document administrator maintains these documents. There is one certification form for each department that is signed off every year. CCHMP reviewed three representative samples of this type of certification and noted that the certification identified the process units involved, operating procedures (Table of Contents of the Department procedures) reviewed, and the name and signature of the production department mentor, and date of the review. The review included separate certification statements for the Safety Systems Documents and Hazard Documents (Chemical Hazards, Safety and Health Consideration Documents) that were also signed and dated by the production department mentor.

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the Operating Procedures Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The submitted RMP dated December 2016 (pages 44-45) and Safety Plan dated August 2016 (pages 15-16) accurately reflect the Operating Procedures Program at the stationary source.

Y NoneAbr



* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due. 1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There were no ensure action items associated with the previous CalARP/ISO audit to be addressed here. This question is not applicable.

N/A NoneAbr


A40 - CalARP Prevention Program: Training (Program 4)



Has the owner or operator ensured that each employee presently operating a process, and each operating employee newly assigned to a process have been trained in an overview of the process and in the operating procedures provided in Section 2762.3? [T19 CCR §2762.4(a)(1) & ISO Section 450-8.016(a)(4)(A)]

* Review the source of training (e.g., equipment vendor) and training requirements (e.g., state regulatory requirement, industry-specific standard), content of training, training style (e.g., classroom, computer-based, OJT) to ensure that it is commensurate with the training content, and the means used to verify competency.

1. P4 and ISO identify the training shall include material on the specific safety and health hazards applicable to the employee’s job tasks, procedures, including emergency operations and shutdown, and safe work practices applicable to the employee's job tasks [T19 CCR §2762.4(a)(1) & ISO Section 450-8.016(a)(4)(A)].2. On-the-job training (OJT) is acceptable, as long as the OJT program is documented [OSHA Region VI presentation on PSM in January 1994].

CCHMP reviewed a number policies related to operator training:-- Operations Training Policy, C(A)-40 (revised January 2017, rev 2)-- Identify and Develop Operation Training policy, C(A)-41 (revised January 2017, rev 2) -- Operator New-Hire Training (Phase 1) policy, C(A)-42 (revised January 2017, rev 2) -- Operator Job Specific Training and Qualification policy, C(A)-43 (revised September 2015, rev 3)-- Operator Refresher Training policy, C(A)-44 (revised January 2017, rev 3)-- Operator Advanced Training (Phase 3) policy, C(A)-45 (revised January 2017, rev 2)-- Subject Matter Experts for Operator Training policy, C(A)-46 (revised January 2017, rev 2). Policy C(A)-42 describes the basic training provided to new hires. This policy describes the various layers of training provided, including:-- HSE topics-- PSM -- Facility Overview-- Equipment Fundamentals-- Equipment Tasks-- Process Fundamentals-- Simulator Training-- Process Operator Duties-- Basic Computer and Interpersonal Skills

Policy C(A)-43 describes the training provided to new operators once their basic training is completed and they are assigned to a process unit. During this phase a Job Training Plan (JTP) is developed for each person. The JTP

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeoutlines the steps and assignments that need to be completed for the new employee to be qualified to work their first position. This includes training from subject matter experts, job-specific training, on the job training (termed "parallel training"), reading and following operating procedures, and eventually passing a written final exam, oral exam, and demonstrations to confirm they have sufficient knowledge and expertise to be a qualified operator. Once qualified, the new operator must remain in their first role for 4 months.

CCHMP was informed there are two phases of new hire training. The first phase is all classroom training described in C(A)-42 and takes approximately 8 weeks. The second phase of the new hire training described in C(A)-43 takes approximately 2-3 months.

Per interviews, once new hires are assigned to a unit, they work with that Department's Mentor to go through their Job Qualification Plan (JQP). Mentors walk the new hires through each step of the training process and are there to monitor their progress and help direct them best on how to learn the correct concepts. Most of the actual new hire training in an operating unit comes from Content Trainers. These are operators who have demonstrated a desire and talent to train others and direct new hires on various aspects of their JQP.

CCHMP reviewed initial operator qualification documentation for 7 operators associated with 5 field jobs and 2 board jobs within the Delayed Coking, Utilities and OPCEN departments. The facility maintains paper copies of each qualification record for each job. Each of the packets contained information used by the facility to verify that the trainee has met the minimum qualifications


ID# Category Question Clarifications Findings Answer ActionsTypeexpected for the position. This information included verification of course-specific instructions on the process (e.g., process overview and its hazards), Parallel Training checklist, final exam, Op Spec evaluation, hand-drawn process flow diagram . Included within each packet is a list of procedures associated with each role. The new operator is tested on three aspects of the operating procedures: -- Awareness Level - demonstration they know how to find ARMS (Administrative Requirements and Management Systems manuals), FRMS (Field Requirements Manuals) and Environmental policy manuals and explain their purpose - also understand the types of operating procedures and their purpose-- Knowledge Level - able to verbally describe their understanding of specific operating procedures-- Skill Level - demonstrate/simulate the operating procedures in the field.

In reviewing documentation associated with the 7 initial job qualifications packages, the number of operating procedures in the Skill Level verification ranged from 13-58 depending on the role.




Has refresher and supplemental training been provided at least every three years, and more often if necessary, to each employee operating a process to ensure that the employee understands and adheres to the current operating procedures of the process? [T19 CCR §2762.4(b)(1) & ISO Section 450-8.016(a)(4)(B)]

* Review documentation maintained at the stationary source to verify that refresher and supplemental training was conducted at least every three years. Documentation must be maintained by the stationary source to ensure compliance with this requirement. [CCHMP interpretation]

CCHMP reviewed the Operator Refresher Training policy, C(A)-44. This policy identified that operators need to receive refresher training for each job they are qualified for every 36 months. The policy also requires each operator "work a minimum of 5 shifts per year, as the primary operator for each job on which they are qualified, to maintain qualification for those jobs." As part of the refresher training, the policy identifies that refresher training includes a review of each module of the original job qualification training and the operating procedures associated with that job.

Per operator interviews, operators in select processing departments (e.g., OPCEN) routinely rotate between all of their qualified positions so they work far more than 5 shifts per year for each position. Other departments do not rotate positions as often so they have to monitor the roles they work to ensure they work each job 5 shifts. Per interviews, Mentors review information provided annually by the Learning and Developing (L&D) Department and provide input to the schedule assignments so every operator gets scheduled to work their 5 shifts. Mentors are also assigned to assist with refresher training by reviewing the 3-year refresher training package with each operator for each of their qualified roles.

CCHMP reviewed refresher training packages for 6 operators for them to remain qualified for specific jobs in the DCU, OPCEN and Utilities. The packages included copies of final exam, Op Spec Evaluation, and a Refresher Training Documentation Task List. The Refresher Training Documentation Task List identifies specific tasks that relate to operating procedures. Mentors and L&D management jointly developed the Task

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeList to represent the dominant activities for each position. For example, "describe how to transfer condensate from Tank 1364 to Tank 1355", "simulate how to place E-780 in service on flow control", "demonstrate how to start MP or LP BFW pump", "simulate the steps you must take if the air Sparger in the Oxidizer Column is plugged". The Refresher Training Documentation Task List also identifies specific operating procedures that the operator is to demonstrate or simulate, including starting up or shutting down equipment, placing equipment into circulation, lighting a furnace after a trip, rodding/unplugging sulfur seals/condensers, placing reboiler or heat exchangers in service, etc.




Does the owner or operator, after the initial or refresher training, prepare a certification record containing the identity of the employee, the date(s) of training, the means used to verify that the employee understood the training, and the signature(s) of the person administering the training? [T19 CCR §2762.4(c) & ISO Section 450-8.016(a)(4)(C)]

* Review documentation maintained at the stationary source to verify certification records are maintained.

1. An auditable training records system will include at a minimum: the name or description of any formal training undertaken by the employee; the date and duration of any formal training; the results of related tests and certification attained; the expiration date of any related certificate, license, etc.; and a copy of external certificates, licenses, etc. awarded [Plant Guidelines for Technical Management of Chemical Process Safety, CCPS].2. Federal OSHA includes the following as acceptable "means of understanding": written tests, oral exams, practical demonstrations, exercises/drills, or simulators as long as they are adequately documented [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994].

Per review of the initial and refresher training documentation listed in A40-01 and A40-03, CCHMP confirmed that the site satisfied this requirement.

For initial training, there is a final sign-off on the Op Spec Evaluation sheet, which is the final phase of the initial training, that states the following: "On the above date the above named Trainee successfully completed the Final Evaluation and is now certified to operate the [XXX] position." The documentation includes the dates of the training, name of the trainee, signature and title of the personnel giving the training, and copies of tests used to verify understanding. Dates of this certification for the documentation reviewed were from 4/2015 through 8/2017, i.e., all prior to the effective date of the Program 4 regulations which added the "certification record" requirement.

The refresher training records reviewed listed in A40-03 ranged in dates from 3/2016 through 2/2018. The refresher training documentation concluded with a document called, Operator Refresher Certification Completion Record, that included the trainee name, date, authorizing individual signature and whether they passed (i.e., written exam score). Copies of written exams were maintained.

Y NoneAbr




Has the owner or operator trained each employee involved in maintaining the on-going integrity of process equipment in an overview of that process and its hazards? [T19 CCR §2762.4(a)(2) & ISO Section 450-8.016(a)(5)(C)]

1. Examples of training in "the hazards of the process" may be informing personnel about process temperatures and pressures, hot surfaces, pinch points, chemical used, areas with unique hazards, relevant ongoing process concerns or issues being addressed, and proper entrance and egress routes. 2. The same qualification criteria required for process operators under the training element of the PSM standard will apply to maintenance technicians, including the "grandfather" clause [OSHA Region VI presentation on PSM in January 1994].3. OSHA identified that without continual attention to training needs due to process changes and other changes, little assurance will exist that maintenance employees will perform their tasks safely [federal OSHA PSM Preamble].

CCHMP was informed that all maintenance employees new to the Shell site are required to attend a portion of the phase 1 training for new hires described in A40-01. During this training, all new maintenance employees receive PSM training and the Facility Overview training. CCHMP reviewed the Facility Overview training presentation and confirmed that it included a discussion of each process within the refinery. CCHMP was informed that all maintenance personnel are also provided a refinery process overview that includes the following discussion on each process: type of process, feeds/inputs, temperatures, pressures, products/outputs, major components, safety hazards, and simplified flow diagrams. CCHMP confirmed these presentations include overviews of the processes and their hazards.

CCHMP reviewed Job Competency Profiles for four crafts (Electrician, Pipefitter, Instrument and Machinist) and confirmed that the refinery process overview training was required. CCHMP reviewed training for five maintenance employees in these crafts and confirmed this training course was completed.

Y NoneAbr




Has the owner or operator trained each employee involved in maintaining the on-going integrity of process equipment in the procedures applicable to the employee's job tasks to assure that the employee can perform the job tasks in a safe manner? [T19 CCR §2762.4(a)(2) & ISO Section 450-8.016(a)(5)(C)]

* Review employee’s (i.e., those employees doing nondestructive tests, welding on pressure vessels, etc.) training records for certifications, content of training, means to verify competency, etc. [OSHA 3133, PSM Guidelines for Compliance, 1994].

1. CCHMP expects that the facility has a process that assures maintenance employees understand and adhere to the facility's written maintenance procedures applicable to their job tasks [CCHMP interpretation].

CCHMP was informed that the facility primarily hires journey-level maintenance employees that are already experienced in their craft. Exceptions to this of late has been the hiring of personnel in the Instrumentation and Machinist crafts. For these crafts, since it has been difficult finding journey-level expertise, the facility developed a training process that requires non journey-level new hires to work with existing personnel until deemed ready to work on their own. For Machinists, new non journey-level employees must shadow existing Machinists in the shop for 800 hours prior to being released to work on their own. For Instrumentation, new non journey-level employees are required to shadow existing Instrument personnel for 6 months spending approximately 4 hours in the shop and 4-8 hours in the plants each day prior to being released to work on their own.

For all crafts, the new person is on probation for 9 months. Most maintenance crafts, essentially all but electrical and instrumentation, perform their day-to-day work in pairs. A new hire is paired with an experienced maintenance craftsperson for work during the day or during call-outs for the first 9 months. This probation period is used to make sure the new hires actually do know their craft as well as to make sure they understand how to navigate the Shell system, including obtaining work orders, obtaining proper permits, properly closing out a job, and documenting the work performed.

All maintenance employees, newly hired and existing are required to be trained to their job competencies assigned for that craft. Shell has developed Job Competency Profiles for every craft. CCHMP reviewed Job Competency

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeProfiles for the following crafts: Electrician, Pipefitter, Instrument and Machinist. Training topics required included general items like: confined space, permit to work, scaffolding, fall protection, hand protection, eye protection, inert gas handling, electrical safe work practices, simple lifting/rigging/slinging, tube fitting, fire extinguisher, pressure relief valves.

CCHMP reviewed training required for select personnel and found specific training for each craft. For example, training provided to specific electricians included: controlling static electricity, process isolation, LOTO, bucket truck, electrical drives and motor control centers, electrostatic precipitators, motor operated valves, plant electrical equipment, back-up power systems, forklift, JLG.


Does the submitted RMP and Safety Plan accurately reflect the existing Training Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


Sections 5.3 and 6.0 of the facility's 2016 Safety Plan accurately describe the existing Training Program.

Section 4.4.4 of the facility's RMP revised in 2016 describe the existing CalARP Program 3 Training Program. This will need to be revised to include discussion on the training associated with the human factors program to comply with Program 4 requirements. According to Program 4 requirements, the facility has until 9/30/19 to update the RMP although the facility's next five year RMP update is due to CCHMP by 6/20/19. This is further described in A49-27.

Y NoneAbr







There were no ensure action items associated with CCHMP's previous audit of this regulatory topic. Therefore, this question is not applicable.

N/A NoneAbr




Has the owner or operator provided refresher and supplemental training at least every three years, and more often if necessary, to each maintenance employee to ensure that the employee understands and adheres to the current maintenance procedures? [T19 CCR §2762.4(b)(2)]

* Review maintenance personnel refresher training on maintenance procedures.

CCHMP was informed that while Shell Refinery has a number of maintenance work instructions, policies, guidelines, and safe work practices, the site only has one official maintenance procedure. The facility requires that annual training be performed for the following maintenance crafts for this one maintenance procedure, Rodout Device GMP-28: analyzers, instrumentation, pipefitters, compressor crew (outside machinists), welders, outside operators. The facility also requires annual refresher training related to lockout / tagout and isolation practices. Training on the maintenance procedure and these policies is computer based. Annual face-to-face training is required on life critical policies, which are: Process Isolation, Working at Height, Permit to Work, Safe Distance, Confined Space and Electrical Lockout. CCHMP confirmed that the facility performs two face-to-face trainings each year so all topics are looked at every three years (e.g., 2017 training was on Electrical Lockout and Confined Space, 2018 will be Process Isolation and Working at Heights. Various crafts also need refresher training on other types of activities. For example:-- Electricians need refresher training on bucket trucks, CPR and AED-- Welders need refresher training on their welds-- Crane operators have to maintain their certification through NCCCO (National Commission for the Certification of Crane Operators).

CCHMP reviewed documentation of training on the one maintenance procedure, Rodout Device GMP-28. The facility maintains copies of face-to-face Sign In Sheet/Training Roster forms for the initial training, dated 2/11/16 through 1/25/18. CCHMP also reviewed refresher training for this procedure, managed

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsTypethrough SOU, and found good compliance with refresher training being on time.


Has the owner or operator developed and implemented an effective written training program that includes: a) The requirements that an employee must meet in order to be designated as qualified; and b) Employee testing procedures to verify understanding and to ensure competency in job skill levels and work practices that protect employee and public safety and health? [T19 CCR §2762.4(d)]

* Review owner or operator training policy. Operator initial and refresher training is adequately covered within the following policies: C(A)-40, C(A)-41, C(A)-42, C(A)-43, C(A)-44 and C(A)-45. See A40-01 for a description of these policies. The collection of these policies define the requirements and expectations listed in the question. See the findings for A40-01 and A40-03 that summarize what was reviewed associated with implementation of these policies.

CCHMP reviewed the facility's Maintenance Training Policy, D(A)-1 (revised June 2016, rev 3). This policy identified that once an individual completes training and/or meets performance standards he/she will be deemed "certified". This policy is very similar to the Operations Training Policy, C(A)-40, in that it provides a high level overview only. For example, the policy identifies the following would be performed: Training Needs Analysis, Training Plan, phases of training (Phases 1-4), Training Delivery, Assess Training Effectiveness. In reviewing the information listed in the maintenance policy, CCHMP was unable to locate additional details on the training content. Specifically, was unable to locate additional details for: "maintenance role fundamentals" [Phase 1 training]; "job role and equipment specific task and procedures training" [Phase 2 training]; how training effectiveness is assessed (e.g., minimum test scores).

P Ensure that the written maintenance training policy, or other policies, are modified to include additional details on: "maintenance role fundamentals" (i.e., Phase 1 training); "job role and equipment specific task and procedures training" (i.e., Phase 2 training); how training effectiveness is assessed (e.g., minimum test scores).

New




Has the owner or operator developed and implemented an effective training program to ensure that all affected employees are aware of and understand all Program 4 elements described in this Article? [T19 CCR §2762.4(e)]

1. P4 identifies for the owner or operator to complete the initial training required in this questionnaire before 10/1/2019. [T19 CCR §2762.4(e)]2. P4 identifies that employees and employee representatives participating in a specialized team shall be trained in the Program elements relevant to that team. [T19 CCR §2762.4(e)] 3. “Affected employees” includes more than just operators and maintenance employees.

CCHMP was informed that new hire (both maintenance and operator) training classes include a session on the PSM program. This training has been performed for a number of years. CCHMP reviewed the training documentation for new hires and found it covered a number of PSM topics although not specifically all of the Program 4 additions, including: damage mechanisms, safeguard protection analysis, human factors, CalARP management systems, management of organizational change, process safety culture assessment. New hires are also trained on Shell's HEMP (Hazards and Effects Management Process) and barrier thinking concepts which has similarity to safeguard protection analysis. New hires are also trained on corrosion control documents, which is Shell's terminology for damage mechanism. They are separately trained on human factors as well. After reviewing other training provided to new hires, CCHMP was unable to verify they are trained on management of organizational change or process safety culture assessment.

The new Program 4 requirements require that "all affected employees are aware of and understand all Program 4 elements". Affected employees are not just new operators and maintenance personnel. Affected employees also refers to existing operators and maintenance personnel, engineers, STLs, mentors, SMEs, Production Specialists, OMCs, planners, management, and most employees onsite. CCHMP suggests that Program 4 training should be provided to all employees. This initial training needs to be completed by 10/1/19. Since this training is not yet due to be completed, nor has it been effectively completed, CCHMP has identified this question as

N/A NoneNew


ID# Category Question Clarifications Findings Answer ActionsTypeN/A.

Program 4 also greatly expanded the roles of operators and maintenance personnel in that they are to participate in all phases of each of the Program 4 topics. It is difficult to participate in a topic if one doesn't know what the topic is.

CCHMP also suggests that the training process developed should incorporate a feedback loop to make sure the training is effective.


Did the owner or operator make sure that effective participation takes place with affected operating and maintenance employees and employee representatives in all phases of training in the CalARP Program? [T19 CCR §2762.10(a)(2) and §2762.4(f)]

1. Employee participation in “all phases” should be defined by the stationary source and should also include training in all of the CalARP Program elements. [T19 CCR §2762.10(a) and §2762.4(f)]

This is a Program 4 requirement that became effective on 10/1/17. As described in A46-01, the facility's Process Safety Management policy, C(A)-4 (revised February 2018, rev 0) identified that employees would participate in all phases of each CalARP program element. CCHMP was unable to confirm that the facility further defined what participation in "all phases" means for the Training Program.

CCHMP confirmed that employees and their representatives have participated in the training of new operators and in refresher training related to being qualified for operator positions.

CCHMP was informed that existing maintenance employees are required to team up with newly hired maintenance employees. CCHMP was unable to obtain information related to maintenance employee refresher training related to whether maintenance employees or their representatives were involved with the process of providing input on training topics or in providing

P Ensure that affected maintenance employees and employee representatives effectively participate throughout all phases in the implementation of the maintenance training program.

New


A41 - CalARP Prevention Program: Mechanical Integrity (Program 4)



Has the owner or operator developed, implemented and maintained effective written procedures to ensure the ongoing integrity of process equipment? [T19 CCR §2762.5(a) & ISO Section 450-8.016(a)(5)(B)]

1. P4 states “The procedures shall provide clear instructions for safely conducting maintenance activities on process equipment, consistent with the Process Safety Information.” [T19 CCR §2762.5(a)(1)]2. P4 states “The procedures and inspection documents developed under this subsection shall be readily accessible to employees and employee representatives pursuant to section 2762.10.” [T19 CCR §2762.5(a)(2)]3. “Process equipment” for purposes of P4, means equipment, including but not limited to: pressure vessels, rotating equipment, piping, instrumentation, process control, safeguard (except procedural safeguards), or appurtenance related to a process. [T19 CCR §2735.3(zz)] 4. “Mechanical integrity” means the process of ensuring that process equipment is fabricated from the proper materials of construction and is properly installed, maintained, and replaced to prevent failures and accidental releases. [T19 CCR §2735.3(jj)]5. Mechanical Integrity applies to tanks and vessels that are not pressurized as well as those that are pressurized [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard].6. For ISO covered stationary sources, mechanical integrity

Per interview with SME, there is only one maintenance procedure (GMP-28 for Safe Use of Bleeder Cleaner/Rodout Devices) but there are approximately 200 maintenance documents (work instructions, policies, and guidelines) and approximately 400 instrumented protection functions (IPF) inspection and testing procedures. The IPFs are used to keep a process in steady state or to return it to steady state after a process upset. IPFs are safety instrumented functions (SIF) typically related to safety integrity levels (SIL) for process safety equipment, e.g. PSVs (pressure safety valves).

CCHMP reviewed the following procedures that were part of the mechanical integrity program at Shell Martinez Refinery (SMR):

Fixed Equipment:-- GMP-30, Bolted Flange Joint Assembly QC/QA (Revision 6, August 31, 2017) provides instruction on the following: Initial Opening, Makeup, BFJA (bolted flange joint assembly) Quality Control and Assurance (QC/QA)-- C(A)-47, Corrosion Control Document Management (Revision 2, date 8/31/2017) which states the standard requirements for the implementation, updating and continuous improvement of Corrosion Control Documents (CCDs). The CCD work process at SMR is consistent with the Shell Basic Practice and Guidelines (BP&G) MAT-23, Corrosion Control Documents Implementation and Maintenance. The CCD covers the Damage Mechanism Review process. -- Procedure D(F)-1, Pressure Relief Device Handling and Service (Revision 14, dated December 2016) the policy includes in table 6.2.6 acceptance criteria for PRV pre-test acceptance criteria and actions.-- Procedure D(A)-16, Management of Dead Legs (dated 12/31/13) which provides criteria for Risk class in Appendix B.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeincludes the use of Industry Codes, Standards, and Guidelines, which are defined as "…the edition of the codes, standards, and guidelines in effect at the time of original design or construction for the design, construction, alteration, maintenance, or repair of process units, industrial equipment, or other industrial facilities, structures, or buildings published by the American Petroleum Institute (API), the Chemical Manufacturers Association (CMA), the American Society of Mechanical Engineers (ASME) or the American National Standards Institute (ANSI), and meets recognized and generally accepted good engineering practices (RAGAGEP).” [Section 450-8.014(f)].

Rotating Equipment:-- MEG-010, Rotating Equipment PSM & LHC Guidelines (Revision 1.0, dated 2/13/2018) the procedure covers the general inspections of rotating equipment at SMR. The inspections include the following: 1. In service inspections 2. Operator task management 3. FUGEM testing (fugitive emission equipment) 4. Oil analysis 5. Vibration monitoring 6. Interim mechanical inspection 7. Full mechanical inspection

Electrical:-- Procedure C(A) - 13, Requirements for Safety Instrumented Functions (Revision 6, November 2017)Section 6.2, Management of Change 1. Used when a change could directly or indirectly impact the design, the design intent, the demand rate, the consequences, and/or the testing requirements of a SIF or create the need for a new SIF shall be covered by the site MOC process. 2. Bypassing a SIF for more than 72 hours if equipment is operating/in service, unless the extended bypass is pre-approved operating procedure (typically when equipment is temporarily out of service or a batch process is in a phase that requires the SIF to be disabled.-- Procedure No. IMP-11, Instrumentation Preventative and Predictive Maintenance Program (revised December 2011)

Routine Maintenance:-- Procedure D(A)-9, Request for Scheduled Inspection or CAIR (corrective action integrity repair) Due Date Extension (revised 2/8/18) defines steps necessary to request and evaluate the extension of a scheduled inspection or repair due date for PE and piping.-- GMP-28, Safe Use of Bleeder Cleaner/Rodout Devices (dated 4/01/16) "provides the steps necessary to safely use a 'Bleeder Cleaner/Rodout Device' to clean plugged instrument taps, isolation valves and associated process equipment."




Is the frequency of inspections and tests of process equipment consistent with the following: a) Applicable manufacturer's recommendations, b) Recognized and generally accepted good engineering practices (RAGAGEP), or c) Internal practices that are more protective than a) or b)? [T19 CCR §2762.5(b)(2) & ISO Section 450-8.016(a)(5)(D)]

* Review and document the criteria used for inspection and test frequency, including trends and tracking methods. 1. P4 identifies, “Inspections and tests shall be conducted more frequently if necessary, based on the operating experience with the process equipment.” [T19 CCR §2762.5(b)(2)]2. This includes frequencies recommended by applicable standards such as API, NACE, NFPA, etc., and through experience gained by on-site mechanical integrity personnel only if it is more stringent than the manufacturer’s recommendations and applicable standards. [CCHMP Interpretation]3. If prior operating experience is used as the basis for testing and inspection frequencies, the past trends and experience must be documented to establish the justification for the frequencies used. [CCHMP Interpretation]

CCHMP reviewed the inspection frequencies for pressure equipment (which includes PRVs, vessels, piping) and rotating equipment (which includes pumps, compressors). See A41-05 for details about the actual equipment data reviewed. FIXED EQUIPMENT:

SMR uses a Risked Based Inspection (RBI) program to determine the frequency of inspections for vessels. This allows SMR to determine the appropriate inspection frequency based on gathering and monitoring the degradation of tanks and pressure vessels over time. This would be consistent with API 653 which covers tank inspections, repairs, alterations, and reconstruction. It also covers the development of an RBI program. Per review, IGP 1.9.2, Creation and Management of RBI Schedule in IMS, the policy states that the inspection driver for vessels included in the RBI program will be the output of RBI assessments per the RRM S-RBI program. In the same paragraph there is mention of API 653. Further down, the policy requires that RBI assessments be reviewed at least every 10 years "or more often if warranted by process, equipment, or consequence of changes." In section 6.1.1, the policy states that a RBI model reassessment shall be completed preferably within 60 days of the completed inspection.

Per review, IGP 1.4.12, Calculated Corrosion Interval Evaluation (Revision 5, dated 7/31/16) provides information about how and when to perform a more rigorous analysis and review of corrosion data that meets the following criteria:- Calculated corrosion inspection interval is less than 24 months- Calculated corrosion rate is greater than the suggested rate- Short term wall loss is greater than 30 mils- Long term wall loss is greater than 20% of original thickness- Remnant life date from IMS corrosion calculations is less than a calculated renewal date that is obtained from a renewal calculator.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeFor RBI Reassessment:Completion of scheduled inspection is to be as follows:- At 10 years if RBI next inspection exceeds 10 years from internal/intrusive or On stream/non-intrusive inspection (API-510), or- At 10 years for class 2 or class 3 piping, if next RBI inspection exceeds 10 years- At determination of changed hardware or process conditions such that degradation mechanisms are affectedCCHMP reviewed data provided by the PEI group and found that the inspections frequencies for piping, tanks, and pressure vessels were determined by historical data and API 653 and 510.

As an example, CCHMP reviewed documentation that indicated that the CS (carbon steel) piping that is located in parts of the light oil processing unit (LOP) receives regular inspections and is monitored closely as it is more susceptible to sulfidation. Per SME, some piping was replaced with Si-CS (silicon carbon steel) which offers better protection, but there is still low silica CS piping in the unit. As of the audit, SMR is monitoring the existing low silica CS piping and there is no plan to replace this remaining piping prematurely. This is part of the SMR RBI program for piping in the facility.

ROTATING EQUIPMENT:

Per interview with SMEs for process compressors and pumps, the initial frequency of inspections is based on OEM data. SMR modifies the frequency of inspections based on historical data which would be consistent with RAGAGEP. Some of the rotating equipment requires more frequent inspections due to the operating conditions and the demand.

Per review, Procedure MEG-10, Rotating Equipment PSM & LHC Guidelines (Revision 1.0, date 2/13/18) provides information on installation, inspection, repair, and testing of pumps. Per interview with the SME, pumps go through major and minor overhauls on a frequency that is determined by OEM data as well as historical date and operating condition of the pumps. The process units monitor the pumps in the units for vibration, lube oil temperature, suction inlet


ID# Category Question Clarifications Findings Answer ActionsTypetemperature, suction inlet pressure, and other factors.

Per the SME, the pump and compressor overhaul work would be classified as follows:- Major overhaul (removing cranks and motors) is typically done every 5-10 years.- Minor overhaul (replacement of seals and bearings) is typically done every 2-3 years.

Per review, Mech 5-1, Rotor Inspection and Repair (Revision 8, date 5/15/15) provides information on inspection frequencies for pumps and compressors.

CCHMP reviewed five pump and six compressor files in the GSAP database and found that the inspection frequencies were in the range that was appropriate considering the operating conditions and the design of the equipment.




Has the owner or operator retained a certification record to document that each inspection and test has been performed? [T19 CCR §2762.5(b)(3) & ISO Section 450-8.016(a)(5)(D)]

1. Documentation of tests and inspections does not mean certification or validation by a third party or by signature [29 CFR 1910.119 preamble].

Per review of IMS reports, which contain information on inspections, for PSVs, Pressure Vessels, and Reactors, SMR retains certification records to document that each inspection and test has been performed per the inspection requirements detailed in A41-04.

FIXED EQUIPMENT:

Per review of IMS reports, which contain information on inspections for PSVs, Pressure Vessels, and Reactors, SMR retains certification records to document that each inspection and test has been performed per the inspection requirements detailed in A41-04.

CCHMP reviewed the Dimersol CCD report which contained information about the corrosion loops evaluated by the CCD. This provided the corrosion rates for different pieces of equipment, including piping, in the process that have similar metallurgy and corrosion rates. Some of the piping examined was Z015M006 which was evaluated 05/2015 and Z0130A004 which was completed 02/2017.

CCHMP reviewed IMS reports for the following and found that all of the inspection records were complete and within the 5 year cycle:- PSV-7000/7008 (DCU)- PSV 7000/7001/7002 (DCU)- PSV 15724 (DSU)- PSV 15071 (DSU)

CCHMP reviewed the API 510 10-year reassessment and the external/internal inspections (10 year max external/California Code of Regulation-Petroleum Safety Order 15 year max internal) for the following vessels which included circumferential weld inspections, laser and video inspection, and thermal fatigue inspection for the following:- V13246 Coke drum- Rx 13907 (DHT) Rx 1- Rx 13908 (DHT) Rx 2- V287 DSU

ROTATING EQUIPMENT:

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeCCHMP also reviewed reports in the Shell database AIM EDMS which is used to store data for process pumps including the OEM data sheets. During a live navigation, the SME entered the pump identification number and a list that included the inspection history, OEM data, alignment data, and seal data was generated. There were also pictures of the pumps. The inspection reports had information for the as-received condition and the after-repair condition. Reports for the following pumps were viewed in the database:- P4278 (HCU)- P13443/4- P2236- P2420- P2262

For the compressors in the facility, the compressor department uses a database to collect and store data for each compressor. This includes the compressor identification number, repair history, inspection results before and after repair, and the parts ordered for repairs. Each compressor is monitored for vibrations as well as lube oil. The electrical and mechanical group analyzes historical and current data whenever a unit OSE or operator suspects that there may be an issue with a piece of equipment.

Reports for the following compressors were viewed in the database:- J79 Clean fuels- J80 - J92 HCU- J116 CCU- J125 CCU- J13425 DCU




Does the inspection and testing certification record identify:a) The date of the inspection; b) The name of the person who performed the inspection or test; c) A description of the inspection or test performed; d) The results of the inspection or test; and e) The serial number or other identifier of the equipment on which the inspection or test was performed? [T19 CCR §2762.5(b)(3) & ISO Section 450-8.016(a)(5)(D)]

Per CCHMP review of IMS (database used to track corrosion and inspections) for select PSV, piping, and pressure vessels, each report includes the history of inspections by date, the name of the persons who performed the inspections, a description of the inspection performed, the results of the inspection, and the serial number of the equipment that was inspected. See A41-05 for information about the specific equipment selected for review.

CCHMP also reviewed documentation for nine PSVs which were in the PEI file room and found that each file contained a stand-alone pop tests along with the information specified in items (a)-(e) of the question.

Per review of the process pump database, the pumps selected had reports that contained items (a)-(e) of the question and are stored either electronically, in binders, or both. The rotary equipment inspection team is working on converting all hard copies of pump reports to electronic copies. However, there are currently two databases that contain pump information: SAP and the database that replaced it, GSAP. The SME was able to access the older SAP database with some effort. This is because SMR archived that database after switching to the new database. The older database will be maintained and can be accessed but it is not readily available to people who want to look at older pump data.

Y NoneAbr




Has the owner or operator corrected deficiencies to ensure safe operation of process equipment by using repair methodologies consistent with RAGAGEP or more protective internal practices? [T19 CCR §2762.5(c) & ISO Section 450-8.016(a)(5)(E)]

1. P4 is more conservative than the previous ISO question, which related to correcting deficiencies in equipment that are outside of acceptable limits.2. Equipment found operating outside acceptable limits does not have to be shut down if other protective measures and continuous monitoring are available, and the deficiencies are corrected in a "safe and timely manner." [OSHA Instruction CPL 2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard].

Per interview with an Operations Maintenance Coordinator (OMC), the maintenance schedule is set for the day, week, and month although the weekly and monthly schedules change fairly regularly based on operating priorities and availability of parts. The inspections and preventive maintenance (PM) of PSVs, piping, and pressure vessels follow a particular schedule as these are considered safety critical. While other maintenance tasks can be delayed, these would fall under either Emergency or Schedule Breaker, either of which would need to be done within a few days or within a week depending on the situation. In the event of a PEI (Pressure Equipment Integrity) item needing to be replaced based on a CCD report, it would be given a high priority by the OMC for that unit. However, in the case of piping or pressure vessels, the replacement can be delayed by the CME (Corrosion and Materials Engineer) if the degradation does not appear to be jeopardizing the safety of the equipment or process. These extensions are based on data that has been compiled by the CME group at SMR over many years.

Per review, SMR performs maintenance on process equipment using procedures that are a combination of the OEM manuals, process data, and changes to procedures over time. For example, compressor J80 in the distillate hydrotreater area was installed in the 1960s. The compressor has received multiple major and minor overhauls as part of the MI program at the facility since it was installed. Over the years, when components would wear out, they would be replaced with up-to-date replacement parts such as gaskets and even lubrication. These were different than the ones that were originally used in the 1960s. The procedure for performing the overhauls of this compressor would be very similar to the one used for newer compressors in the facility.

Per SME, pumps are closely monitored for vibrations, viscosity, water content, flash point, acid number, particle counts and other specialty testing. When a pump is found to be operating outside of certain limits, e.g. if the vibrations become severe,

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypethe pump would be removed from service and repaired per the procedures set up in GSAP regardless of the pump repair schedule. Per review of the pump data files in A41-05, the pump repairs would be consistent with RAGAGEP.

CCHMP reviewed the maintenance backlog for several months and determined that no critical repairs had been delayed. There are items that do fall outside of the schedule but these would not be safety critical items. This is consistent with the information provided by the PEI leader as well as several unit SMEs.




Does/did the owner or operator conduct regularly scheduled checks and inspections to ensure that all process equipment is suitable for the process application for which it is or will be used; and fabricated from the proper materials of construction? [T19 CCR §2762.5(d)(1 & 3) & ISO Section 450-8.016(a)(5)(F)]

* Review and document the criteria used that existing and new equipment is suitable. 1. P4 is more conservative than the previous ISO question, which related only to fabrication of equipment. 2. For new equipment, documentation could include providing the vendors with equipment performance and materials of construction requirements, and shop and field testing such as leak tests, hydro tests, operating curve tests, etc. [CCHMP Interpretation]

Per interview with SME, any new process equipment introduced to the facility would go through a design review that includes an MOC process. This would require a sign off by a team of subject matter experts who would perform the necessary analyses to make sure that the equipment selected for the process would be able to handle the operating conditions. The DEP (Design and Engineering Practices) database provides information on projects, processes, and equipment that have been developed or used in the past at SMR or other Shell facilities around the world. DEP would be used by the team to select equipment that would meet the requirements of API and internal Shell specifications. Once the new process equipment has been installed, there would be a PSSR (Pre-Start Up Safety Review) performed by a team with the necessary technical expertise. As part of the PSSR, there is a checklist in Attachment 1 of Procedure C(A)-14, Pre-Startup Safety Review/Statement of Fitness (Revision 11, December 2014) that includes questions related to completion of field construction, installation, maintenance work, and equipment in accordance with design specification and approved drawings, recommendations or gas closures from Hazard Assessments, field walk-throughs, functional testing of equipment, updates to P&IDs. The DEPs would also provide the specifications needed to repair and overhaul existing equipment or to add additional equipment to an existing process.

CCHMP reviewed DEP S1.29.02.11 which included specifications for pumps that met API 675 and API 610. Each API specification was the current revision.

Y NoneAbr




Does/did the owner or operator conduct regularly scheduled checks and inspections to assure that all process equipment is designed, constructed, installed, maintained, inspected, tested, operated and replaced in compliance with the manufacturer’s and any other design specifications and all applicable codes and standards.? [T19 CCR §2762.5(d)(1 & 3) & ISO Section 450-8.016(a)(5)(F)]

* Review and document the criteria used that existing and new equipment is in compliance. 1. P4 is more conservative than ISO since P4 includes “all process equipment” unlike Program 1-3 which is for construction of new plants and equipment.2. P4 states, “If the owner or operator installs new process equipment or has existing process equipment for which no RAGAGEP exists, the owner or operator shall ensure and document that these are designed, built, installed, maintained, inspected, tested and operated in a safe manner.” [T19 CCR §2765.5(d)(2)] 3. For new equipment, documentation could include project monitoring, field weld X-rays, system leak checks, system hydro tests, positive material identification, etc. [CCHMP Interpretation]

Per interview with SME, a lot of the equipment that is used in SMR has been in place for many years. Over the years, SMR has developed operating data which allows modification of inspection frequencies and replacement. For new equipment, SMR uses OEM data to set inspection criteria. This is for pressure equipment, piping, PSVs, and process pumps. CCHMP reviewed the repair and inspection history for 25 pieces of equipment (7 PSVs, 8 pumps, 6 compressors, 4 pressure vessels) and these had inspections and frequencies that were consistent with the specifications API 579, API 610, API 570, API 510.

Per interview with SME, for existing equipment, if OEM replacement parts are no longer available, an MOC would be generated which would prompt a technical review to evaluate the alternatives parts. This would need to be performed before any replacement parts are used. See A42-01 for information on MOC policy as it relates to parts that are not "replacement-in-kind."

Per interview with SME, there was a valve located in the DCU which had to be replaced with a Carbon Steel valve rather than a stainless steel. This was a temporary repair (MOC M20142922-01) due to a valve replacement taking several months to ship. Per SME, this valve will be monitored more closely and replaced as soon as the appropriate valve is received.

Per interview with SME, the rotary equipment group has established procedures for installation, maintenance, inspection, and replacement that is based on the OEM manuals. These would be consistent with RAGAGEP.

Per live navigation of the DEPs with the SME, depending on the scope of the project, the project team would use DEPs to make sure that the latest codes and standards are used whether it was for introducing a new piece of equipment, modification of an existing piece of equipment or a new process. Shell Global maintains a database of equipment files in DEPs that meet API, Shell, and International Standards Organization. These would be for

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypepumps, valves, pipe, heat exchangers, pressure vessels, and other equipment. These standards would be consistent with RAGAGEP.

See A41-08 for more information on the process used to make sure that process equipment is designed, constructed, installed, maintained, inspected, tested, operated, and replaced in compliance with design specifications.


Does the submitted RMP and Safety Plan accurately reflect the Mechanical Integrity Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The 2014 RMP and the 2016 Safety Plan accurately reflect the Mechanical Integrity program at Shell Martinez Refinery.

Y NoneAbr



* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for

this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due. 1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There were no action items from the previous CalARP audit. This question does not apply.

N/A NoneAbr




Does/did the owner or operator establish a process for evaluating new or updated equipment codes and standards and implementing changes as appropriate to ensure safe operation? [T19 CCR §2762.5(d)(5]

* Review policy or interview with SME regarding this practice.

Per interview with SME, SMR uses DEPS (Design and Engineering Practices) which is maintained by Shell Global. Design data is gathered from projects all over the world, stored online and accessible by the SMR technical staff that is responsible for maintaining the pumps, compressors, and PEI equipment. The DEPS include the latest revisions of Shell policies along with the International Standards Organization policies and API and ASME standards. The DEPS are kept current by Shell Global which aggregates all of the data. CCHMP did a live navigation of DEPs with the SME and did look at certain API standards for pumps, one of which was API 610. This standard was current in the system. For existing equipment, SMR would also use DEPs to find the most current specifications and equipment information.

Y NoneNew




Does/did the owner or operator complete a Damage Mechanism Review (DMR) for each process for which a damage mechanism exists? [T19 CCR §2762.5(e)(1)]

1. P4 states, “Where no DMR is performed, the owner or operator shall document the rationale for the determination that no damage mechanism exists. The owner or operator shall determine and document the priority order for conducting the DMR based on process operating history, PHA schedule and inspection records. No less than 50 percent of the initial DMRs shall be completed within three (3) years of the effective date of this Article, and the remainder within five (5) years of the effective date of this Article. If the owner or operator has conducted and documented a DMR for a process unit within five (5) years prior to the effective date of this section, and that DMR includes the elements identified in paragraph (e)(8), that DMR may be used to satisfy the owner or operator’s obligation to complete an initial DMR under this paragraph.” [T19 CCR §2762.5(e)(1)] 2. The effective date of P4 is 10/1/17.

Per review, SMR has generated a number of CCDs (corrosion control documents) for the different process units. For each unit, the number of CCDs that was performed is specified. A CCD performs the same function as a Damage Mechanism Review. The damage mechanisms covered by the CCDs are environmental, wet corrosion, embrittlement, CUI (corrosion under insulation), and a few others.

SMR generated CCDs for each of the process units as follows:- Cracked Products (8 CCDs)- Clean fuels (6 CCDs)- Distilling/Hydroprocessing (6 CCDs)- OPCEN (8 CCDs)- Utilities (3 CCDs)

SMR has also identified the following areas as needing CCDs to comply with Program 4 requirements: the wharf, recovered oil processing, blender, tanks, ETP, and process water. Per SME, these would be the last areas that would require CCDs. These CCDs would need to be completed by 10/2022 in order to meet the requirements of Program 4.

There are 9 CCDs (out of the 31 total) due for revalidation in 2018, the rest with target dates of 2019-2022.

CCHMP reviewed the following CCDs:

Opcen- Distillates Saturation Unit (Revision 3, September 2014)- SRU-4 (Revision 3, September 2016)- Dimersol (Revision 4, August 2017)- Flexicoker (Revision 6, December 2010) (in the process of being reviewed as of the audit.)

Cracked Products- Delayed Coker (Revision 5, October 2016)

Clean fuels- DHT (Distillate Hydrotreater) (Revision 5, February 2016)

Y NoneNew



Per review of SMR's CCD program, SMR is meeting the regulation ahead of schedule. SMR has performed CCDs on most of their processes which is above the 50% mark set for October 2020.




Does/did the owner or operator ensure the DMR was updated at least once every five (5) years; and reports retained for the life of the process unit? [T19 CCR §2762.5(e)(2 & 12)]

* Look for this requirement in policy.

Per review, Procedure C(A)-47, Corrosion Control Document Management (Revision 2, dated 8/31/17) states in section 9.2 that "a comprehensive review (revalidation) of CCDs should be conducted by a CCD revalidation team on a 4-8 year interval depending on the criticality of the unit." The 4-8 year interval would not meet the requirement of the new Program 4 requirement of updating the CCDs every 5 years.

For the CCD revalidations below, and all of the CCDs used to meet the 50% target completion that were completed before 10/2017, must be revalidated by 10/2022 in order to meet the timeline set forth in the Program 4 regulation.

For the CCD of the Delayed coker unit, revalidations were done as follows:Rev 5 - 10/2016 (most recent)Rev 4 - 06/2011Rev 3 - 07/2006Rev 2 - 03/2000

For the CCD of the Distillate Saturation Unit, revalidations were done as follows:Rev 3 - 09/2014 (most recent)Rev 2 - 04/2010Rev 1 - 05/2005

For the CCD of the Distillate Hydrotreater, revalidations were done as follows:Rev 5 - 02/2016 (most recent)Rev 4 - 09/2011Rev 3 - 08/2006Rev 2 - 06/2001Rev 1 - 07/1998

For the CCD of the Sulfur Recovery Unit, revalidations were done as follows:Rev 3 - 09/2016 (most recent)Rev 2 - 06/2011Rev 1 - 05/2006Rev 0 - 02/2004

Y NoneNew




Was the DMR performed by a team with expertise in engineering, operation of the processes under review, equipment and pipe inspection, and damage and failure mechanisms; and one member knowledgeable in the specific DMR method being used? [T19 CCR §2762.5(e)(5)]

* Review the DMR report to look for affected operating and maintenance employees and employee representative participation. [T19 CCR §2762.10 (a)(2)]* Review the owner or operator policy regarding employee participation in this program.

1. The owner or operator shall provide for employee participation in all phases in the implementation of the DMR program. [T19 CCR §2762.10(a)(2)] a) Employees participating in the DMR must receive appropriate training in the DMR methodology used;b) Employees should be involved in developing recommendations and the final report.

Per review of Procedure C(A)-47, the CCD team responsible for developing, maintaining, and revalidating CCDs is to consist of the Unit Operations Support Engineer (OSE), Operations Specialist, PEI Unit Inspector, and Corrosion and Materials Engineer (CME).

Per interview, CMEs participated in all of the CCDs reviewed by CCHMP and each had an extensive background in damage mechanism analysis. The SME said that the operations representatives were unit operators who expressed interest in learning about CCDs.

Per review of the CCDs below, each had an appropriate team made up of an OSE, Operations Specialist, PEI Inspector, and CME:- Delayed Coker (October 2016)- Distillates Saturation Unit (September 2014)- DHT (February 2016)- SRU-4 (September 2016)- Flexicoker (December 2010)

Per interview, the unit inspectors gather the inspection data and input the data into the corrosion monitoring database. This data is monitored by the PEI group.

Y NoneNew




Does the DMR for each process include: a) Assessment of Process Flow Diagrams (PFDs); b) Identification of all potential damage mechanisms; c) Determination that the materials of construction are appropriate for their application and are resistant to potential damage mechanisms; d) A discussion of the conditions that cause the damage mechanism and how rapidly the damage may progress; e) Methods to prevent or mitigate damage; f) Review of operating parameters to identify operating conditions that could accelerate damage or that could minimize or eliminate damage; g) Assessment of previous experience with the process including inspection history and all damage mechanism data; andh) A review of new information available such as, inspection data, industry wide experience, and changes to applicable standards, codes and practices? [T19 CCR §2762.5(e)(6 & 8)]

* Review the DMR process to make sure it includes these items, i.e., not necessarily in the DMR report. 1. P4 identifies that, “…damage mechanisms include, but are not

limited to:(A) Mechanical loading failures, such as ductile fracture, brittle fracture, mechanical fatigue, and buckling; (B) Erosion, such as abrasive wear, adhesive wear, and fretting; (C) Corrosion, such as uniform corrosion, localized corrosion,

and pitting; (D) Thermal-related failures, such as creep, metallurgical transformation, and

thermal fatigue; (E) Cracking, such as stress-corrosion

cracking; and (F) Embrittlement, such as high-temperature hydrogen attack.” [T19 CCR §2762.5(e)(7)]

Per review of C(A)-47, section 3.1, a CCD should contain the following:- Title page with a list of revision number/date, CCD development team and review team- Summary with CCD revision history- Table of contents- Introduction- Process description (overview, general process description and materials related unit constraints)- List of CMDs (corrosion materials diagram)- Corrosion loop data- Corrosion mechanisms, prevention, and inspection (could include high temperature corrosion/degradation, aqueous corrosion, environmental cracking, fouling, mechanical degradation)- Guidelines for startup

Per review of the CCD for Dimersol (2017), the report included corrosion loops, corrosion mechanisms, prevention, and inspection, and operating parameters that were set to minimize degradation. The actual inspection data history was kept by the PEI group but was accessible to the CMEs.

Per review of the CCDs mentioned in A41-14, each report contained information that addressed items (a)-(f). This included information about the operating parameters, inspection history and data, and any new data. This would be collected and compiled by the PEI group. However, per CCHMP review, the DSU and the DCU reports do not have Process Flow Diagrams attached. Per interview with CME, the PFDs are not always attached to the printed CCD but are in the electronic CCD folder as CMDs. The printed CCD is maintained by the Corrosion Materials Engineer (CME) and other employees access the electronic CCD. CCHMP performed a live navigation with the CME of the CCD folder and verified the PFDs for both the DSU and the DCU.

Y NoneNew




Does the written DMR report include the following: a) The process unit(s) reviewed; b) Damage mechanisms analyzed; c) Results of the analyses conducted; d) Recommendations for temporary mitigation; e) Recommendations for preventionf) Completed corrective action items appended to the report? [T19 CCR §2762.5(e)(9) & §2762.16(e)(15)]

CCHMP reviewed the CCDs for the following processes:- Delayed Coker Unit (DCU)- Distillates Saturation Unit (DSU)- Distillate Hydrotreater (DHT)- SRU-4- Flexicoker- Dimersol

The reports include the damage mechanisms analyzed for each of the process units. There is a table in each report that lists the applicable damage mechanism, the areas affected, the likelihood or estimated rates, and notes. In other sections of the report there are tables for Process Limits (Integrity Operating Windows) and a piping inspection strategy. There is also a section for additional monitoring. The piping strategy table includes the location, the class, the suggested rate (IPY-inches per year degradation), corrosion type (localized or general), deadleg corrosion mechanism, and deadleg corrosive orientation.

Per review of section 4.0, the CCD details the preventive measures that are in place for the applicable damage mechanisms. Depending on the corrosion loop being evaluated for each of the CCDs, the damage mechanisms could include oxidation, sulfidation, aqueous corrosion, environmental cracking, fouling, mechanical degradation, or a combination of damage mechanisms. For example, the piping material for the furnace tubes is made of 9 Cr - 1 Mo which offers better corrosion resistance to naphthenic acid and sulfidation.

Per review of the CCDs, each has at the back a list of recommendations and action items. However, the recommendations and action items are not appended to the reports. CCHMP did a live navigation with the SME in the FAM/RADAR database (the tracking tool for action items) for the updated CCD for the flexicoker and the CCD for the DCU. The 2016 CCD report for the DCU had recommendations with completion dates that were tracked in a separate file and the FAM/RADAR database. The 2018 CCD report for the Flexicoker

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsTypeis still in progress but there are recommendations listed in FAM/RADAR. Per the SME, recommendations that cannot be closed out immediately go into FAM/RADAR so that they can be tracked to completion.

Some of the recommendations in FAM/RADAR could be considered temporary mitigations. A temporary mitigation might be for using a different type of material for a piece of equipment. For example, one recommendation from the 2016 DCU CCD that was approved was to temporarily install a CS (carbon steel) body and disk valve for a butterfly valve instead of 316 SS (stainless steel). The 316 SS butterfly was the best configuration for this valve but it had a lead time of about 6 months. This temporary mitigation was to replace a valve that was not working properly and for which there was no spare. This was covered by an MOC. There are other recommendations covered in FAM/RADAR that would just be tracked that have target dates but not expiration dates as in the case of the CS valve.




Does/did the owner or operator resolve the DMR team’s findings and recommendations, determine corrective action for implementation, track to completion, and document closeout? [T19 CCR §2762.5(e)(11)]

* Verify the Risk Based inspection program was updated if the recommendation included an updated inspection frequency to a damage mechanisms.* Verify consistency with A41-08 if the recommendation was to change alloy.* Verify PSI was updated if the recommendation was to operate at lower pressure, temperature and/or rates. 1. Action items shall follow a documented work process to address findings and

recommendations including: a) Rejection of recommendations;

b) Alternative safeguards; c) Written comments by team members written comments on any rejected or changed findings and recommendations; and d) Final decision for each recommendation [T19 CCR §2762.16(d & e)]

Per interview with CME, the CCD recommendations are kept and tracked electronically. Those recommendations that cannot be closed immediately are tracked in FAM/RADAR which provides increased visibility for open action items. CCHMP did a live navigation of the FAM/RADAR tracking tool and found that the findings and recommendations from the CCDs are tracked to completion and include the corrective actions taken. The FAM/RADAR tracking tool stores this data separately from the CCD report but a CME could access FAM/RADAR at any time. The 2018 CCD for the Flexicoker still had open action items in the FAM/RADAR database that had not been closed due to the CCD having been completed recently.

Y NoneNew

A41-20 CalARP Program 4

Did the owner or operator provide effective training to employees and employee representatives before serving on a DMR team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions. [T19 CCR §2762.4(e)]

Per interview with an SME from the CME group, operators are typically selected based on their familiarity with the CCD program. Operators in the units are expected to have some knowledge of the damage mechanisms as part of the operator unit training and are provided with just-in-time training before the CCD study begins. CCHMP interviewed several operators in different units and found that although they were aware of CCD, they did not participate directly in the CCD program development.

Y NoneNew


A42 - CalARP Prevention Program: Management of Change (Program 4)

ID# Categor Question Clarifications Findings Answer ActionsType


Has the owner and operator developed, implemented and maintained written procedures to manage changes (except for "replacement in kind") to process chemicals, technology, process equipment, procedures and facilities; including requirements to use qualified personnel and appropriate methods for MOCs based upon hazard, complexity and type of change? [T19 CCR §2762.6(a & d) & ISO Section 450-8.016(a)(6)(A)]

* Review MOC policy to ensure the ISO stationary source has a process to conduct an ISSA for a “major change”, that could reasonably result in a MCAR. The policy should define what is considered a major change. Criteria for how site personnel would determine whether a change could reasonably result in a MCAR should also be included in policy.* Review MOC records for the ISO stationary source for any major changes and provide records to auditor doing A34 so ISS can be evaluated. 1. "Replacement in kind" means a replacement that satisfies the design specifications [T19 CCR §2735.3(tt)].2. Examples of changes in process technology include: (a) production rates (b) new equipment (c) change in catalysts (d) changes in operating conditions to improve yield or quality [OSHA 3133, PSM Guidelines for Compliance, 1994].3. Examples of changes in equipment include: (a) materials of construction (b) piping arrangements (c) alarms and interlocks [OSHA 3133, PSM Guidelines for Compliance, 1994].4. Examples of operating or maintenance procedure changes subject to MOC requirements include those that are beyond formatting, grammar, typographical errors, etc., and include changes, that are not associated with changes in process chemicals, technology or equipment. [CCHMP interpretation]5. Procedure changes that are independent of other changes require either that the MOC procedure/policy or separate procedures/policies clearly indicate that changes require a minimum of a technical basis/analysis, a health and safety review, and documentation of the above along with

The facility has developed, implemented and maintained written procedures to manage changes (except for "replacement in kind") to process chemicals, technology, process equipment, procedures and facilities; including requirements to use qualified personnel and appropriate methods for MOCs based upon hazard, complexity and type of change. CCHMP reviewed the policy titled C(A)-15: Management of Change (MOC), rev.12, Feb. 2018. Per the policy, Section 6.0, the facility requires to conduct an ISSA for a “major change” that could reasonably result in an MCAR. The policy references I(A)-43, "Inherently Safer Systems" and MPO procedure 2.15B, "SEO Reviews for Projects Subject to ISS." See Questionnaire A58 for further description of information related to Inherently Safer Systems Analysis that would be required.

CCHMP reviewed 22 MOCs completed since the last ISO audit from the following process units:- Delayed Coking Unit (DCU)- Distillate Hydrotreater (DHT)- Distillates Saturates Unit (DSU)- Logistics - Tank Farm (Tank)- Sulfur Recovery Unit (SRU4)

The MOCs are electronic and are completed on the KMS (Knowledge Management System) database. CCHMP observed a live navigation of the MOC process. The MOCs reviewed included the following information:- Unit Name & MOC Reference/Title- MOC Status- Responsible Person- Initiator- Target Closure Date- Date Initiated- Actual Completion Date- Technical Basis

Y NoneAbr


ID# Categor Question Clarifications Findings Answer ActionsTypetraining and notification documentation, as appropriate. [CCHMP interpretation]

- Description- Details of MOC Items and Related Action Items- Technical Evaluation Document


Do the Management of Change procedures address the impact of the change on process safety, and safety and health prior to any change? [T19 CCR §2762.6(b)(2) & ISO Section 450-8.016(a)(6)(B)]

* Review PHA's, meeting minutes, or other reviews conducted to ensure that the impact of the change on safety and health and process safety was addressed.

The Technical Evaluation Analysis portion of each MOC includes a subsection titled Technical Consideration section that addresses safety precautions. CCHMP reviewed 22 MOCs referenced in A42-01 and confirmed that the completed MOCs addressed the impact of the change on process safety, and safety and health prior to any changes being made. The impact of a change was evaluated in the Technical Consideration section of the MOC.

Y NoneAbr




Do the Management of Change procedures address modifications to and/or development of new operating and maintenance procedures prior to any change? [T19 CCR §2762.6(b)(3) & ISO Section 450-8.016(a)(6)(B)]

Per a review of the completed MOCs referenced in A42-01, the MOCs include a section that is titled "Details of MOC Items and Related Action Items" that only has actions to approve the completion of MOC but no specific actions for the MOC completion such as addressing modifications to and/or development of new operating and maintenance procedures prior to any change. The MOC includes a subsection titled "PSSR" that addresses completion of such actions but it was not entirely clear to CCHMP what activities were completed under the MOC versus the PSSR.

Per interview with SME and OPCEN Department Manager and the review of the completed MOCs, the MOCs/PSSRs include three approval levels. The MOC initiator/OMC (Operations Maintenance Coordinator) sign off that "MOC is installed correctly". Per interview, the sign off by Operations Specialist and Department Manager represents the redundant check that the MOC actions have been completed. However, the MOC action item completions and all of the approvals are shown under the PSSR action items.

The MOC actions required and responsible person/department to complete those actions should be included in the electronic MOC action items tracking independent of what is identified under PSSR actions. It is suggested that the electronic MOC documentation be updated to identify the procedures and or PSI modifications to be completed including P&IDs to be corrected/revised, and documentation that training for the change has been completed, responsibilities for these actions and completion date of the actions as part of the MOC process. It is suggested that a separate section address the PSSR actions to more clearly identify what activities were performed as a redundant check for the

Y NoneAbr




Do the Management of Change procedures include provisions for temporary repairs, including temporary piping or equipment repairs; and address the necessary time period required for the change prior to any change? [T19 CCR §2762.6(a) and §2762.6(b)(4) & ISO Section 450-8.016(a)(6)(B)]

* Review records on how temporary changes are tracked and how the changes are restored to their original or design conditions.* Review the procedures and policies in place that address when a temporary change can be kept longer than specified in the MOC. 1. Time limits should be defined for all temporary changes and monitored. Since otherwise, without control, these changes may tend to become permanent. The MOC procedure must also address how equipment and procedures are restored to their original or design conditions at the end of a temporary change [OSHA 3133, PSM Guidelines for Compliance, 1994].

The Management of Change procedures include provisions for temporary repairs, including temporary piping or equipment repairs; and address the necessary time period required for the change prior to any change. Below are two examples of the 22 MOCs reviewed:- M20172068 - Temporary rotate the five DSU high pressure PSVs to atmosphere, initiated 9/11/2017, completed 1/15/2018, expiration 1/1/2018.- M20171936 - CV-934 and CV-936 Butterfly Valves Temporary Use, initiated 10/13/2017, completed 11/1/2017, expiration 10/15/2019.

CCHMP reviewed Procedure D(F)-10: Temporary Repairs, revised 4/15/2014. Per interview, installation and removal of clamps are a part of the temporary repairs process. This procedure is to establish the work process and field requirements for the management of temporary repairs (TRs) including the design, fabrication, installation, and removal of all TRs to pressure equipment and piping in the refinery. The procedure states that it meets all MOC procedure guidelines and qualifies as a stand-alone procedure per C(A)-15: Management of Change. Per interview with the SME, currently there are a total of 104 active process temporary repairs (Clamps) and 67 additional TRs in the utilities department for a total of 171 TRs for the refinery. CCHMP reviewed a summary table maintained by the Pressure Equipment Inspection (PEI) Department that identified each active TR in a process area with a log number, the date added, equipment ID, description, CAIR (Corrective Action Inspection Request) Traveler number, and a planned removal date. The date of removal for each TR is within one year of installation or based on the next turnaround scheduled. CCHMP also reviewed three active TR documents and two TRs that had been removed. Each TR had the initiator name and signature, senior production specialist

Y NoneAbr


ID# Categor Question Clarifications Findings Answer ActionsTypeand the production manager.


Are employees involved in operating a process informed of, and effectively trained in the change in a timely manner, prior to implementation of the change? [T19 CCR §2762.6(f) & ISO Section 450-8.016(a)(6)(C)]

* Review training records or meeting minutes to show that affected employees were trained in the change prior to making the change. 1. P4 identifies that “Prior to implementing a change, the owner or operator shall inform all employees potentially affected by the change.” [T19 CCR §2762.6(l)]

Per interview with SME and a review of the MOC Policy referenced in A42-01, operating, maintenance and contractor employees may be trained or informed of changes by various methods. These include department mentor's email, team meetings, training sessions, training modules, or writing about the change in the daily in the daily in the daily guidelines, depending on the change. Training is documented and attached to the MOC in KMS or MOC package. For larger projects, a management of change training signoff sheet is completed and maintained by the Department Mentor. CCHMP reviewed two examples of such training documentation of the change and noted the signoff included the initials and date of training for the different shift team members.

Per interview and live navigation, at the beginning of a shift, each operator signs on to the computer, reviews the shift turnover notes and department email, and checks for any updates including MOC information. All operators must document that they have reviewed the MOCs related to their department. Per interview, training required for most of the smaller changes are done via email to the operations shift teams with information/clarification on the change. However, there is no confirmation that the MOC initiator receives from the email recipients on whether they opened the email on change training and understood the training or if they had any questions. Training for bigger changes are completed by classroom or onsite review of the impact of the change. The training on the change that is provided via email needs to be confirmed via the MOC process. Also see A42-05 for a consider action to complete this task as part of the MOC action items process.

P Ensure documentation of MOC training provided to employees is maintained that identifies training was provided in a timely manner and effective.

Abr




Are maintenance employees whose job tasks will be affected by a change in the process informed of, and effectively trained in the change in a timely manner prior to the implementation of the change? [T19 CCR §2762.6(f) & ISO Section 450-8.016(a)(6)(C)]

* Review training records or meeting minutes to show that affected employees were trained in the change prior to making the change. 1. P4 identifies that “Prior to implementing a change, the owner or operator shall inform all employees potentially affected by the change.” [T19 CCR §2762.6(l)]

Per interview and the MOC policy, maintenance employees whose job tasks will be affected by a change in the process are informed of, and effectively trained in the change in a timely manner prior to the implementation of the change as described in A42-08. This is done whenever maintenance is impacted.

Y NoneAbr


Does/did the owner or operator make the MOC documentation available to and require effective training in the change prior to implementation of the change for contractor and employees of contractors who are operating the process and whose job tasks will be affected by a change? [T19 CCR §2762.6(f) & ISO Section 450-8.016(a)(6)(C)]

* Review training records or meeting minutes to show that affected employees were trained in the change. 1. Contract owner or operator must inform its employees of the work practices necessary to safely perform his or her jobs, including the potential hazards related to their jobs; applicable refinery safety rules; and applicable provisions of the facility’s emergency action plan. [T19 CCR §2762.12(b)(2)]

Per interview with SME and some contractors and the MOC Policy, as described in A42-08, the MOC documentation is made available to the affected contractor employees and training is provided in the change prior to implementation of the change. Per interview, the project review meetings and the morning safety huddle meetings review any relevant safety concerns related to the work to be completed including addressing the relevant MOC concerns. Larger projects provide training on MOCs for all related operations, maintenance and contractor employees and these projects will maintain the completed training rosters with the project files. Maintenance department includes contractor employees and they will receive training on MOCs when appropriate. Training is normally provided by project engineers or operations training mentors as appropriate. Shell Refinery does not use contractors to operate their processes. The refinery requires all contractor employees to receive training on the potential hazards related to their jobs; applicable refinery safety rules; and applicable provisions of the facility’s emergency action plan through the site/department indoctrination training.

Y NoneNew




Does/did the owner or operator ensure that if a change results in a change to the PSI (§2762.1 or Section 450-8.016(A)(1)), that this information will be updated as soon as possible? [T19 CCR §2762.6(g) & ISO Section 450-8.016(a)(6)(D)]

See A42-05 for information about how a change that could affect PSI would be addressed within the MOC. There was also a consider item given for the same question related to updating PSI information independent of the redundant check that is completed in the PSSR.

Y NoneAbr


Does/did the owner or operator ensure that if a change results in a change in the operating procedures or practices (§2762.3 or Section 450-8.016(A)(2)), and/or results in a change in the written procedures to maintain the ongoing integrity of process equipment required by Section 2762.5 that such procedures or practices are updated prior to the start-up of the process? [T19 CCR §2762.6(h) & ISO Section 450-8.016(a)(6)(E)]

See A42-05 for how MOC is affected if a change results in a change in the operating procedures or practices, and/or results in a change in the written procedures to maintain the ongoing integrity of process equipment. A consider item is given for the same question to include specific action items as part of the MOC process independent of the redundant check that is completed in the PSSR.

Y NoneAbr


Do the submitted RMP and Safety Plan accurately reflect the Management of Change Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The submitted RMP (pages 48-49) dated December 2016 and Safety Plan (page 20) dated August 2016 reflect the Management of Change Program at the stationary source.

Y NoneAbr



* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item

table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due. 1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There were no ensure action items associated with the previous CalARP/ISO audit to be addressed. This question is not applicable.

N/A NoneAbr




Does/did the owner or operator review the Damage Mechanism Report or conduct a Damage Mechanism Review (DMR) as part of a major change on a process for which a damage mechanism exists, prior to approval of the change and document the findings in the MOC? [T19 CCR §2762.6(c), §2762.5(e)(3)]

1. P4 further states “If a major change may introduce a damage mechanism, a DMR shall be conducted, prior to approval of the change.” [T19 CCR §2762.5(e)(3)]

Per interview and a review of the MOCs completed, the MOC Technical Evaluation does include a review of damage mechanism if applicable. However, the MOC policy does not address a requirement for such review. Per interview with SME, they would know whether a change qualified as a P4 major change. Although it is not a regulatory requirement for the MOC policy to specifically require a Damage Mechanism Review (DMR) or to review the DMR report as part of a major change review, it is suggested.

Y NoneNew


Does/did the owner or operator perform a Hierarchy of Hazard Control Analysis (HCA) as part of a major change on a process prior to implementation of the change and document the HCA recommendations in the MOC? [T19 CCR §2762.6(c)]

* Look for the criteria and trigger in MOC policy, HCA or ISS review will be documented in A59. 1. Major change “means: (a) introduction of a new process, or (b) new process equipment, or new regulated substance that results in any operational change outside of established safe operating limits; or (c) any alteration in a process, process equipment, or process chemistry that introduces a new hazard or increases an existing hazard.” [T19 CCR §2735.3(hh)] 2. P4 requires an HCA to be performed associated with a major change regardless if the major change could reasonably result in a major incident. [T19 CCR §2762.13(b)(2-3)]

Per interview with SME, a Hierarchy of Hazard Control Analysis (HCA) will be completed as part of a major change on a process prior to implementation of the change and the HCA recommendations will be documented in the MOC. However, the MOC policy makes no mention of this requirement. Similar to A42-15, although it is not a regulatory requirement for the MOC policy to specifically require an HCA as part of a major change review, it is suggested.

Y NoneNew




Does/did the owner or operator provide for employee participation pursuant to the provisions of section 2762.10? [T19 CCR §2762.6(e)]

* Review the MOC documents to check for employee participation in “all phases” includes, but is not limited to:a) HSE review;b) Determine the type of training needed to be effective for the MOC [T19 CCR §2762.10(a) and §2762.4(f)]

Per the MOC policy referenced in A42-01, Section 6.0, "The MOC process provides for Employee Participation per ARMs Process Safety Management procedure, C(A)-4." CCHMP reviewed Procedure C(A)-4: Employee Participation and noted that there is a reference to MOC as an element of PSM program that employee participation is required.

Per interview with the SME, there are weekly meetings on MOC review for each of the six refinery departments. (Logistics, Cracked Products, Distilling Hydroprocessing, Utilities, Delayed Coking, OPCEN (Operations Central)). An employee representative is invited to attend these meetings. These meetings are with technical and operations representatives to discuss all MOCs going on in that department, including the ones being initiated. There are separate MOC meetings for larger projects as well which are set up as needed. One USW representative assigned to be involved with the MOC process was invited to attend these meetings as well. The USW representative was generally happy with their union involvement with the MOC process.

Y NoneNew


Did the owner or operator provide effective training to employees and employee representatives before serving on a MOC team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions. [T19 CCR §2762.4(e)]

Per interview with SME, before an employee can serve on the MOC team, that employee must receive MOC training. This training should include the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions. Interview with employee representatives confirmed that this training has been conducted for the USW representative assigned to follow MOCs.

Y NoneNew


A43 - CalARP Prevention Program: Pre-Startup Safety Review (Program 4



Does/did the owner or operator perform pre-startup safety reviews for new processes? [T19 CCR §2762.7(a) & ISO Section 450-8.016(a)(7)(A)]

* Review completed PSSR's and corresponding information. 1. A PSSR is also required for new stationary sources although P4’s “new processes” is more restrictive. [ISO Section 450-8.016(a)(7)(A)] 2. A new stationary source is a stationary source constructed on a site such that it is physically separated from and otherwise independent from existing stationary sources and would not affect or be affected by another facility or any of its process(es) [OSHA Interpretation Letter to Chevron, 1/11/96].3. New Stationary Source means a stationary source that now has a covered process that is not currently in the CalARP program. [T19 CCR §2735(qq)]

Section 2.0 of C(A)-14 - Pre-Startup Safety Review/Statement of Fitness policy (PSSR policy; revision dated 12/31/2014) identifies the requirement to develop a Statement of Fitness (SoF) for the following assets:- prior to commissioning a new asset or a modification to an asset, via Management of Change (MOC) process- prior to restarting an asset after an overhaul or turnaround- prior to restarting after an uncontrolled shutdown where the asset was subjected to conditions outside its design limits or subjected to environmental conditions beyond original design parameters

Per interview with the PSM Manager, there have been no new processes at Shell Martinez Refinery.

N/A None




Does/did the owner or operator perform pre-startup safety reviews for:a) Modified processes if the modification necessitates a change in the process safety information, b) Partial and unplanned shutdowns,c) Turnaround work? [T19 CCR §2762.7(a) & ISO Section 450-8.016(a)(7)(A)]

* Review completed PSSR's and corresponding information. Employee interviews may identify changes to the regulated source which should have required a PSSR. 1. A PSSR is also required for modified stationary sources although P4’s “modified processes” is more restrictive. [ISO Section 450-8.016(a)(7)(A)] 2. PSI must be modified before startup [OSHA Instruction CPL2-2.45A CH-1 Appendix B - Clarifications and Interpretations of the PSM Standard, September 13, 1994].

Section 3.0 of the PSSR policy states that a PSSR/SoF is required following extended shutdowns, major maintenance activities (e.g. turnaround, pit stops), when a change is made via the MOC process, or prior to restarting following an uncontrolled shutdown where the Asset was subjected to conditions outside the design limits or experienced environmental conditions beyond the original design parameters.

Depending on the event, one of several forms will be used to document that PSSR requirements are met:- Attachment 1: Pre-Startup Safety Review Questions in KMS; used prior to commissioning a new or modified facility- Attachment 2: Pre-Startup Safety Review Form - Process Units; used prior to restarting an existing facility from a shutdown or turnaround- Attachment 3: Pre-Startup Safety Review Form - Following An Incident; used prior to restarting an existing facility following an incident involving an uncontrolled shutdown that leads to exceedance of equipment design limits or damage to equipment that impacts its functionality (i.e., failure of an Instrumented Protective Function to activate when required, failure of a pressure relief valve to open)- Attachment 4: Tanks Pre-Startup Safety Review Form; used following major tank maintenance

Additionally, there are 9 Knowledge Management System (KMS) PSSR modules that may be used depending on the type of change involved. These modules are used when a change is initiated in KMS and include the following topics:- Full MOC template (similar to Attachment 1)- Control Systems Changes- Pressure Equipment Inspection (PEI) Changes

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsType- Mechanical (Rotating Equipment) Changes- Electrical Changes- ESP Limit (Alarm) Changes- Civil/Structure Changes- IPF Bypass- New Chemical/Catalyst

CCHMP reviewed 21 completed MOC/PSSR packages, 15 of which were identified to have required a PSSR. Additionally, CCHMP reviewed one PSSR for a startup due to an unplanned shutdown and one PSSR for the restart of a boiler. Per interview with the MOC/PSSR focal point, no turnaround has occurred since the CalARP Program 4 regulation was implemented beginning on October 1, 2017. No significant issues were noted with the completed MOC/PSSR packages.




Does/did the stationary source confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that process equipment is maintained and operable in accordance with design specifications including construction, maintenance, and repair work performed? [T19 CCR §2762.7(b)(1-2) & ISO Section 450-8.016(a)(7)(B)]

Section 6.2 of the PSSR policy identifies questions built into the MOC module in the Knowledge Management System (KMS) used to manage electronic MOCs/PSSRs. An example of such questions can be seen by Attachment 1 (PSSR Questions in KMS), Questions 1 and 2 which address the condition and operability of process equipment: - Are the facilities mechanically complete?- Is field construction, installation, maintenance work, and equipment in accordance with design specification and approved drawings?

Several other Attachments and KMS PSSR modules included similar questions, but were varied based on the specificity required by the type of change employed. The majority of questions dedicated to the various PSSR checklists were dedicated to verification of physical systems and their compliance with Shell's internal standards.

CCHMP reviewed the sampling of completed MOC/PSSR packages mentioned in A43-02 which included a redundant check of the construction, maintenance, and repair work performed on process equipment is conducted prior to the introduction of regulated substances to a process.

Y NoneNew




Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that effective safety, operating, maintenance, and emergency procedures are in place and adequate? [T19 CCR §2762.7(b)(3) & ISO Section 450-8.016(a)(7)(B)]

Attachment 1 (PSSR Questions in KMS), Questions 9, 10, 12 and 13 address the availability of effective procedures: - Are necessary startup, shutdown, operating, and special procedures in place? - Are necessary maintenance procedures in place? - Have the emergency procedures been updated if necessary (unit operation emergency)?- Have the safety and emergency response procedures been updated if necessary?

Similar questions addressing safety, operating, and emergency procedures are found in Attachments 2 and 4 in the PSSR policy as well as 6 of the 9 KMS PSSR module templates. However, not all Attachments and KMS templates included a verification item for maintenance procedures, which encompass all written procedures used to ensure the ongoing integrity of process equipment. As such, CCHMP identifies the current PSSR program as having a gap in addressing the potential impacts of a change on maintenance procedures.

CCHMP reviewed a sampling of completed MOC/PSSR packages and noted that the PSSR section verified that the necessary startup, shutdown, operating, maintenance (when the template used included a verification), emergency and special procedures are in place and that a redundant check was completed prior to the introduction of regulated substances to a process.

P Ensure that the PSSR process captures and verifies that effective maintenance procedures are in place and adequate.

Abr




Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a new covered process or new process unit, that a PHA, Hierarchy of Hazard Control Analysis, Damage Mechanism Review and Safeguard Protection Analysis have each been performed and recommendations have been resolved or implemented before startup? [T19 CCR §2762.7(b)(4) & ISO Section 450-8.016(a)(7)(B)]

1. It is not necessary that all recommendations resulting from a PHA be implemented before startup. However, all of the recommendations resulting from a PHA need to be addressed or resolved, although it may not be necessary in every case to complete all of the recommendations prior to startup [29 CFR 1910.119 preamble].

Attachment 1 (PSSR Questions in KMS), Question 3 addresses recommendations from two analyses:- Have all recommendations or gap closures from Hazard Assessment and Further Risk Analysis been incorporated into the design and implemented?

Per interview with the PSM Manager, no new processes have been constructed and is confirmed by a review of the PSSR sampling described in A43-02. However, the language of the PSSR policy, C(A)-14, and the templates used to document compliance should be updated to include the additional review of Hierarchy of Hazard Control Analyses, Damage Mechanism Reviews and Safeguard Protection Analyses prior to the introduction of regulated substances to a new covered process or new process unit.

N/A NoneNew


Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to new or modified processes, all changes have been implemented in accordance with the requirements contained in the management of change program, §2762.6 or Section 450-8.016(A)(6)? [T19 CCR §2762.7(b)(4) & ISO Section 450-8.016(a)(7)(B)]

* Review corresponding management of change records to ensure that they were completed in accordance with T19 CCR §2762.6. 1. A PHA is not necessarily required prior to startup of a modified stationary source. Actions necessary prior to startup of modified stationary sources must follow MOC process [Preamble to 29 CFR 1910.119].

Attachment 2 (PSSR Form - Process Units), Question 3 addresses the requirement that all changes are implemented in accordance with the requirements contained in the MOC program:- Have MOC requirements for new or modified facilities being met prior to start up?

A similar question is directly included in Attachments 2 and 4 of the 9 KMS PSSR module templates. However, the remaining 7 templates include questions related to verifying that items related to PSI and health and safety evaluations were addressed.

Per interview with the MOC/PSSR focal point, Attachment 2 is to be completed by operations prior to starting up any process units following a maintenance turnaround or extended downtime and is external to the KMS process.

Y None




Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that training of each operating employee and maintenance employee affected by the change has been completed? [T19 CCR §2762.7(b)(5) & ISO Section 450-8.016(a)(7)(B)]

1. All documents or information developed or collected by the owner or operator related to the PSSR should be accessible including information that might be subject to protection as a trade secret. [T19 CCR §2762.10(a)(3)]

Attachment 1 (PSSR Questions in KMS), Questions 14 and 15 address the training of operations and maintenance personnel affected by the change (both questions include a statement to attach training documentation):- Have the affected onshift operators been informed of and trained in the change? - Have the affected maintenance employee and contractors been informed of and trained in the change?

Similar questions concerning operator training are found in Attachments 2 and 4 in the PSSR policy as well as 9 of the 9 KMS PSSR module templates. However, verification of training of maintenance employees affected by the change is not universally covered and is only addressed in 5 of the 9 KMS templates. As all changes made via KMS require a PSSR to be completed and not all of the KMS PSSR templates address the training of affected maintenance employees, CCHMP identifies this as a gap in regards to addressing the training of affected maintenance personnel in the PSSR process.

CCHMP reviewed a sampling of completed MOC/PSSR packages which identify that a redundant check of the training provided to affected operations and maintenance personnel (if included in the KMS template) is conducted prior to the introduction of regulated substances to a process. CCHMP reviewed one completed MOC/PSSR package which included documented signoffs from operations personnel that received face-to-face training. The primary method of training involves an email notification sent to affected operations and maintenance personnel to inform them of the change. Per interviews with a Mentor and a Production Unit Manager, operators are also informed of upcoming changes through the start-of-shift meetings and receive informal face-to-face meetings with

P Ensure that the PSSR process captures and verifies that training to affected maintenance personnel is provided.

Abr


ID# Category Question Clarifications Findings Answer ActionsTypethe Operations Specialists or Operations-Maintenance Coordinators.


Does the submitted RMP and Safety Plan accurately reflect the Pre-startup Review Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


CCHMP reviewed the most recently submitted RMP (certification dated 6/20/2014) and noted that Section 4.4.6 accurately reflects the current PSSR program, but has not been updated to include Program 4 requirements. Shell has until September 30, 2019 to update the RMP. See A49-27 regarding updates to the RMP.

Page 21 of the Safety Plan includes the same description of the PSSR program as the submitted RMP and meets the ISO requirements.

Y NoneAbr




No action items were issued in the previous CalARP/ISO audit. This question is not applicable.

N/A NoneAbr


Did affected operating and maintenance employees and employee representatives effectively participate, throughout all phases, in performing PSSRs? [T19 CCR §2762.10(a)(1)]

Per interview with union representatives, there are currently no plans to include employees or employee representatives in the PSSR process outside of consultation on select action items. See A46-01 regarding the employee participation policy with regards to PSSR.

N/A NoneNew




Did the owner or operator provide effective training to employees and employee representatives before serving on a PSSR team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions? [T19 CCR §2762.4(e)]

Section 7.0 of the PSSR policy does not identify operators or maintenance personnel or their representatives as responsible parties for PSSRs. Additionally, Section 8.0 of the PSSR policy states that PSSR awareness training is required for the following individuals: Operations Shift Team Leaders and Mentors, Production Specialists, Production Unit Managers, Operations Support engineers, PEI engineers, Electrical engineers, Control Systems engineers, Machinery engineers, Reliability engineers, Process Safety engineers, and H&S department engineers. The PSSR policy does not include discussion of a PSSR team as individuals are assigned to review specific elements for each MOC based on the expertise required to review and approve the change. Per interview with union representatives, there are currently no plans to include employees or employee representatives in the PSSR process that would require being trained on completing PSSRs. See A40-13 regarding the provision of training to satisfy Program 4 requirements.

N/A NoneNew


A44 - CalARP Prevention Program: Compliance Audits (Program 4)



Has the owner or operator conducted an effective compliance audit every three (3) years and certified that the owner or operator has evaluated the procedures and practices developed under this Article to verify that the procedures and practices are in compliance with the provisions of this Article, and are being followed? [T19 CCR §2762.8(a) & ISO Section 450-8.016(a)(8)(A)]

* Review the certified audit reports. 1. The effective date of the P4 compliance audit requirement was 10/1/2017 making the first P4 compliance audit due by 10/1/2020. Until then stationary sources are still required to conduct and certify compliance audits to comply with ISO requirements. [T19 CCR §2762.8(a) & ISO Section 450-8.016(a)(8)(A)]2. The start point of the three-year compliance audit cycle under the RMP/CalARP program has the following effective dates: a) June 21, 1999 for stationary sources subject to the federal RMP program; b) June 21, 2002 for stationary sources subject to the state CalARP program, but not subject to the federal RMP program. [T19 CCR §2745.1 and CCHMP interpretation]3. The first compliance audit for stationary sources that comply with the federal PSM standard, 29 CFR §1910.119 is required by May 26, 1995. [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994]4. CalOSHA'’s PSM standard, T8 CCR §5189, does not specify a frequency for conducting the Injury and Illness Prevention Program audits. However, federal PSM specifies three years. CalOSHA uses the three-year frequency in their compliance checklist. 5. Employers must certify in writing that there has been a PSM compliance audit at least every three years [OSHA Instruction CPL 2-2.45A CH-1 Appendix B-Clarifications and Interpretations of the PSM Standard September 13, 1994].6. This Article refers to Program 4

Per review of the facility's compliance audit policy, Procedure C(A)-29, Internal Assurance (Revision 5, dated October 2016) SMR internal audits are completed every 3 years.

Per review, Shell Martinez Refinery (SMR) conducted compliance audits in 2014 (4/28-5/02) and 2017 (4/10-4/13). Each compliance audit had a certification page that was signed by the General Manager at the time of the audit. This certification page includes PSM/RMP/CalARP/ISO Compliance Audit Certification.

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTyperequirements (Article 6.5).


Did the compliance audit document that the audit was conducted by at least one person knowledgeable in the process and the Program 4 requirements including their qualifications? [T19 CCR §2762.8(b & c) & ISO Section 450-8.016(a)(8)(B)]

* Review audit team member qualifications. 1. “Knowledgeable in the process” refers to knowledge in the covered process that has a regulated substance.2. Audits should be led by a person knowledgeable in audit techniques and who is impartial to the facility being audited. [29 CFR 1910.119 – Appendix C]

Per review of the compliance audit reports for 2014 and 2017, the compliance audit for 2014 was led by Shell Upstream America which is an entity within Shell that is not part of SMR. For the 2017 audit, SMR did the audit in house. The audit was led by a member of the Manufacturing, Excellence, and Support (ME&S) Group. Per interview, the audit lead had experience performing internal audits. Per SME, whenever the audit team covered a process area, the team would consult with an operator who had experience working in that particular area. Since the 2017 compliance audit was performed before the Program 4 requirements took effect, that audit would not be required to cover Program 4 requirements.

Y None


Has the owner or operator prepared a written report of the compliance audit that includes the scope, methods used, questions asked to assess each program element along with findings and recommendations of the compliance audit? [T19 CCR §2762.8(c), §2762.16(e)(15) & ISO Section 450-8.016(a)(8)(C)]

* Review the compliance audit report, which must document completion date and assignment of responsibility for completion of each corrective action. [T19 CCR §2762.16(e)(7)]

Per review, the 2014 and 2017 audit reports included the scope, method used, and questions asked to assess the different programs. The reports included findings and recommendations for each along with the responsible party. In the 2014 report, SMR did not provide the entire report to CCHMP including the questions that were asked during the audit. This was documented in the previous CalARP/ISO audit performed in 2014. For the 2017 report, the questionnaires used for the audit were the CCHMP Program 3 audit and ISO questionnaires that covered topics such as PSI, PHA, operating procedures, training, MI, MOC, PSSR, compliance audits, incident investigations, employee participation, contractors and ISO topics. SMR completed the Abridged questions and attached the results along with findings and target completion dates.

Y NoneAbr




Does/did the owner or operator after the completion of the compliance audit promptly determine and document an appropriate response to each of the findings of the compliance audit and complete the corrective action within one and one half (1.5) years or during the first regularly scheduled turnaround for items requiring a process shutdown? [T19 CCR §2762.8(d), §2762.16(e)(12-13) & ISO Section 450-8.016(a)(8)(D)]

1. The owner or operator must demonstrate in writing that it is not feasible to do so [complete the corrective action]. [T19 CCR §2762.16(e)(12)2. Turnaround means planned total or partial shutdown of a petroleum refinery process unit or plant to perform

maintenance, overhaul or repair of a process and process equipment, and to inspect, test and replace process materials and equipment. Turnaround does not include unplanned shutdowns that occur due to emergencies or other unexpected maintenance matters in a process unit or plant. Turnaround also does not include routine maintenance, where routine maintenance consists of regular, periodic maintenance on one or more pieces of equipment at a refinery process unit or plant that may require shutdown of such equipment. [T19 CCR §2735.3(www)]

Per review of policy C(A)-27, in the section Target Dates, the procedure states that target dates shall be set for completion within 1.5 years of performance of the audit, or during the next turnaround for those items requiring a turnaround for completion.

Per interview with the SME, the 4 recommendations from the 2014 compliance audit have all been closed. CCHMP was given a copy of the recommendations and all of the recommendations had been closed and were closed within 1.5 years. None of the recommendations were rejected. For the 2017 compliance audit, 5 of 16 recommendations have been closed. None of the recommendations had been rejected. The remaining 11 recommendations all have target completion dates that will meet the 1.5 year timeline per the new regulation that took effect in 2017.

Y NoneAbr




Does/did the owner or operator append the report with the actual completion dates when deficiencies were corrected? [T19 CCR §2762.16(e)(15) & ISO Section 450-8.016(a)(8)(D)]

* Review the documentation regarding tracking of changes to correct deficiencies, including how scheduled dates are changed.1. The stationary source needs to document the final resolutions taken and actual completion dates when deficiencies were corrected. [CCHMP interpretation]

Per review of the Compliance Audit reports from 2014 and 2017, only the action items from the 2014 Compliance Audit have been completed. A table of completed action items is kept in FAM. SMR has since replaced FAM with a new system called RADAR which is now used to store action items. The Compliance Audit reports and completed recommendations are maintained at the facility and can be provided upon request. For the 2017 Compliance Audit, only 5 of 16 recommendations have been completed so far and the rest of the action items have target completion dates that will meet the required 1.5 year regulatory timeline. Per policy C(A)-27, Target Date changes are to be approved via email and this email will be attached to the action in FAM. This approval will include the unit or area manager, the appropriate refinery team leader (RTL) sponsor and the assurance coordinator (AC). The AC will determine who is required to grant final approval which could include the Regional Vice President depending on the risk ranking of the finding and the category of the assurance project.

Y NoneAbr


Does the owner or operator retain the three most recent compliance audit reports? [T19 CCR §2762.8(e) & ISO Section 450-8.016(a)(8)(E)]

1. The effective date of the P4 compliance audit requirement was 10/1/2017 making the first P4 compliance audit due by 10/1/2020. Until then stationary sources are still required to maintain the two most recent compliance audits to comply with ISO requirements. [T19 CCR §2762.8(e) & ISO Section 450-8.016(a)(8)(E)]

CCHMP reviewed the two previous Compliance Audits completed in 2014 and 2017. The 2017 Compliance Audit was completed before October 2017. This meets the requirement of ISO as the Program 4 requirement did not take effect until October 2017. Starting with the next Compliance Audit performed, three audit reports must be kept by the facility.

Y NoneAbr




Does the submitted RMP and Safety Plan accurately reflect the existing Compliance Audits Programs at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


Both the 2014 RMP and the 2016 Safety Plan accurately reflect the existing Compliance Audit programs at the stationary source at the time that each was updated. The Shell Martinez Refinery is aware of the changes to the requirements for compliance audits in 2017 and that these corrections will be included in the next RMP update.

Y NoneAbr




There was one Ensure action item from the previous audit and it has been addressed.

Y NoneAbr


Has the owner or operator made the compliance audit report available to employees and employee representatives for review and comment? [T19 CCR §2762.8(c) & §2762.10(a)(3)]

* Review any written comments by employees and owner or operator responses on the compliance audit report.

1. Program 4 states that “The owner or operator shall respond in writing within 60 calendar days to any written employee or employee representative comments on the written audit report.” [T19 CCR §2762.8(c)]

Per interview with SME, once the Compliance Audit report is complete, an email is sent to the employees and employee representatives informing them that the Compliance Audit report is complete. Any employee may view the report in the PSM department as the report is not made available online or distributed to the facility outside of the leadership team.

Y NoneNew




Has the owner or operator followed the corrective action work process documented in §2762.16(d) and (e) when developing the resolution and implementation of compliance audit recommendations? [T19 CCR §2762.8(d)]

1. As part of the ARP Management System, the owner or operator shall develop and document a corrective action work process to address findings and recommendations including:a) Rejection of recommendations;b) Alternative safeguards;c) Written comments by team members; written comments on any rejected or changed findings and recommendations; andd) Final decision for each recommendation [T19 CCR §2762.16(d & e)]2. Program 4 states, “The owner or operator shall develop and document corrective actions to implement each accepted recommendation, including documentation of a completion date and assignment of responsibility for completion of each corrective action. All target dates shall be consistent with the requirements of subsections (10) through (13) for completion of corrective action items.” [T19 CCR §2762.16(e)(7)]

Per review of policy C(A)-29, the findings and corrective actions from the internal audits and external audits are recorded in FAM by the assurance coordinator. C(A)-27, Fountain Assurance Manager (FAM) Practice, Revision 12, dated November 2016, provides the work process for managing findings and action items from audits and other sources. In the Implement Mitigation section there is a statement that the action taken to close out a recommendation or action item should effectively address the action required. "If this differs from the action required, the auditee needs to agree to any changes and document in FAM." It also states that the Action Party, "should verify the effectiveness of the corrective action with their Line Manager before closure in FAM."

Y NoneNew




As part of performing the compliance audit, has the owner or operator consulted with operators with expertise and experience in each process audited and documented the findings and recommendations from these consultations in the audit report? [T19 CCR §2762.8(f)]

Per review of policy C(A)-29, the Internal Audit Selection and Competency, the audit pool includes individuals from all levels of the organization and across different disciplines and departments. However, the procedure does not specify that an operator with a particular skill set will be consulted or that the recommendations made by the operator will be captured in the compliance audit.

Per interview with the SME, the compliance audit teams for both the 2014 audit and the 2017 audit consulted with operators with expertise and experience whenever the audit team went out to a process unit or an area that required specific expertise. However, the recommendations that came from the operators were not documented separately. These recommendations were included as part of the overall recommendations.

Y NoneNew


A45 - CalARP Prevention Program: Incident Investigation (Program 4)



Has the owner or operator developed, implemented, and maintained effective written procedures for promptly investigating and reporting any incident that results in or could reasonably have resulted in a major incident, or catastrophic release of a regulated substance? [T19 CCR §2762.9(a) & ISO Section 450-8.016(a)(9)(A)]

* Review the Incident Investigation procedures to ensure they include an effective method for conducting a thorough RCA. Note: RCAs are only required for MCARs [ISO Section 450-8.016(a)(9)(A)] and incidents that resulted in or could reasonably have resulted in a major incident. [T19 CCR §2762.9(b)]. Catastrophic releases require an incident investigation [ISO Section 450-8.016(a)(9)(A)]. See A57-01 for review of MCAR events.* Review the Incident Investigation policy to ensure the P4/ISO stationary source has a process to conduct an HCA/ISSA on recommendations from a major incident investigation or if the investigation recommends a “major change” that could reasonably result in a MCAR. They should have a policy that defines major change and have criteria for how site personnel would determine whether a change could reasonably result in a MCAR. Policy wording should also identify to complete HCA/ISSA as soon as administratively practicable after completion of the incident investigation report. [ISO Section 450-8.016(i)(1)(D)]* Review incident investigation records for any qualifying recommendations that trigger HCA/ISS and provide records to auditor doing A59 so HCA/ISS can be evaluated.

CCHMP reviewed the Incident Investigation Procedure: I(A)-6/EM-11.1 Investigations and Incident Reporting (rev.15, dated Sept 2016) which includes requirements for reporting and investigating MCARs, potential MCARs, and catastrophic releases and still references the Program 3 section of CalARP regulations (2760.9), and ISO. CCHMP notes the procedure does not include the new Program 4 requirements (effective 10/1/17) for incident investigation defined in section 2762.9 of the CalARP regulations, meaning there is no mention of major incidents or incidents that could have reasonably resulted in a major incident.

The procedure identifies requirements for conducting an ISSA for investigation recommendations involving a major change that could reasonably result in a MCAR. CCHMP notes that this is the previous requirement under ISO, and that the current requirement under CalARP Program 4 states a HCA/ISSA must be conducted for any major change resulting from recommendations, regardless of incident potential. See A58-01 for more discussion on this topic.

The incident investigation procedure must be updated to include the new CalARP Program 4 requirements. CCHMP was informed that a draft incident investigation policy is currently in-progress to include P4 requirements. CCHMP was unable to review this draft policy during the audit.

Per CCHMP's review, the incident investigation procedure identifies that all personnel are required to report any incident they are aware of to the appropriate supervisor as soon as possible. The supervisor is responsible for gathering facts and reporting the incident to the Department Manager. Incidents are reported into the Fountain Incident Management (FIM) database. Requirements for reporting incidents in FIM are further defined in procedure I(A)-18 Incident Reporting (rev. 8, dated Sept 2014). This document includes procedures for employees to enter incidents into FIM ("First Report"), and submit a "0-60 report" to

P Ensure that the incident investigation procedure is revised to include steps for reporting and conducting an effective RCA investigation for any incident that results in or could have reasonably resulted in a major incident, and that the procedure is implemented and maintained. The revised procedure needs to include the definition of Major Incident per CalARP Program 4 regulations.

Ensure that any incidents that occurred after 10/1/17 are reassessed for major incident and potential major incident applicability and investigated as necessary using appropriate employee participation.

Ensure that incidents that resulted in, or could have reasonably resulted in a MCAR are investigated using

Abr


ID# Category Question Clarifications Findings Answer ActionsType* Review how the stationary source defines an "incident that could reasonably have resulted in a major incident or catastrophic release of a regulated substance" and how and when they investigate these types of events. This may include "near misses". "Near misses" are an incident that has the potential for injury and/or property damage. [Guidelines for Auditing Process Safety Management Systems - CCPS]

1. Major incident: an event within or affecting a process that causes a fire, explosion or release of a highly hazardous material, and has the potential to result in death or serious physical harm (as defined in Labor Code Section 6432(e), or results in an officially declared public shelter-in-place, or evacuation order. Serious physical harm means any injury or illness, specific or cumulative, occurring in the place of employment or in connection with any employment, that results in any of the following: (1) Inpatient hospitalization for purposes other than medical observation; (2) The loss of any member of the body; (3) Any serious degree of permanent disfigurement; (4) Impairment sufficient to cause a part of the body or the function of an organ to become permanently and significantly reduced in efficiency on or off the job, including, but not limited to, depending on the severity, second-degree or worse burns, crushing injuries including internal injuries even though skin surface may be

quickly notify appropriate personnel and leadership of an incident via email. CCHMP was informed that the 0-60 report is a copy of the First Report entered into FIM. CCHMP reviewed the 0-60 report emails for the incidents mentioned later in this question. Each 0-60 report contained the following: department or unit responsible, title or short description of the incident, full incident description, specific location where incident occurred, responsible supervisor, date incident occurred, immediate corrective actions taken, and classification as near miss or incident with consequence.

The procedure also defines steps and responsibilities for screening FIM First Reports and routing the incident First Report to the appropriate supervisor ("Responsible Supervisor") for review and to complete more questions in FIM about the incident, conduct risk ranking and determine if the incident should be investigated ("First Input" module). Once the First Input is completed by the Responsible Supervisor, the submitted incident is officially established in FIM where immediate corrective actions are assigned (where appropriate), and investigation of the incident is determined and tracked to closure. CCHMP was informed per SME interview that the FIM database is used to track incidents company-wide, and CCHMP confirmed this via live-navigation of FIM.

The incident investigation procedure I(A)-6 includes steps to classify the actual and potential severity of incidents using the Downstream Manufacturing (DSM) Risk Assessment Matrix (RAM) in Attachment A of the procedure. The RAM matrix defines severity on a scale of 0 to 5 (5 being most severe), and likelihood on a scale of A to E (E being more likely). The consequences are defined for each severity level for the following categories: People, Assets, Environment, and Reputation. CCHMP notes that incidents classified as 3 or higher for severity using RAM would likely be a CalARP-qualifying incident. Per the procedure, appropriate level (Level 1, 2, or 3) and method of investigation (Causal Learning, TOP, Tech Study, etc.) is determined based on the incident classification. These levels and methods are defined in the procedure.

CCHMP notes that Level 3 is the highest level of

the appropriate investigation method, as required per the SMR incident investigation procedure.


ID# Category Question Clarifications Findings Answer ActionsTypeintact, respiratory illnesses, or broken bones. [T19 CCR §2735.3(ii) & Labor Code Section 6432(e)]2. “Catastrophic release” means a major uncontrolled emission, fire, or explosion, involving one or more regulated substances that presents an imminent and substantial endangerment to public health and the environment. [T19 CCR §2735.3(l)]

investigation used at the stationary source that is intended to define the root causes of the incident, and may take multiple weeks to complete. Level 3 investigations could use the Causal Learning methodology or a root cause analysis (RCA). Level 2 investigations typically take 1-2 weeks and could be a Tech Study or a combination of TOP and Causal Learning (TOP/CL), where TOP (triangle of prevention) is an investigation technique used by USW workers. CCHMP was informed that a Tech Study is typically used for incidents that involved an equipment failure, and TOP/CL is used to for incidents that involved a human element and is a causally reasoned method that uses a timeline and cause/effect diagram to identify causes.

Per the incident investigation procedure, MCARs will be investigated with a root cause methodology (Level 3 investigation), and potential MCARs will be investigated with either Level 2 or Level 3 investigations. Per interview with SME, catastrophic releases would be investigated using a Level 3 investigation, and near miss catastrophic releases could be investigated using Level 2 or 3 investigations depending on the incident.

CCHMP reviewed a list of incidents and near misses since the previous CalARP/ISO audit (May 2015 to March 2018) maintained in FIM (about 1000), and lists tracking open and closed investigations over this time period. One list has closed out investigations from 8/17/15 to 8/16/17. CCHMP notes that this list includes 19 total incidents indicating if classified as MCAR, or potential MCAR. The incidents are classified as follows: one MCAR, 4 potential MCARs, 14 blank/other. CCHMP notes that none of these qualify as major incidents/potential major incidents since they occurred before 10/1/17. The second list has open investigations from 9/7/17 to 2/12/18 (9 total, 4 potential MCARs, 5 blank/other). CCHMP notes that 3 of the potential MCARs and two of the other incidents occurred after 10/1/17, meaning these could qualify as major incident/potential major incidents. The stationary source should reassess incidents that occurred after 10/1/17 for major incident and potential major incident applicability, and conduct an RCA for these incidents using appropriate employee participation if they qualify. Additionally, CCHMP notes that 3 of the


ID# Category Question Clarifications Findings Answer ActionsTypepotential MCARs are being investigated using a Tech Study Level 1 investigation, which is not consistent with the procedure which says a Level 2 or 3 would be used.

CCHMP was informed that only the closed investigations have a completed report for review. CCHMP reviewed a sample of 6 investigation reports for the following incidents (including dates incidents occurred and investigation methodology used):

1. F44 Tube Leak (4/26/16); CL Level 32. FXU Tubing Failure and Release (8/16/17); TOP/CL Level 33. Loss of SP2 Sulfur Seal #2 (1/11/17); TOP/CL Level 24. HCU TA H2S exposure (100 ppm) (5/2/17); TOP/CL Level 25. Tier 1 Release of Antioxidant and Gasoline (3/28/17); TOP/CL Level 26. Loss of Power to Substations 1203 & 1206 (12/19/16); TOP/CL Level 2.

Per the closed investigation tracking list, incident 6 was classified as an MCAR, and incidents 2-5 were classified as potential MCARs. Per SME interview, incident 1 should have been classified as a potential MCAR.

CCHMP identified that the MCAR incident was investigated using a Level 2 investigation, which is not the appropriate level as required per the incident investigation procedure (Level 3). See questionnaire A57 for more discussion on this MCAR investigation report.

CCHMP was informed that no catastrophic releases have occurred at the stationary source since the previous CalARP/ISO audit. Upon review of the incidents entered into FIM, CCHMP was unable to identify any catastrophic releases.




Was an incident investigation team established and did it, at a minimum, consist of:a) A person with expertise and experience in the process involved;b) A contractor employee and contractor employee representative if the incident involved work of the contractor; c) A person with expertise in overseeing the investigation and analysis;d) Other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident; ande) A person with expertise in the owner or operator’s incident investigation methodology? [T19 CCR §2762.9(d) & ISO Section 450-8.016(a)(9)(C)]

* Review the II/RCA report to look for affected operating and maintenance employees and employee representative participation in all phases. [T19 CCR §2762.10(a)(2)] Note: should include related review such as DMR and HCA. Selected employee should not be person involved in the incident or presents a conflict of interest.

1. The incident investigation team must implement the owner or operator’s root cause analysis method to determine the underlying causes of the incident. [T19 CCR §2762.9(e) 2. Stationary sources need to develop in-house capability to investigate incidents occurring in their facilities. This is optional, but should be considered. [29 CFR 1910.119 – Appendix C]3. Investigation team members need training in investigation techniques including (a) conducting interviews of witnesses, (b) documentation of information, and (c) investigation report writing. This is optional, but should be considered. [29 CFR 1910.119 – Appendix C]

As mentioned in A45-01, CCHMP reviewed a sample of 5 investigation reports for the following incidents that were identified as potential MCARs at the stationary source:

1. F44 Tube Leak (4/26/16)2. FXU Tubing Failure and Release (8/16/17)3. Loss of SP2 Sulfur Seal #2 (1/11/17)4. HCU TA H2S exposure (100 ppm) (5/2/17)5. Tier 1 Release of Antioxidant and Gasoline (3/28/17)

Each investigation report documented the investigation team members. CCHMP notes that each team included a person with expertise in the incident investigation methodology, a person with expertise in overseeing the investigation and analysis, and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident (e.g. engineers, heat transfer specialists, etc.). See A57-08 and A57-09 for additional discussion on team composition for the 2016 MCAR investigation. CCHMP identifies that one of these incidents (number 5, above) involved the work of the contractor, however a contractor employee and representative were not documented as being on the investigation team. Per interview with SME, the contractor company was interviewed and provided information as part of the investigation, however this was not documented. CCHMP found that whether the team included a person with expertise and experience in the process involved was not consistently documented in the investigation report. Per interview with SME, personnel with expertise and experience in the process involved in the incident were consulted during the investigations. CCHMP believes it would be beneficial to document in the report the additional key personnel consulted during incident investigations, but were not on the main investigation team.

As mentioned in A45-01, the incident investigation procedure has not been updated to include CalARP Program 4 requirements for incident investigations, meaning that the stationary source does not have a system to identify, report, and investigate incidents that resulted in, or could have reasonably resulted in a major incident. CalARP Program 4 requires that these incidents are investigated using a root cause analysis

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsType(RCA). The incident investigation procedure should be revised to include the CalARP Program 4 RCA team composition requirements for investigations of incidents that resulted in or could have reasonably resulted in a major incident.

CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents.

A45-04 ISO Did the stationary source promptly address and resolve incident report findings and recommendations and was a report prepared at the conclusion of every investigation? [ISO Section 450-8.016(a)(9)(D &

1. This question applies to all non-RCA incident investigation reports.2. Report shall include the date of the incident, date investigation began, description of the incident, factors that contributed to the incident, recommendations resulting from the incident, and if recommendation is applicable refinery-wide.3. ISSA needs to be performed for any II recommended major change that could reasonably result in an MCAR.

CCHMP notes that reports were prepared at the conclusion of the investigation for the 5 potential MCAR incidents mentioned in A45-03. Per CCHMP review, each report documented the following: date and time the incident began, team members, incident summary, impact/problem statement, background/process description, narrative timeline/sequence of events, cause analysis/factors that contributed to the incident, recommendations resulting from the incident, and whether a recommendation is applicable refinery-wide. CCHMP notes that all but 1 report included the date the investigation began. CCHMP was unable to verify that this date is documented.

CCHMP reviewed the status of the recommendations from the 5 potential MCAR incidents listed below:

1. F44 Tube Leak (4/26/16): 3 recommendations; all closed out by the target date.2. FXU Tubing Failure and Release (8/16/17): 6 recommendations; 1 closed out by the target date, 5 not completed and not yet due.3. Loss of SP2 Sulfur Seal #2 (1/11/17): 1 recommendation; closed out by the target date.4. HCU TA H2S exposure (100 ppm) (5/2/17): 2 recommendations; 1 closed out by the target date and 1 not completed and not yet due.5. Tier 1 Release of Antioxidant and Gasoline (3/28/17): 4 recommendations; all closed out by the target date.

Y NoneAbr




Does the RCA incident investigation report include the following:a) Date and time of the incident;b) Date and time the investigation began;c) A detailed description of the incident;d) The factors that caused or contributed to the incident, including direct causes, indirect causes and root causes, determined through the root cause analysis; e) A list of any DMR(s), PHA(s), HCA(s), and Safeguard Protection Analyses (SPA(s)) that were reviewed as part of the Investigation; f) Interim recommendations to prevent a recurrence or similar incident; g) Recommendations for permanent corrective action [T19 CCR §2762.9(i)]h) Whether the cause of the incident and/or recommendations resulting from the investigation are specific only to the process or equipment involved in the incident, or are applicable to other onsite processes or equipment? [ISO Section 450-8.016(a)(9)(D)]

* Review report to make sure that HCAs performed for recommendations resulting from a major incident are appended to the final investigation report. [T19 CCR §2762.9(g)]. Note: number of HCAs performed should be referred to A59-01 for review.* Verify the investigations were started within 48 hours of the incident. [T19 CCR §2762.9(c)]

1. The team shall develop recommendations to address the findings of the investigation. [T19 CCR §2762.9(g)]2. CCHMP recommends the report include the information that is required in §2750.9(b) of the 5-year accident history: (a) date, time, and approximate duration of the release, (b) regulated substance(s) released, (c) estimated quantity released in pounds, (d) type of release event and its source, (e) weather conditions if known, (f) onsite impacts, (g) known offsite impacts, (h) initiating event and contributing factors if known, (i) whether offsite responders were notified if known, (j) operational or process changes that resulted from investigation of the release [T19 CCR §2750.9(b)].

Per CCHMP review of the 2016 MCAR investigation report (i.e., Loss of Power to Substations), the investigation began within 48 hours of the incident. The report also included recommendations, see A57-04 for more details.

The investigation procedure, I(A)-6/EM-11.1, includes a list of minimum required elements to be included in MCAR investigation reports. CCHMP notes that these include elements a-j from section 2750.9(b) of the CalARP regulations, and element h from this question. See A57-11 for discussion of additional elements required under ISO, and the actual contents included in the 2016 MCAR investigation report. CCHMP notes that element h of this question is included in the 2016 MCAR investigation report. CCHMP identifies that the MCAR report also includes most elements from section 2750.9(b) required per the incident investigation procedure, except approximate duration of release, regulated substance(s) released, estimated quantity released in pounds, weather conditions if known, and whether offsite responders were notified if known.

As mentioned in A45-01, the incident investigation procedure has not been updated to include CalARP Program 4 requirements for incident investigations, meaning that the stationary source does not have a system to identify, report, and investigate incidents that resulted in, or could have reasonably resulted in a major incident. CalARP Program 4 requires that these incidents are investigated using a root cause analysis (RCA).

CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents. This means that no subsequent HCAs have been performed for resulting recommendations from a major incident.

CCHMP identifies that the incident investigation procedure should be revised to include elements a-g of this question. It is suggested that elements a-j in section 2750.9(b) be included in the RCA report for a

P Ensure that MCAR investigation reports include at a minimum all elements required per the stationary source incident investigation procedure, I(A)-6/EM-11.1, or modify the procedure.

New


ID# Category Question Clarifications Findings Answer ActionsTypemajor incident, or incident that could have reasonably resulted in a major incident.


Did/does the owner or operator address and resolve each corrective action from an RCA incident investigation including interim actions and document the final resolutions promptly but no later than one and one-half (1.5) years after the completion of the investigation unless the owner or operator demonstrates in writing that it is infeasible to do so? [T19 CCR §2762.9(g & l), §2762.16(e)(12) & ISO Section 450-8.016(a)(9)(E)]

1. Recommendations must include interim actions that will reduce the risk of recurrence or similar incident until final actions can be implemented. [T19 CCR §2762.9(g)]2. The owner or operator may reject a team recommendation if the owner or operator can demonstrate in writing that one of the following applies:(A) The analysis upon which the recommendation is based contains material factual errors;(B) The recommendation is not relevant to process safety; or(C) The recommendation is infeasible; however, a determination of infeasibility shall not be based solely on cost. [T19 CCR §2762.16(e)(2)]3. The owner or operator may change a team recommendation if the owner or operator can demonstrate in writing that an alternative inherent safety measure would provide an equivalent or higher order of inherent safety, or, for a safeguard recommendation, an alternative safeguard would provide an equally or more effective level of protection. [T19 CCR §2762.16(e)(3)]4. Each corrective action requiring a process shutdown shall be completed during the first regularly scheduled turnaround of the applicable process, subsequent to completion of the incident investigation, unless the owner or operator demonstrates in writing it is not feasible to do so. [T19 CCR §2762.16(e)(13)]

See A57-04 for discussion on how the recommendations from the 2016 MCAR investigation (i.e., Loss of Power to Substations) were resolved. CCHMP notes that all 4 recommendations were resolved no later than 1.5 years after the completion of the investigation, which is consistent with the incident investigation policy.


CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents. See A45-01 for further discussion regarding this topic and related ensure item.

CCHMP identifies that the incident investigation procedure does not include requirements for addressing recommendations from a RCA for a major incident, or incident that could reasonably have resulted in a major incident. The procedure also does not include criteria for when the stationary source can reject or change a recommendation from the incident investigation.

R NoneAbr




Has the owner or operator tracked each recommendation with a corrective action plan to completion and appended the documentation of completion with actual completion dates to the incident investigation report? [T19 CCR §2762.9(l), §2762.16(e)(15) & ISO Section 450-8.016(a)(9)(E)]

1. The corrective action plan shall include review, and revalidation as necessary, of the appropriate portions of all relevant PHAs and DMRs. [T19 CCR §2762.9(l)]

CCHMP was informed per SME that all recommendations and corrective actions from investigations are entered into the FIM database for tracking. Per CCHMP review of the FIM database, each recommendation is assigned a "FIM action #" in the database and includes the assigned individuals responsible for addressing the action, estimated completion date, and status (e.g. open, in-progress, closed). More information regarding each recommendation can be viewed including the actual completion date, actual actions taken, closure date, additional notes, etc. CCHMP notes that FIM action #'s are linked to the specific FIM Incident # for the incident they resulted from. When searching for a specific recommendation or action related to an incident, they can be located in the FIM database by either the FIM Incident # or the specific FIM action #.

CCHMP verified via live navigation with SME that the recommendations and corrective actions for the 2016 MCAR event were tracked to closure in the FIM database, as described above.

CCHMP also identifies that the recommendations for the 5 potential MCAR incident reports are tracked in FIM. See A45-04 for more discussion on the status of these recommendations.


CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents, and thus there are no resulting recommendations or corrective actions to track to closure.

Y NoneNew




Has the report been provided to and, upon request, reviewed with employees whose job tasks are affected by the incident and made available to operating, maintenance, and other personnel whose job tasks are relevant to the incident findings, including contractor employees where applicable? [T19 CCR §2762.9(k) & ISO Section 450-8.016(a)(9)(F)]

1. Investigation reports are to be provided upon request to employee representatives, and where applicable, contractor employee representatives. [T19 CCR §2762.9(k)]2. All documents or information developed or collected by the owner or operator related to the incident investigation program should be accessible to employees and employee representatives including information that might be subject to protection as a trade secret? [T19 CCR §2762.10(a)(3)]

Per interview with SME, learning sessions are used to report out incident investigation findings to personnel, however these learning sessions may not be consistently done for CalARP/ISO qualifying incidents and may not include all affected personnel whose job tasks are relevant to the incident findings including contract employees where applicable. These learning sessions are also not consistently documented.

CCHMP notes that a learning session was conducted for the 2016 MCAR incident to share findings with affected personnel. This session was conducted to address a recommendation from the investigation and was documented with a sign-in sheet including the names and positions of attendees and a date. See A57-04 for additional discussion on this item.

CCHMP was unable to review documentation that investigation findings were reviewed with affected personnel for the 5 potential MCAR incident investigations reviewed.

CCHMP was informed that investigation findings could also be communicated through the Learning From Incident (LFI) process. Per SME, in the LFI process the investigation report is sent to management/leadership of the unit affected with the expectation that management will share the findings of the report with appropriate staff. However, CCHMP was informed that there is no check to ensure that this review of the findings with staff was completed.

P Ensure that MCAR/potential MCAR investigation findings are reviewed with all affected personnel whose job tasks are relevant to the incident findings, including contract employees where applicable, and that this review is documented.


Are incident investigation reports retained for the life of the process unit? [T19 CCR §2762.9(m)]

1. ISO only requires reports to be maintained for five years so P4 is more conservative. [ISO Section 450-8.016(a)(9)(G)]

CCHMP was informed per SME interview that incident investigation reports are retained electronically in the FIM database indefinitely, which is consistent with the incident investigation procedure.

Y NoneNew



A45-14 ISO Are incidents "tracked" in any way to identify "trends" that may lead to prevention/risk reduction?

1. "Tracking trends" is optional for stationary sources; however it would be beneficial if stationary sources implement similar "optional” activities.

CCHMP was informed that incidents are tracked to identify trends that are used to prevent and reduce incidents from reoccurring. Per SME, there is a team of personnel at the stationary source that meets quarterly to present and discuss incident trends and identify potential items to improve on.

Additionally, on an annual basis the stationary source is required to complete an "LOPC Reduction Plan" and submit a presentation of the Plan to the Vice President of the company. Per interview with SME, this Plan includes information gathered from the team gathering incident trends. CCHMP reviewed an example of an LOPC Reduction Plan (dated May 2017), that identified the main issues identified regarding incident trends. The Plan also included a bar graph of refinery incidents for 2016 which broke down incidents by cause, and for each cause it displayed the distribution by refinery department. Some examples of causes include: human factors, operating manuals, MOC, flange/packing failure, inspection/testing, etc.

Y NoneAbr


Do the submitted RMP and Safety Plan accurately reflect the existing Incident Investigation Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The 2016 RMP (pgs. 56-58) and SP (pgs. 29-31) reflect the current Incident Investigation program at the stationary source. The RMP has not been updated to include CalARP Program 4 requirements. The stationary source has up to 24 months from when Program 4 became effective to update the RMP, or until 9/30/19. See A49-27 for more discussion on this topic and related consider item.

Y NoneAbr





There were no ensure action items related to this regulatory topic from the previous audit. This question does not apply.

N/A NoneAbr




Did the incident investigation team review the related DMRs that were performed and incorporate the applicable findings from these DMRs into the incident investigation? [T19 CCR §2762.9(f)]

1. P4 states, “As part of an incident investigation pursuant to section 2762.9, where a damage mechanism is identified as a contributing factor, the owner or operator shall review the most recent DMR(s) that are relevant to the investigation. If a DMR has not been performed on the processes that are relevant to the investigation, the owner or operator shall conduct and complete a DMR prior to implementation of corrective actions pursuant to section 2762.16(d) and (e).” [T19 CCR §2762.5(e)(3)]

As mentioned in A45-01, the stationary source does not have a procedure implemented for reporting and investigating major incidents or incidents that could reasonably have resulted in a major incidents. The incident investigation policy should be updated to include Program 4 incident investigation requirements including that the incident investigation team will review the related damage mechanism reviews (DMRs) that were performed and incorporate the applicable findings from these DMRs into the incident investigation.

Per CCHMP's review of the incident investigation tracking list maintained at the stationary source, 5 incidents occurred after CalARP Program 4 became effective (10/1/17). Each of these investigations is open, meaning that the investigation is in-progress and a final report has not been issued. CCHMP identified that 3 of 5 of these incidents were classified as potential MCARs, and 2 were not classified as MCAR or potential MCAR. Per interview with SME, none of these incidents were assessed for whether they qualified as major incidents or incidents that could have reasonably resulted in a major incident. Since these investigations are still open, CCHMP is not able to confirm if damage mechanisms were identified as contributing factors in any of these incidents.

Per interview with SME, if an a damage mechanism was related to an incident, the appropriate expertise (e.g. from the Pressure Equipment Integrity (PEI) group) would participate on the investigation team and necessary documentation regarding damage mechanisms including corrosion control documents (CCDs), would be reviewed as part of the investigation.

CCHMP notes that if any of these incidents are determined as major incidents or could have reasonably resulted in major incidents, and damage mechanisms are identified as contributing factors, then the related DMRs must be reviewed and applicable findings incorporated into the investigation.

N/A NoneNew




Did affected operating and maintenance employees and employee representatives effectively participate throughout all phases in the implementation of the incident investigation program? [T19 CCR §2762.10(a)(2)]

1. “All phases” may include employee participation in recommendation closure verification or other activities, check employee participation policy for details.

CCHMP identifies that this question is focused specifically on employee participation in implementing the CalARP Program 4 incident investigation program.

As mentioned in A46-01, the stationary source developed an employee participation procedure that requires for employees and employee representatives to effectively participate in all phases in the implementation of the incident investigation program under CalARP Program 4.

As mentioned in A45-01, the incident investigation procedure is currently being updated to include Program 4 requirements but has not been finalized and implemented. Also mentioned in A45-01, the facility has not clearly defined major incident, or those that could reasonably result in a major incident. As such, none have been identified to have occurred since the CalARP Program 4 regulations became effective (10/1/17). Ensure action items were listed in A45-01 to review past incidents, and if any meeting the definition of major incident were found to have occurred, investigate them with proper employee participation. CCHMP was informed per USW representatives that employees will participate in implementing the CalARP Program 4 incident investigation program.

CCHMP notes that currently employees are actively involved in incident investigations of incidents subject to CalARP Program 3/ISO.

R NoneNew


A46 - CalARP Prevention Program: Employee Participation (Program 4)



Did the owner or operator develop, implement and maintain a written plan to effectively provide for employee participation in the Accidental Release Prevention elements in consultation with employees and employee representatives throughout all phases in the development, training, implementation and maintenance of the Accident Release Prevention elements? [T19 CCR §2762.10(a)(2) & ISO Section 450-8.016(a)(3)]

* Review documents such as meeting minutes that would demonstrate this consultation including how the program should be implemented. 1. An authorized collective bargaining agent may select employee(s) to participate in overall CalARP program development and implementation planning and for employee(s) to participate in each team-based activity. [T19 CCR §2762.10(b) & ISO Section 450-8.016(a)(3)]2. Employee participation in “all phases” includes, but is not limited to:a) Initial, refresher and supplemental training provided to operators;b) Refresher and supplemental training provided to maintenance employees;c) Unit process hazards communicated to contract and maintenance personnel;d) Operator training to remain qualified;e) Operator training competency testing;f) Training provided to all affected employees on the Program 4 elements;g) Training for specialized teams (e.g., PHA, DMR, HCA, MOC, MOOC, PSCA, SPA, PSSR, incident investigation/RCA);h) Training provided to employees related to any CalARP Program (e.g., MOC, PSSR, Human Factors). [T19 CCR §2762.10(a) and §2762.4(f)]

CCHMP reviewed Process Safety Management policy (C(A)-4 rev. Feb., 2018) attachment 3 discusses the employee participation at SMR and that SMR actively encourages employee participation through all phases in performing PHAs, SPAs, HCAs, DMRs, MOCs, PSSRs, MOOCs, process safety culture assessments and incident investigations. It further states that the employee representatives (USW and IBEW) have the authority to select employees to participate in overall PSM program development and implementation planning and to participate in PSM teams and other activities related to PSM elements.

PHA: CCHMP reviewed I(A)-50 (rev. 7, 12/1/2016), section 6.1.1 states that process hazard analysis shall be performed by a team including at least one operations representative (qualified operator with at least 3 years experience with the process unit being assessed).

SPA: CCHMP was not provided any policy that address SPA/LOPA. CCHMP noted that of the PHAs reviewed, LOPA was integrated into the HAZOP and the HAZOPs were conducted by a team including union representation. See discussion in A38-16.

DMR: CCHMP reviewed C(A)-47 (rev. 2, 8/31/2017), section 3.0 states Corrosion Control Documents are developed and/or maintained (revalidations) by a team consisting of the Unit Operations Support Engineer (OSE), Operations Specialist, PEI Unit Inspector, and Corrosion & Materials Engineer (CME).

HCA: CCHMP reviewed I(A)-43 (rev. 07, Feb., 2018) and did not see any discussion related to employee participation.

MOC: CCHMP reviewed C(A)-15 (rev. 12, Feb

Y NoneNew


ID# Category Question Clarifications Findings Answer ActionsType3. The owner or operator should consider forming safety and health committees with employees and management representatives. [29 CFR 1910.119 Appendix C]

2018), section 6.0 states the MOC process provides for Employee Participation per ARMS Process Safety Management procedure, C(A)-4.

PSSR: CCHMP reviewed C(A)-14 (rev. 11, Dec. 2014) and was unable to confirm it specifies personnel who must be involved in PSSR.

MOOC: CCHMP reviewed the I(A)-53 'Management of Organizational Change' (rev.6, 2/20/2018), Section 6.3.1 specifies that the MOOC process will typically start by forming a MOOC Change Review Team. The change team should include those personnel who will be most affected by the change (representatives of the affected positions), and are likely to be the most familiar with the potential impacts of the change. Section 6.1 states that the MOOC process provides for Employee Participation per ARMS Process Safety Management procedure, C(A)-4.

PSCA: CCHMP reviewed the I(A)-71 'Process Safety Culture Assessment (PSCA) Program (rev.0, Feb 2018), Section 6.2 defines the PSCA Team is to be comprised of representatives from Contract Partners, Company Management, and Union Representatives. The Team is given the task to design, deliver, and evaluate the assessment.

II/RCA: CCHMP reviewed Procedure I(A)-6/EM-11.1 Investigations and Incident Reporting (rev. 15, Sept. 2016). This is the policy for the work process for incident investigation. It states that the USW investigation tool, TOP, is an example Level 2 investigation methods.

Other ARPE programs (Compliance Audits, Mechanical Integrity. Operating Procedures, Training): CCHMP reviewed C(A)-40 (rev. 2, Jan 2017) Operations Training Policy and D(A)-1 (rev. 3, June 2016) and did not find any specific discussion of employee participation.




Do the submitted RMP and Safety Plan accurately reflect the Employee Participation Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016)]


The RMP (rev. Dec 5, 2016, p. 58) and the SP (rev. Aug 26, 2016, p. 32) discuss the general employee involvement in the prevention programs and provide for access to process safety records for prevention program elements. These documents do not reflect all of the current CalARP Program 4 prevention program elements. However, the facility until September 30, 2019 to update the RMP so this questioon is not yet applicable. See additional discussion in A49-27.

N/A NoneAbr


Have all ensure action items associated with the previous CalARP/ISO audit of the Stationary Source been addressed within this prevention program questionnaire?

* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.

There were no ensure action associated with the 2015 CalARP/audit so this questioon is not applicable.

N/A NoneAbr


Was the DMR report provided to and, upon request, reviewed with all operating, maintenance, and other personnel, whose work assignments are within the process unit covered in the DMR? [T19 CCR §2762.5(e)(10)]

* Ask the audit team member during employee interviews about the DMR review process when and how the DMR information was provided to affected plant personnel.

Per interview with Corrosion Materials Engineers (CME), Corrosion Control Documents are the DMR reports and at SMR and these documents are kept evergreen. Which is to say that though the reports are periodically revalidated with a team, the information related to the equipment, including any inspection results and subsequent repairs or replacement, are updated and documented by the CMEs. SMR developed Corrosion Control Documents as early as 1997 after a major incident. Per interview, employee representatives are involved with the review sessions and recommendation development and all CCDs are available and accessible to all employees. However, the general awareness of CCDs can be improved as part of Program 4 awareness training. See A40-13 for overall Program 4 training requirement.

R NoneNew


A47 - CalARP Prevention Program: Contractors (Program 4)



When selecting a contractor, does the owner or operator obtain and evaluate information regarding the contract owner or operator's safety performance and programs and ensure that the contractors and subcontractors use skilled and trained workforce pursuant to HSC Section 25536.7? [T19 CCR §2762.12(b)(1) & ISO Section 450-8.016(a)(11)]

* Look for skilled and trained workforce as it is defined as one that consists of registered apprentices or skilled journeypersons as described in HSC 25536.7 section 2(b)(9):A) The worker either graduated from an apprenticeship program for the applicable occupation that was approved by CalOSHA or has at least as many hours of on-the-job experience in the applicable occupation that would be required to graduate from an apprenticeship program.B) The worker has completed within the prior two calendar years at least 20 hours of approved advanced safety training for workers at high hazard facilities. This applies only to work performed on or after July 1, 2018.C) For contracts awarded, extended or renewed as of January 1, 2014, at least 30 percent of the skilled journeypersons are graduates of an apprenticeship program for the applicable occupation that was either approved by the chief pursuant to Section 3075 of the Labor Code or located outside California and approved for federal purposes pursuant to the apprenticeship regulations adopted by the federal Secretary of Labor. As of January 1, 2015, at least 45 percent, and as of January 1, 2016, at least 60 percent. [SB54_Section 25536.7, SEC 2 (b)]

1. This section applies to contractors performing maintenance or repair, turnaround, major renovation, or specialty work on or adjacent to a covered process. It does not apply to contractors providing the incidental services which do not influence process safety such as janitorial work, food and

Per review of Procedure I(A)-42, Contractor HSSE Selection and Management, Revision 7, (no date), Shell uses CMS (Contract Management System) to store all contracts. In Attachment A of the procedure is an outline for the Selection of contractors and assuring HSSE capabilities. In Attachment B, Contract HSSE Risk Assessment Guideline, SMR has a matrix to determine the HSSE Contract Risk. The matrix has Red for high, yellow for medium, and blue for low. For the red area:-- Description: Work in process area, LSR (life saving rules) activities -- Chemical Risk: Yellow/Red-- Generic Activity Risk: Yellow/Red

Per interview with SME, SMR uses a third-party vendor to compile data on contractors. Each contractor is given a risk ranking based on the work that is performed using the criteria above. The third-party vendor will only provide contractors who meet the requirements established by SMR. If a contractor were to fall below a certain safety performance level, the contractor would be flagged in the system. If the contractor's safety performance continued to slide, the contractor would be removed from the SMR vendor list.

The SME also indicated that almost all of the contractors who perform work in or around the process area are under long-term contracts and thus would not be subject to the Program 4 requirement HSC 25536.7 section 2(b)(9) as the contracts were signed in 2013. However, for contractors who do not have long-term contracts, SMR is meeting the P4

Y NoneAbr

Page 1 of 8Shell Refinery - 2018 CalARP Audit Findings14-Feb-19

ID# Category Question Clarifications Findings Answer ActionsTypedrink services, laundry, delivery or other supply services. [T19 CCR §2762.12(a)].

requirement by using the total hours worked by the contract employees and calculating a percentage based on that. SMR still has until July 2018 to meet the 20 hour safety training requirement.


Does/did the owner or operator inform the contract owner or operator and ensure that the contractor owner or operator informs each of its employees of the work practices necessary to safely perform his or her jobs, included but not limited to the following: a) the potential hazards related to their jobs; b) applicable refinery safety rules; and c) in the applicable provisions of the stationary source’s emergency action plan? [T19 CCR §2762.12(b)(2) & ISO Section 450-8.016(a)(11)]

* Review any material or training provided to contractors such as safety manuals distributed during training.

1. P4 states that the owner or operator is not precluded from requiring a contractor or an employee of a contractor to whom information is made available under this section to enter into a confidentiality agreement prohibiting him or her from disclosing such information, as set forth in CCR Title 8, Section 5194(i) (Trade secrets as provided for in General Industry Safety

See A47-01 for information on the training that is verified by SMR that is done by the contractor for the contract employees.

Per review of Shell Oil Products US Martinez Refinery Contract Partner Health, Safety, Security and Environmental Manual, revised February 1, 2017, SMR provides this document to contractors which covers Fire, Releases, Medical, or Rescue Help, Hazard Communication, Environmental Procedures, SMR Procedures, PPE, Safe Work Practices, General Contract Partner Rules, and Security. Per review of the Hazard Communication section, it states that SMR is to inform contract employees of the hazards at SMR. Per interview with SME, SMR uses a third-party vendor to perform site specific training with all contract employees that includes hazards in the facility as well as the emergency evacuation plan for the facility.

Y None




Does/did the owner or operator explain to the contract owner or operator the applicable provisions of Article 7 (the Emergency Response Program)? [T19 CCR §2762.12(b)(3) & ISO Section 450-8.016(a)(11)]

Per interview with the SME, as part of the contractor audit, SMR looks at the Emergency Response training for contract employees chosen at random. In the Emergency Response section of the SMR contractor evaluation form (revised in 2017), SMR asked the contractor about a job specific Emergency Action Plan for contract employees working at SMR. In the previous SMR form (revised in 2015), in the Comments section of the Emergency Response section, there is a permanent note indicating that the contractor is to provide documentation of classroom training for 3 employees. Per SME, these three employee files are chosen at random for each audit. CCHMP reviewed seven of the SMR audit files for the audits performed in 2015, 2016, and 2017 and found that the Emergency Action Plan questions had been completed for all of the audit files. The SME also indicated that contractors are trained on Emergency Response and site specific HSSE policies by a third party vendor.

Y None




Does/did the owner or operator periodically evaluate and document the evaluation of the performance of the contract owner or operator in fulfilling their obligations as specified in T19 CCR §2762.12(c)? [T19 CCR §2762.12(b)(5-6) & ISO Section 450-8.016(a)(11)]

1. The employer must ensure through periodic evaluations, that the training provided to contractor employees by the contract employer is equivalent to the training required for direct hire employees [OSHA Instruction CPL 2-2.45A CH-1 Appendix A, September 1994]2. Employers must periodically audit contractor's performance in the field. A records review alone is not acceptable [OSHA Region VI presentations on PSM in January, 1994].

Per interview with SME, SMR has a program called SCUFS (Shell Contractors United for Safety) that is made up of Shell contractors who meet once a month to go over findings from SCUFS field audits at SMR. These field audits take place monthly. There is also a Permitted Work Field Audit program headed by the SMR HSSE team in which a team of Shell employees go out into the field to perform field audits on permitted work. Auditees include contractors but contractors are not the primary focus of the program. Each Permitted Field Audit is documented by the HSSE team. CCHMP reviewed a sampling of 36 SMR Permitted Work Audits from 2015, 2016, 2017, and one from 2018 and found that about half of the audits were performed on three contractors.

Per SME interview, SMR provides training requirements to the third-party vendor which is then uploaded to the system. These requirements include the use of PPE, Emergency Procedures, LOTO, confined space entry, and other skills assigned as appropriate for the job that the contract employee will be doing. For job specific training, SMR relies on the third-party vendor to determine the appropriate level of training required to perform certain tasks. Per review of 7 of the 36 PSM office audits completed by the SMR audit team, each contractor provided documentation that covered competency performance measures which evaluate the skill level of each contract employee related to the job being performed.

Per SME, the site Contract Holder is also to play a role in conducting field audits of their contractors independent of the Permitted Field Audits performed by the HSSE group. However, SMR does not currently specify this in Procedure I(A)-42.

Y NoneAbr




Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job including, but not limited to, the following: a) The potential hazards related to their job;b) Applicable refinery safety rules;c) And in the applicable provisions of the owner or operator’s emergency action pland) And the requirements of HSC Section 25536.7? [T19 CCR §2762.12(c)(1) & ISO Section 450-8.016(a)(11)]

* Review contractor training records to determine whether there is documentation that contract employees have been trained in the work practices necessary to perform their jobs safely. [CalOSHA Consultation, Guidelines for Process Safety Management, Part 1, June 1994].

1. The facility should be knowledgeable in how the contract owner trains contract employees. [CCHMP Interpretation]2. The facility should request/review documentation from the contract owner to ensure that only properly trained contractors work on or near covered processes. Owner or operators do not have to maintain the actual training records on site, but should maintain at least a record of the review process. [CCHMP Interpretation]

Per review of Procedure I(A)-42, section 6.6.2 SMR Contractor PSM Audit and Record Review, the procedure states that no fewer than 12 contractors (including routine, turnaround, and projects) who work on a covered process shall be selected and audited using the Contractor HSSE PSM Audit checklist.

Per review of the contractor audits, SMR does a yearly PSM audit of 12 contractors (3 employees selected at random for each contractor) that work in and around the process areas. These contractors are classified as HSSE high risk. The auditor uses a sheet (last updated 7/20/17) titled SMR Contractor Evaluation/verification that has 69 questions that cover the following areas:-- Environmental-- Incentive Programs-- Communications and Meetings-- PPE-- Medical Services and First Aid-- Permit Systems-- ER-- HSE reviews/audits-- HSE responsibility-- Incident investigation-- Training-- General Requirements.

The evaluation sheet lists the company name and the SMR Contract Owner and Contract Holder. SMR audited 12 contractors in 2017, 12 in 2016, and 12 in 2015 for a total of 36 contractors. Per the list generated by procurement, there are a total of 70 contractors listed as HSSE high risk, 20 listed as HSSE Medium risk and 94 listed as HSSE Low risk. The list provided by the procurement group has 54 contractors that are not part of the HSSE group. SMR will need to modify their process as any contractor working on or near a covered process is subject to the contractor auditing requirements. CCHMP

N Ensure that SMR revises their contractor auditing process to encompass all contractors working on or near a covered process.

Abr


ID# Category Question Clarifications Findings Answer ActionsTypefound a different issue during the previous audit. Although it is not a regulatory requirement to modify the contractor policy, SMR is encouraged to revise Procedure I(A)-42 so that it focuses on auditing all contractors that come onsite including the medium and low risk contractors.

CCHMP reviewed seven audit files completed by SMR on contractors and found that the audit files each contain information on potential hazards of the process, the applicable safety rules, and the emergency action plan. These are covered in the training section of the SMR PSM audit file.




Does/did the contractor owner or operator maintain a record for each contract employee that has successfully completed the training required by this section identifying: (a) Each employee who has received training, (b) The date(s) and subjects(s) of training, and (c) The means used to verify that the employee understood the training? [T19 CCR §2762.12(c)(2) & ISO Section 450-8.016(a)(11)]

* Review the records maintained by the facility that document that the contract owner maintains these training records. This may be an audit process by the facility. If it is an audit process, we need to ensure that the training records are being audited. The operator can also keep these records onsite. If this is being done, we need to audit this record keeping.

1. The facility should be knowledgeable in how the contract owner trains contract employees. Some of the topics that may be covered in training: LOTO, PPE, Emergency situation, plant safety, hot work, line breaking, confined space entry, elevated work, hazardous materials communication, live electrical hazards. [CCHMP Interpretation]2. The facility should request/review documentation from the contract owner to ensure that only properly trained contractors work on or near covered processes. Owner or operators do not have to maintain the actual training records on site, but should maintain at least a record of the review process and records reviewed. [CCHMP Interpretation]

Per interview with the SME, SMR performs periodic audits of contractor records provided by the contractors. Contract employee records are chosen at random (usually 3 employees per contractor that have worked at SMR) and the SMR auditor compiles information from the employee files chosen related to training. The contractor training records include the dates, the subjects, and the names of the contract employees. Per review of 7 audit files (2 from 2015, 2 from 2016, and 3 from 2017), the training topics include PPE, daily pre-job HSE meetings, reporting unsafe acts or conditions, access to SDS for each chemical brought on-site or used on-site, Job Safety Analysis, and other safety related topics. Certain contractors (crafts positions which include pipefitters, welders, machinists, and others) will also perform field audits in order to verify that the training for particular job tasks and plant safety information is understood and being followed. For example, welding contractors perform QC inspections on welds in order to verify that the welds meet certain quality standards which would indicate that the welders had been adequately trained. The welding contractor will also have a person come to the facility to make sure that the welders are following the site specific safety policies as well as the contractor's safety

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the Contractors Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The 2014 RMP and the 2016 Safety Plan both accurately reflect the Contractors program at the Shell Martinez Refinery.

Y NoneAbr






1. This question is only applicable to owner or operators that have had prior CalARP/ISO audits by CCHMP.

There was one Ensure action item from the previous audit that was addressed.

Y NoneAbr


A48 - CalARP Emergency Response Program (Programs 1,2,3,4)


A48-07 Responding - Program 4 CalARP & ISO

Does the emergency response plan include procedures for informing and interfacing with the public and local emergency response agencies about accidental releases, emergency planning, and emergency responses? [T19 CCR §2765.2(a)(1)(A) & ISO Section 450-8.016(a)(12)(A)(i)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement partially corresponds to T8 CCR §5192(q)(2)(A) and §5192(q)(2)(I).

The stationary source has an emergency response plan (ERP) titled EM-2.2 Emergency Response Organization and Emergency Response Plan (rev. 16, dated Sept. 2017) that is part of the overall emergency manual maintained on the site intranet and accessible by all employees.

Section 2.2 outlines the ERP elements including: 1. Pre-Emergency Planning and Coordination with Outside Parties2. Personnel Roles, Lines of Authority Training, and Communications3. Emergency Recognition and Prevention4. Safe Distances and Places of Refuge5. Site Security and Control6. Evacuation Routes and Procedures7. Emergency Medical Treatment and First Aid8. Emergency Alerting and Response Procedures9. Critique of Response and Follow-up10. PPE and Emergency Equipment 11. Emergency Response Drills

Per SME interview these elements are covered within EM-2.2 and other applicable policies and procedures that are referenced within this document.

EM-2.2, Attachment 5 contains detailed descriptions and checklists for each role in the Emergency Operations Center (EOC) for an incident. CCHMP notes that the Emergency Operations Coordinator determines what information to communicate to agencies regarding community impacts of the incident and the Liaison Office is responsible for proper Community Warning System (CWS) and agency notifications for an incident. Specifically, the checklist for the Liaison has steps to declare a CWS level based on input from the Refinery Safety Leader, direct

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypesecurity to notify CCHMP of the CWS level (through the terminal), and inform the EOC of the CWS level. The checklist for the Emergency Operations Coordinator has steps to verify that a CWS level was called in, verify that all regulatory notifications have been completed, and assure that accurate and consistent information is provided to agencies, media, and the public regarding the incident.

Page 8 of EM-2.2 states that the EOC will be the focal point for coordinating communications with the community, and outside agencies. The procedure identifies that the Information Officer is the main position responsible for handling communications to the community and media. CCHMP notes that only personnel working under the direction of the Information Officer are authorized to make statements to the community, public officials and neighbor inquiries. Page 84 of EM-2.2 includes a checklist for the Information Officer's specific responsibilities at the beginning, middle, and end of an incident including addressing community/public inquiries, communicating impact to the appropriate members of the community (e.g. sensitive receptors), logging and returning all media calls, and continue updating the community and media with current information regarding the incident.

EM-2.2, Attachment 9 includes a list of communications in the event of an incident. Phone numbers are included on the communication list for Martinez PD and CCHMP. Additionally, page 5 of EM-2.2 identifies that if an incident becomes a level that exceeds onsite available expertise and resources, the refinery will request assistance from Contra Costa County Fire Protection District (CCCFPD).




Does the emergency response plan include documentation of proper first aid and emergency medical treatment necessary to treat accidental human exposures and a SDS or written information is available to the medical facility treating the exposed personnel? [T19 CCR §2765.2(a)(1)(B), §2762.3(e), T8 CCR §5157(k)(4) & ISO Section 450-8.016(a)(12)(A)(i)]

* If the emergency response plan references SDS’s, review the plan to see how they incorporate the SDS’s into their plan (e.g., verify that emergency responders will have access to the SDS’s). This review is not to verify the adequacy of the data presented on the SDS, nor is it to review medical records to verify treatment was given as indicated on the SDS. The Plan is not required to have any reference to SDS’s.

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement corresponds to T8 CCR §5192(q)(2)(H) and §5192(q)(9).

Page 15 of EM 2.2 identifies additional reference documents for emergency response, including ARMS Manual I(A)-33 for emergency medical treatment and first aid. CCHMP reviewed I(A)-33 Treatment/Reporting of Work Related Injuries and Illnesses (rev. 6, dated June 2016) which includes the following sections:

6.1- Reporting and Treatment of Work Related Injuries or Illnesses6.2- First Aid/ Medical Treatment6.3- Emergency Treatment6.4- Off Hours Care and Consultation for Injuries that Do Not Require Ambulance Transportation6.5- Required Notification6.6- Follow-up6.7- Occupational Medical Case (Injury and Illness) Review Meeting

CCHMP notes that sections 6.2 and 6.3 provide instructions for getting an employee proper medical attention onsite at the Refinery Medical Center, or offsite. For emergency treatment, instructions are provided for calling an ambulance to bring the employee to the hospital.

Section 7 includes responsibilities for employees, medical staff and refinery supervisors and management regarding this procedure. CCHMP notes that the Team Leader/Supervisor is responsible for assuring necessary paperwork and information, including SDS, is provided to the ambulance or designated person transporting the employee to the treatment facility.

Additionally, per EM 2.2 the emergency response team includes personnel that are qualified on the trauma team (TIGER). Each member of TIGER are trained and certified to the Emergency Medical Technician (EMT) level.

Y None




Does the emergency response plan include procedures and measures for emergency response after an accidental release of a regulated substance? [T19 CCR §2765.2(a)(1)(C) & ISO Section 450-8.016(a)(12)(A)(i)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement corresponds to T8 CCR §5192(q)(3).

CCHMP reviewed procedure EM 2.1 Fires and Other Emergencies (rev. 6, dated Feb 2016) which includes steps to report an emergency, request an ambulance, making announcements over the emergency broadcast system (EBS), sending pages to appropriate members on the emergency response team based on type of emergency (e.g. fires, gas releases or spills, major power failure, and earthquakes), and making "Incident Over" notifications to the refinery. This procedure also includes requirements for testing the EBS, which occurs Mondays at 11:00 am, Wednesdays at 8:00pm, Fridays at 1:00 am, and on Saturday. CCHMP verified that the EBS is tested on Mondays at 11:00 am.

CCHMP also reviewed Attachment 2 in EM 2.2 which includes basic firefighting and spill control methods based on materials such as gases, flammable or class I liquids, combustible liquids, and special hazards and materials. Specific measures based on material and hazard are included in pages 21- 63 of EM 2.2, for example: anhydrous ammonia, Class IA flammable liquids, Class IIIA and IIIB combustible liquids, energized electrical equipment, external floating roof tanks, hydrogen sulfide, liquefied petroleum gas, sulfur dioxide, etc.

Y None




Does the emergency response program include procedures for the use of emergency response equipment and for its inspection, testing, and maintenance? [T19 CCR §2765.2(a)(2) & ISO Section 450-8.016(a)(12)(A)(ii)]

* Review documentation of inspection, testing, and maintenance of emergency response equipment. [ISO Section 450-8.016(a)(12)(A)(ii)]* Review annual flow test SCBA-face pieces/regulator (by NFPA/manufacturer recommendation), 5-year hydrotesting on SCBA tanks (w/ stamp)

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. This requirement partially corresponds to T8 CCR §5192(q)(2)(K) and §5192(g).3. This includes fire water piping systems and hydrants, fire water pumps and drivers, fire trucks, SCBA, fire extinguishers, etc. [CCHMP Interpretation]

Per interview with SME, there are 2 procedures that define the inspections, tests, and maintenance of various emergency equipment onsite: procedure I(A)-14 Inspection of Fire Protection Equipment (rev.6, dated Sept 2017), and I(A)-65: Breathing Air Equipment (rev. 4, dated Feb 2018).

Per CCHMP review of I(A)-65, the following breathing equipment are inspected and maintained at the stationary source: breathing air supply hoses, breathing air mask, SCBAs, 5-minute escape bottles, breathing air trailers, breathing air regulators/manifolds.

Per interview with SME, SCBAs are inspected monthly, flow-tested annually, and hydro-tested every 5 years. CCHMP was informed that these tests are completed by a third-party contractor and that the contractor tracks these tests in a spreadsheet for each SCBA onsite based on department. CCHMP reviewed the spreadsheet which includes the following for each department: location, regulator number, cylinder number, hydro date, next due hydro date, last date flow test complete, next flow test due date, last overhaul, and next overhaul. CCHMP notes that the frequencies for the hydrotests and flow tests are consistent with those mentioned per interview. Per interview, the spreadsheet also colors the cells yellow for tests coming due, and red for overdue. CCHMP was also informed that the SCBA monthly maintenance checklists are maintained in binders by year. CCHMP noted that the maintenance shop contained the binders for 2015, 2016, and 2017. CCHMP reviewed the 2017 binder and noted that there is a checklist for each SCBA that included a list of items and boxes to sign off as completed for each month (with date) of that year. Each checklist documents the following: model, unit, cylinder serial number, year, last hydrotest, next due hydrotest date, date flow test completed, etc. CCHMP notes that some of the items on the checklist include:

Y NoneAbr


ID# Category Question Clarifications Findings Answer ActionsTypeexamining the mask and hose for contamination, damage, and deterioration, checking the condition of the hair net for tightness and cracking, checking the cylinder gauge for full indication and current hydrotest date, making sure cylinder is completely full, checking for leakage, etc.

Per CCHMP review of procedure I(A)-14 Inspection of Fire Protection Equipment, there is a table summarizing the emergency response equipment inspection requirements including the following: device inspected, action (e.g. visual or flow test), frequency, performed by, responsible party, records owner, and protocols. CCHMP notes that the devices in this table include equipment such as: fire monitors and hose reels, hydrants and monitors, portable extinguishers, deluge and spray systems, emergency response vehicles and apparatus, fire engines and pumps, raw/fire water pumps and piping, etc.

CCHMP reviewed a spreadsheet of the ER vehicle and apparatus checks for 2015-2018. This list includes a list of all ER vehicles and apparatus at the stationary source and tracks inspections on a monthly basis. CCHMP was informed that checklists are used to document inspections for each vehicle/apparatus. CCHMP notes that the frequency for each check is identified on the checklist. For example, Engines 1, 2 and 3 are inspected using a checklist every 2 weeks. The checklists include columns to check whether each item on the list is "ok" or "not ok" and a comments column to describe when an issue is identified.




Does the emergency response program include training for all employees in relevant procedures and relevant aspects of the Incident Command System? [T19 CCR §2765.2(a)(3) & ISO Section 450-8.016(a)(12)(A)(iii)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR

§5192.2. This requirement corresponds to T8 CCR §5192(q)(6), (7), and (8).

Section 2.2 of EM-2.2 defines the various levels of emergency response training for refinery personnel including a list of required knowledge that a person must demonstrate competency in for each level. The defined levels are as follows:

- First Responder Awareness Level (maintenance personnel, engineers, other technical staff with field duties) - qualified to identify hazardous substance releases and notify proper authorities.

- First Responder Operations Level (lab technicians, lab foremen, operators, and operations foremen) - qualified to respond to releases defensively and from a safe distance, as part of the initial response efforts.

- Hazardous Materials Technician (basic fire crew (BFC), auxiliary fire crew (AUX), trauma/emergency medical team (TIGER), high-angle rescue (SHARC), and health and safety inspectors) - qualified to respond to releases in order to stop the release.

- Hazardous Materials Specialist (response action team (RATs)) - qualified to respond with and provide support to Hazardous Materials Technicians and have specialized knowledge for responding to various substances/chemicals.

- On Scene Incident Commander (Safety Supervisor, RSL, or Sr. Safety Inspector) - qualified to assume control of the scene at the incident.

Attachment 1 of EM-2.2 includes the training requirements for emergency response team which includes BFC, AUX, TIGER, SHARC, and RAT.

CCHMP was informed that the emergency response team at the facility is completely made up of volunteer site personnel. The team has about 150 personnel from various

P Ensure that What-If and Red-Tag drills are completed as specified in policy C(A)-24 or modify the policy. (This is a modified repeat)

Abr


ID# Category Question Clarifications Findings Answer ActionsTypedepartments and shifts throughout the refinery. The stationary source maintains a spreadsheet of responders indicating their name, department, team #, response qualifications, truck assignments, and completed training for each quarter. CCHMP reviewed the training spreadsheet for 13 personnel on the emergency response team with various qualifications. The spreadsheet indicates responder availability based on completion of medical clearance and training requirements. CCHMP was informed per SME that if required trainings have not been completed, that responder is on the "unavailable" list meaning that they cannot be called to respond until they have completed required training. CCHMP notes that the spreadsheet indicates responder availability for each quarter of the year (from 2017 to Q1-2018).

Per the spreadsheet, 3 of the 13 responders were indicated as unavailable at least one of the quarters in 2017. CCHMP notes that all members qualified on the BFC and/or AUX fire crew (12 of the 13 reviewed) have completed the Texas A&M Fire School (TEEX). CCHMP notes that the spreadsheet indicates when the next TEEX training is due for each person. EM-2.2 requires that TEEX training be completed at least every 3 years. CCHMP notes that the next due date for TEEX for the 12 personnel qualified on the BFC and/or AUX goes past this three year requirement, however these trainings are not yet due (2019-2021). CCHMP was informed per SME interview that there are only a couple TEEX trainings scheduled per year, so the requirement is that the TEEX training be completed by the end of the third calendar year. CCHMP believes it would be beneficial to revise EM-2.2 to reflect this practice.

CCHMP also reviewed printouts from the site training tracking software, SOU, for 3 of the 13 responders on the spreadsheet from 2015-current. One member is qualified as AUX, SHARC, and TIGER. The second member is


ID# Category Question Clarifications Findings Answer ActionsTypequalified as AUX, SHARC, TIGER, and RAT. The remaining member is qualified as AUX, BFC, and SHARC. Per review of the SOU records, each member completed BFC and AUX training, and annual fire extinguisher hand-on annual training. CCHMP notes that each person completed the required annual SHARC refreshers.

CCHMP also reviewed training records from SOU for 3 maintenance personnel and noted that each completed Incident Command System training.

CCHMP was also informed that the stationary source conducts various drills to train operators on emergency operating procedures and assess the effectiveness of the site ERP and emergency response team. The stationary source completes 3 types of drills related to emergency response: Red-Tag, What-If, and Emergency Response drills. Per interview with SME, the Emergency Response drills involve exercising scenarios with the emergency response (ER) team in various areas of the refinery. CCHMP was informed that the scenarios are determined based on a list of 13 pre-defined scenarios including goals and objectives for each. Some examples include: vapor cloud explosion resulting in fire, earthquake with leak resulting in fire or toxic vapor release, medical and rescue response, loss of primary containment (LOPC) resulting in leak/spill, etc. Per interview with SME, the drills are conducted quarterly and if an incident actually occurs where the ER team is activated, then that response is used to satisfy the quarterly drill for that quarter. Per interview with SME, these quarterly drills/actual responses are documented in an excel spreadsheet. CCHMP reviewed the spreadsheet for 2015-2018 that indicates the following: year, quarter, date completed, and specific emergency response elements, situations, medical, environmental, and security aspects to test during the drill. CCHMP notes that ER drills have been completed on a quarterly basis. The remaining


ID# Category Question Clarifications Findings Answer ActionsTypeER drills for Q2, Q3, and Q4 of 2018 identify the planned scenarios and elements that will be evaluated.

Per SME interview, Red-Tag and What-If drills are more focused on operations emergency response. The requirements for conducting these drills are specified in C(A)-24 Emergency Procedure and Abnormal Situation Drills Policy (rev. 3, dated June 2015). CCHMP reviewed this policy which defines types and required frequencies of drills including Abnormal Situation (What-If), and Emergency Procedure (Red-Tag). Per the policy, What-If drills involve scenarios based on plant upsets (could be past or current) that are typically created by personnel in the unit (e.g. Sr. Production Specialist, Shift Team Leader (STL), Operator, etc.) CCHMP was informed that these drills could be conducted in the field, as a table-top, or a combination. Red-Tag drills involve exercising emergency operating procedures in the units.

Per SME interview and C(A)-24, each operating Team (1-4) will complete a minimum of one What-If drill and one Red-Tag drill each month, and within a 3-year period all operators must complete drills for all emergency procedures associated with the units they are qualified to operate. The policy indicates that each drill will be documented to identify that it has been completed as scheduled. CCHMP was informed that documentation of completed What-If and Red-Tag drills are managed by each department in the refinery (e.g. OPCEN, DCD, etc.).

CCHMP reviewed documentation for completed What-If and Red-Tag Drills for OPCEN and DCD for 2015-2018. Reports are documented by year and department and include the following information: drill number, drill description, due date (month and year), date completed, teams, team leader, and What-If. The drill description column includes a list of emergency procedures drilled on, and the What-If column has a brief description of


ID# Category Question Clarifications Findings Answer ActionsTypethe scenario completed for each Team. Per CCHMP review, from Jan 2015- Feb 2018, 152 of each What-If and Red-Tag drills should have been completed for each department (based on the at least one per month requirement for each of the 4 Teams).

CCHMP notes that the OPCEN report is divided into 2 parts: OPCEN North, and OPCEN South. Per CCHMP review the following gaps were identified for each department:

1. OPCEN North: 18 What-If and 5 Red-Tag drills were not completed, and of the drills that were completed, 42 were completed past the due date (ranging from a couple weeks to months).

2. OPCEN South: 20 What-If and 3 Red-Tag drills were not completed, and of the drills that were completed, 47 were completed past the due date (ranging from a couple weeks to months).

3. DCD: 26 What-If and 17 Red-Tag drills were not completed, and of the drills that were completed, 3 were completed past the due date (ranging from a couple weeks to months).

CCHMP issued an ensure item in A28-10 during the previous CalARP/ISO audit regarding gaps in completing What-If and Red-Tag drills required per C(A)-24, which has not been addressed. As such, CCHMP has re-issued a modified repeat ensure item in this questionnaire.




Does the emergency response program include procedures to review and update, as appropriate, the emergency response plan to reflect changes at the stationary source and ensure that employees are informed of changes? [T19 CCR §2765.2(a)(4) & ISO Section 450-8.016(a)(12)(A)(iv)]

1. Stationary sources in California that respond to an accidental release of regulated substances must have an emergency response program consistent with T19 CCR §2765.2 and T8 CCR §5192.2. Stationary sources need to have a program to periodically review and update their emergency response program. Relying on using the MOC process to make changes may not satisfy this requirement since the MOC process covers only what is being changed. The MOC process may not result in a complete or very frequent review of the response plan. [CCHMP Interpretation]

Per interview with SME, the ERP is managed under the site document control procedure. CCHMP was informed that the ERP is reviewed at least once every 3 years, and is updated as often as necessary to reflect changes to the program. CCHMP notes that the current version is rev. 16, dated Sept 2017 and that the next review is due June 2018. CCHMP reviewed the document history and noted that since 2015 the ERP has been revised 7 times. The revision history includes a description of each change made, the date, and the personnel who wrote, reviewed, and approved the document.

Per interview with SME, only the most recent version is available to all employees on the intranet. This version is updated each time the ERP is revised. CCHMP was informed that changes to the ERP are communicated to employees through a facility-wide weekly email newsletter called the "Martinez Minute". CCHMP reviewed a copy of a Martinez Minute newsletter dated 3/7/18 and noted that it contained general refinery news and updates, tracking of days since the last incidents (e.g. recordable injuries, environmental incidents, and API Tier 1/2 incidents), and upcoming events. The newsletter also included a section titled "New, Revised, Retired and Deleted Documents" with a link to view the list of documents. CCHMP was informed that this link is updated on a monthly basis, but is always on the weekly newsletter.

Y NoneAbr


Does the submitted RMP and Safety Plan accurately reflect the Emergency Response Program at the stationary source? [T19 CCR §2745.2(d) & ISO Section 450-8.016]


The 2016 RMP (pgs. 62-65) and SP (pgs. 38-41) accurately reflect the Emergency Response Program at the stationary source.

Y NoneAbr







There were no ensure action items related to this regulatory topic from the previous CalARP/ISO audit. This question does not apply.

N/A NoneAbr


A49: Section A - Management Systems

ID# Question Clarifications Findings Answer ActionsCategory Type

A49-01 Does the policy and procedure include job descriptions of management positions with roles and responsibilities for each program and how staff members are assigned overall responsibility to oversee compliance for the Safety Program, safety goals that support continuous improvement and include an organizational chart? [T19 CCR §2762.16(a), §2762.16(b)(1-2) & Section A.1.1 of the CCHMP Safety Program

Guidance Document]

1. The senior Stationary Source manager should be described as the person with authority and responsibility for compliance.2. This may be documented in Stationary Source senior staff job function descriptions or competency models, the goals and responsibilities documented during regular performance reviews, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the Process Safety Management policy (C(A)-4, rev 0, Feb.2018), which states the refinery general manager is responsible for the overall management of the safety program elements and each of the process safety program element is assigned a refinery leadership team (RLT) owner. Attachment 1 in the policy is a table that lists all the PSM elements roles and responsibilities including the owner, focal point and subject matter expert (SME). For example, the safety management system owner is the general manager and there are focal point managers (technology manager and HSSE manager) and SMEs (H&S Manager, Process Safety Manager) supporting the program; for employee participation, the owner is the HSSE manager with H&S manager and the process safety manager being the focal point and the safety engineer and the USW H&S reps being the SME.

Per interview, the facility also maintain organizational chart and job descriptions by "HR on-line". CCHMP was able to review a generic job description for an process operator which listed accountabilities to include strict compliance with Shell's safety policies and procedures and to take immediate corrective action, proper turnover to the relieving shift, monitoring process conditions, communicate with other team members including utilities, logistics, etc., participate in required assigned group task, preventive maintenance and training. CCHMP also reviewed job descriptions for USW TOP Representative, USW Process Safety Representative, L&D Supervisor, ESP

Y NoneProgram 4 CalARP & ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typefocal point and H&S manager.

CCHMP also reviewed ESP-002 Roles & Responsibilities, SOSO (rev. 0, 5/2017), provide detail role description and responsibility as it pertains to Ensure Safe Production (ESP).



A49-04 Does the management systems program address: a) How senior Stationary Source staff is held accountable for their Health and Safety Program record, andb) How the rewards and penalties compare to those for production performance? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This may be documented in the senior Stationary Source staff normal performance reviews, or Stationary Source’s “score card” or “performance indicators”, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview with Plant Manager, the site is held accountable to the company with specific metrics: - Goal Zero Days- Recordable HSE- Unplanned DT- Product Quality- Cash Surplus

Per interview, these five categories are equally weighted each quarter for the purposes of yearend bonus calculation. CCHMP also reviewed the site score card plan for 2018 and how it compared to 2013-2017. This included Total number of "Goal zero" days, H&S injury rates, Environmental incidents, API incidents, etc.

CCHMP also reviewed the Process Safety Triangle, which at the base of the triangle are the leading indicators and end with the lagging indicators at the top which are: LOPC (API Tier1, >1000 kg excess flaring).

Per interview with PSM Manager, every work process focal person have developed metrics to track the performance of the prevention programs. Some of those are represented and monitored and rolled into the reporting. For example, for the LOPC (loss of primary containment) metric, from the equipment integrity group this is further monitored, the leaks are categorized into leaks due to internal corrosion, leaks due to external corrosion, leaks due to gaskets, leaks due to valve packing and glands, etc.).

Y NoneISO Abr



A49-05 Does senior Stationary Source staff address how the Stationary Source promotes “safety first” approach? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This should be apparent in the safety program policies and documents. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview with Plant Manager, in the senior staff meeting, Martinez plans to continue to foster the goal zero culture with emphasis on 10:1 relationships and extending goal zero into process safety and environmental performance.

Y NoneISO Abr

A49-06 Does senior Stationary Source staff periodically, but at least every three years, review the Safety Program management system, for: a) Continuing appropriateness;b) Adequacy; andc) Effectiveness? [T19 CCR §2762.16(a) & Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. Documentation of these reviews may be in meeting minutes, study reports, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview with PSM Manager and Plant Manager, annually, the site leaders meet and have a HSSE Management Review in January for a process safety plan for the year. CCHMP reviewed the presentation material for 2018 and included a review of 2017 status which included a formal LOPC reduction plan with a PS Steering Team; improving visibility of process safety including sharing of process safety metrics with the Refinery Leadership Team (RLT) and Production Leadership Team (MPLT). The meeting also reviewed the PS triangle for 2017 based on indicators that evaluated:- API Tier 4 - Operating Discipline & management systems Performance Indicators - API Tier 3 - Challenges to Safety Systems- API Tier 2 - LOPC Events of Lesser Consequence- API Tier 1 - LOPC Events of Greater Consequence

Y NoneISO Abr

A49-10 Does senior Stationary Source staff ensure that there is expertise available in each of the different Safety Program elements, including Human Factors? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. This includes proper training and background experience. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview with Plant Manager and management staff, the facility reviews the goal for the year and assess personnel need. Per general discussion with various safety program SME, all were very aware of implications of human factors in the various program elements. Documentation of human factors' training can be found in A56-05.

Y NoneISO Abr



A49-11 Does senior Stationary Source staff allocate time and resources for the different Safety Program elements? [Section A.1.1 of the CCHMP Safety Program Guidance Document]

1. Documentation of allocated resources may include budget line items, sufficient personnel assigned to develop and implement the Safety Program elements, etc. [Section A.1.1 of the CCHMP Safety Program Guidance Document]

Per interview with Plant Manager, leadership annually meet to review the safety goals and assess any special need.

Per interview with PSM Manager, each prevention program focal point annually reviews and assess the program and discuss with management anticipated need and request proper support for resource. In the annual planning meeting, in anticipation for the regulatory need from CalARP Program 4 and PSM 5189.1, the process safety group requested and made plans to add one more process safety engineer. Resource allocation is discussed in anticipation for processing huge volumes of MOC after a turnaround. Currently, the incident investigation focal point is trying a new approach to have qualified investigators pre-determine availability throughout the year so that they could take on an investigation among their other normal duties.

Y NoneISO Abr



A49-13 Does the management system have written procedures to ensure effective communications of safety, operations, and maintenance information among and across process and maintenance personnel, contractors, support personnel, supervisors and senior management? [T19 CCR §2762.16(b)(3)]

1. The program should address two-way communication, reporting lines, information exchange, and employee involvement. [Section A.1.2.1 of the CCHMP Safety Program Guidance Document]

Per CCHMP review, the facility has an "Administrative Requirements & Management Systems Manual" that address the work process for the site. This includes the policy for creating new operating procedure A(A)-31, Field Operator Task Management Standards A(A)-22, Use Operating Procedure A(A)-34, Use Maintenance Procedures A(A)-38, etc.

CCHMP reviewed ESP-002 Roles & Responsibilities, SOSO (rev. 0, 5/2017), provide detail role description and responsibility as it pertains to Ensure Safe Production (ESP), for example the shift handover including the electronic signature in the shift report for Console Operator is described in section 6.8.3 and in section 6.9.3 for the reliability operator. The procedure also includes 'end of shift report'. Additionally, roles and responsibilities for the Shift Team Leader including holding Shift team meetings to discuss Safety, Process Safety, Environmental, Business Plan, and Maintenance. The policy specified that there will be a minimum of one shift meeting per shift.

CCHMP was able to observe a shift team meeting and noted the participation and communication from the various responsible parties.

Y NoneProgram 4 CalARP

New



A49-14 Does the Program policies and procedure ensure that the findings, recommendations, and corrective actions for all ARP programs such as PHA's, DMRs, HCAs, SPAs, incident investigations, compliance audit and MOC's are communicated effectively to the employees and employee representatives? [T19 CCR §2762.16(b)(4) & Section A.1.2.1 of the CCHMP Safety Program Guidance Document]

1. Check to make sure policies and procedures in each program effectively provided for employee participation as outlined in A46 and A55. [T19 CCR §2762.16(b)]2. The program should address two-way communication, reporting lines, information exchange, and employee involvement. [Section A.1.2.1 of the CCHMP Safety Program Guidance Document]

PHA/SPA: Per CCHMP review, the discussion on communication of findings, recommendations and corrective actions are detailed in A38-22.

DMR: Per CCHMP observation, damage mechanisms are documented in the corrosion control document (CCD). Actions taken are adjustments to inspection frequencies and/or methods. If an equipment is to be replaced, it is either replacement in kind or a MOC will be triggered for changes to materials of construction. Per interview with SME, CCDs are available on the facility website for employees to access.

HCA: Per CCHMP review, the discussion on communication of findings, recommendations and corrective actions are detailed in A58-23 & 25.

II: Per CCHMP review, the discussion on communication of findings, recommendations and corrective actions are detailed in A45-12.

CA: Per CCHMP review, compliance audit reports are made available to employees. See discussion in A44-9.

MOC/PSSR: CCHMP notes the MOC generally do not generate corrective actions. However, PSSR may identify follow-up actions. Section 6.3.6 of C(A)-15 (rev. 12, Feb 2018) states that when the responsible person tracked items to assure closure within 6 months of implementation the MOC status will change to MOC completed. Section 6.3.4 of the MOC states that affected Production employees on the current shift must be informed and trained before the change can be commissioned. Then employees must be trained at the start of his or her shift.

R NoneProgram 4 CalARP & ISO

New



A49-15 Does the Safety Program address the communications between appropriate personnel in the organization (such as between shifts)? [Section A.1.2.1 of the CCHMP Safety Program Guidance Document]

Per interview with operators, every operator signs into the system and enter shift log into the "UTL" system for shift turnover. The computerized system have standardized entries for general condition of the unit/process, any alarm states, equipment out of service, etc. CCHMP also observed a morning shift meeting at the control room where all unit personnel discussed items related to the condition of the equipment, any ticket that needed to be issued for update on equipment status and pre-planning activities. CCHMP was also able to view one of the daily refinery production meeting that is broadcasted to the entire refinery. This meeting covers production rates, major maintenance and activities for each department.

Y NoneISO Abr

A49-17 Do the Safety Program elements include the Stationary Source's personnel's specific responsibilities for managing Safety Program elements development and implementation? [Section A.1.2.2 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the Process Safety Management policy (C(A)-4, rev 0, Feb.2018) states the Refinery General Manager is responsible for the overall management of the Safety Program elements. Under the GM, each of the Process Safety Program element is assigned a Refinery leadership Team (RLT) owner. The policy outlines the requirements and responsibilities for managing Process Safety Elements and the corresponding policy are referenced. Attachment 1 of the policy further identified each PSM element with the owner, focal point, and the SME (subject matter expert), this included the prevention programs, permit to work, emergency response, process Safety Culture Assessment, and Trade Secret.

Y NoneISO Abr



A49-19 Are the job descriptions collectively reviewed to be sure that there are no gaps in coverage? [Section A.1.2.2 of the CCHMP Safety Program Guidance Document]

1. Job descriptions include job function descriptions.2. Competency models or task assignments could be considered job function descriptions.

Per interview with the PSM Manager, there are job descriptions available in the HR online database. Per interview with the General Manager, the site leadership team annually reviews the site safety goals and assess any personnel needs and identify gaps in terms of resource and experience. See additional discussion in A49-11.

Per interview with MOC/MOOC focal point, when an MOOC is initiated, the existing personnel writes down all the task that are performed to capture the specific job functions and assigned tasks.

Y NoneISO Abr



A49-20 Has the owner or operator developed and reported to Cal OES annually a certified written report by June 30 of each year the following site-specific Common Process Safety Performance Indicators:a) Past due inspections for piping and pressure vessels; excluding relief devices, instrumentation, instrument air receivers, boilers, furnaces, atmospheric tanks, or rotating equipmentb) Past due PHA corrective actions and seismic corrective without approved UPA extensions;c) Past due Incident Investigation corrective actions reported for major incidents;d) number of major incidents that have occurred since October 1, 2017e) total number of temporary piping and equipment repairs installed on hydrocarbon and high energy utility systems and total number of piping and equipment past the planned permanent replacement date? [T19 CCR §2762.16(h)(1 & 2) & Sections A.1.2.3 and A.1.2.8 of the CCHMP Safety Program Guidance Document]

* Review for the initial baseline and check with selected auditor to verify the data for the indicators.

1. The January 1 to December 31 data must be submitted by June 30 of the following year beginning June 30, 2019.2. Pressure vessels include but are not limited to: heat exchangers, columns, spheres, bullets as defined by CA Safety Order and U-stamped (or treated as such). 3. The scope of the inspections for this reporting include external visual, condition monitoring location (CML) and nondestructive examination (NDE), and internal visual for pressure vessels and piping (as defined by circuits).4. Past due is defined as overdue by the requirements listed in CCR T8 §6857, API 510 and API 570. Deferral/extension when used shall follow the requirements contained within the above code and recommended practices.5. Report of piping inspection must include the total number of circuits at the stationary source and the total number of annual planned circuit inspections for that year to provide context. 6. The owner or operator shall document, but not report, the date the temporary piping repair was installed, and the date for the permanent repair to be complete.7. Past due item is an item

This requirement is to be submitted in June 20, 2019 for 2018.

CCHMP notes that currently the facility is submitting process safety performance indicators a) - d) already as part of the Industrial Safety Ordinance annual performance report. CCHMP verified that this information was submitted and have been incorporated into the ISO annual report. CCHMP noted that on the PS Triangle, past due inspections (unapproved) is captured under the API Tier 3.

Per interview with the PSM Manager, each work group focal point person also maintains additional metrics that help gauge the performance of the specific prevention program in addition to the PS triangle. For example, the PEI group monitors all inspection results and enter the data into the data management system. Temporary piping and equipment repairs are also entered into a spreadsheet that can be viewed by others in the refinery. These installations are reported by units and the expected removal date.

Per CCHMP review, the facility would be able to report in 2019, the process safety performance indicators identified by the regulation.

N/A NoneProgram 4 CalARP & ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typethat is not completed by the end of the month during the month that is due. Each month an item that is past due shall be counted overdue. If the item is continued from the prior month then it is also counted as a repeat item.8. Site-specific indicators are required by March 30, 2018.9. Stationary Sources should implement effective leading and lagging process safety metrics consistent with those identified in Section A.1.2.8 of the CCHMP Safety Program Guidance Document and/or API RP 754. 10. The Stationary Source should develop metrics that promote broad awareness of process safety concerns, some of which may not be related to an actual or potential catastrophic incident. [Section A.1.2.8 of the CCHMP Safety Program Guidance Document]



A49-21 Does the owner or operator track and document all changes to the accident release prevention (ARP) and ISO Program elements policies and procedures? [T19 CCR §2762.16(c)] & [Section A.1.2.4 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed Policy A(A)-25 'Document Control', (rev. 5, Oct 2015), which is a policy for controlling documents at SMR. It states the current electronic version of the document is the controlled document and that printed versions of controlled site documents are uncontrolled. CCHMP notes that printed policy documents states "uncontrolled when printed" in the footer and each policy/procedure specifies the next revision date and may range from 1-5 years (e.g. non-electrical is one year, SCA is 3 years, MOC is 5 years). CCHMP also notes that the revision history of the policy/procedure includes a brief description of the reason for the revision. Hardcopies of policies are limited and is controlled in accordance with A(A)-29 'Controlling Authorized Hardcopies'.

A(A)-29 specifies that authorized hardcopies of Procedure Manuals shall be updated on a routine basis once a document has been reviewed, approved, and issued for use; the appropriate procedure manual by the Department Document Control Coordinator or Learning Advisor - Field (Mentor).

Per CCHMP review of the various Safety Program, there are policies developed to address the ARP and ISO program elements. See detail discussions of each questionnaire for completeness.


New



A49-22 Are changes to the different Safety Program elements policies and procedures based on the following:a) Evaluation process of the management systems;b) The auditing of the Safety Program; andc) Input from the employees? [Section A.1.2.4 of the CCHMP Safety Program Guidance Document]

1. The management system should have written policies and procedures for review of Safety Program elements policies that ensure effectiveness of the program. This may be included in the Management of Change process.

Per C(A)-4 (rev. 0, Feb., 2018), section 6, "the elements have been developed, are audited for compliance, and are continually improved." Section 6.18 states that compliance is formally audited every three years by a team composed of Process Safety subject matter experts. These audits are designed to ensure that regulatory requirements (including PSM, RMP, CalARP, and the Industrial Safety Ordinance) are met. C(A)-4 also specifies the next revision date to be 2/15/2021 (in a 3 year period).

Y NoneISO Abr

A49-26 Has the Stationary Source worked with CCHMP in preparing for public meetings associated with the Industrial Safety Ordinance and participated with CCHMP in these meetings as requested? [Section A.1.2.7 of the CCHMP Safety Program Guidance Document]

Per CCHMP's prior experience, SMR has worked cooperatively with CCHMP in preparing for public meetings associated with the Industrial Safety Ordinance with CCHMP as requested.

Y NoneISO Abr

A49-27 Does the submitted RMP and Safety Plan accurately reflect the existing management system at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016 and Section E.2 of the CCHMP Safety Program Guidance Document]


Section 4 of the RMP (rev. Dec. 5, 2016) and the Safety Plan (rev. Aug. 2016) describes an integrated management system that is in place at SMR to oversee implementation of safety prevention elements. There is a tabular representation of the safety program elements and the corresponding program owner responsible for the implementation of the program. CCHMP notes that the list may not be current as it listed the HR Manager as the owner for the operating procedure and training topics rather than the L&D Manager and the list did not reflect all the current CalARP Program 4 prevention program elements. However, the facility has until September 30, 2019 to update the RMP and Aug 2019 for a SP update.

Y NoneISO Abr



A49-28 Have all ensure action items associated with the previous ISO audit of the Stationary Source been addressed within this prevention program questionnaire?

* Complete the status column in the previous ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.

1. This question is only applicable to Stationary Sources that have had prior ISO audits by CCHMP.

There were no ensure action associated with the 2015 CalARP/audit.

N/A NoneAudit Follow-Up

Abr



A49-29 Does the owner or operator implement and document an effective Stop Work Procedure that ensures:a) Employees, and employees of contractors has authority to refuse to perform a task where doing so could reasonably result in death or serious physical harm;b) Employees, and employees of contractors has authority to recommend to the operator in charge of a unit that an operation or process be partially or completely shut-down, based on a process safety hazard; and,c) The authority of the qualified operator in charge of a unit to partially or completely shut-down an operation or process, based on a process safety hazard? [T19 CCR §2762.16(f)(1) & (g)]

1. This must be developed including employees and employee representatives’ participation and implemented by Dec. 29, 2017.

CCHMP reviewed a draft Stop Work Procedure (I(A)-70, rev. Jan., 2018) which states that the procedure ensures that "all employees and contractors have the authority to stop work when they believe a condition exists that places themselves, their co-workers, the environment, or our community at risk, or could adversely affect the safe operation of our workplace." And that "Stop Work Authority (SWA) and Intervention are core principles, and necessary activities to support the Shell Martinez Goal Zero values."

Section 6.4 address 'non-operational work or activities stop work authority' for the individual to notify the SMR employee responsible for the area of concern. If the communication to the reporting party did not fully address the initial concern, there is a dispute resolution process in section 6.5. If the determination was made to shut the work activity, it can only be restarted in the conditions in section 6.6 has been met.

Section 6.2 address 'non-operator seeks stop work authority of process unit' for situations where any non-operations person requests SWA for perception of an operating unit or equipment that could reasonably result in death or serious physical harm has the authority to recommend to the unit operator to shutdown part or all the unit. Then follow the steps in section 6.3.

Section 6.3 address 'unit operator seeks stop work authority for own process unit' and unit operator shall consult with shift team leader (STL) if action has been taken or if further consultation is necessary. STL shall notify refinery safety leader (RSL) and refinery team leader (RTL) of the action. The unit operator of the unit in question should be

P Ensure that the draft Stop Work Procedure I(A)-70 is finalized, issued and that both contractors and employees are made aware of the policy.

CalARP Program 4

New


ID# Question Clarifications Findings Answer ActionsCategory Typeincluded in the resolution. The unit or equipment shall only be restarted if the conditions in section 6.6 has been met.

Section 6.6 specifies that there needs to be agreement from the unit operator of the unit in question, the unit's STL and the RTL and completion of the Pre-startup safety review for operating process. For non-operational work, the RSL shall ensure the work is safe to restart.

A49-30 Does the owner or operator implement and document an effective Stop Work Procedure that ensures:a) Employees, and employees of contractors has right to anonymously report hazards;b) Hazards that present the potential for death or serious physical harm are prioritized, promptly respond to and corrected? [T19 CCR §2762.16(f)(2) & (g)]

* Verify that the owner or operator responded in writing within 30 calendar days to written hazard reports submitted.

1. This Stop Work Procedure must be developed with employees and employee representatives’ participation and implemented by Dec. 29, 2017.

Section 6.2 of the draft I(A)-70 states "If you wish to report anonymously, you could phone (from a safe location) Security control at (phone number) and request to speak to the Refinery Team Leader."

Section 10.0 of I(A)-70 states a written reply is required when an individual applies his/her SWA and the individual does not receive satisfactory verbal feedback that resolves the issue. The written record must be provided to the individual initiating the SWA within 30 days of the issue resolution. The written record may be CAPA (Corrective Action Preventative Action) for (Fountain Incident Management) FIM entries, a Goal Zero card for contractor issues, etc. Written record must be provided to the individual initiating the Stop Work Authority within 30 days of the issue resolution.

See action in A49-29 for approval and issuance of the 'Stop Work Procedure.'

R NoneCalARP Program 4

New


A50: HFP (P4) and Latent Conditions


A50-02 Did the owner or operator’s human factors analysis use an effective method in evaluating the following:a) Staffing levels;b) Shift work; c) Overtime;d) The complexity of tasks; e) The length of time needed to complete tasks; f) The level of training, experience, and competency of employees; g) The human-machine and human-system interface; h) The physical challenges of the work environment in which the task is performed;i) Employee fatigue, including contractor employees and other effects of shiftwork and overtime;j) Communication systems; and k) The understandability and clarity of operating and maintenance procedures? [T19 CCR §2762.15(c) and ISO Section 450-8.016(b)(3)]

* P4 - Evaluate whether each item in the question was effectively evaluated.

1. Prior to Program 4 requirements, staffing, shiftwork and overtime may have been addressed simply through a facility-wide or management system latent conditions checklist. [ISO Section 450-8.016(b)(3)].2. The County's 2011 LCC may not be sufficient to evaluate items listed in the question.

CCHMP reviewed the facility's Policy for Management of Overtime Limits, G(A)-28 (revised July 2017, rev 7). The policy identifies the maximum number of days and hours an employee may work during normal operations and during outages. The policy covers both 12-hour and 10-hour shifts. For example, if working a 12-hour shift during normal operations, the limit is working 7 consecutive days or nights; if working 12-hour shift during an outage, the limit is 14 consecutive days or nights.

CCHMP was informed that the facility customized the county's LCCs to develop tailored checklists to be used in PHAs, procedures, incident investigations and management of organizational changes. The facility-wide human factors evaluation, at least the one completed in 2013, used the entire LCC as it was not customized.

CCHMP reviewed the facility's Human Factors policy, I(A)-15 (revised February 2018, rev 9). This policy identified that the facility uses latent conditions checklists (LCCs) to look for hidden causes that could lead to accidents. I(A)-15 identified that issues such as staffing levels, shiftwork and overtime are also addressed in the site's Management of Organizational Change policy, I(A)-53. CCHMP reviewed blank MOOC worksheets and confirmed that staffing and overtime issues are listed.

CCHMP reviewed completed LCCs from the following PHAs completed in 2016: Pentane Storage, Distillate Hydrotreating Unit, Delayed Coker, Distillate Saturation Unit, Sulfur Recovery Unit #4. CCHMP

P Ensure that the human factors program is modified to incorporate the following into appropriate evaluations keeping in mind employee participation requirements: the complexity of tasks and contractor fatigue.

Any Method – Program 4 CalARP & ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeobserved LCC questions related to a number of the items listed in the question. CCHMP was unable to locate questions related to task complexity or contractor fatigue.

CCHMP reviewed blank and completed LCCs associated with incident investigations (e.g., I(A)-6). Similar to the PHA LCC, CCHMP observed questions related to a number of the items listed in the question although was unable to locate questions related to task complexity or contractor fatigue.

CCHMP reviewed the last facility-wide LCC completed in December 2013. CCHMP notes that the LCC completed appeared to be the entire County LCC. Similar to what was previously stated, CCHMP observed questions related to a number of the items listed in the question although was unable to locate questions related to task complexity or contractor fatigue.

CCHMP reviewed LCCs associated with operating and maintenance procedures. Similar to previously described, CCHMP observed questions related to a number of the items listed in the question although was unable to locate questions related to task complexity or contractor fatigue.

CCHMP was informed that part of the Contractor HSSE PSM audit process, a question is asked regarding contractor fatigue. The question asked is "Does your company have a system for tracking compliance to API RP 755 (Fatigue Management Policy)?" CCHMP was informed this is relatively new question, as it started to be asked during Contractor HSSE PSM audits in 2016. CCHMP was also informed that approximately three years ago Shell developed a macro to sample contractor


ID# Question Clarifications Findings Answer ActionsCategory Typehours submitted for payment to get a feel for their compliance with Shell's fatigue management policy. Timekeepers at Shell have run the macro in the past and it occasionally highlighted individual contractors that exceeded the fatigue policy. Contract Holders were subsequently informed and asked to check with the contracting company to bring this to their attention. CCHMP was informed that the use of the macro was not a requirement nor part of the Timekeeper's normal work process and it is currently not being used.

As described above, CCHMP was unable to confirm the LCCs used accounted for task complexity or contractor fatigue. It is not a requirement that all LCCs include these considerations. To satisfy Program 4 requirements, Shell needs to incorporate the evaluation of contractor fatigue into their human factors program.



A50-06 Does the Stationary Source ensure that personnel applying the latent conditions checklist are trained to understand that the intent of the checklist isn't to identify their errors, but rather to identify latent conditions that could cause them to make an error and are truly contemplating each question (i.e., not simply checking boxes)? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. Personnel applying the latent conditions checklist should be trained to view the checklist indicators or questions as examples to lead the thought process. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]2. The checklist should be used as a “tool” to prompt further discussion. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]3. Stationary Sources should consider requiring personnel applying the checklists to provide justification or supporting examples for all answers. Since personnel not involved with the original analysis may review checklists sometimes years later, documentation of supporting examples or justification will remove some of the subjectivity of applying the checklist. [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document

PHA:CCHMP confirmed that each of the five PHAs reviewed included HF LCC training documentation in the form of sign-in sheets. The sign-in sheets identified that Power Point slides were used in the training. CCHMP reviewed the Power Point training slides provided to PHA team members and verified it included items listed in the question. As identified in A56-07, CCHMP found a discrepancy on the timing of completing the LCC training related to PHAs reviewed but that is not related to this question.

Procedures:CCHMP reviewed training sign-in sheets associated with Mentors training Content SMEs on procedure writing and LCC reviews. This is described in detail within A56-07 and CCHMP confirmed the training included discussion on the LCCs in that they are used a brainstorming activity and not to point out errors someone has made and to make sure they are truly understanding the questions asked.

Incident Investigations:The facility's Investigations and Incident Reporting policy, I(A)-6/EM-11.1 (revised September 2016, rev 15) identified that training must be performed for the investigation team members on the LCC before they complete the LCC. CCHMP reviewed the training Power Point provided to these team members and verified it included items listed in the question. CCHMP reviewed LCC just in time training documentation associated with the following events:-- Loss of Power to Subs 1203 and 1206, 12/22/16-- KGP Tubing Failure and Release, 9/18/17-- Tier 1 Tubing Failure Release of Gasoline (no team LCC training provided

Y NoneLCC Method – ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeas the entire team was trained facilitators)

In both cases, topics covered for this training included: the purpose and intent of the LCC; method for reviewing, interpreting and responding to questions; understanding the reason for each question; relative importance of different questions.

Facility-Wide:The facility performed a facility-wide LCC in March 2013. Documentation associated with the LCC included meeting summary highlights that described personnel were trained on how to apply the checklist and using the questions as examples to lead the thought process.



A50-08 Does the Stationary Source ensure that employees who completed the latent conditions checklist AND appropriate members of management review and sign off that the checklist was appropriately applied? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. CCHMP does not consider the definition of management to be simply defined by whether a position receives a salary versus receiving hourly compensation.2. To satisfy the management sign off requirement, a Stationary Source should specifically authorize individuals who have sufficient knowledge of applying latent conditions checklists, and have been trained in this application, to assume the role of management to approve the application and completion of checklists.3. If multiple employees participated on a latent conditions checklist team, sign offs do not need to include each employee individually; a representative of the employees is sufficient.

PHA:CCHMP confirmed for each of the PHAs reviewed (listed in A50-02), that documentation was maintained (e.g., names, titles, dates, and signatures) of employees who completed the PHA LCC and managers who approved the LCC.

CCHMP observed several items listed in one of the PHA LCCs, Distillate Hydrotreating Unit PHA, that identified potential human factors concerns and CCHMP was unable to locate any corrective actions for them. For example: -- "Labeling isn't always clear in the field. Unit is 20 years old, labels are starting to fall off", -- "Tag names for some alarms are ambiguous", -- "There are a couple instruments that have been broken for some time".

In addition, for the DSU PHA LCC, it was identified that old style start/stop switches exist and have different switch positions from newer switches. The LCC identified the older switches were "marked in the field to avoid confusion". The LCC further identified the situation was okay by operations.

CCHMP was informed that for the PHA LCCs described above with potential issues, the PHA scribe wrote items down in the LCC as the group discussed them although the team did not identify these items as concerns to be corrected. In reviewing the items with site personnel, CCHMP recognized that not all of the items listed in the LCC may have been cause for concern and needed a PHA recommendation for correction. Nevertheless, management is suppose to review the completed LCCs to verify they were appropriately applied. Listing items like instrumentation being broke for some time should have triggered some

P Ensure that appropriate members of management actually review the completed PHA and Facility-Wide LCCs to make sure they were appropriately applied as well as the LCCs have signatures from both management and representative employees.

LCC Method – ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typetype of comment or response and included identification that work orders or something was done to address the issue.

CCHMP also observed that 3 of the 5 PHAs initially reviewed used old versions of LCCs dated 2005 (i.e., Distillate Hydrotreating Unit, Delayed Coker, Distillate Saturation Unit) even though the PHAs were performed in 2016 and the LCCs were revised in 2013. The PHA Coordinator is responsible for reviewing the PHA LCCs and typically would be making sure the correct LCC was used. CCHMP was informed that there was a transition of PHA Coordinator leads at the time these PHAs and LCCs were completed and there was some miscommunication.

Procedures:CCHMP reviewed the process used by operations to create and revise operating procedures. For every new or revised operating procedure a "Review Transmittal" accompanies the procedure. This form includes signatures of operators who completed the LCC along with managers who approved the changes made to the procedures and verification that the LCC was completed properly. CCHMP reviewed a number of modified procedures from the DCU and confirmed that LCCs were completed, along with the modified procedure along with the Review Transmittal form. The process followed was consistent with A(A)-32 Controlling (Reviewing/Revising) Operating Procedures policy.

For maintenance procedures the process was found to be slightly different. During CCHMP's previous 2015 audit, the facility reviewed their maintenance activities and only found one maintenance procedure that needed to have a human factors evaluation. This procedure was reviewed


ID# Question Clarifications Findings Answer ActionsCategory Typeand signed off by maintenance employees as well as maintenance management and documented in the revision history of the procedure. This procedure has not changed so no additional LCC review of it has occurred. For the 2018 audit, the facility modified their process for evaluating human factors evaluations on maintenance documents (i.e., policy A(A)-37)) and started implementing it while CCHMP was onsite. Maintenance documents include the one maintenance procedure, a number of work instructions, maintenance policies and maintenance guidance documents. The total number of these maintenance documents is roughly estimated to be around 200. Also, CCHMP was informed A(A)-37 will apply to engineering Instrumented Protective Function (IPF) procedures, which there are approximately 400 of them. The process for reviewing all maintenance documents, which now is in the neighborhood of 600 documents, includes a Decision Tool to determine which one of three LCCs should be used with which maintenance document. Unfortunately, this process had not produced any documentation for CCHMP to review during the audit. A(A)-37 includes a transmittal form very similar to that used by operations to include signatures of those who completed the LCC along with managers who approved the changes made to the procedures and verification that the LCC was completed properly.

Incident Investigations:CCHMP reviewed several completed investigations (listed in A50-06). Each investigation included a management sign-off form that included manager/sponsor signatures as well as facilitator/trainer participants.

Facility-Wide:


ID# Question Clarifications Findings Answer ActionsCategory TypeCCHMP was informed that the facility-wide LCC was completed in March 2013 and included members of management on the team as well as represented employees. CCHMP was informed there was not any official management or represented employee sign-off on this LCC.



A50-09 Does the Stationary Source ensure that each latent conditions question receiving a "No" answer is thoroughly analyzed and a recommendation developed and implemented for resolution of the problem? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. The analysis should be conducted with appropriate members of operations and maintenance as well as supervisory positions and members of management.2. Each question is an indicator of a program deficiency relating to a tangible item that can be observed.

PHA:CCHMP did not find any PHA recommendations related to human factors or LCC related issues from any of the five PHA's reviewed (see A50-02). Nevertheless, CCHMP did identify several items of note in A50-08 that did not appear to have received adequate review.

CCHMP was informed that most PHAs do not identify any human factor issues or latent conditions. The PHA Coordinator maintains a spreadsheet that tracks the resolution of all closed PHA recommendations, and specifically, whether the issue came from a LCC. CCHMP reviewed a number of PHAs and did not locate any PHA recommendations that specifically were written to address LCC issues. CCHMP reviewed a spreadsheet maintained by the PHA Coordinator that identified two PHA recommendations issued and completed in the last several years that came from a LCC. CCHMP reviewed documentation associated with these LCC issues and found evidence that the items were addressed and tracked to completion.

Procedures:CCHMP was informed that the intent of the customized operating procedure LCC is to make sure all revised or newly created operating procedures do not have any latent conditions in them. During the LCC review of such procedures and Mentor interviews, all answers on the LCCs must be "yes" or "n/a" as all human factors issues must be addressed before the procedures can be approved for use. For the LCCs reviewed for modified procedures, all LCC questions were marked as "yes" or "NA".

As described in A50-08, the facility


Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeevaluated all of their "maintenance procedures" for latent conditions in 2015. Since then, the facility has developed a process to evaluate approximately 600 maintenance documents that is in the process of being implemented. CCHMP was informed that this process will be very similar to that used for operating procedures in that any LCC used on a maintenance document will only have "yes" and "N/A" answers as all LCC issues must be addressed before the document is approved for use.

Incident Investigations:CCHMP reviewed three incident investigations and associated LCCs for the one MCAR and two potential MCAR events (see A50-06 for a description of these incidents). Each of the LCCs identified one or more potential concerns that were tracked as incident investigation recommendations. CCHMP reviewed each of these recommendations to confirm closure.-- For the MCAR event, Loss of Power to Substations 1203 and 1206, CCHMP confirmed that the LCC issue (i.e., sufficient knowledge and experience on the operating team and was it accessible, recommendation #1) was completed on time within approximately 1.5 years after the incident. -- For the Tier 1 Tubing Failure and Release of Gasoline near miss MCAR event, CCHMP confirmed that the LCC issue (i.e., contractor most likely did not have appropriate qualifications and training to install tubing, FIM# 963261) was completed within 5 months after the incident, which was two months before the target due date.-- For the FXU KGP Tubing Failure and Release event, CCHMP confirmed that the LCC issue (i.e., insufficient knowledge on the potential of overtightening of tubing, FIM# 987818) has not been completely resolved yet.


ID# Question Clarifications Findings Answer ActionsCategory TypeCCHMP was informed that the target date for this resolution is 1/15/19, approximately 1.5 years after the incident.

Facility-Wide:There were no recommendations issued for the March 2013 facility-wide LCC study.



A50-10 Does the Stationary Source ensure a formal "feedback" loop is developed to inform personnel of the recommendations from the checklist and to ensure that the recommendations developed will adequately address the concerns? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. A feedback loop is expected to promote a two-way communication with affected personnel on the corrective action proposed to resolve a human factors latent condition. 2. It is not the intent of the feedback loop to require the Stationary Source to formally respond to or address all of the comments received, but appropriate comments should be given adequate consideration.3. Instructing affected personnel that PHA recommendations are available for review without describing the latent conditions deficiency recommendations is unacceptable.

PHA:CCHMP was informed that the PHA Coordinator maintains a spreadsheet that tracks the closure of all PHA recommendations. This spreadsheet also highlights which PHA recommendations came from a PHA LCC question in order to remind personnel that an email must be sent to affected personnel (i.e., the PHA team) to specifically ask for feedback on the effectiveness of the resolution. CCHMP reviewed copies of emails sent to affected personnel and team member's responses identifying the issues were adequately resolved.

Procedures:CCHMP interviewed individuals assigned as Mentors (e.g., responsible for writing procedures and training operators in the units). Mentors are assigned the role of revising existing and developing new operating procedures in conjunction with completing the human factors LCCs. CCHMP was informed that operating procedures are reviewed on a set frequency and involve the Mentor first reviewing the procedure and completing a LCC, then a qualified operator (i.e., Content SME) is assigned to review the proposed modifications and documented LCC. CCHMP confirmed this practice through operator interviews and if the procedure was inaccurate, Content SMEs would mark the procedure up as appropriate to make sure it is properly modified. As described in A50-09, each operating procedure LCC should have an answer of "yes" or "N/A" so rarely does a Content SME have comments on the actual LCC.

Similar to that described in A50-08 and A50-09, the process used to evaluate maintenance documents will include a feedback loop for select represented maintenance employees to be a

P Ensure that a formal feedback loop is developed associated with the Incident Investigation process to discuss concerns identified on the latent conditions checklist with the employees involved along with the resulting proposed corrective actions and that this is documented.

LCC Method – ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Typedocument's "Content SME" although the Maintenance Department might not use that exact term. That "Content SME" will be involved with the maintenance document review and LCC review.

Incident Investigations:CCHMP reviewed three incidents that included LCC evaluations. These incidents are described in A50-09. For the investigations reviewed, CCHMP found that the facility mapped each LCC concern to an incident investigation recommendation and this process typically is done by a Solutions Development Team, which is different than those who participated in the LCC. Per SME interviews, CCHMP was informed that the investigation team has been sent emails after completion of the investigation to read over and sign off on the process. As discussed during the audit, CCHMP does not treat email communication as an effective two-way communication tool. Additional effort is needed to make sure that those involved with completing the LCCs understand how issues are proposed to be resolved and to get their input.




A50-11 Does the Stationary Source have a formal tracking mechanism to ensure that latent conditions checklist recommendations are resolved in a timely fashion? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. ISO Section 450-8.016(d)(3) identifies schedule requirements for PHA recommendations. If the checklist is applied as part of the PHA process, the recommendations will be under the same requirements (i.e., one year unless a shutdown is required, then during the next shutdown unless the source can demonstrate infeasibility to CCHMP).2. LCC action items identified in a PHA are subject to the same PHA actions requirement. Stationary Sources must send CCHMP a request for extension before PHA actions related to LCC become overdue if they cannot be addressed within 1 year and a turnaround is not applicable. [Section B, Chapter 3.2 of the CCHMP Safety Program Guidance Document]

PHA:CCHMP was informed that LCC items developed during the PHA are tracked as PHA recommendations and are held to the one-year ISO requirement like all PHA recommendations, unless a turnaround is required and then scheduled for the next available turnaround. As identified within A50-09, the PHA Coordinator maintains a spreadsheet that tracks every PHA recommendation to closure.

Procedures:As previously described, operating procedures are reviewed for latent conditions when created or revised and cannot be approved for use until any identified issue is resolved. CCHMP was informed that the same will be true for maintenance documents. Over the next three years, each maintenance document will be reviewed with a LCC and any issues found must be addressed before the maintenance document can be used.

Incident Investigations:CCHMP was informed that the facility currently has three levels of incident investigations, which is described in more detail within A45-01. All recommendations from incident investigations triggering a LCC are currently tracked in a system called FIM (also described in A45-01). CCHMP confirmed that LCC recommendations from the three incidents reviewed are tracked in FIM until completion. See A50-09 for a list of incidents reviewed and LCCs verified to be completed.

Facility-Wide:There were no recommendations issued for the March 2013 facility-wide LCC study. CCHMP was informed that if there were any facility-wide LCC action items,


Abr


ID# Question Clarifications Findings Answer ActionsCategory Typethe site's Process Safety Group would track them to completion.

A50-12 Does the Stationary Source routinely audit and revise the latent conditions checklists to reflect the current situation within the Stationary Source? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

1. Since the initial compilation of the LCC checklist, other checklists have been developed (e.g., AIChE’s CCPS’s Human Factors Methods for Improving Performance in the Process Industries, Copyright 2007). Stationary Sources are encouraged to review this and other checklists to update their tools to uncover existing latent conditions.[Section B, Chapter 3.1 of the CCHMP Safety Program Guidance Document]2. CCHMP added additional questions for evaluation of latent conditions that may help improve the overall human factors program in 2010. Stationary Sources are encouraged to review Attachment A of the CCHMP Safety Program Guidance Document and augment their own latent conditions checklists.

Section 6.3 of I(A)-15 identified that an LCC review team is supposed to review the LCCs every 5 years in conjunction with the Human Factors policy, I(A)-15. CCHMP was informed the last time this was performed was in December 2013. At that time, a group of staff and represented employees reviewed I(A)-15; Shell's customized versions of the LCCs for operating procedures, PHA, MOOC and incident investigations; and human factors training provided. CCHMP reviewed documentation of the review that took place in 2013. CCHMP was informed that the facility will be performing their next review by the end of 2018.


A50-13 Have all ensure action items associated with the previous CalARP/ISO audit of the Stationary Source been addressed within this prevention program questionnaire?


1. This question is only applicable to Stationary Sources that have had prior CalARP/ISO audits by CCHMP.



Abr



A50-14 Did the owner or operator include a written analysis of human factors where relevant in the design phase of a major change, MOOCs, HCAs, incident investigations and PHAs? [T19 CCR §2762.15(b)]

* Document the human factors analysis method (e.g., LCC and/or Alternate Method) used for each of these items and the criteria for their use.

1. The analysis shall include a description of selected methodologies and criteria for their use [T19 CCR §2762.15(b)].2. This question is similar to A50-03, although that question is focused on discovering latent conditions using a LCC for PHA, incident investigations, procedures and facility-wide only (i.e., does not cover design phase of major change, MOOC, HCA).

Design Phase of a Major Change:The facility has not developed a process to analyze for human factors issues associated with the design phase of a major change. This is one of the new Program 4 requirements.

MOOCs:CCHMP was informed that the facility developed a customized LCC for MOOC from the County's original LCC. The questions selected are listed in the facility's master LCC spreadsheet that shows what questions are used for what customized LCCs. The facility also follows the County's SP Guidance and has adopted the MOOC checklists listed in Attachment B. This is further described in A54-05.

HCAs:The facility has not developed a process to analyze for human factors issues associated with HCAs or ISSAs.

Incident Investigations:As described in A50-02 and elsewhere in this questionnaire, the facility developed customized LCCs and has used them to evaluate latent conditions within qualifying MCAR incidents. As described in A45-01, the facility has not incorporated Major Incident Program 4 requirements into their incident investigation process.

PHAs:As described in A50-02 and elsewhere in this questionnaire, the facility developed customized LCCs and has used them to evaluate latent conditions within PHAs.

P Ensure that a process(es) is developed to analyze for human factors issues keeping in mind employee participation requirements associated with: 1) design phase of a major change, and 2) HCAs and ISSAs.

Any Method – Program 4 CalARP

New



A50-15 Did the owner or operator’s human factors analysis of process controls include the following areas:a) Error proof mechanisms;b) Automatic Alerts; andc) Automatic System Shutdowns? [T19 CCR §2762.15(c)]

* Evaluate how process controls were evaluated.* Existing LCC need to be expanded to properly address this if using LCC.

This question relates to evaluating these types of systems and how they relate to employees. For example, operators may sit back while the automatic controls are directing operations, or they may have to provide occasional input to the system, or they may have to step in and provide different direction or disable automatic systems when they are not functioning properly. Since process controls typically become more prevalent and reliable as time goes on, employee knowledge retention or "muscle memory" activities may be impacted. CCHMP expects a human factors analysis to evaluate these and likely other aspects of process controls.

CCHMP found within the 2013 version of the LCC used during the PHA questions related to process controls. CCHMP counted the facility has over 20 LCC questions that review various aspects of process controls. For example:-- "operators have sufficient knowledge to safely operate or shutdown the unit in emergency situations where they must assume manual control" (#1.5); -- "are field critical instruments - field instruments that are associated with ESP Standard or Critical limits - routinely checked for accuracy" (#3.7); -- "is it clear to the operators which controllers are under their direct responsibility within the control system" (#3.24); -- "do the process control system displays adequately present the process information [consider the logical layout of process or equipment configuration information, consistent presentation of information, visibility of information from various work positions, and the logical linking of information between displays]" (#3.27)

Y NoneAny Method – Program 4 CalARP

New



A50-16 Does the submitted RMP and Safety Plan accurately reflect the existing Human Factors Program at the stationary source? [T19 CCR §2745.2(d), ISO Section 450-8.016(b)(4) and Section E.3 of the CCHMP Safety Program Guidance Document]


Section 6.0 of the facility's 2016 SP includes a discussion on their Human Factors Program that matches what CCHMP found onsite.

The facility's RMP revised in December 2016 does not mention the site's Human Factors program. This is a new Program 4 requirement and the facility has until 9/30/19 to incorporate a Human Factors discussion into their RMP. The facility's next five year RMP update is due to CCHMP by 6/20/19. This is further described in A49-27.


New

A50-17 Does the owner or operator make sure that effective participation takes place with affected operating and maintenance employees and employee representatives in all phases of implementation of the Human Factors Program? [T19 CCR §2762.10(a)(2) and §2762.15(g)]

* Verify employees effectively participated in the HF program.

1. This question covers participation in “implementation” only as A46-01 is to evaluate “development, training and maintenance”. 2. Participation in “all phases” of implementation should be defined by the stationary source and should also include:a) Being involved with assessing human factors issues in questions A50-02, A50-14 and A50-15;b) Assessing for human factors issues in new and revised operating and maintenance procedures. [T19 CCR §2762.10(a)(2) and §2762.15(d)]

As described within this questionnaire, Shell Refinery has incorporated employee participation into the completion of the LCCs, which has been the method of choice for evaluating human factors at the site. Program 4 requirements have extended the human factors program into several areas that were not covered under County ISO requirements. Specifically, performing human factors evaluations associated with HCAs and process controls, as well as evaluating contractor fatigue and complexity of tasks. Ensure action items listed in A58-14, A58-15 and A58-02, respectively, address these items.

R NoneProgram 4 CalARP

New


A51: Section B - PHA's SPA


A51-01 Did the Stationary Source elect to complete the applicable questions of the Latent Conditions Checklist prior to conducting the PHA?

If so:a) Were PHA team members provided with copies of the completed checklist prior to the PHA meeting;b) Were the PHA team members provided with all of the action items or recommendations formulated to resolve the latent conditions and the status of each;c) Did the PHA team evaluate the consequences of implementing action items or recommendations from the latent conditions review; andd) Did the PHA team leader use the results of the latent conditions checklist to focus the PHA revalidation (similar to MOC and II) to consider the effects of existing latent conditions on the frequency of and consequences associated with any active failure or unsafe act? [ISO Section 450-8.016(b)(1) and Section B: Chapter 4.2.1 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may elect to apply the Latent Conditions Checklist prior to the PHA (question A51-01), apply the Latent Conditions Checklist during the PHA (question A51-02), or apply a different approach after consulting with CCHMP (question A51-03).2. The requirements of this protocol apply to PHAs performed on existing systems, PHA revalidations, and PHAs performed during the design of a new process.3. The latent condition checklist (or other method used to identify existing latent conditions) is designed to be a “brainstorming tool” to prompt personnel into further discussion.

Per CCHMP review, SMR elected to use a modified version of the CCHMP LCC Checklist for PHAs.

CCHMP reviewed 7 PHAs (see A38-05 for a complete list). Per CCHMP review of Appendix B of the PHAs all the LCC sessions were completed prior to the PHA worksheets being completed.

Per CCHMP review of the latent conditions checklist in the 7 PHAs reviewed some of the PHAs used out of date LCC checklists. See A50-08 for more details.

R NoneISO Abr



A51-02 Did the Stationary Source elect to complete the applicable questions of the Latent Conditions Checklist during the PHA?

If so:a) Did the PHA team analyze and document "why" employees would execute each active failure or unsafe act resulting in a potentially hazardous scenario; andb) Do PHA revalidations include a review of each active failure or unsafe act resulting in a potentially hazardous scenario; andc) Did the PHA team consider the effects of existing latent conditions on the frequency and consequences associate with any active failure or unsafe act? [ISO Sections 450-8.016(b)(1) and Section B: Chapter 4.2.2 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may elect to apply the Latent Conditions Checklist prior to the PHA (question A51-01), apply the latent conditions checklist during the PHA (question A51-02), or apply a different approach after consulting with CCHMP (question A51-03).2. The requirements of this protocol apply to PHAs performed on existing systems, PHA revalidations, and PHAs performed during the design of a new process.3. The PHA team should identify the latent conditions for each individual active failure, or elect to group active failures with the potential for similar latent conditions.

See A51-01 the latent conditions checklist was completed prior to the PHA being performed. This question does not apply.

N/A NoneISO Abr



A51-04 Did the Stationary Source perform Procedural PHAs to evaluate potential active failures or unsafe acts in the procedure such as missed or out of sequence steps and including raising questions regarding the availability of personnel to perform a task as specified in the procedure? [ISO Sections 450-8.016(b)(1) and Section B: Chapter 4.3 of the CCHMP Safety Program Guidance Document]

1. Stationary Source should screen all activities performed in their processes using established criteria (e.g., frequency, criticality, emergency or temporary procedures, large equipment startup/shutdown procedures, consequences of failure, etc.). [Section B: Chapter 4.3 of the CCHMP Safety Program Guidance Document]

CCHMP has reviewed I(A)-49 (Procedures HAZOP, last revised 11/16) which states that Procedures HAZOPs (called critical procedure audits at SMR) are performed on all critical operating procedures. Per CCHMP review, SMR has 44 critical operating procedures.

Per CCHMP's 2015 audit, there was an action item to change the process of critical procedure audits from looking at just "critical steps" to reviewing all steps in the procedure. Per CCHMP interview, now every step in a critical procedure is included in a critical procedure audit.

CCHMP has reviewed 4 Procedural PHAs:

1) CCU-2100, CCU Shutdown (critical procedure audit study dates of 6/14/27, 7/17/17, and 8/7/17)

2) CFH-4270, Loss of DEA Circulation to H2S Absorber and Continued Operation of CFH (critical procedure audit study date 5/24/17)

3) FXU-2127, J-201 Air Compressor Shutdown (critical procedure audit study date 2/15/17)

4) SR3-2100, SR3 Shutdown for Turnaround (critical procedure audit study date 3/22/17)

Per CCHMP review, the Procedural PHA team has evaluated the hazards of the procedure and has created recommendations to improve the procedure when needed.

Per CCHMP interview with SME, the Procedural PHA team discusses each step. If there is no consequences the team will document no consequences of concern.

Y NoneISO Abr



Additionally CCHMP reviewed the critical procedure list and notes that some procedures have fallen off the list. Per interview, this occurs during the 3 year review, if during the review the procedure is deemed by the team no longer critical it will be removed from the list and a procedural PHA will not be done.

Per interview there are no immediate plans to perform procedural PHAs on procedures that are not identified as critical. CCHMP suggests all facilities should consider performing more procedural PHAs.

A51-06 Did the Stationary Source identify latent conditions that may exist at the Stationary Source through the PHA process? [ISO Sections 450-8.016(b)(1) and Section B: Chapter 4.1 of the CCHMP Safety Program Guidance Document]

* Verify by sampling some of the applicable latent conditions and confirming how the Stationary Source addressed the issues.

1. This question applies to those latent conditions applicable during a PHA (i.e., some management questions may not be appropriate for a unit's PHA).2. Stationary Sources should also raise questions during the procedural PHA if there is adequate time to perform all the required tasks.

Per CCHMP review of the 7 PHA LCCs, the PHA teams, did review the latent conditions checklist and identified latent conditions and recommendations. Per CCHMP review, some of the completed check lists appeared to identify latent conditions with no recommendations to fix the latent condition. For further details and a related action item see A50-08.

R NoneISO Abr

A51-09 Do the submitted RMP and Safety Plan accurately reflect the PHA Program at the Stationary Source? [T19 CCR §2745.2(d) and ISO Section 450-8.016(b)(4) and Section E.3.1 of the CCHMP Safety Program Guidance Document]


Per CCHMP review, the 2016 RMP and SP accurately reflect the PHA program at SMR.

Y NoneISO Abr






The ensure item from the previous audit of the topic has been addressed.

Y NoneAudit Follow-Up

Abr



A51-11 Did the owner or operator have a safeguard protection analysis (SPA) team perform a written SPA to determinea) The effectiveness of existing individual safeguards;b) Combined effectiveness of all existing safeguards for each failure scenario in the PHA;c) Individual and combined effectiveness of safeguards recommended in the PHA; andd) Individual and combined effectiveness of additional or alternative safeguards that may be needed? [T19 CCR §2762.2.1(a) and ISO Section 450-8.016(j)(1)

1. The safeguard protection analysis (SPA) must use a quantitative or semi-quantitative method, such as Layer of Protection Analysis (LOPA) or an equally effective method approved by CCHMP. [T19 CCR §2762.2.1(c) and ISO Section 450-8.016(j)(1)]2. Program 4 requires that this is done for all scenarios where the PHA identifies the potential for a major incident, which is more conservative than ISO since ISO states it is only to reduce the probability and/or severity of a catastrophic release. [T19 CCR §2762.2(e) and [ISO Section 450-8.016(j)(1)]3. The risk reduction obtainable by each IPL shall be based on site-specific failure rate data, or in the absence of such data, industry failure rate data for each device, system, or human factor. [T19 CCR §2762.2.1(c)]4. All independent protection layers (IPLs) for each failure scenario shall be independent of each other and independent of initiating causes. [T19 CCR §2762.2.1(b)]5. This was effective as of September 30, 2014. Stationary Sources have until June 30, 2019 to complete all such analyses. (ISO)6. The analyses may be done with the PHA or as a standalone evaluation (ISO)

Per CCHMP review of 7 PHAs conducted between 2015 and 2017, each of the PHAs included a LOPA analysis. Per interview, SMR uses LOPA as the method for performing a safeguard protection analysis.

Per CCHMP review of C(A)-49, Hazards and Effects Management Process (HEMP), for units with hazards that fall into the risk levels on a risk level matrix (RAM) of 5A or 5B (red and yellow risk), the PHA will incorporate HEMP into the safeguard analysis. This is completed through a PHA/Bowtie review. Per CCHMP review of 7 completed PHAs, CCHMP noted that when available the appropriate bowtie studies were referenced.

The policy further states that for all other scenarios falling into a RAM 4 or 5 that safeguards are evaluated to verify adequacy. This is accomplished via LOPA. Per CCHMP review of the policy the LOPA evaluates tolerability based on residual risk with the goal being to get to As Low As Reasonably Practicable (ALARP). CCHMP reviewed the 7 PHA and noted that all RAM 4/5 scenarios were evaluated using LOPA.

For the 2 PHAs that were completed after P4 came into effect, CCHMP notes that the same guidelines were used to apply LOPA to safeguards. Per the P4 regulations a safeguard protection analysis must be done for all scenarios which have the potential for major incident. Upon reviewing the risk matrix CCHMP notes that scenarios with a severity of 3 can also have potential for major incident and the LOPA must be adjusted to include such scenarios. The 2 PHAs (CO Boilers and CGHT) need to be reviewed for possible scenarios where SPA needs to be completed.

P Ensure SPA is performed for PHA scenarios where there is a potential for major incident.

Ensure the CO Boilers and CGHT PHAs are reviewed for any additional scenarios where a safeguard protection analysis may need to be completed.

Safeguard Analysis – Program 4 CalARP & ISO

New



A51-12 Was the SPA performed by a team with expertise in engineering and process operations and include: a) At least one employee who has experience and knowledge specific to the process being evaluated, b) One member who has experience and knowledge specific to the safeguards, c) One member who is knowledgeable about the specific SPA method used; and,d) Consultation with individuals with expertise in damage mechanisms, process chemistry, or an engineer specializing in controls systems and instrumentation as necessary? [ISO Section 450-8.016(j)(3) & T19 CCR §2762.2.1(e)]

1. The PHA team may perform the SPA if the PHA team meets the requirements in the question. [T19 CCR §2762.2 (e)]2. Employees and employee representatives must be allowed to effectively participate throughout all phases in performing SPAs. [T19 CCR §2762.10(a)(1)]

Per CCHMP review of the 7 PHAs, the SPA (LOPA) is incorporated into the PHA and uses the PHA team. The PHA teams included the expertise listed in question A51-12.

Y NoneSafeguard Analysis

Abr



A51-13 Did the Stationary Source prepare a written report including: a) Potential initiating events and their likelihood and possible consequences, including equipment failures, human errors, loss of flow control, loss of pressure control, loss of temperature control, loss of level control, excess reaction or other conditions that may lead to a loss of containment; b) The risk reduction achieved by each IPL for each initiating event; c) Necessary maintenance and testing to ensure that all IPLs function as designed; d) Recommendations to address any deficiencies identified by the SPA; ande) SPA performed is in accordance with the standard of practice applicable to the type of analysis conducted? [T19 CCR §2762.2.1(f) & ISO Section 450-8.016(j)(4)]

1. The Stationary Source will complete the report within 30 days after the completion of the safeguard protection analysis and make the report available to CCHMP during an audit or inspection and upon request. [ISO Section 450-8.016(j)(4)]2. The SPA findings, recommendations and completed corrective actions shall be appended to the PHA report. [T19 CCR §2762.2(e), §2762.2.1(g) and §2762.16(e)(15)]

Per CCHMP review of 7 PHAs, the SPA (using LOPA) is incorporated into the PHA report. The PHA worksheets include columns for the LOPA (safeguards, verification, probability of failure on demand, LOPA analysis, recommendations, and comments).

Per CCHMP review of the LOPA, the LOPA column documents one initiating event. Per discussion with the PHA/SPA SME, the PHA team will discuss the different initiating events for a scenario but when the different initiating events have identical safeguards that are deemed adequate they will not repeat the LOPA calculation, however the PHA does not do a good job of documenting this. When there are different safeguards that are applicable to the different initiating events the LOPA team will document the two different calculations.

Per CCHMP review, the risk reduction is shown in the LOPA column for each IPL. Per CCHMP review the risk reduction credits have been defined in DEP01.00.02.13-Gen (Process Engineering and Safeguarding Practices, last revised February 2017). This DEP clearly defines how much credit can be taken for different safeguards. Examples of this include basic process control systems, operator intervention, etc.

CCHMP has reviewed how the final residual risk is calculated for the LOPA which is:

Residual Risk = Initiating Event Frequency X Enabling Probability X Probability of Failure on Demand X Conditional Probability (i.e. conditional modifiers)

SMR has clearly defined conditions that are acceptable to be used and when. For

P Ensure SPA documentation includes the necessary maintenance and testing required to ensure that all IPLs function as designed.

Safeguard Analysis – Program 4 CalARP & ISO

New


ID# Question Clarifications Findings Answer ActionsCategory Typeexample for initiating events related to human error the team has to take into consideration the skill of the craft and when the task is done. Another example is that probability of explosion can be used as a conditional modifier and control of ignition sources can be used for certain rates of release and distance from the ignition source. Another commonly used event frequency that is clearly defined in the DEP is for general human error probabilities where the event frequency is determined by the human error * number of critical steps * opportunities/year

CCHMP notes that recommendations are also documented and are carried over into the PHA recommendation list.

Per CCHMP review, the written reports for the two LOPAs conducted after the P4 regulations became effective did not include necessary maintenance and testing to ensure all Independent Protection Layers (IPL) function as designed.

A51-14 Did the Stationary Source update and revalidate the safeguard protection analysis at least once every five years? [ISO Section 450-8.016(j)(2)]

P4 requires that SPA findings and recommendations shall be appended to the PHA report and each revalidation. [T19 §2762.2.1(g) and CCHMP interpretation]

Per CCHMP review of the LOPA, the LOPA is included in the PHA report. The PHA is revalidated every five years and the LOPA is included in this revalidation.

Y NoneSafeguard Analysis – ISO

Abr

A51-15 Did the Stationary Source complete all SPAs for the PHA within 6 months of completion of the PHA? [T19 §2762.2.1(d)]

Per CCHMP review SPAs are completed in the PHA study which meets the 6 months of the completion of the PHA timeline.

Y NoneSafeguard Analysis – Program 4 CalARP

New

A51-16 Does the owner or operator maintain all SPA documentation for the life of the process? [T19 CCR §2762.2.1(i)]

SPA documentation is maintained in the PHA, PHAs are kept for the life of the process. This requirement is being met.

Y NoneSafeguard Analysis

New



A51-17 Has the owner or operator developed a documented corrective action work process to promptly complete all corrective actions that includes the following:a) Final decision for each recommendation;b) Corrective actions implemented for each accepted recommendation including completion date and assignment of responsibility;c) Rejection of recommendations;d) Any alternative safeguards;e) Team members written comments on any rejected or changed findings and recommendations;f) Whether an SPA was promptly revalidated or updated if prompted by a PHA, HCA, DMR or SPA corrective action;g) Prioritize the completion of corrective actions to address process safety hazards to prevent the potential for a major incident;h) Corrective actions to be completed within 2.5 years after the SPA; andi) Corrective actions to be completed during the first regularly scheduled turnaround? [T19 CCR §2762.2.1(h) & §2762.16(e)]

1. The team must provide to the owner or operator findings and recommendations at the earliest opportunity, but no later than 14 calendar days after recommendation and findings are complete. [T19 CCR §2762.16(e)(1)] 2. To reject a team recommendation, the owner or operator must demonstrate in writing that one of the following applies: (A) The analysis upon which the recommendation is based

contains material factual errors; (B) The recommendation is not relevant to

process safety; or (C) The recommendation is infeasible; however, a determination of infeasibility shall not be based solely on cost. [T19 CCR §2762.16(e)(2)]3. To change a team recommendation, the owner or operator must demonstrate in writing that an alternative safeguard would provide an equally or more effective level of protection. [T19 CCR §2762.16(e)(3)]4. Any rejected or changed recommendation must be communicated to onsite team members and made available to offsite team members for comment. [T19 CCR §2762.16(e)(4)]5. Interim safeguards are to be completed to address process safety hazards with potential major incident pending permanent corrections. [T19

CCR §2762.16(e)(10)]6. This question is for tracking actions taken.

Per CCHMP review of C(A)-49, the following process is used for LOPA recommendations: "The local management team, including the unit Production Unit Manager (PUM) and any other affected managers, meets with the PHA team to review the draft PHA report and agree upon the PHA Team's final recommendations......" Per the policy, the recommendations are entered into Fountain Assurance Management (FAM). Per CCHMP interview, this database is no longer being used and has been replaced by RADAR. The policy should be updated to include the correct references.

Furthermore, the policy states that the due date set for the recommendations usually follows the CCHMP ISO 1 year requirement or the DSM Prioritization Tool.

Y NoneSafeguard Analysis – Program 4 CalARP

New



A51-18 Did the owner or operator provide effective training to employees and employee representatives before serving on a SPA team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions. [T19 CCR §2762.4(e)]

CCHMP has reviewed the presentation slides for the "Process Hazards Analysis Overview" training given to PHA team members. This training includes an introduction to SPA, methodology, and concepts as well as an overview of the PHA process.


New


A52: Section B - Incident Investigation


A52-01 Are Human Systems considered as causal factors in the incident investigation process for Major Incident, Major Chemical Accidents or Releases (MCAR), or for incidents that could reasonably have resulted in a Major Incident or MCAR? [T19 CCR §2762.15(b)&(c) & ISO Section 450-8.016(b)(1)(B)]

1. Human factors analysis of process controls include the following areas: a)

Error proof mechanisms; b) Automatic Alerts; and c) Automatic System

Shutdowns [T19 CCR §2762.15 (c)]2. Human systems are discussed in Section B: Chapter 5.1.1 of the CCHMP Safety Program Guidance Document. Latent conditions are discussed in Section B: Chapters 2 and 3 of the guidance document. See A50-02 for detailed discussion.3. A root cause analysis is required for incidents that could reasonably have resulted in a Major Incident and is not required for a near miss MCAR, but an incident investigation, including human factors considerations, is required for a near miss MCAR.

As mentioned in A45-01, the Incident Investigation Procedure: I(A)-6/EM-11.1 Investigations and Incident Reporting (rev.15, dated Sept 2016) includes requirements for investigating Major Chemical Accidents or Releases (MCARs) and incidents that could have reasonably resulted in a MCAR, but not major incidents or incidents that could have reasonably resulted in a major incident. See A45-01 for more discussion on this topic and related ensure item.

Per the incident investigation procedure, human factors must be considered for any incidents classified as MCARs or incidents that could have reasonably resulted in a MCAR by completing a latent conditions checklist (LCC). CCHMP was informed per SME that the LCC is the same as the LCC in Attachment A of the County's Safety Plan Guidance Document.

As mentioned in A45-01, the stationary source maintains a list of open and closed investigations. Since the last CalARP/ISO audit in May 2015, the stationary source identified 1 MCAR event and 8 potential MCARs. CCHMP notes that the MCAR and 4 of the potential MCARs are closed out investigations, and the remaining 4 potential MCARs are open investigations.

CCHMP reviewed the completed investigation reports for the potential MCARs and MCAR event, listed below.

Potential MCARs:

1. FXU Tubing Failure and Release (8/16/17)

P Ensure that an LCC is completed to consider human systems for each investigation of an MCAR and potential MCAR, as required per the incident investigation procedure.

Program 4 CalARP & ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory Type2. Loss of SP2 Sulfur Seal #2 (1/11/17)3. HCU TA H2S exposure (100 ppm) (5/2/17)4. Tier 1 Release of Antioxidant and Gasoline (3/28/17)

MCAR event:

1. Loss of Power to Substations 1203 & 1206 (12/19/16)

CCHMP notes that a LCC was completed for the MCAR event and 2 of the potential MCARs listed above: FXU Tubing Failure and Release, and Tier 1 Release of Antioxidant and Gasoline. See questionnaire A50 for more discussion on this topic.

CCHMP was unable to review completed LCCs for the other 2 potential MCARs listed (Loss of SP2 Sulfur Seal #2, and HCU TA H2S exposure (100 ppm)). The stationary source must evaluate human systems for each potential MCAR incident.

A52-02 Is Attachment A in the Guidance Document, the latent conditions checklist, or another systematic method used to consider human systems? [ISO Section 450-8.016(b)(1) and Section B: Chapters 5.2.1 and 5.2.2 of the CCHMP Safety Program Guidance Document]

1. Although the use of Attachment A checklist is optional, the Stationary Source must adopt a method to identify existing latent conditions in the consideration of human systems as causal factors for the incident.2. Stationary Sources are encouraged to use the complete set of LCCs for investigations of MCARs and near miss MCARs. 3. Some recognized RCA techniques may adequately incorporate review of human systems in the incident investigation process, consult with CCHMP for approval.

See A52-01 for more details on this discussion and related ensure item.

R NoneISO








Abr

A52-04 Does the owner or operator have a process in place to identify incidents that could reasonably have resulted in a Major Incident or MCARs? [T19 CCR §2762.9(a), ISO Section 450-8.016(b)(1) & Section B: Chapter 5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources must have a system in place to identify incidents that could reasonably have resulted in a Major Incident or MCARs [Section B: Chapter 5 of the CCHMP Safety Program Guidance Document and CCHMP interpretation]

As mentioned in A45-01, the stationary source has a system to identify incidents that could have reasonably resulted in MCARs, but not in major incidents. Per CCHMP review of the FIM database, there were about 200 incidents and near misses that occurred after the CalARP Program 4 effective date (10/1/17). 5 of these incidents are currently being investigated at the stationary source, 3 of which were classified as potential MCARs. CCHMP was informed per SME that none of these incidents were assessed for potential qualification as an incident that could have reasonably resulted in a major incident. See A45-01 for more discussion on this topic and related ensure item.

CCHMP was informed that a draft policy is in-progress to include requirements for identifying and reporting incidents that could have reasonably resulted in major incidents, however, CCHMP was not able to review this policy and confirm there is a process to identify these incidents.


Abr



A52-05 Does the submitted RMP and Safety Plan accurately reflect the Incident Investigation Program at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016(b)(4) and Section E.3.2 of the CCHMP Safety Program Guidance Document]


See A45-16 for discussion on this topic. Y NoneProgram 4 CalARP & ISO

Abr


A53: Section B - ProceduresID# Question Clarifications Findings Answer ActionsCategory Type

A53-02 Has the Stationary Source:a) Determined which tasks require written procedures; b) Verified that they have written procedures for every task deemed necessary; andc) Augmented vendor or manufacturer procedures to ensure information includes appropriate level of detail to match facilities’ worker competency? [Section B: Chapter 6.1.2.1 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources should address routine activities as well as infrequent tasks, shared tasks, or tasks requiring assistance from operators from other areas or assistance from other craft.2. Task analysis (e.g., hierarchical task analysis, tabular task analysis, and timeline analysis) is one method to develop comprehensive task descriptions and procedures. Stationary Sources should also remember to consider all operating modes including non-routine and maintenance activities in the task analysis.3. Training Needs Assessments, Process Hazard Analysis, and Job Safety Analysis are examples of resources for identifying tasks that should have written procedures.4. Factors that should be considered when determining whether a written procedure is necessary include: a) Frequency; b) Criticality; c) Complexity; and d) Regulatory requirements.5. Stationary Sources may find it beneficial to review existing work instructions, training matrices, and the most hazardous or unreliable processes (e.g., high risk work).6. For uniformity in procedure development, written criteria that defines levels of frequency, criticality, complexity and procedure requirements is encouraged.7. If the consequence of not performing a task or performing a

As described in A39-02, Procedure A(A)-32 is to establish the requirements for controlling, reviewing and revising operating procedures (including Work Instructions). Per interview, factors that are considered when determining whether a written procedure is necessary include frequency, criticality, complexity, and regulatory requirements. The scope includes conducting a proper review process including functional, technical and compliance (use of Latent conditions checklist) and conducting preliminary and final approval.

Per interview with the SME, SMR used a consulting team and a vendor provided software to review all operating procedures. Operations employees were involved in the review starting in 2003 and ending in 2004. Rules for writing procedures were followed along with a team of vendor engineers for the review. Every one of the procedures were rewritten and the review verified that they have written procedures for every task deemed necessary; and augmented vendor or manufacturer procedures to ensure information includes appropriate level of detail.

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typetask in an arbitrary manner is acceptable, an official written operating procedure is probably not required.



A53-04 Did the owner or operator develop a schedule for revising existing operating and maintenance procedures based on a human factors analysis? [T19 CCR §2762.15(e) & Section B: Chapter 6.1.2.4 of the CCHMP Safety Program Guidance Document]

1. The owner or operator shall complete no less than fifty percent of assessments and revisions by 9/29/2020 and one hundred percent by 9/30/2022. [T19 CCR §2762.15(e)]2. The timing listed in clarification #1 only applies to a new owner or operator that was not subject to county ISO requirements prior to being subject to Program 4 requirements. [CCHMP interpretation]

As described in A53-02, operating procedures are reviewed every three years and this review includes a review of human factors LCCs.

CCHMP reviewed Procedure A(A)-37: Create and Revise Maintenance Procedures, rev. 3, February 2018. This procedure establishes fundamental requirements for creating and revising field maintenance activities. This procedure applies to all employees who create and approve maintenance procedures, work instructions and safe work practices. The procedure uses a decision tool that assesses task complexity, familiarity and criticality to determine the combined risk and the choice of one of three levels of LCC checklists.

Per interview with the Training Supervisor responsible for development of maintenance procedures, SMR previously (about 2013) reviewed all written maintenance procedures and work instructions and ranked them per the procedure tool available. At that time, only one maintenance procedure and the Instrument Protective Functions (IPFs, approximately 200 procedures) were ranked as true procedures. The other procedures were identified as work instructions that did not require human factors LCC or step by step sign offs. As of 3/1/2018, all procedures previously documented for maintenance activities will be reviewed. Those procedures that have actual maintenance activities will be risk ranked based on the new policy A(A)-37. The maintenance procedures will address one of the human factors LCCs appropriate to the level of the risk ranking. A more recent review of maintenance procedures identified 86 procedures that involve maintenance activities and there are additional



ID# Question Clarifications Findings Answer ActionsCategory Typemaintenance related procedures that will be selected and reviewed that would be included in the review. Per interview with the maintenance training supervisor, SMR will review approximately 100 to 200 maintenance related procedures and complete at least 50 percent by 9/30/2020 and one hundred percent by 9/30/2022, per the P4 CalARP requirements.

The IPFs have their own Procedure (C(A)-13: Requirements for Safety Instrumented Functions) that does not specify which LCC is used for review of the IPF procedures. For review and updating of the IPFs procedures, SMR should also consider reviewing and applying the latest developed maintenance procedure A(A)-37.



A53-06 Has the Stationary Source ensured that interrelated procedures are reviewed and that gaps and overlaps are eliminated? [Section B: Chapter 6.1.2.3 of the CCHMP Safety Program Guidance Document]

1. If the Stationary Source elects to eliminate an existing procedure, a separate methodology, such as a procedure needs assessment, should be developed by the Stationary Source to document the assessment process. Such assessment should include a rationale for elimination of the procedure and should include review and considerations by existing trained and qualified personnel satisfying employee participation requirements. 2. It is important to review boundary operations and shared resources and equipment.3. A gap analysis is a tool for creating procedures and eliminating overlaps/redundancies within procedures, not for eliminating procedures.[Section B: Chapter 6.1.2. CCHMP Safety Program Guidance Document]

CCHMP reviewed the operating procedures referenced in A39-02 and noted that those procedures related to a given procedure are referenced/highlighted on the first page of the procedure. A procedure may reference a different procedure if there is a need for completing a different procedure as part of the first procedure.

The three year review of the operating procedures includes a functional review by the production department mentors, operators and operations specialist that identifies gaps and overlaps and any gaps and overlaps which are mitigated accordingly.

Per interview with the Training Supervisor responsible for development of maintenance procedures, they have previously reviewed nearly one hundred procedures and identified only one procedure that was determined to require a review of effective procedure writing and completing an LCC. A more recent review of maintenance procedures has identified a minimum of 86 procedures that directly involve maintenance activities and there are additional policy/procedures such as safe work practices that will be selected and reviewed that would require a review of the effective procedure writing policy and completion of an LCC.

Y NoneISO Abr



A53-09 Has the Stationary Source trained employees responsible for developing and maintaining the procedures in rules for writing effective instructions? [Section B: Chapter 6.1.2.5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources should consider developing written guidelines that summarize the accepted manner in which procedures are to be written, reviewed, revised, and maintained.2. Stationary Sources should identify the frequency for refresher training of appropriate personnel in rules for writing effective instructions (e.g., at least every three years, just in time) to be consistent with Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document.

Each of the six refinery Production Departments has identified a production mentor who is responsible for developing and maintaining the operating procedures. The Training Department manager trains the Production Department mentors on a face to face training basis on written guidelines that summarize the accepted manner in which procedures are to be reviewed, revised, and maintained. The training manager also covers the rules for writing effective instructions, and how to manage procedures and documentation of the review process.

The training department also maintains a computer based training module on writing effective procedures that includes a handout titled "Basic Procedure Writing Skills". The production mentors complete this training as a part of their refresher training on writing effective procedures.

Per interview with the Training Supervisor responsible for training the maintenance department employees, the computer based training module will be used to train maintenance employees assigned to reviewing and maintaining the maintenance procedures. CCHMP reviewed this training module that takes about half an hour to complete and found it to be an effective tool for this training. However, maintenance staff that will be assigned to writing procedures may not have any familiarity for writing effective procedures using latent conditions checklists. CCHMP believes that live training similar to that for operating procedures should be provided to the first time maintenance procedure writers and computer based training can be used as a supplement to the live training and also as a refresher training.

Y NoneISO Abr



A53-10 Has the Stationary Source developed programs to review and approve procedures to ensure that they are accurate, current, and that the effects of procedural errors are fully understood, and appropriately documented? [Section B: Chapter 6.1.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP audit questions A39-18 and A39-19, as well as ISO question A51-04.2. Stationary Sources may elect to have employees observing other employees performing the task, identifying any discrepancies between the written procedure and the actual practice.3. Stationary Sources may elect to combine the procedure review and refresher training by requiring personnel to "walkthrough" the procedure with their supervisors.4. Stationary Sources may elect to conduct a formal error analysis such as barrier analysis, work safety analysis, and/or human error HAZOP.

Procedure A(A-32): Controlling (Reviewing/Revising) Operating Procedures, dated Nov. 2016 addresses the steps to edit, review and revise procedures and what position is responsible for these reviews. The purpose of this procedure is to establish the requirements for controlling, reviewing and revising operating procedures (including Work Instructions) in accordance with MOC requirements. The procedure has several requirements including a functional review, a technical review, a compliance review including the use of Latent Conditions Checklist, preliminary and final review and approval, a final edit review and placing the document into the controlled system.

CCHMP reviewed about 25 operating procedures referenced in A39-02 and conducted procedure walks for the following 4 procedures:- DCU 1130, Charge Heater F-13425 Cold Startup, revised 8/29/2018- DSU-3241, F-30 DSU Furnace Hot Re-Light, reviewed 1/30/2017- DHT-4115, Loss of Wash Water, reviewed 10/17/2017- SR4-2101, SR4 SWS6 Shutdown, reviewed12/15/2016

Based on a review of the referenced procedures and the procedure walks completed, CCHMP noted the following concerns:- Some of the procedures include caution statements or supporting information with actionable steps that need to be corrected to the procedure action steps. An example is a note in Procedure DHT-4115 that has been added as a result of a DHT PHA action item implementation that indicates "Without wash water from stripped sour water or condensate from utilities, corrosive ammonia salts will build up quickly in the circuit, for this

P Ensure to review the operating procedures to identify possible inclusion of actionable steps in caution or support statements that need to be placed as procedure action steps.

Ensure to review the operating procedures for correct placement of caution/ notes statements.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typereason It is recommended that the Corrosion Materials Engineer be notified anytime DHT loses wash water." This supporting information includes an actionable step that needs to be placed into the procedure steps.- The placement of caution statements also need to be reviewed to make certain that they are placed before the applicable process step rather than steps away from the applicable process step (e.g., SR4-2101).

CCHMP also noted the following observations that should be improved in the review of operating procedures:- Procedures do not consistently specify roles for the actionable steps (e.g., DSU-3241, SR4-2101). - Procedures may also benefit from more human factor improvements such as adding missing steps (e.g., DSU-3241).- Procedures do not consistently include equipment numbers (e.g., DSU-3241).

Procedure A(A)-37: Create and Revise Maintenance Procedures, rev. 3, February 2018 establishes fundamental requirements for creating and revising field maintenance activities. This procedure applies to all employees who create and approve maintenance procedures, work instructions and safe work practices. Per interview, the maintenance employees that will be involved in the training will consist of maintenance level supervisors and their designated team members. The Maintenance Training supervisor has not yet identified the specific members that would be involved with the training and would require training in effective procedure writing and completing human factors LCCs.



A53-12 Does the Stationary Source ensure that only current, approved versions of procedures are accessible to employees? [Section B: Chapter 6.1.4 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources that maintain both electronic and printed procedures need to have a program to ensure that both contain only current and approved versions of procedures.

SMR maintains the up to date electronic copies of their operating procedures available to the Production Departments. These are kept on line by the Production Department mentors and the Production Department administration staff in coordination with guidance from the Training Department. Each control room maintains a red binder with hard copy emergency operating procedures at each of the Production Departments. A hard copy binder containing the normal operating procedures is also maintained at the Shift Team Leader's office. Hard copy emergency and normal operating procedures are updated whenever a procedure or group of procedures are updated.

Y NoneISO Abr



A53-14 Has the Stationary Source incorporated the following into normal procedures and emergency operating procedures:a) Procedure title and number (if appropriate) should be easy to locate;b) The last step of the procedure should be identified;c) Temporary procedures should be clearly identified;d) Each procedure should be written for the procedure user (i.e., engineer, operators, health and safety staff, level of experience);e) Each step should be written as a command;f) Use common words;g) Avoid vague terms (i.e., leave no room for guessing or interpreting word meaning);h) Spell out first use of acronyms and abbreviations; i) Each step should include only one action. This will help to ensure that employees will not “overlook” an assumed but unwritten step;j) Steps that should be performed in a particular sequence should be numbered and listed sequentially;k) Critical step sequencing should be preceded by a caution or warning;l) Whenever possible, the procedures should reference equipment or instrumentation by unique number or name;m) Page layout (i.e., line spacing, length of lines, and font size) should not negatively affect readability;n) Procedures should neither reference steps from nor excessively reference other procedures or documents;o) Precautionary statements (e.g., warning, caution) should be clearly

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated. [Section B: Chapter 6.2 of the CCHMP Safety Program Guidance Document]2. Flow charts can aid in understanding complex procedures with parallel paths.

CCHMP reviewed the procedures referenced in A39-02 in regards to the specified topics to be addressed and noted that these general elements of effective procedure writing have been incorporated into the normal operating procedures and emergency operating procedures.

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typedefined and placed immediately before the step to which they apply; p) Precautionary statements should stand out from procedure steps;q) Procedure “branching” (e.g., return to step 3) should be minimized; r) Sign off should be required for verifying critical steps of a procedure;s) Steps within procedures to be performed by multiple employees should be clearly indicated and possibly require checklists or signoffs;t) Complex procedures or procedures that require more than one shift to perform should require check-off or sign-off;u) Steps that require contingencies or criteria to assist the employee should precede the action (i.e., if the temperature is above XX, set the flow rate to the following range YY-YYY);v) Formulas or tables should be included when procedures require calculations (i.e., minimize “in your head” calculations); w) Incorporate feedback loops as appropriate in the procedure so that employees can verify that their activities were correct; x) Non-routine personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply (alternatively a step to don or use the PPE);y) Instructions and conditions when by-passing shutdown systems or interlocks is allowed should be specified; andz) Write all steps necessary for the operating task (e.g., do not list “startup compressor” if there is


ID# Question Clarifications Findings Answer ActionsCategory Typemore than a simple push-button to press)? [Section B: Chapters 6.2 and 6.4 of the CCHMP Safety Program Guidance Document]

A53-15 Has the Stationary Source ensured that emergency operating procedures are easy to access and clear to understand? [Section B: Chapter 6.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to ISO question A53-05.2. Stationary Sources may elect to use different color paper or a separate brightly colored binder for emergency procedures.3. Clarity in understanding may be enhanced by using larger type than usual, or by using lists in conjunction with simplified drawings or flow diagrams.4. Decision aids (flow charts, decision trees) may be used to assist the operator in making correct decisions.

On line on the facility server, every department has a web page that includes hyperlinks to their emergency procedures. A red binder maintains hard copies of the emergency procedures which are kept at the console operator work station for a given department. Per a review of the emergency procedures referenced in A39-02 and operator interviews, emergency operating procedures are easy to access and clear to understand.

A binder containing copies of the normal operating procedures for each production unit is kept in the Shift Team Leader's office along with the red binder containing hard copies of the emergency procedures.

Y NoneISO Abr

A53-17 Does the submitted RMP and Safety Plan accurately reflect the Procedures Program at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016(b)(4) and Section E.3.3 of the CCHMP Safety Program Guidance Document]


The submitted RMP dated December 2016 Pages 44-45 and Safety Plan dated August 2016 Pages 15-16 accurately reflect the Procedures Program at the stationary source.


Abr






There were two ensure action items associated with the previous CalARP/ISO audit of which one has been addressed and a second one has been reiterated in a modified form in A48-11 (Emergency Response Questionnaire).

Y NoneAudit Follow-Up

Abr



A53-19 Has the Stationary Source incorporated the following into maintenance procedures: a) Elements listed in A53-16;b) List the craft or personnel to which the procedure is applicable;c) Labeled graphics should be included for the user’s benefit;d) Sufficient detail must be used to reduce interruptions (i.e., times that the user must stop the procedure or put the procedure down);e) The procedure should include the Scope and Purpose;f) Special tools and equipment necessary to complete the job should be listed at the beginning of the procedure;g) Specific or unique cleaning supplies should be noted;h) Appropriate health and safety information should be included or referenced;i) The personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply; j) Should include required follow-up actions or tests and identify the user who must be notified as appropriate;k) Consider identifying critical maintenance tasks; andl) Consider including self-checks that should be used during maintenance activities? [Section B: Chapter 6.3.1 of the CCHMP Safety Program Guidance Document]

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated. [Section B: Chapter 6.3 of the CCHMP Safety Program Guidance Document]

Per interview with the Training Supervisor responsible for training the maintenance department employees (SME), SMR had previously screened the maintenance procedures and identified one procedure to review for compliance with the ISO requirements and that procedure was:- CDM-1P: Safe Use of Bleeder Cleaner/ Rodout Devices, reviewed 4/1/2016.

CCHMP also reviewed an LCC that was completed for this procedure that contained 20 questions. The LCC did not identify any corrective actions.

Per interview with the SME, the computer based training module referenced in A53-09 is planned to be used to train maintenance employees assigned to reviewing and maintaining the maintenance procedures. CCHMP reviewed this training module and found it to be an effective approach for this training. A combination of this training module with the three types of Human Factors LCCs included with Procedure A(A)-37: Create and Revise Maintenance Procedures generally address the requirements for this question. However, the elements included in Section B, Chapter 6.2 of the Safety Program Guidance Document should be compared with the computer based training for writing effective procedures and also incorporated into a live training for effective procedure writing.

Y NoneISO Abr



A53-20 Has the Stationary Source incorporated the following into safe work practice procedures:a) Elements listed in A53-19;b) Steps to drain, purge, or clean the equipment, if applicable;c) Safeguards to protect against the hazards, for example, isolation of energy sources and process materials;d) Required monitoring of worksite conditions and worker performance; ande) A method to formally turn over control of the equipment from operations to the group responsible for the maintenance work? [Section B: Chapter 6.3.2 of the CCHMP Safety Program Guidance Document]

1. The intent of this question is not to dictate the content and format of procedures but some of these general elements of effective procedures should be incorporated.

CCHMP reviewed a sampling of safe work practice policies and found they include tasks in general terms but the tasks do appear to be specific enough to benefit from a human factors evaluation. Consistent with the prior CCHMP ISO audit, this question is not applicable. Policies reviewed included:

- C(F)-4, Lockout of Electrically Driven and Powered Equipment, dated October 2017, rev. 15

- C(F)-5, Isolation Procedures, March 2017, rev. 21- I(F)-3, Safety/Departmental Permits, June 2017, rev. 26

- I(F)-29, Control of Hazardous Energy, October 2017, rev. 10

Per interview with SME, these and other safe work practices, including confined space entry, will be reviewed as part of the more comprehensive review of maintenance procedures for possible application of effective procedure writing and human factors LCCs.

Y NoneISO Abr


A54: Section B - MOC for Organizational Changes


A54-01 Has the owner or operator developed, implemented and maintained a written procedure for conducting MOC's on the:a) Reduction in the number of positions, or number of personnel;b) Reduction of classification levels of employees; c) Changing shift duration;d) Substantive increase in the responsibilities of personnel at or above 15%? [T19 CCR §2762.6(a), §2762.6(i) & Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

1. MOOC is required for changes affecting operations, engineering, maintenance, health and safety or emergency response.2. Owner or operators can incorporate MOC for organizational changes into their MOC process, or can develop a separate Management of Organizational Change (MOOC) process.3. MOOC requirements also apply to contractors in permanent positions. [T19 CCR §2762.6(j) & ISO 450-8.016(b)(1)(F)]4. Reduction in the number of positions, substantive increase in duties, and changes in responsibilities refer to changes in permanent staffing levels/reorganizations. Staffing changes that last longer than 90 calendar days are considered permanent. [T19 CCR §2762.6(j) & ISO 450-8.016(b)(1)(F)]

CCHMP reviewed Procedure I(A)-53 - Management of Organizational Change (MoOC policy; revision dated 2/20/2018) which describes an applicable change as:- Change in the number of positions, or number of personnel within those positions- The roles and/or responsibility to perform identified critical activities assigned to a specific position are substantially increased or modified- Change to the organization structure (existing organizations are merged or divided- Reduction in staffing levels, reducing classification levels of employees, changing shift duration, or substantively increasing employee responsibilities at or above 15% (based on time available to carry out tasks). The requirements also apply to contract partners in permanent positions.

Per interview with the MoOC SME, there have been no organizational changes that meet the criteria mentioned above since the previous CCHMP audit.


Abr



A54-02 Has the Stationary Source developed criteria or guidance to assist appropriate personnel in determining "when" an MOC for an organizational change should be initiated? [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

1. The MOC for organizational changes or MOOC should occur prior to the change although this may not always be possible (for example, an employee abruptly leaving on their own accord).2. If the MOOC takes place after the change is made, the MOC Policies or procedures shall state when the MOC will be complete for this organizational change.3. MOOC requirements also apply to contractors in permanent positions in operations and maintenance and temporary changes associated with strike preparations. [T19 CCR §2762.6(j) & ISO Section 450-8.016(b)(1)(F)]4. Process changes may impact the way personnel interact with the process and should be examined as possible candidates for MOOC analysis. 5. Stationary Sources are encouraged to develop a documented screening process to briefly review all pending changes in positions of operation, maintenance, emergency response, and health & safety to determine whether the change would be subject to a full MOOC evaluation. [Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

Section 6.2 of the MoOC policy provides additional language and guidance for when an MoOC is to be initiated:

- Elimination of a position with the exception of a temporary position filled for the purpose of accomplishing a discrete task for a finite duration/upon completion of a task or a position made obsolete by accompanying elimination of non-critical responsibilities- Reduction of number of individuals in a position: the reduction must be at or below the minimum number of individuals necessary to ensure that direct operations, safety, or emergency response activities can be carried out without routinely incurring excessive overtime that may lead to fatigue- Significant change in responsibilities: an overall increase of responsibility that impacts a position's capacity (time available) to effectively carry out some or all of the required tasks; changes in responsibilities when replacing critical tasks with other tasks without ensuring that the critical tasks continue to be addressed


Y NoneISO Abr



A54-03 Does the owner or operator provide for affected employees and their representatives participation in the MOOC? [T19 CCR §2762.6(k)(2) & Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

* Review MOOC documentation to verify affected employees and employee representative participated in all phases. [T19 CCR §2762.10(a)(2) & Section B: Chapter 7 of the CCHMP Safety Program Guidance Document]

Section 6.3.1 of the MoOC policy describes the MoOC Change Review Team. The team consists of 2-5 people with the size and makeup of the team to be determined by the manager(s) of the affected department(s). The makeup of any specific change team should include personnel who:1. Will be affected by the change (representatives of the affected positions), and2. Are likely to be the most familiar with the potential impacts of the change


N/A NoneProgram 4 CalARP & ISO

Abr

A54-04 Has the owner or operator developed and disseminated criteria or guidance to assist personnel responsible for conducting the MOOC in determining the composition of the team? [T19 CCR §2762.6(k) & Section B: Chapter 7.1 of the CCHMP Safety Program Guidance Document]

1. "Change teams" or "MOOC teams" should include employees and their representatives, as appropriate, from engineering, maintenance, and operations as well as safety and health.2. The “change team” or “MOOC team” must be given the time, resources, and management support to properly evaluate proposed staffing changes. [Section B: Chapter 7 of CCHMP Safety Plan Guidance Document]

See A54-03 regarding guidance for determining the makeup of the MoOC Change Review Team.





A54-05 Has the owner or operator developed and implemented a method to ensure that they clearly understand their existing situation prior to making the organizational change including performing a human factors analysis? [T19 CCR §2762.15(c) & Section B: Chapter 7.2 of the CCHMP Safety Program Guidance Document]

1 Owner or operator must do a human factors assessment as part of the MOOC analysis and as identified in A50-02 [T19 CCR §2762.6(k)(3) & §2762.15(c)].2. Owner or operators may elect to conduct a job task analysis to clearly understand the responsibilities of each position.3. Written job function descriptions must be current and accurate for all positions affected by the change. [T19 CCR §2762.6(k)(1)].4.Prior to conducting the MOOC, owner or operators need to evaluate job tasks and any “other” activities that an individual performs to effectively account for the existing situation. 5. Job tasks and any “other” activities that an individual performs need to be evaluated to effectively account for the existing situation.6. All positions that may be reduced or eliminated as well as those positions that may have an increase in duties and/or responsibilities associated with the change must be assessed.7. Owner or operators are encouraged to develop a process to attempt to capture the knowledge and experience from personnel before they change positions or vacate their position even if there are no proposed changes. The MOOC process may be used to document such

information. [Section B: Chapter 7 CCHMP Safety Plan Guidance Document]

Section 6.3.2.1 of the MoOC policy describes the process to define the existing situation prior to making an organizational change. Section 6.3.3 of the same policy describes the use of the Latent Conditions for Management of Organizational Change checklist (Attachment D) which includes 15 questions taken from the County's Latent Conditions Checklist (County LCC) and are tailored to identify potential issues associated with the proposed organizational change.

Per interview with the Process Safety Manager, job descriptions for all Shell employees (both hourly and staff) are available on the HR Online program. When an MoOC is initiated, as part of the evaluation process, an individual in the affected position is required to record the job description to ensure there are no gaps between the recorded job description and current duties performed.



Abr



A54-06 Has the Stationary Source developed and implemented a method for determining the technical basis for the organizational change including: a) Purpose; b) Scope; andc) Schedule of the pending staff change and the potentially affected positions? [Section B: Chapter 7.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP question A42-03.2. The technical basis should include what is to be changed, what is to be achieved by the change, why will the change achieve the intended goal, and why is the change necessary at this time.3. Stationary Sources may elect to use Attachment B of the CCHMP Safety Program Guidance Document (CMA’s Management of Safety and Health During Organizational Change).

CCHMP reviewed the MoOC Approval Form (Attachment A) which includes the following sections to record the technical basis of an organizational change: Description of Change, Summary of Impact Assessment. Per interview with the MOOC focal point and a review of the MoOC policy, the implementation date of the organizational change is determined during the Management Review portion of the MoOC work process and is recorded by Human Resources. Attachment A of the MoOC form identifies a MoOC closeout date that for all practical purposes reflects when the organizational change has been implemented.


Y NoneISO



A54-07 Has the owner or operator developed, implemented, and maintained a method for assessing the impact that the change in staffing will have on operations, engineering, maintenance, health and safety, and emergency response? [T19 CCR §2762.6(j) & Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP question A16-04, but is focused on staffing changes.2. Owner or Operators may elect to conduct a modified PHA to assess the impact of the change on safety and health. 3. Owner or Operators may elect to complete a time sequencing analysis to outline all of the tasks that must be performed during critical and emergency situations. 4. Owner or Operators may elect to conduct field verification of the time/task analysis for the identified scenarios, as appropriate.5. Owner or Operators must stop and redefine the situation if the health and safety evaluation discovers additional position(s) that are affected that are not being evaluated. [Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

Section 6.3.2 of the MoOC policy describes how a Change Review Team will assess the impact of a proposed organizational change. The team begins with defining the existing situation and developing a detailed inventory of the job duties that are carried out by the affected positions. Any of the above duties that are identified as critical to Health, Safety, Security, and Environment (HSSE), Product Quality (PQ), and Reliability are documented within the Critical Activities Mapping Table (Attachment B); the tasks are then distributed by the Department Manager to alternate personnel to ensure that these duties continue to be carried out effectively. Additional impact assessments include the Health and Safety Checklist for Management of Organizational Change (Attachment C) which focuses on the following impacted areas: Health and Safety (H&S) Management, H&S Training, Safe Work Practices, OSHA PSM Management, Contractor Safety, Emergency Response, Safety and Health (S&H) Regulatory, Occupational Health, Operations Effectiveness H&S, and Craft Safety Effectiveness.



Abr



A54-08 Does the MOOC team have a written document of the effects of the organizational change, the findings, recommendations, rationale for the team’s decision to implement or not implement the change and potential action items to mitigate the consequences of the change? [T19 CCR §2762.6(k) & Section B: Chapters 7.4 and 7.5 of the CCHMP Safety Program Guidance Document]

1. Documentation must include: MOOC team members, description of the MOOC, factors evaluated by the team which should include: how the existing situation was defined, technical basis for the change, how any impacts on safety and health were assessed, negative impacts identified and documented mitigation actions that resolved each identified negative impact. [T19 CCR §2762.6(k) & ISO Section B: Chapter 7.5 of the CCHMP Safety Program Guidance Document]2. The documentation must clearly identify if the management decision is inconsistent with the team findings (e.g., the MOOC team concludes that the change could negatively impact safety and cannot be mitigated and the management feels that the effects can be addressed by certain corrective actions.)

Section 6.3.6 of the MoOC policy describes the MoOC package which includes the following documentation:- Completed MoOC Approval Form - Attachment A- Description of Organizational Change & Duties Inventory (Consult with MOC Focal Point for examples, if needed)- Completed Critical Activities Mapping Table - Attachment B- Completed Health & Safety Checklist - Attachment C- Completed HF Latent Conditions Checklist - Attachment D- Completed Action List (if any) - Attachment E- Implementation Plan- Training Documentation, including Sign-Off Sheet- Completed Documentation Update Plan - Attachment G- Completed MoOC and Latent Condition Checklist training and Management Review Signoff - Attachment F





A54-09 In their review of an organizational change, does the Stationary Source pay particular attention to assessing the impact on safety and health during: a) Off hours; and b) Emergency situations? [Section B: Chapter 7.4 of the CCHMP Safety Program Guidance Document]

1. For example, personnel changes may reduce the number of operators available during an emergency or increase operator response time to complete a task.2. For example, the addition of equipment that significantly adds to the complexity of the unit may require additional resources to bring to a safe state during an emergency.

Attachment D includes several questions that are used to identify the impact of a proposed organizational change with respect to emergencies:- 1.9: Would the change impact the ability to relieve workers for necessary breaks from periods of sustained concentration such as emergencies (i.e. is adequate backup available to accommodate necessary physical and mental breaks)?- 2.6: Do written procedures for emergency operations presume a certain number of operators, and if so, would the change affect implementation of these procedures?- 2.50: If the change is implemented, will operators have time to respond to emergencies and report (i.e., make necessary notifications) in accordance with procedures?- 4.28: If the change affects an operator position, is the operator also an emergency responder (e.g., fire brigade member)?- 4.29: If the change is implemented, will there be adequate backup assistance when an operator emergency responder must respond to an emergency?- 4.30: Would the change result in tasks requiring the operator to travel large distances to perform nearly simultaneous actions?

Prior to completing Attachment D, the Change Review Team is provided training on the MoOC work process and the use of Attachment D to identify latent conditions. The training is documented

Y NoneISO



A54-10 Has the owner or operator developed and implemented a method to ensure that employees affected by the organizational change are informed of, and trained in, the change prior to the change occurring? [T19 CCR §2762.6(l) & Section B: Chapter 7.5 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP questions A42-08 through A42-10.

Attachment A includes a section to record whether training on the organizational change has been completed by affected employees. Per interview with MOOC focal point, notification of the change is communicated to affected employees via email and any required training is provided as necessary prior to being assigned additional responsibilities.


A54-11 Has the Stationary Source developed and implemented a method to ensure that operating, maintenance, health and safety, and emergency response procedures are updated accordingly associated with an organizational change? [Section B: Chapter 7.5 of the CCHMP Safety Program Guidance Document]

1. This ISO question is similar to CalARP questions A42-05 and A42-12.

CCHMP reviewed Attachment C and noted the OSHA PSM Management section asks if the organizational change could impact operating procedures, emergency planning and response. Additionally, the MoOC Document Update Plan (Attachment G) and Latent Conditions HF Checklist for MoOC (Attachment D) identify the following documents that may need to be updated: Operating Procedures, Emergency Procedures, Maintenance Procedures.

Y NoneISO

A54-12 Does the Stationary Source ensure that procedures that require simultaneous tasks or require tasks to be conducted by certain positions are reviewed during the MOC for organizational change? [Section B: Chapter 6.1.4 of the CCHMP Safety Program Guidance Document]

Attachment D includes several questions that address simultaneous tasks or position-specific tasks. See A54-09 regarding example questions.

Y NoneISO








Abr

A54-14 Does the submitted RMP and Safety Plan accurately reflect the MOOC Program at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016(b)(4) and Section E.3.4 of the CCHMP Safety Program Guidance Document]


CCHMP reviewed the most recently submitted RMP (certification dated 6/20/2014) and noted that the document has not been updated to include a description of the MoOC program at Shell Martinez. Shell Martinez has until September 30, 2019 to update the RMP to meet this requirement. See A49-27 regarding updates to the RMP.

Pages 45 and 46 of the submitted Safety Plan (certification dated 8/26/2016) accurately reflects the MoOC program currently employed at Shell Martinez.


Abr



A54-15 Has the stationary source manager, or designee, certified based on information and belief formed after reasonable inquiry that the MOOC assessment is accurate and that the proposed organizational change(s) meets the regulatory requirements? [T19 CCR §2762.6(k)(4)]

Section 6.3.3 of the MoOC policy describes the management review and approval process for MoOCs. Upon completion of the Change Review, the team leader should schedule a meeting with the Manager(s) of the affected department(s) to review the findings, agree on a proposed mitigation plan and timeline to address issues identified by the Change Review, and develop the change implementation plan and timeline. The completion of the Management Review is documented within the Management Review and Approval Section of the MoOC Approval Form (Attachment A) and the MoOC and Latent Conditions Checklist Training and Management Review Sign-Off form (Attachment F).


N/A NoneProgram 4 CalARP

New



A54-16 Did the owner or operator provide effective training to employees and employee representatives before serving on a MOOC team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions? [T19 CCR §2762.4(e)]

Section 8 of the MoOC policy identifies the training requirement for the Change Review Team members as just-in-time training on the MoOC and Latent Conditions checklist prior to participation on a Change Review Team. This training is documented using Attachment F of the MoOC procedure.

The MoOC and Latent Conditions Checklist Training and Management Review Sign-Off sheet (Attachment F) identifies the topics covered in the MoOC training: - MoOC Work Process- Purpose and intent of the MoOC latent conditions checklist- Method for reviewing, interpreting and responding to questions- Review of questions in the latent conditions checklist- Understanding the reason for each question- Relative importance of different questions



New


A55: Section B - Employee Participation


A55-05 Does the Stationary Source ensure that employees and their representatives review the written human factors program on an established frequency and that any necessary revisions are incorporated? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

1. Continuous improvement of the human factors program should be documented and may include, but is not limited to the following activities: periodic review of completed latent conditions checklists (LCC) for accuracy and appropriateness; periodic review of the various LCC questions or customized checklists for adequacy of use; field evaluations/spot checks on human factors issues; verification of human factors issues and assurance that subsequent recommendations were properly addressed; human factors training needs assessment for employees; and periodic review of the Stationary Source’s written human factors program.

CCHMP reviewed I(A)-15 (rev. 9, Feb 2018); section 6.10 specifies employees and their representatives shall participate in the review of the Human Factors program (and this document) at least every five years and more often as necessary. It further states employees participate in the application of the Latent Conditions Checklist, participate as members of Process Hazard Analysis teams, Incident Investigations team, reviewing Management of Organizational Change for staffing changes, in reviewing and updating operating and maintenance procedures and throughout the MOC process as applicable.

Per CCHMP review, a team was formed to review the written human factors program in 2013, see A50-12 for a more detailed discussion of this review.

Y NoneISO Abr



A55-07 Does the Stationary Source ensure that employees and their representatives participate in maintaining the written human factors program current and accurate? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed I(A)-15 Human Factors (rev. 9, Feb 2018) and in section 2.0, it states employees participate in the application of the Human Factors Checklist, participate as members of the Process Hazard Analysis teams and Incident Investigation teams, review Management of Organizational change for staffing changes, and review and update operating and maintenance procedures.

Per CCHMP review of the prevention programs, employees are involved in completing the latent conditions checklists. Per PHA, the team completes the LCC as a team prior to the HAZOP and will field-verify any specific issue of concern that was identified. For procedures, the procedure mentor consults with an SME to review the procedures before finalizing. Employees are also involved with completing latent conditions checklists associated with qualifying incident investigations.

Y NoneISO Abr

A55-10 Does the Stationary Source ensure that employees and their representatives are included in the incident investigation team, and are involved with evaluating latent conditions during the investigation? [Section B: Chapter 8.2.3 of the CCHMP Safety Program Guidance Document]

1. This ISO question is a follow-up to CalARP/ISO question A45-03.

Per interview and policy review, employees and their representatives are included in the incident investigation team and are involved with evaluating latent conditions during the investigation.

Y NoneISO Abr

A55-11 Does the Stationary Source ensure that employees and their representatives participate in developing, reviewing, finalizing, and maintaining procedures, including identification of latent conditions existing within the procedures that could cause or exacerbate an active failure? [Section B: Chapter 8.2.4 of the CCHMP Safety Program Guidance Document]

1. This ISO question is a follow-up to ISO questions A53-07 and A53-10.

Per interview, the LCC is completed by the mentor when a procedure is revised. The LCC along with the updated procedure are then reviewed by a content SME and mentors.

Y NoneISO Abr



A55-12 Has the Stationary Source developed a human factors committee to assist in the development and implementation of the human factors program; or maintain documentation of employee participation in continuous improvement of the human factors program? [Section B: Chapter 8.2 of the CCHMP Safety Program Guidance Document]

1. Optional to have a formal human factors committee, but recommended.2. Typical activities in continuous improvement of the human factors program could include, but are not limited to: periodically reviewing completed latent conditions checklists (LCC) for accuracy and appropriateness; periodic review of the various LCC questions or customized checklists for adequacy of use; performing field evaluations/spot checks on human factors issues; ensuring recommendations are properly addressed; and assessing human factors training needs for employees.

Per interview, there was a human factors committee when the facility was first developing the human factors program. The committee has been disbanded for many years. It is optional to have a human factors committee.

See A55-05 for review of the human factors program by employees.

Y NoneISO Abr

A55-13 Does the submitted RMP & Safety Plan accurately reflect the Employee Participation Program at the Stationary Source? [T19 CCR §2745.2(d) & ISO Section 450-8.016(b)(4) and Section E.3.5 of the CCHMP Safety Program Guidance Document]


Section 4.4.10 of the RMP (rev. Dec. 5, 2016) and Section 5.9 of the Safety Plan (rev. Aug. 2016) describes the employee participation program at the facility but does not reflect some of the new elements of program 4 (e.g. participation in the Damage Mechanism review, Safeguard protection analysis). However, these are not required updates for SP and the facility has until September 2019 to update RMP to reflect new programs. See additional discussion on A49-27.


Abr






There were no ensure action associated with the 2015 CalARP/audit.


Abr

A55-15 Does the owner or operator make available and provide on request a copy of the written Human Factors Program to employees and their representatives, and to affected contractors, contractor employees, and contractor representatives? [T19 CCR §2762.15(h)]

* Verify contractors and contractor representatives have access to the Human Factors Program.

CCHMP reviewed I(A)-15 Human Factors (rev. 9, Feb. 2018) and noted that employees are involved with application of the LCC and review of the LCC checklist (see discussion regarding the LCC checklist review in A50-12).

Personnel all have access to the refinery's policies on the intranet and based on interviews, they are aware of human factors in a generic and general way unless they participated in writing procedures, PHAs or some specific item related to the HF program. Contractors and the representatives will be involved in the HF program to the extent that they are in specific prevention program elements. Contract companies are provided with Shell policies prior to being on site.


New


A56: Section B - Training


A56-05 Does the Stationary Source maintain training documentation (e.g., curriculum, instructor qualifications, course duration, course participants, and means used to ensure participants understood training) for: a) Basic awareness of human factors initial training;b) Overall human factors program; and c) Specialized training (e.g., completion of Latent Conditions Checklist)? [Section B: Chapter 9.2 of the CCHMP Safety Program Guidance Document]

1. Training on the application and completion of the latent condition checklists is required for users of the checklist if the facility uses latent condition checklists, see the Human Factors questionnaire A50 (i.e., Stationary Sources have the option of developing an alternate method other than applying the latent conditions checklist to identify existing latent conditions).

CCHMP was informed that human factors training is required for all new operators and maintenance employees. Currently, the H&S Representative and Environmental Representative provide this training during one of the new hire training sessions. CCHMP reviewed documentation associated with this 2-hour course and confirmed it contained training on basic awareness and on the overall human factors program. The facility documents who receives this training and uses a Q&A process with breakout sessions to verify understanding. CCHMP was informed that some of the individuals performing the training were involved with the original human factors program development or had received the training in the past. Section 8.0 of the Human Factors policy I(A)-15 identified that employees who received the initial awareness training or refresher training on Human Factors are qualified to train others on the application of the LCCs.

For new hire operator training documentation, CCHMP reviewed an agenda that identified human factors training was to be provided on 1/8/18. CCHMP was informed that face-to-face training documentation is maintained on sign-in sheets. Reviewing the Sign In Sheet/Training Roster for the new operator hires and although it listed the attendees, it did not identify that initial human factors training was actually provided. CCHMP spoke with the trainer and confirmed training was provided on that day. For maintenance new hires, their initial face-to-face training on human factors (dates ranged from 2/2/16 through 1/24/18) was documented on

Y NoneISO Abr


ID# Question Clarifications Findings Answer ActionsCategory TypeSign In Sheet/Training Rosters along with attendee signatures.

CCHMP was informed that all other site personnel review their initial Human Factors training, associated with I(A)-15, through the Shell Open University (SOU). This training is computer based and includes instruction and quizzes. Every individual assigned to take this course is tracked and documented when training is completed. CCHMP reviewed the SOU course and confirmed it covered basic awareness and the overall human factors program. The training also touches on the use of latent conditions checklists for PHA, operating procedures, incident investigations and management of organizational change. CCHMP notes there was no mention of using latent conditions checklists for maintenance procedures. CCHMP reviewed SOU training documentation on Human Factors for the entire site for all employees, a list of over 650 employees. Human Factors training was documented for each employee. CCHMP also reviewed training for 8 operations and maintenance personnel and confirmed that test results are maintained to verify employee understanding.

CCHMP reviewed specialized just in time human factors training associated with incident investigations. This training was documented on sign-in sheets and kept online along with other incident investigation information. Power Point slides are used to perform training on the LCC process prior to the incident investigation team completing the LCC. CCHMP reviewed the training slides and confirmed it included discussion of the LCCs. Just in time training conducted takes between 10-15 minutes.

CCHMP reviewed specialized just in time human factors training associated with


ID# Question Clarifications Findings Answer ActionsCategory TypePHAs. Documentation of this training was included within the PHA reports. CCHMP reviewed the training slides and confirmed it included discussion of the LCCs.

A56-06 Does the facility provide employees and their representatives with basic awareness and overall human factors refresher training every three years, and more often if necessary? [T19 CCR §2762.15(f) & Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document]

1. Program 4 states, “The owner or operator shall train all of their employees that have process and process equipment responsibilities on the Human Factors Program.” P4 does not specifically require HF training every three years. [T19 CCR §2762.15(f)]2. ISO is more conservative as all employees must receive human factors training. [Section B: Chapter 9.2.2 of the CCHMP Safety Program Guidance Document]3. This training may be an extension of the material provided in the initial basic awareness and overall training curriculums.

As described in A56-05, Shell uses a computerized training tracking system called Shell Open University (SOU) to track the training of basic awareness and overall human factors refresher training. CCHMP reviewed human factors training for the site and found that out of approximately 650 employees trained on human factors, a total of 8 were listed as late for their refresher training. CCHMP was informed that SOU sends emails to employees and their supervisors twice per month that identifies what training is coming due in the next month and what training is past due. Out of the 8 employees who were overdue, three were staff positions, three were operators, one from maintenance and one from the lab.

The Maintenance Department also distributes a maintenance training spreadsheet that lists all maintenance employee's training status. CCHMP was informed that every employee is required to take their training on time, and if they go late their Supervisor steps in to make sure it is completed, including issuing formal reprimands if there is a recurring problem. Since there were only 8 individuals overdue (i.e., 99% in compliance), no action item is warranted.


Abr



A56-07 Does the facility provide employees and their representatives with specialized refresher training on an as needed basis? [Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document]

1. In general, the minimum frequency employees should receive specialized refresher training on completing latent conditions checklists is every three years. For those employees who do not routinely complete a latent conditions checklist, refresher training should occur prior to applying the checklist.2. Individuals learn at different rates using different means. Please refer to the Safety Program Guidance Document for additional training considerations.

CCHMP reviewed specialized training associated with completing LCCs for PHAs. CCHMP reviewed a total of 7 PHAs. CCHMP found the following training documentation discrepancies:-- DSU PHA LCC training was documented 9/14/16 and the completed LCC was dated 9/12/16 - Further review of the PHAWorks software identified the training actually took place on 9/12/16 and the training sign-in sheet was improperly dated-- SRU4 PHA LCC training was documented 7/12/16 and the completed LCC was dated 7/11/16 - Further review identified the training actually took place on 7/11/16 and the training sign-in sheet was improperly dated-- DHT PHA LCC training was documented 8/29/16 and the completed LCC was dated 7/26/16 - no additional documentation was found on the date of the LCC training-- DCU PHA LCC was identified as completed by five people although only four were listed on the LCC training just in time training sheet. LCC training was performed on the same day as the LCC completion, 8/8/16.

CCHMP reviewed specialized training associated with completing LCCs for Incident Investigations. As described in A52-01, the facility had 5 events that were classified as potential MCARs (Major Chemical Accidental Releases) and 1 MCAR since the previous CCHMP audit. The facility only completed LCCs for 2 of the potential 5 MCARs and the 1 actual MCAR. CCHMP issued an ensure action item in A52-01 to complete the additional LCCs. CCHMP reviewed the specialized LCC training for the 2 potential MCARs and the 1 actual MCAR. -- Tier 1 Tubing Failure Release of Gasoline, potential MCAR event took place on 3/28/17. LCC training was not

P Ensure that specialized latent conditions checklists (LCCs) training associated with PHAs and qualifying Incident Investigations are performed and documented prior to completion of the LCCs.

Ensure that refresher training is provided to Content SMEs on completing the latent conditions checklists used when creating and revising operating procedures.

Ensure that initial and refresher training is provided to appropriate maintenance employees on completing the latent conditions checklists for maintenance procedures associated with the Create and Revise Maintenance Procedures policy, A(A)-37.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Typeperformed as both individuals who completed the LCC were trained incident investigation facilitators knowledgeable in human factors and LCCs. There was no date listed on the LCC.-- FXU Debut Temporary Facilities Tubing Release, potential MCAR event took place on 8/16/17. The LCC training form identified just in time LCC training occurred on 9/18/17 although trainee's identified their training took place on 2/27/18. CCHMP was informed that the training took place on 9/18/17 although it was not documented. There was no date listed on the LCC.-- Loss of Electrical Power to Subs 1203 and 1206, actual MCAR event that occurred on 12/19/16. LCC training was performed on 12/22/16, the same day as listed on the completed LCC.

CCHMP discussed just in time training with three Mentors. CCHMP was informed that mentors work with Content SMEs on revising and updating operating procedures. Mentors provide Content SMEs with initial training on LCCs. This training was the same training as provided to the Mentors, which included training on how to write procedures as well as using LCCs. Mentors document this training with Content SMEs using sign-in sheets. CCHMP was informed that subsequent training is provided through SOU through the Latent Conditions Checklist course. CCHMP was unable to confirm that the Latent Conditions Checklist course has been assigned to any of the Content SMEs or any other employee. As such, some of the Content SMEs are not being provided sufficient specialized refresher training on LCCs.

During CCHMP's previous audit, the facility had used a LCC to evaluate their maintenance operations and found one procedure, Rodout Device, met the


ID# Question Clarifications Findings Answer ActionsCategory Typerequirement to perform a human factors evaluation. At that time personnel received just in time training on using a LCC. For this audit, CCHMP was informed that the facility revised their practice on performing human factors evaluations on maintenance procedures and expanded that to all maintenance documents. The following maintenance policy was recently revised to describe this process: Create and Revise Maintenance Procedures policy, A(A)-37 (revised February 2018, rev 3). This policy includes three LCCs to be used depending on the ranking of the maintenance document to be reviewed. CCHMP was informed that this policy was issued while CCHMP was onsite although it has not been fully implemented. Training on the new policy has not occurred, nor has there been any training on the newly created LCCs associated with the policy. CCHMP was informed that the facility is working on developing the just in time LCC training for this policy and intends to borrow from the training provided for LCC reviews of operating procedures, incident investigations and PHAs.

CCHMP was informed that the facility provided just in time training to the team involved with completing the facility-wide LCC completed in December 2013. Documentation of this training was maintained. The next facility-wide assessment will occur by the end of 2018.



A56-08 Does the submitted RMP and Safety Plan accurately reflect the Training Program at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016(b)(4) and Section E.3.6 of the CCHMP Safety Program Guidance Document]


As described in A56-09, Sections 5.3 and 6.0 of the facility's 2016 Safety Plan accurately describe the existing Training Program.

Section 4.4.4 of the facility's RMP revised in 2016 describe the existing CalARP Program 3 Training Program. This will need to be revised to include discussion on the training associated with the human factors program to comply with Program 4 requirements. According to Program 4 requirements, the facility has until 9/30/19 to update the RMP although the facility's next five year RMP update is due to CCHMP by 6/20/19. A consider item was listed in A56-09.


Abr






Abr


A57: Section C - Root Cause Analysis


A57-01 Does the Stationary Source ensure that a Root Cause Analysis is conducted for each Major Chemical Accident or Release (MCAR)? [ISO Section 450-8.016(c)(1) and Section C of the CCHMP Safety Program Guidance Document]

* Review the RCA/MCAR policy to ensure there is a process to conduct an ISSA if the RCA report or an associated investigation report recommends a “major change” that could reasonably result in a MCAR. The policy should define what major change means to the stationary source and include criteria for how site personnel would determine whether a change could reasonably result in a MCAR. Policy wording should also identify to complete ISSA as soon as administratively practicable after completion of the RCA report.* Review RCA reports and associated incident investigation reports for any qualifying recommendations that trigger ISS and provide records to auditor doing A59 so ISS can be evaluated.

1. Major incident: an event within or affecting a process that causes a fire, explosion or release of a highly hazardous material, and has the potential to result in death or serious physical harm (as defined in Labor Code Section 6432(e)), or results in an officially declared public shelter-in-place, or evacuation order. Serious physical harm means any injury or illness, specific or cumulative, occurring in the place of employment or in connection with any employment, that results in any of the following: (1) Inpatient hospitalization for purposes other than medical observation; (2) The

Since the last CalARP/ISO audit (May 2015) to current (March 2018), one Major Chemical Accident or Release (MCAR) occurred at the stationary source (12/19/16). Substation (Sub) 1 Bus Section G main breaker (1700/2) tripped causing loss of power to two distribution substations, Sub 1203 and Sub 1206. This event involved loss of power, and subsequent shutdown and flaring, at multiple units in areas including LOP, OPCEN, and Utilities and Logistics Vine Hill Area. The flaring resulted in multiple odor and noise complaints from the community and activation of a Community Warning System (CWS) Level 2.

As mentioned in A45-01, the MCAR incident was investigated using a Level 2 Causal Learning/TOP technique instead of the root cause analysis methodology (Level 3) that is required per the incident investigation procedure. See A45-01 for further discussion and related ensure item.

Per CCHMP's review, the incident investigation procedure identifies requirements for conducting an ISSA for investigation recommendations involving a major change that could reasonably result in a MCAR. CCHMP notes that this is the previous requirement under ISO, and that the current requirement under CalARP Program 4 states a HCA/ISSA must be conducted for any major change resulting from recommendations, regardless of incident potential. See A58-01 for more discussion on this topic.

R None ISO


ID# Question Clarifications Findings Answer ActionsCategory Typeloss of any member of the body; (3) Any serious degree of permanent disfigurement; (4) Impairment sufficient to cause a part of the body or the function of an organ to become permanently and significantly reduced in efficiency on or off the job, including, but not limited to, depending on the severity, second-degree or worse burns, crushing injuries including internal injuries even though skin surface may be intact, respiratory illnesses, or broken bones. [T19 CCR §2735.3(ii) & Labor Code Section 6432(e)]2. Major Chemical Accident or Release means an incident that meets the definition of a Level 2 or Level 3 Incident in the CWS incident level classification system defined in the Hazardous Materials Notification Policy as determined by the Department; or results in the release, including, but not limited to air, water, or soil of a Regulated Substance and meets one or more of the following

criteria: a) One or more fatalities; b) At least 24 hours of hospital treatment of each of at least three persons; c) On or offsite property damage (including clean up or restoration) initially estimated at $500,000 or more; d) Results in a vapor cloud of flammables and/ or combustibles that is more than 5,000 pounds. [ISO Section 450-8.014(h)]



A57-02 Does the Stationary Source periodically update CCHMP regarding the facts related to the incident/release and the status of the Root Cause Analysis during meetings with CCHMP? [Section 450-8.016(c)(1)]

Are reports provided to the department for posting on the website? [T19 CCR §2762.9(j)]

1. These meetings are to be coordinated with other agencies with jurisdiction over the Stationary Source to the extent possible. [ISO Section 450-8.016(c)(1)]

The stationary source communicated updates regarding the MCAR incident and subsequent investigation to CCHMP. The stationary source provided a 72-hour and 30-day final report on the incident to CCHMP as required by CCHMP's Hazardous Materials Incident Notification Policy. Both reports were posted on the CCHMP website.

As mentioned in A45-01, the incident investigation procedure has not been updated to include CalARP Program 4 requirements for incident investigations, meaning that the stationary source does not have a system to identify, report, and investigate incidents that resulted in, or could have reasonably resulted in a major incident. CalARP Program 4 requires that these incidents are investigated using a root cause analysis (RCA). See A45-01 for related ensure item.

CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents.




A57-03 Does the owner or operator ensure that the final report containing the Root Cause Analysis will be submitted to CCHMP within 90 calendar days of the incident or not more than five months from the date of the incident due to the complexity of the investigation? [T19 CCR §2762.9(h)]

1. For RCAs conducted for a near-miss or MCAR, the facility has 30 days to submit the report to CCHMP from the completion of the Root Cause Analysis. [ISO Section 450-8.016(c)(1) and Section C.2.2.4 of the CCHMP Safety Program Guidance Document]2. If the owner or operator demonstrates additional time is needed due to the complexity of the investigation, status reports must be submitted to CCHMP within 90 calendar days of the incident and every 30 calendar days thereafter until the investigation is complete. [T19 CCR §2762.9(h)]3. CCHMP must post the final RCA report from a major incident to their website within 30 calendar days of receipt. [T19 CCR §2762.9(j)]

As mentioned in A57-02, the final investigation report for the 2016 MCAR event was submitted to CCHMP 30 days after the incident. This practice is consistent with the incident investigation procedure which states that the final report will be submitted to CCHMP within 30 days of completing the RCA.

As mentioned in A57-02, since the CalARP Program 4 regulations became effective on 10/1/17, the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents.


New



A57-04 Does the final Root Cause Analysis report include recommendations and an implementation schedule to mitigate against the release/incident recurring? [ISO Section 450-8.016(c)(1) and Section C.2.2.3 of the CCHMP Safety Program Guidance Document]

1. The RCA report must identify the management system causes, including organizational and safety culture causes. [T19 CCR §2762.9(e)] 2. The RCA report should identify that human system were considered as causal factors.3. The RCA report should also identify contributing causes and the proposed steps to correct them.

The final investigation report for the 2016 MCAR included 4 recommendations, each with an assigned responsible manager or individual and estimated completion date, listed below.

1. Update Electrical Job Safety Analysis (JSA) template to include verbiage to evaluate the need for additional electrical staff while troubleshooting of breaker controls and protective relaying in main substations (Substations 1, 2, and 3) - due 8/31/17.

2. Install labels for protective relays on Panel 2 in Sub 1. Labels will identify the corresponding breakers that will trip upon activation of the protective relay - due 2/28/18.

3. Install informational label for alarms associated with breaker trips on alarm panel (Panel 6) in Sub 1 - due 2/28/18.

4. Review incident investigation learnings with all applicable electrical personnel - due 6/30/17.

CCHMP verified via field walk with SME that recommendations 2 and 3 were completed by the due date. CCHMP reviewed a sign-in sheet dated 6/20/17 for the investigation learnings session including 20 electrical personnel, confirming that recommendation 4 was completed on time. Recommendation 1 was addressed by creating an Enhanced Electrical JSA document that would be completed in addition to the original Electrical JSA for any jobs involving switching, distribution troubleshooting, and electrical safe work condition (ESWC) considerations. CCHMP was informed that the original Electrical JSA did not prompt specific hazards and discussions related to these electrical tasks.

Y NoneISO



A57-05 Is the Root Cause Analysis method one of the recommended methods from CCPS or was it reviewed by CCHMP to determine substantial equivalency? [ISO Section 450-8.016(c)(1) and Section C.2.2.1 of the CCHMP Safety Program Guidance Document]

1. CCPS in “Guidelines for Investigating Chemicals Process Incidents” lists seven primary methodologies: a) Accident Anatomy Method; b) Causal Tree Method; c) Fault Tree Analysis; d) Multiple-Cause; Systems-Oriented Incident Investigation; e) Multilinear Events Sequencing; f) Sequentially Timed Events Plot; and g) TapRoot Incident Investigation System. [Section C.2.2.1 of the CCHMP Safety Program Guidance Document]2. Other CCHMP accepted methods include: a) Apollo, b) Reason, c) Causal Mapping, d) Sologic

As mentioned in A45-01, the MCAR incident was investigated using a Level 2 Causal Learning/TOP technique instead of the root cause analysis methodology (Level 3) that is required per the incident investigation procedure. See A45-01 for related ensure item.

Per interview with SME, the Level 3 RCA is no longer used at the stationary source. CCHMP was informed that the stationary source is moving toward using TOP/CL methodology for each Level of investigation (Level 1, 2, or 3), which will be reflected in the updated procedure that is currently in-progress. CCHMP notes that the Causal Learning methodology is not one of the recommended methods from CCPS and has not been reviewed by CCHMP to determine if it is equivalent to one of the approved methods. The stationary source needs to work with CCHMP to determine if the TOP/Causal Learning methodology is an equivalent RCA methodology.

P Ensure that the stationary source works with CCHMP to determine if the site RCA methodology is equivalent to CCPS recommended methods, and that CCHMP's determination is documented.

ISO



A57-06 If CCHMP elects to conduct an independent investigation or Root Cause Analysis, does the Stationary Source comply with the following:a) Allow CCHMP to investigate the accident site and directly related facilities such as control rooms, physical evidence and where practicable the external and internal inspection of equipment?b) Provide CCHMP with pertinent documentation?c) Allow CCHMP to conduct independent interviews of Stationary Source employees?d) Appoint a person to be a single point of contact to coordinate the interface between CCHMP and the Stationary Source? [ISO Section 450-8.016(c)(2) and Section C.3.1 of the CCHMP Safety Program Guidance Document] In addition, after a major incident, did the owner or operator assist CCHMP in conducting:a) An independent Process Safety Culture Assessment;b) An evaluation of the CalARP Management System; orc) A Human Factors Analysis? [T19 CCR §2762.9(n) and §2775.2.5]

1. Independent interviews are subject to all rights of the Stationary Source and employees to be represented by legal counsel and/or management and union representatives during such interviews. [ISO Section 450-8.016(c)(2)]

CCHMP has not elected to conduct an independent investigation or RCA for any incident that occurred since the last CalARP/ISO audit to present (May 2015 - March 2018). This question does not apply.

The incident investigation procedure includes a section regarding third party investigations, including from local authorities (e.g. CCHMP), which identifies that the stationary source will identify a focal point onsite to work directly with outside agencies during the investigation.

N/A NoneCalARP Program 4 & ISO



A57-07 Does the owner or operator provide effective training to employees and employee representatives before serving on a RCA team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions? [T19 CCR §2762.4(e)]

1. Root Cause Analyses are to be performed by a team. [Section C.2.2.2 of the CCHMP Safety Program Guidance Document]2. Core team members should receive training on the incident investigation methodology. Just in time training is sufficient. [Section C.2.2.2 of the CCHMP Safety Program Guidance Document]

Per interview with SME, the 2016 MCAR investigation team consisted of 3 members, 2 which have been formally trained as facilitators for the investigation methodology used. CCHMP was able to review training documentation on the methodology for one of these members. The documentation included an email confirming participation in the training course and a picture of the class participants with names (dated 9/8/14). CCHMP was unable to review this documentation for the other member trained in the methodology.

CCHMP was informed that a just in time training was completed before the investigation began for the remaining member, however this training was not documented.

P Ensure that training provided to investigation facilitators the RCA investigation methodology is documented.

ISO

A57-08 Does the remainder of the Root Cause Analysis team include at least one person knowledgeable in the covered Process involved? [Section C.2.2.2 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the remainder of the investigation team for the 2016 MCAR and identified that at least one person was knowledgeable in the covered process involved. The incident involved electrical issues and the team included an electrical engineer with experience in the process.

Y NoneISO

A57-09 Are the remaining members of the Root Cause Analysis team individuals with appropriate knowledge and experience to thoroughly investigate and analyze the incident? [Section C.2.2.2 of the CCHMP Safety Program Guidance Document]

Per review of the investigation team for the 2016 MCAR, the team included individuals with appropriate knowledge and experience to thoroughly investigate the incident. The team included a process engineer with experience in the process and investigation methodology. Additionally, the investigation facilitator also had experience in the investigation methodology.

Y NoneISO



A57-11 Do final Root Cause Analysis reports contain the following information consistent with the complexity and severity of the incident?a) Table of Contents;b) Executive Summary;c) Introduction;d) Scope of Investigation; e) Investigation team makeup;f) Description of the incident, including on-site and off-site affects;g) Brief description of the process involved; h) Facts, including a time line;i) Causal Factor Analysis, concluding with citing of underlying causes; j) Recommendations;k) Justification for not implementing recommendations, if any; l) Schedule for implementing recommendations; andm) Glossary? [Section C.2.2.3 of the CCHMP Safety Program Guidance Document]

1. The underlying causes of the incident must include identification of management system causes, including organizational and safety culture causes. [T19 CCR §2762.9(e)] 2. A list of required content is listed in A45-07 and A57-04.3. The content listed in this question is CCHMP suggested topics and format.

The investigation report for the 2016 MCAR event included the following information:

- Date and time the incident began- Date and time the investigation began- Summary of the event- Impact- Background and process description- Narrative sequence of events/timeline- Cause analysis- Recommendations with assigned responsible individuals and estimated completion dates- Attachment containing diagram of system where incident occurred

CCHMP notes that all elements in this question except investigation team makeup are included in the investigation report. CCHMP was able to review the team makeup maintained in FIM.

Y NoneISO

A57-12 Did the Stationary Source include in the accident history all Major Chemical Accidents or Releases from June 1, 1992 through the date of the most recent submittal of the Safety Plan to the Department? [ISO Section 450-8.016(e)]

* Review the accident history information maintained by the Stationary Source and confirm that the accident history presented in the Safety Plan is appropriate.

Section 13, pgs. 58-86 of the submitted Safety Plan (dated 8/26/16) includes the accident history for the stationary source. The accident history includes all MCAR incidents since June 1, 1992 through the date of this Safety Plan submittal. CCHMP notes that this section includes a definition of a MCAR event.

Y NoneISO



A57-13 For each Major Chemical Accident or Release included in the history, did the Stationary Source record, to the extent known: (a) date, time, and approximate duration of the release (b) chemical(s) released (c) estimated quantity released in pounds (d) type of release event and its source (e) weather conditions at the time of the release (f) onsite impacts (g) known offsite impacts (h) initiating event and contributing factors (i) Root cause(s) (j) whether offsite responders were notified (k) operational or process changes that resulted from investigation of the release? [ISO Section 450-8.016(e)(1)]

1. Numerical estimates shall be provided to two significant digits. [CCHMP Interpretation]

CCHMP identifies that each MCAR included in the accident history documented all elements listed in this question. CCHMP notes that since the Safety Plan was last submitted 8/26/16, the MCAR event that occurred 12/19/16 and discussed throughout this questionnaire, is not included in the 5-year accident history.

Y NoneISO

A57-14 Does the submitted RMP and Safety Plan accurately reflect the Root Cause Analysis method and Accident History information maintained by the Stationary Source? [T19 CCR §2745.2(d), ISO Sections 450-8.016, 450-8.016(e), and Sections E.4 and E.6 of the CCHMP Safety Program Guidance Document]


The 2016 RMP and SP accurately reflect the accident history maintained by the stationary source, however, the site RCA methodology is not accurately reflected. See A57-05 for further discussion on this topic. The stationary source must work with CCHMP to determine if the incident investigation methodology is equivalent to RCA methodologies approved by CCHMP. See A57-05 for further discussion and related ensure item.

As mentioned in A57-13, the MCAR event that occurred 12/19/16 is not included in the submitted Safety Plan (dated 8/26/16). The Safety Plan should be updated at the next submittal due in 2019 to include the 2016 MCAR event in the 5-year accident history.

R NoneISO Abr



A57-15 Has the Stationary Source annually submitted a report of the accident history? [ISO Section 450-8.016(e)(2)]

1. Annual accident history reports are due to CCHMP by June 30 of every year. [ISO Section 450-8.016(e)(2)]2. ISO facilities submit additions to annual accident history reports to CCHMP as part of their ISO Annual Performance Review and Evaluation. [ISO Section 450-8.016(e)(2)]

The stationary source has annually submitted accident history reports to CCHMP as part of their ISO Annual Performance Reviews. CCHMP notes that the 2016 MCAR event was included in the 2017 Annual Performance Review submittal to CCHMP.

Y NoneISO


* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due. 1. This question is only applicable to Stationary Sources that have had prior CalARP/ISO audits by CCHMP.



Abr


A58: Section D - HCA/ISSA


A58-01 Does the owner or operator conduct a Hierarchy of Hazard Control Analysis (HCA) / Inherently Safer Systems Analysis (ISSA) in a timely manner for:a) PHA recommendations for scenarios identified with the potential for a major incident;b) Whenever a major change is proposed as part of a MOC review;c) On recommendations listed in a RCA investigation report issued by the owner or operator or the department associated with a major incident or MCAR;d) On recommended major change from an incident investigation report that could reasonably result in a MCAR? [T19 CCR §2762.13(b)(1-3) and ISO Sections 450-8.016(c)(1), 450-8.016(c)(4), 450-8.016(i)(1)(C-E)]

1. New process HCA/ISS is discussed in A58-04. 2. Existing process HCA/ISS is discussed in A58-04, A58-10 and A58-11.3. Major incident “means an event within or affecting a process that causes a fire, explosion or release of a highly hazardous material, and has the potential to result in death or serious physical harm (as defined in Labor Code Section 6432(e)), or results in an officially declared public shelter-in-place, or evacuation order.” [T19 CCR §2735.3(ii)]4. Major change “means: (1) introduction of a new process, or (2) new process equipment, or new regulated substance that results in any operational change outside of established safe operating limits; or (3) any alteration in a process, process equipment, or process chemistry that introduces a new hazard or increases an existing hazard.” [T19 CCR §2735.3(hh)] 5. P4 requires an HCA to be performed associated with a major change (as part of MOC) regardless if the major change could reasonably result in a major incident. [T19 CCR §2762.13(b)(2)] 6. Inherently Safer Systems is defined in CCHMP’s Industrial Safety Ordinance to mean feasible alternative equipment, processes, materials, layouts, and procedures meant to eliminate, minimize, or reduce the risk of a Major Chemical Accident or Release by modifying a process rather than adding external layers of protection. [ISO Section 450-8.014(g)]

CCHMP was informed that the facility has not made or proposed any major changes to their processes nor has there been any qualifying incidents / investigations since October 2017. Related to HCA documentation, there were no HCAs/ISSAs to review associated with question items b) through d). The facility had one MCAR event in 2016, but the RCA report did not identify any recommendations consistent with a major change. CCHMP was also informed that the facility currently does not have a method to track "major incidents" as personnel was led to believe through Cal OSHA discussions that tracking potential MCAR events would encompass all major incidents. Although similar, there is a difference between potential MCAR events and potential major incidents. Therefore, it is unclear to CCHMP whether the facility has performed HCAs when required.

CCHMP reviewed the facility's Inherently Safer Systems / Hierarchy of Control policy, I(A)-43 (revised February 2018, rev 7). This policy identifies that ISSAs are required in the development and analysis of PHA recommendations. Several items are noted on this policy that are either inconsistent with the Program 4 requirements or could assist with Program 4 compliance:-- "Major incident" is not mentioned in the policy-- "Highly hazardous material" is not mentioned in the policy-- "1st Order" and "2nd Order" inherent is not mentioned in the policy-- Program 3 CalARP regulations were cited in the policy instead of Program 4 -- Section 6.1 identifies that ISSA needs

P Ensure that a method is established to perform HCAs/ISSAs using appropriate employee participation for situations identified within the question related to a major incident.


New


ID# Question Clarifications Findings Answer ActionsCategory Typeto be performed on major changes that could reasonably result in a MCAR. Program 4 requires HCA to be performed associated with a major change regardless of incident potential.-- Section 6.1 identifies that ISSA needs to be performed on incident investigations associated with actual or potential catastrophic releases of a regulated substance. HCAs are now required under Program 4 associated with major incidents instead of catastrophic releases.

CCHMP also noticed a discrepancy associated with policy I(A)-43 is it defines 'major change' that is consistent with ISS requirements but conflicts with Program 4. Currently, I(A)-43 defines major change as a "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". This is the same wording as listed in Contra Costa County's ISS Guidance Document for evaluating ISS for a "new process". Program 4 defines major change as, "(1) introduction of a new process, or (2) new process equipment, or new regulated substance that results in any operational change outside of established safe operating limits; or (3) any alteration in a process, process equipment, or process chemistry that introduces a new hazard or increases an existing hazard." CCHMP believes the current wording listed as major change in I(A)-43 should remain for ISO applicability for ISS, but needs to be modified to satisfy Program 4 HCA requirements.

CCHMP reviewed "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. This policy is used for evaluating new processes and projects for ISS consideration and is further described in A58-06. CCHMP found


ID# Question Clarifications Findings Answer ActionsCategory TypeProgram 4 requirement gaps in this policy similar to I(A)-43.

CCHMP reviewed HCA documentation associated with evaluating PHA recommendations; item a) in the question. Current practice has been to perform an ISSA on PHA recommendations if an MCAR could reasonably occur. For example, the CO Boiler PHA completed in December 2017 identified a recommendation (FIM# 978931) that identified, "Recommendation does not require ISS analysis. The likelihood of potential MCAR consequence does not meet the "could reasonably occur" definition." This PHA was subject to Program 4 requirements and should have been evaluated based on major incident. As previously described, the facility does not have a mechanism to evaluate whether a major incident occurred. CCHMP reviewed the PHA recommendation completion status for the five PHAs described in A50-02 and only found 1 recommendation that was subject to an ISSA. CCHMP then reviewed PHA recommendations from 7 other PHAs and found 6 additional recommendations where ISSAs were performed and documented.



A58-05 Does the owner or operator ensure that the HCA team documents: a) Written recommendations to eliminate process safety hazards to the greatest extent feasible using first order inherent safety measures; b) Written recommendations to reduce any remaining process safety hazards to the greatest extent feasible using second order inherent safety measures;c) If necessary, the team shall also document written recommendations to address any remaining risks in the following sequence and priority order: 1) Effectively reduce remaining risks using passive safeguards; 2) Effectively reduce remaining risks using active safeguards; 3) Effectively reduce remaining risks using procedural safeguards;d) The individual rationales for the inherent safety measures and safeguards recommended for each process safety hazard? [T19 CCR §2762.13(f) and §2762.13(g)(5) and Section D.1.4 of the CCHMP Safety Program Guidance Document]

1. P4 established the following prioritized prevention and control measures to eliminate or minimize a hazard: first order inherent; second order inherent; and passive, active and procedural protection layers. The county’s SP Guidance document currently only identifies four levels for risk reduction for ISS in order of decreasing reliability (the first is the most reliable) as follows: Inherent, Passive, Active, and Procedural. These are defined within A58-03.2. P4 is more conservative as it requires all HCAs performed to follow the order listed in the question; whereas, the county’s SP Guidance document identifies that Stationary Sources must consider moving up through the four levels, from Procedural to Inherent, only when evaluating PHA recommendations and mitigations.3. New processes, new process units, and new facilities and existing process HCAs/ISSAs must focus on inherent (i.e., first order inherent safety measures and second order inherent safety measures) and passive safeguards only. [Sections D.1.1 and D.1.2 of the CCHMP Safety Program Guidance Document] 4. At least one risk control category should be identified as being used when developing recommendations and mitigations from PHA's for scenarios that have a major incident or MCAR potential.

Existing Process:The existing process HCA/ISSA is completed during PHAs using an Inherently Safer System Checklist from the County's SP Guidance Document and is documented through the completion of the ISS checklist and PHA. CCHMP reviewed two PHAs: Catalytic Gasoline Hydrotreating Unit (completed in October 2017) and CO Boilers (completed in December 2017). The facility did not identify any written recommendations subject to HCA evaluations associated with these PHAs.

New Processes:CCHMP reviewed Procedure 2.15A & 2.15B and was unable to locate the Program 4 requirement of a top down HCA approach. CCHMP was informed that there has been no new process, new process unit or new facility ISSA/HCA evaluations since the last CCHMP audit. The facility has evaluated projects for ISSA applicability. CCHMP reviewed three project ISSAs completed since the last audit. The documentation ranged from completed ISS checklists to more of a report format. CCHMP was informed that the level of detail used for the documentation has depended upon the size and complexity of the project. None of the ISSA documentation mentioned the top down approach for HCAs identified in the question. CCHMP reviewed the following project studies (see A58-06 for more information related to new process HCAs/ISSAs evaluations):-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17, not required under ISO or Program 4-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18, not required under ISO or Program 4-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through

P Ensure each HCA performed includes documentation of a top-down approach for listing the first order then second order inherent safety measures, and then, if necessary, passive, active or procedural risk reduction measures.


New


ID# Question Clarifications Findings Answer ActionsCategory Type1/17, not required under Program 4 but subject to ISO.

Major Changes:CCHMP was informed that there have been no major changes (as defined by Program 4) proposed to any process since the last CCHMP audit.

Major Incident:The facility's last MCAR was in 2016 prior to the Program 4 requirements. To date the facility has not defined major incident so it is unclear whether any events may have triggered an HCA. This is further described in A58-01. For the 1 MCAR event, no recommendations were issued that appeared to meet the Program 4 definition of a Major Change or could reasonably result in an MCAR.

PHA Recommendations:CCHMP reviewed ISSA documentation for select completed PHA recommendations. The format used for the documentation was consistent with that identified in Attachment G of the facility's PHA policy, I(A)-50. As described below, the format used does not incorporate all the items listed in the question. The documentation includes: -- The name of the PHA study; -- Team members and roles; -- PHA scenario; -- Summary of recommendation and ISS strategy taken;-- Other options considered but not taken and reason why they were not implemented:-- Process Safety Manager review and approval signature and date.



A58-06 Does the owner or operator use a review process for new processes, new process units, and new facilities, and their related process equipment that includes an Inherently Safer System review / Hierarchy of Hazard Control Analysis at different phases of the design process? [T19 CCR §2762.13(b)(4) and Section D.1.1 of the CCHMP Safety Program Guidance Document]

1. P4 identifies that an HCA report prepared for a new process, new process unit, and new facilities, and their related process equipment shall be provided to the department, who will make these HCA reports available to the public by posting them on the department’s website within 30 calendar days. [T19 CCR §2762.13(b)(4)] 2. Inherently Safer Systems should be reviewed early in the development phase of a new covered process and then reviewed throughout the different project design phases. 3. Project design phases may vary by project and by Stationary Source. Typical project design phases include (but are not limited to): chemistry forming (synthesis); facilities design scoping and development; and basic design phase.4. A new process is defined as: the addition of a process that did not previously exist or a major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry.5. Stationary Sources should develop criteria for when a new process would require ISS.6. Stationary Sources should not use proprietary technology to by-pass needing to apply ISS and/or conducting an ISS analysis. [Section D of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the facility's policy titled, "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. SEO is Safety, Environmental and Operability reviews. ISS is Inherently Safer Systems. The policy identified that ISS is reviewed at three distinct phases of the design process: Select (SEO1), Define (SEO2) and Execute (SEO3). Associated with each of these phases, different SEO/ISS questions are asked using three different checklists. Per interviews, these phases match those listed in the County's SP Guidance Document (e.g., chemistry forming, design scoping, and basic design). This Shell policy also has a fourth checklist that is to be used prior to startup that also includes ISS questions.

This policy identifies that ISS is evaluated for new processes only when there is one or more scenarios where an MCAR could reasonably occur. This is a county ISO requirement that has been superseded by CalARP Program 4 requirements, which now identify that HCA needs to be performed during the "design and review of new processes, new process units, and new facilities, and their related process equipment" regardless of incident potential. As such, the policy and site practice will need to change.

Shell evaluated each of the following for ISS events though not all of them were subject to ISS requirements. The first two projects listed below were small in scale and did not meet the criteria in the County's ISS guidance or Program 4. The third was significantly larger and more complex and did meet the criteria in the County's ISS guidance but did not meet that identified under Program 4 (even if the event had happened after

P Ensure that new process/project evaluations follow Procedure 2.15A & 2.15B in using the ISS Checklists (versus summarizing an ISS narrative) or modify the policy to incorporate an alternate approach.

New Process – Program 4 CalARP & ISO

New


ID# Question Clarifications Findings Answer ActionsCategory Type10/1/17).-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through 1/17

For the first two projects, the facility followed their Procedure 2.15A & 2.15B policy and evaluated each using their ISS checklist as well as their SEO design checklist. These projects are new and have only completed up to phase 1 for ER 3334 and through phase 2 for ER 3257 of the facility's design process. Projects must complete all three phases before a project can be considered viable. The last project, ER 3227, has passed all three phases of review and was subject to the County ISS requirements since the new project met the ISS condition of "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". CCHMP reviewed documentation associated with this project and was unable to locate completed ISS checklists for any of the three phases. CCHMP was informed that this large project went through multiple rounds of HAZOP reviews at each of the three phases of its design. CCHMP was informed that the facility's simple ISS checklists are not useful for large projects like these and instead the teams evaluated ISS opportunities through the HAZOP and through discussions. Similar large project ISS reviews in the past had been documented through more of a narrative approach than using the ISS checklist. CCHMP was unable to locate any ISS narrative summary for this project. CCHMP reviewed Procedure 2.15A & 2.15B policy and was unable to locate a discussion of using a narrative


ID# Question Clarifications Findings Answer ActionsCategory TypeISS summary to document ISS reviews.

Attachment D of CCHMP's SP Guidance Document contains a guideword approach that can be used for ISS evaluations during HAZOP method assessments if an ISS checklist is not used. It is suggested that Shell adopt this guideword approach as an option for consideration.



A58-07 For all Inherently Safer System / Hierarchy of Hazard Control Analyses does the owner or operator employ teams with expertise in engineering and process operations including an operator currently working the unit and one member knowledgeable in the ISS/HCA method used to perform, update and document the analyses? [T19 CCR §2762.13(d) and Section D.1.1 of the CCHMP Safety Program Guidance Document]

1. P4 identifies that the operator involved shall have experience and knowledge specific to the process being evaluated. [T19 CCR §2762.13(d)]2. P4 identifies the team shall consult, as necessary, with individuals with expertise in damage mechanisms, process chemistry, and control systems. [T19 CCR §2762.13(d)]

PHA Recommendations:CCHMP confirmed that the PHA teams include appropriate personnel listed in the question, including an operator currently working the unit when PHA recommendations are developed. CCHMP was informed that many times the entire PHA team is involved with developing PHA recommendations, and for items needing an ISSA, the entire PHA team participates in that as well. There are situations where an additional barrier is needed that is undefined by the PHA team so the item is referred to others (e.g., Project Development Group) to determine the best course of action. Currently, for those types of ISS evaluations, it has been performed by an engineer or several engineers and has not included an operator currently working the unit. CCHMP reviewed two PHAs completed since October 2017 and did not locate any PHA recommendations that would be subject to ISSA/HCA. CCHMP reviewed other PHA recommendations that were subject to ISS evaluation, which were performed and documented as described above and in A58-12.

New Processes:Per interviews and review of the Procedure 2.15A & 2.15B, team members are selected based on the complexity and phase of the project. Section 6.1 of the policy specifies team participants for the various three phases. Reviewing this table, CCHMP was unable to locate mention of an operator currently working the unit. New project ISS studies are mentioned in A58-06. Two of these studies reviewed were started after 10/1/17 although did not meet the conditions of Program 4 of proposing any "new processes, new process units, and new facilities, and their related process equipment". As such, none of the "new


New


ID# Question Clarifications Findings Answer ActionsCategory Typeprocess" ISS evaluations were subject to needing an operator currently working on the unit.

Major Incidents:As previously described, the facility currently does not define major incidents nor track them. An action item has been listed in A58-01 to incorporate major incident into their ISS/HCA evaluation process. The facility has tracked MCAR events. Based on CCHMP's review of the one MCAR event in 2016, there were no recommendations consistent with a major change that triggered an ISSA. CCHMP was informed that it is likely the individuals selected to assess an HCA/ISSA associated with a major incident or MCAR may include corporate design representatives or at a minimum the Project Development Group although that is not defined in policy I(A)-43.

Major Changes:As previously described, there have been no modifications proposed consistent with the definition of a major change currently listed in the Program 4 regulations. CCHMP was informed that likely the same individuals listed under Major Incidents identified previously would perform the ISSA/HCA.

Existing Processes:The facility evaluates their existing processes for HCA/ISSA within their PHA study. Team members for the HCA/ISSA study are typically the same as the PHA team, which includes one or more engineers, at least one operator from the unit, and a facilitator who is also an engineer. The facilitator is trained on PHA methods as well as on the process used to evaluate for inherently safer systems using the ISS checklists that are listed in the County's SP Guidance Document. CCHMP reviewed the ISSAs performed for the five PHAs listed in A50-


ID# Question Clarifications Findings Answer ActionsCategory Type02 and confirmed each team composition matched this list. CCHMP also reviewed PHAs completed after October 2017 and confirmed the same team composition.



A58-08 Does the Stationary Source adequately document their Inherently Safer Systems analysis for new processes for each phase? Documentation maintained should include, as applicable, but is not limited to:a) ISS team makeup, responsibilities, qualifications and experience;b) Criteria used to require an ISS review for the process;c) The relevant ISS questions asked and answered (e.g., can quantities be reduced, can other chemicals be used, can different equipment be used, etc.);d) The information available during the ISS assessment (e.g., chemical compatibility matrix, chemical properties, material and energy balances, PFD, P&ID, etc.);e) How process improvements were reviewed and the determination of the process that was determined to be the inherently safest process;f) The process used to determine that the equipment sizes are minimized and the results of this determination;g) The process used to determine the minimum inventories needed and the results of this determination;h) The process used to simplify the covered process, if applicable, and the results of this process;i) The process used to reduce the waste made from the project and the results of the determination; j) Applicable items considered from the ISS checklist in

* If no new processes have gone through an ISS assessment, review the system in place to evaluate Inherently Safer Systems for new processes.

1. P4 requires specific HCA documentation for all HCA analyses, see A58-12 for details.2. P4 identifies that an HCA report prepared for this purpose shall be provided to the department, who will make these HCA reports available to the public by posting them on the department’s website within 30 calendar days. [T19 CCR §2762.13(b)(4)]

Section 6.2 of Procedure 2.15A & 2.15B identifies that the team is to document all of the items listed in the question. Of the three project ISS evaluations reviewed in A58-06, only one of them, ER 3227, was subject to County ISO ISS requirements, and therefore, subject to this question. CCHMP reviewed the documentation associated with this project and was unable to confirm that items b) through k) listed in this question were documented for any phase.

The facility produced one report for ER 3227 at the final phase of the project review that included a project summary, HAZOP worksheets, and three meeting sign-in sheets to correspond with phase 1-3 meetings. The items listed in this question are supposed to be documented for "each" phase of the ISS evaluation. For project ER 3227, three separate reports containing the information in the question should have been produced to summarize what was accomplished at each phase.

P Ensure new process / project ISS evaluations are documented at each phase of the assessment consistent with Section D.1.1 of the CCHMP Safety Program Guidance Document.

Ensure three separate reports are developed, one for each phase of ISS review, for project ER 3227 and each contain the information identified in the question.

New Process – ISO

Abr


ID# Question Clarifications Findings Answer ActionsCategory TypeAttachment C of the SP Guidance Document; andk) For applicable items from the ISS checklist in Attachment C of the SP Guidance Document that were not considered, the Stationary Source should document why each item was not considered. [Section D.1.1 of the CCHMP Safety Program Guidance Document]



A58-10 Does the owner or operator perform and document Inherently Safer System analyses / Hierarchy of Hazard Control Analyses for existing processes through a method independent from a PHA? [T19 CCR §2762.13(a) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. P4 requires HCAs for all existing processes regardless of incident potential. [T19 CCR §2762.13(a)]2. P4 identifies that HCAs for existing processes shall be performed in accordance with the following schedule and may be performed in conjunction with the PHA schedule:a) No less than 50% of existing processes by 9/29/2020;b) Remaining processes by 9/30/2022. [T19 CCR §2762.13(a)]3. Cal OSHA 5189.1 identifies to conduct an HCA as a standalone analysis for all existing processes; for the team to review the PHA while conducting the HCA; and the HCA may be performed in conjunction with the PHA schedule. [T8 CCR §5189.1(l)(1)]4. Stationary Sources can perform an independent ISS analysis that is done in addition to a process PHA, or an ISS analysis that is incorporated into a PHA.5. The ISS analysis should review the covered processes for ways to eliminate or reduce hazards that are present as well as risks that are present in the covered process. This may be achieved by using a checklist (provided in Attachment C of the SP Guidance Document) or guideword analysis (provided in Attachment D of the SP Guidance Document) . 6. If the Stationary Source decides to do the ISS analysis as part of the PHA, a N/A should be the answer for this question.7. If the Stationary Source decides to use some other ISS checklist or other methods to evaluate ISS, these must be approved by CCHMP prior to their use.

The facility has incorporated ISSAs into their PHA for existing processes. This question is not applicable.

N/A NoneExisting Process – Program 4 CalARP & ISO

Abr



A58-11 Does the owner or operator perform and document Inherently Safer System analyses / Hierarchy of Hazard Control Analyses for existing processes through the existing PHA review? [T19 CCR §2762.13(a) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. P4 requires HCAs for all existing processes regardless of incident potential. [T19 CCR §2762.13(a)]2. P4 identifies that HCAs for existing processes shall be performed in accordance with the following schedule and may be performed in conjunction with the PHA schedule:a) No less than 50% of existing processes by 9/29/2020;b) Remaining processes by 9/30/2022. [T19 CCR §2762.13(a)]3. Cal OSHA 5189.1 identifies to conduct an HCA as a standalone analysis for all existing processes; for the team to review the PHA while conducting the HCA; and the HCA may be performed in conjunction with the PHA schedule. [T8 CCR §5189.1(l)(1)]4. This would require that each covered process in its entirety have an initial ISS analyses conducted. Incorporating the ISS analysis into a revalidated PHA may not be sufficient if the whole process is not evaluated. 5. The ISS analysis should review the covered processes for ways to eliminate or reduce hazards that are present as well as risks that are present in the covered process. This may be achieved by using a checklist (provided in Attachment C of the SP Guidance Document) or guideword analysis (provided in Attachment D of the SP Guidance Document). 6. If the Stationary Source performs an independent ISS analysis, a N/A should be the answer for this question.

Starting in 2014 the facility incorporated ISSAs into their PHA for existing processes. Currently the facility manages 58 PHAs for the site and each of those processes have had an ISSA. CCHMP reviewed ISSAs for the following 5 PHAs:-- Pentane Storage-- Distillate Hydrotreating Unit-- Delayed Coker-- Distillate Saturation Unit-- Sulfur Recovery Unit #4

Each of the existing process ISSAs were completed by using the ISS checklist from the County's SP Guidance Document.

The facility identified 8 additional process operations that have never had a PHA while the Program 4 rule was being developed. The facility is currently satisfying the minimum 50% requirement as they are right now at 88% complete. The following process areas needing HCAs/ISSAs are identified as:-- Utilities Boiler Feedwater System-- Condensate System-- Steam System-- Instrument Air-- Nitrogen Storage and Distribution-- Cooling Towers (3 of them)

CCHMP was informed that the facility is currently walking down the Utilities Boiler Feedwater System P&IDs and once those are verified to be accurate will proceed with conducting the PHA and existing process ISSA/HCA. The facility plans to complete two of these studies in 2018 and the remaining six by 10/1/20.

Y NoneExisting Process – Program 4 CalARP & ISO

Abr



A58-12 Does the owner or operator within 30 days of completing the HCA/ISS adequately document their analysis in a report, including: a) A description of the composition, experience, and expertise of the members of the team that performed the HCA/ISS analysis; b) A description of the methodology and approach used by the team;c) A description of each process safety hazard analyzed by the team, including identifying, characterizing and prioritizing process safety hazards;d) Identification and description of the inherent safety measure(s) and safeguards analyzed by the team, including publicly available information on inherent safety measures and safeguards identified and analyzed;e) The conclusions of the analysis;f) The rationale for the inherent safety measures and safeguards recommended by the team for each process safety hazard, including documenting first and second order inherent safety measures and remaining risks (passive, active, procedural);g) An action plan, including a timeline to implement the recommendations? [T19 CCR §2762.13(g), ISO Section 450-8.016(i)(2) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. This question applies to every HCA/ISSA report developed.2. P4 identifies that the HCA team is to complete an HCA report within 90 calendar days following development of the recommendations. ISO is more conservative as a report is required within 30 days of completing the analysis. [T19 CCR §2762.13(g) and ISO Section 450-8.016(i)(2)]3. If Attachment C – ISS checklist of the SP Guidance Document was used, stationary sources are to document applicable items considered, and why for any item not considered.4. P4 identifies that the HCA team is to:(a) Include all risk-relevant data for each process or recommendation, including incident investigation reports associated with any incident that results in or could reasonably have resulted in a major incident. P4 does not require this data to be included within the HCA report.(b) Identify, analyze, and document all inherent safety measures and safeguards (or where appropriate, combinations of measures and safeguards) in an iterative manner to reduce each hazard to the greatest extent feasible. [T19 CCR §2762.13(e)]5. P4 identifies for relevant, publicly available information on inherent safety measures and safeguards, “This information shall include inherent safety measures and safeguards that have been: (A) achieved in practice by for the petroleum refining industry and related industrial sectors; or, (B) required or recommended for the petroleum refining industry, and related industrial sectors, by a federal or state agency, or local California agency, in a regulation or report.” [T19 CCR §2762.13(e)(3)]6. Implementing only one ISS option to address identified hazards may not be adequate to address the greatest hazard reduction or elimination. However, it is

CCHMP reviewed a number of policies relating to HCAs/ISSAs (e.g., I(A)-43, Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS, I(A)-50, C(A)-15) and none of them identified that an HCA/ISSA report needs to be developed or includes the information within the question within 30 days of completing the analysis. It is not a definitive requirement to include this statement within each policy.

New Process:As described in A58-06, CCHMP reviewed three new project ISS evaluations and found none of them were subject to Program 4 requirements. For project ER 3227, which was subject to County ISS requirements, one report was developed that had a date of 2/6/17. The last ISS evaluation session was completed on 1/26/17 so a report was issued within 30 days. County ISO requires that all ISSAs be documented in a report within 30 days after completing the analysis. ISO ISS report contents include those items identified in A58-08 and portions of question items b) and d) through g). The report for ER 3227 did not include the following from the 2014 ISO regulation:-- Identification and a description of the inherently safer system(s) analyzed in the ISSA; -- A description of the methodology used to analyze the inherently safer systems(s); -- The conclusions of the analysis; -- The rationale for the conclusions; and -- An action plan, including a timeline to implement the inherently safer system(s) recommended in the ISSA.

PHA Recommendations:CCHMP reviewed two PHAs completed since October 2017 and did not locate

P Ensure the final report for new process ISS evaluation for ER 3227 is modified to include the following:-- Identification and a description of the inherently safer system(s) analyzed in the ISSA; -- A description of the methodology used to analyze the inherently safer systems(s); -- The conclusions of the analysis; -- The rationale for the conclusions; and -- An action plan, including a timeline to implement the inherently safer system(s) recommended in the ISSA.


New


ID# Question Clarifications Findings Answer ActionsCategory Typenot necessary to implement more than one ISS if the implementation of a second ISS does not add any significant hazard reduction or has been documented as infeasible.

any PHA recommendations that would be subject to ISSA/HCA. CCHMP reviewed documentation of past PHA recommendation ISS evaluation closures and found they satisfied the 2014 ISO regulation items described above under the New Process discussion.

Existing Process:The respective unit PHA report contains the HCA/ISSA that was performed for existing processes. The HCA/ISSA is made part of the PHA report and is issued when the PHA report is issued. The HCA/ISSA team was the same as the PHA team and the method used was the ISS checklist from Contra Costa County's SP guidance document. The PHA reports reviewed did not identify any ISS issues that needed to be addressed.

MOC:There were no major changes proposed since the last ISO audit.

II:There were no major changes identified from an incident investigation report that could reasonably have resulted in a MCAR since the last ISO audit.

RCA:CCHMP was unable to locate any recommendations listed in a RCA investigation report associated with a major incident. CCHMP was also unable to locate any recommendations listed in a RCA investigation report that recommended a major change that could reasonably result in a MCAR.



A58-13 Does/did the Stationary Source document for Inherently Safer Systems identified as infeasible and those considered and not implemented the grounds that were used to make the feasibility determination? [ISO Section 450-8.016(i)(3) and Section D.1.4 of the CCHMP Safety Program Guidance Document]

1. “If a stationary source concludes that implementation of an inherently safer system is not feasible, the stationary source shall document the basis for this conclusion in meaningful detail. The documentation shall include sufficient evidence to demonstrate to the department’s satisfaction that implementing the inherently safer system is not feasible and the reasons for this conclusion. A claim that implementation of an inherently safer system is not feasible shall not be based solely on evidence of reduced profits or increased costs.” [ISO Section 450-8.016(i)(3)]2. “Feasible” means capable of being accomplished in a successful manner within a reasonable period of time taking into account health, safety, economic, environmental, legal, social, and technological factors. [T19 CCR §2735.3(v)]3. Section D.1.4 of the CCHMP Safety Program Guidance Document defines feasibility.4. The documentation should include what Inherently Safer Systems were considered and why they were determined infeasible and rejected.5. The documentation maintained by the Stationary Source shall include sufficient evidence to demonstrate to CCHMP’s satisfaction that implementing the ISS is impractical, and the reason for this conclusion.

In reviewing documentation associated with the project ISS evaluation for ER 3227, three of the project recommendations identified the following wording under the column identified as Inherently Safer Systems: "Other alternative design not viable" or "Other options considered are not viable". CCHMP was unable to locate a discussion of "other alternative design" or "other options considered" associated with ISS options, and more specifically, documentation that supports these rejected ISS options were not feasible.

CCHMP reviewed the following PHA recommendations where ISS was applied. These recommendations came from the following PHAs and scenarios:-- KGP Unit 2017 PHA Revalidation, scenarios 15.20, 15.27, 15A.17-- DSU 2016 PHA Revalidation, scenarios 15.8 and 18.2-- CFH Unit 2017 PHA Revalidation, scenarios 4.1, 4.14, 27.5-- HGHT Unit 2016 PHA Revalidation, scenarios 1.4, 5.13, 13A.1, 13A.2-- Flexsorb 2017 PHA Revalidation, scenarios 5.10.1, 16.20.1, 11.2.1, 12.15.1, 12.15.2 -- CGH 2017 PHA Revalidation, scenarios 7A, 3.1, 7A.24.1-- CCU-CGP Unit 2017 PHA Revalidation, scenario 1.9.2, 1.30.1

In reviewing documentation associated with the above PHA recommendations, CCHMP found the following wording used for other options considered but not taken and the reason why they were not implemented: -- "Benefit of this option is grossly disproportionate from the risk" [KGP scenario 15.20, 15.27, 15A.17-- "team considers this option as not viable" [DSU scenarios 15.8, 18.2; CGH scenarios 7A, 3.1, 7A.24.1]

P Ensure items presented in ISSA/HCA studies as infeasible include sufficient documentation to support that conclusion, including the basis for this conclusion in meaningful detail.

ISO Abr


ID# Question Clarifications Findings Answer ActionsCategory Type-- "Other alternative design not viable" [CFH scenarios 4.1, 4.14; HGHT scenarios 1.4, 5.13; CCU-CGP scenarios 1.9.2, 1.30.1].

CCHMP expects documentation of infeasibility to be consistent with that identified in Section D.1.4 of the CCHMP Safety Program Guidance Document.

CCHMP reviewed Procedure 2.15A & 2.15B and found the ISS checklist summarizes that the ISS analysis is required to document to the County's satisfaction the reasons something identified is impractical. "Any claim of "financial infeasibility" shall not be based solely on evidence of reduced profits or increased costs, but rather shall include evidence that the financial impacts would be sufficiently severe to render the improvement as impractical."

Section 6.7 of I(A)-43 describes how feasibility is determined and matches items listed in Section D.1.4 of the County's SP ISS Guidance Document.



A58-14 Does the owner or operator revalidate the Inherently Safer System analysis / Hierarchy of Hazard Control Analysis for existing processes at least once every five years, in conjunction with the PHA schedule? [T19 CCR §2762.13(c), ISO Section 450-8.016(i)(1)(A) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. P4 identifies that HCAs for existing processes shall be performed in accordance with the following schedule and may be performed in conjunction with the PHA schedule:(a) No less than 50% of existing processes by 9/29/2020;(b) Remaining processes by 9/30/2022. [T19 CCR §2762.13(a)]2. If the 5-year revalidation for an Inherently Safer System analysis is not yet due, the Stationary Source is expected to have a system or policy in place to perform the revalidation at least once every five years.

The facility has been subject to County ISO requirements since 1999 and has been conducting existing process ISS analyses ever since. Starting in 2014 Shell started incorporating their ISS analysis of existing processes into the unit PHAs; prior to then they documented existing ISS studies outside of the PHA. They are currently following their PHA schedule to document all existing ISSAs, which is every 5 years.

As described in A58-11, Shell Refinery identified 8 processes that have not had an existing process ISSA or PHA. These are all utility related processes. The facility plans to complete the PHAs and ISSAs for these 8 operations by 10/1/20, well within the requirement to get to 100% by 9/30/22.

Y NoneExisting Process – Program 4 CalARP & ISO

Abr



A58-15 Does the Stationary Source adequately document and maintain their Inherently Safer System analyses revalidations to include:a) Incorporation of improvements made in the ISS method since the last review was conducted or selection of a new method to perform the ISS analyses;b) ISS review for all changes that have been made since the last ISS analysis; c) Review of all MCARs or potential MCARs that occurred at the process under review; andd) Review for any new and existing technologies not previously reviewed that can be incorporated that will make the process under review inherently safer. [Section D.1.2 of the CCHMP Safety Program Guidance Document]

1. This documentation is in addition to the documentation requirements listed in A58-05 and A58-12.2. Regardless of whether the 5-year revalidation for an Inherently Safer System analysis has been completed yet, the Stationary Source is expected to have a system or policy in place to maintain this documentation.

CCHMP was informed that PHA team members are tasked with completing the ISS Checklist during the PHA. Shell started using the current ISS Checklist after it was incorporated into the County's SP guidance document soon after being published in CCPS' 2008 book, "Inherently Safer Chemical Processes: A Life Cycle Approach", second edition. As stated in A58-14, until 2014 the facility used to use the ISS checklist in a stand alone ISS study. The checklist is currently used to review all nodes within the PHA evaluated during a revalidation or redo PHA. There has been no changes to the ISS checklist. As part of the PHA/ISS review, the facility evaluates all MOC changes made to the process since the previous PHA/ISS review. Past incidents, including MCARs and potential MCARs, are evaluated as part of the PHA and ISS review. PHA teams are required to include a process engineer and that engineer has routine discussions with world-wide technology specialists that work with all Shell sites to ensure personnel remain up to date with the latest technologies.

CCHMP reviewed the 5 existing process ISS evaluations listed in A58-11.

Y NoneExisting Process – ISO

Abr



A58-16 Does the owner or operator provide effective training to employees and employee representatives before serving on an HCA team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions including:a) Identification and use of first order inherent levels, then second order inherent and then address remaining risk using passive, active and procedural risk reduction categories; b) Use of the different categories of risk reductions;c) Approaches to apply ISS including minimization, substitution, moderation, and simplification? [T19 CCR §2762.4(e), §2762.13(f) & Section D.1.3 of the CCHMP Safety Program Guidance Document]

1. First order inherent, second order inherent and risk reduction categories (passive, active and procedural) are defined in A58-03.2. Approaches for consideration of ISS (minimization, substitution, moderation, and simplification) are defined in A58-02.3. The Stationary Source is expected to document that these elements are incorporated into their ISSA program.

To date, the facility has provided personnel with training on the County ISO's version of ISS. For existing process ISS studies evaluated within PHAs, this has been just-in-time training documented on sign-in sheets. For addressing ISS on PHA recommendations, the training has been for engineers on the various ISS concepts. Associated with new process evaluations, project engineers have been trained on ISS concepts, again all using the County ISO's version of ISS. There have been no ISSAs associated with proposed major changes or MCAR events.

Program 4 now requires separation between first order inherent to the greatest extent feasible, second order inherent to the greatest extent feasible, and then using other risk reduction measures. In general, personnel are provided with adequate training on County ISO ISS concepts although improvement is needed to comply with the new Program 4 requirements. Shell has 24 months, or until 10/1/2019, to complete this training.


Abr



A58-19 Has the owner or operator developed a documented corrective action work process to promptly complete all corrective actions that includes the following:a) Final decision for each recommendation;b) Corrective actions implemented for each accepted recommendation including completion date and assignment of responsibility;c) Rejection of recommendations;d) Any alternative safeguards;e) Team members written comments on any rejected or changed findings and recommendations;f) Whether an HCA was revalidated or updated if prompted by a PHA, HCA, DMR or SPA corrective action;g) Prioritize the completion of corrective actions to address process safety hazards to prevent the potential for a major incident;h) Corrective actions to be completed within 2.5 years after the HCA; andi) Corrective actions to be completed during the first regularly scheduled turnaround? [T19 CCR §2762.13(h) & §2762.16(d-e) and Section D.1.5 of the CCHMP Safety Program Guidance Document]

1. The team must provide to the owner or operator findings and recommendations at the earliest opportunity, but no later than 14 calendar days after recommendations and findings are complete. [T19 CCR §2762.16(e)(1)] 2. To reject a team recommendation, the owner or operator must demonstrate in writing that one of the following applies: (A) The analysis upon which the recommendation is based contains material factual errors; (B) The recommendation is not relevant to process safety; or (C) The recommendation is infeasible; however, a determination of infeasibility shall not be based solely on cost. [T19 CCR §2762.16(e)(2)]3. To change a team recommendation, the owner or operator must demonstrate in writing that an alternative safeguard would provide an equally or more effective level of protection. [T19 CCR §2762.16(e)(3)]4. Any rejected or changed recommendation must be communicated to onsite team members and made available to offsite team members for comment. [T19 CCR §2762.16(e)(4)]5. Interim safeguards are to be completed to address process safety hazards with potential major incident pending permanent corrections. [T19 CCR §2762.16(e)(10)]6. This question is for tracking actions taken.7. ISSA/HCA actions formulated through the PHA process must be completed within one year or during the next scheduled turnaround if a shutdown was required. Stationary Sources must send CCHMP a request for extension before PHA actions (including other studies and analysis related to the PHA) become

The majority of this question is related to Program 4 requirements as only item i) in the question and clarification #7 are from the County ISO ISS guidance document. As previously described, only the existing process ISS studies and PHA recommendations after 10/1/17 have been subject to Program 4 HCA requirements.

None of the existing process ISSAs reviewed by CCHMP identified any ISS recommendations. CCHMP reviewed a total of 8 PHA recommendations that were related to an ISSA action. CCHMP reviewed the completion status of each of these and found the majority were closed out within 1 year after the PHA. Several recommendations were found to need a turnaround, DSU 2016 PHA scenarios 15.8 and 18.2, and the target closure date is 8/30/20.


New


ID# Question Clarifications Findings Answer ActionsCategory Typeoverdue when they cannot be addressed within 1 year and a turnaround is not applicable. [Section D.1.5 of CCHMP Safety Program Guidance Document]






Abr

A58-22 Do the submitted RMP and Safety Plan accurately reflect the Inherently Safer Systems/HCA Program at the Stationary Source? [T19 CCR §2745.2(d) and ISO Section 450-8.016 and Section E.5 of the CCHMP Safety Program Guidance Document]


Section 9.0 of the facility's 2016 SP includes a discussion on their ISS Program that matches what CCHMP found onsite. This process will need to change slightly once Program 4 HCA requirements have been incorporated as identified within this questionnaire. The facility's next three year SP update is due to CCHMP by 8/26/19.

The facility's RMP revised in December 2016 does not mention the site's ISSA/HCA program. This is a new Program 4 requirement to incorporate this information into the RMP and the facility has until 9/30/19 to do that. The facility's next five year RMP update is due to CCHMP by 6/20/19. This is further described in A49-27.


Abr



A58-23 Did affected operating and maintenance employees and employee representatives effectively participate throughout all phases in performing HCAs? [T19 CCR §2762.10(a)(1) and §2762.13(d)]

* Verify employees and their representatives were part of the HCA team and involved with all aspects of the HCA.

1. Participation in “all phases” should be defined by the stationary source and should also include:a) Being involved as an HCA team member with HCAs for existing processes, new processes, PHA recommendations, MOCs as part of a major change, on recommendations from an incident investigation report associated with a major incident, and revalidation or update of any HCA;b) The process used to develop and document recommendations; d) HCA report development; e) Providing findings and recommendations to management;f) Communication from management on recommendations proposed to be changed or rejected, including receiving communication from management and providing comments back to management;g) MOCs conducted to change a proposed completion date for a HCA recommendation;h) Communication of an effective plan with rationale and revised timeline for recommendations in need of interim safeguards;i) Communication of closure of HCA recommendation documentation. [T19 CCR §2762.10(a)(1), §2762.13(d) and §2762.16(e)]

This is a Program 4 requirement that became effective on 10/1/17. As described in A46-01, the facility's Process Safety Management policy, C(A)-4 (revised February 2018, rev 0) identified that employees would participate in all phases of each CalARP program element. CCHMP was unable to confirm that the facility further defined what participation in "all phases" means for the HCA Program.

As described in this questionnaire, the facility has not fully implemented Program 4 requirements. Employees have participated for existing process HCA evaluations and in resolving PHA recommendations. There have been no new process HCA evaluations nor have them been any major changes subject to Program 4 requirements. A45-01 identified there may have been major incidents that have occurred. If so, an HCA may have been required. HCAs require that affected operating and maintenance employees and employee representatives effectively participate in all HCAs. A58-01 identified an ensure action item to develop a process to perform an HCAs associated with a major incident using appropriate employee participation.

R NoneProgram 4 CalARP

New



A58-24 Does the owner or operator retain all HCA/ISSA reports for the life of each process? [T19 CCR §2762.13(i)]

This is a Program 4 requirement that became effective on 10/1/17. As of the date of this audit, the facility has maintained all HCAs/ISSAs since the Program 4 regulations became effective.

CCHMP reviewed the engineering project policy Procedure 2.15A & 2.15B. Section 6.6 of this policy identified that ISS documentation must be maintained for at least 10 years per County requirements. The CalARP Program 4 requirements now require documentation to be maintained for the life of the process.

CCHMP reviewed the section 10.1 of the HCA/ISSA policy I(A)-43 and found it identified to maintain ISS recommendations indefinitely. CCHMP was also informed that if an ISSA was performed associated with an incident (e.g., MCAR or major incident), the ISSA would be maintained along with other incident documentation indefinitely.


New



A58-25 For corrective actions not within the timeline listed in question A58-19, has the owner or operator implemented interim safeguards sufficient to prevent the potential for a major incident, pending permanent corrections, and documented:a) The rationale for deferring the corrective action(s); b) The documentation required under the MOC process; c) A timeline describing when the corrective action(s) will be implemented; and d) An effective plan to make available the rationale and revised timeline to all affected employees and their representatives? [T19 CCR §2762.16(e)(14)]

1. For applicable corrective actions that cannot be implemented in two and half years that did not require a process shutdown. [T19 CCR §2762.16(e)(11)]

This is a Program 4 requirement that became effective on 10/1/17. As previously described, only the existing process ISS studies and PHA recommendations have been subject to Program 4 HCA requirements. Since 10/1/17, CCHMP did not find any ISSA/HCA that qualified for interim safeguards. Per discussions with the PHA Coordinator, CCHMP was informed that if a scenario was identified, either through the PHA or ISSA, that scored in the red of Shell's Risk Assessment Matrix (RAM) and permanent solutions could not be implemented within a year, then interim safeguards must be implemented. CCHMP was informed that this has not occurred for ISSA action items since 10/1/17 so this question is not applicable.

CCHMP reviewed I(A)-43 and Procedure 2.15A & 2.15B and was unable to locate descriptions of implementing interim safeguards when necessary. It is not a requirement to include this in policies but


New


A59: Process Safety Culture Assessment


A59-01 Has the owner or operator conducted an effective Process Safety Culture Assessment (PSCA) or Safety Culture Assessment (SCA) and produced a written report? [T19 CCR §2762.14(b) & ISO Section

1. P4 requires the owner or operator to produce a written report and action plan by April 1, 2019. [T19 CCR §2762.14(b)]2. P4 and ISO would allow the owner or operator to count an initial PSCA if conducted and documented between April 1, 2016 and April 1, 2019 if that PSCA includes the elements identified in A59-05. [T19 CCR §2762.14(b)]3. The ISO requires stationary sources to complete the SCA by November 2010 and document it in a report. [County Industrial Safety Ordinance Section 450-8.016(h)]

Per interview with the Safety Engineer and review of the 2015 SCA report, data collection for the most current Safety Culture Analysis (SCA) was conducted between September 2015 and November 2015 and the written report issued on 1/19/2016.


A59-02 Has the Stationary Source used at least one of the following methodologies to perform the safety culture assessment: a) Written Survey, b) Interview, c) Observation, d) Focus Group, e) An equivalent method as approved in advance by CCHMP? [ISO Section 450-8.016(h) and Section F.5 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources may use more than one methodology to perform the assessment of the entire site. [ISO Section 450-8.016(h)]

Page 4 of the 2015 SCA report describes the SCA methodology as a 20-question written survey consisting of open-ended questions. The survey was administered both electronically as a web-form tool as well as with paper forms.

CCHMP reviewed Attachment B of the 2015 SCA report which identifies the responses for each question in the survey. Potential responses to the open-ended questions are dependent on the type of question asked. For questions related to frequency, the following responses were used and tracked: Blank, Don't Know, Never, Seldom, Fairly Often, Very Often, Always. For questions related to perception, the following responses were used and tracked: Blank, Don't Know, Strongly Disagree, Disagree, Neutral, Agree, Strongly Agree.

Y NoneISO



A59-03 Did the Stationary Source establish a methodology for evaluating work groups? [Section F.3 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources MUST establish their assessment process and state the methodology selected for each work group. 2. The work groups assessed should at a minimum include: employees in management, supervisors, operators, maintenance, engineering, health and safety personnel and resident and applicable transient contractors. [Section F.3 of the CCHMP Safety Program Guidance Document]

Page 3 of the 2015 SCA report identified the following departments (and total responses submitted):

- Operations - Delayed Coking (45)- Operations - Logistics (41)- Operations - LOP (81)- Operations - Opcen (69)- Operations - Utilities (23)- Other Staff (HR, PA, L&D, Finance, etc.) (35)- Projects (43)- Quality Assurance Lab (16)- Routine Maintenance (183)- Technical Staff (HSSE, PEI, OSE, CSE, etc.) (93)- Turnaround Maintenance (158)

Additionally, individuals were divided by roles (and total responses submitted):- Contractor Partner, Routine (147)- Contractor Partner, Turnaround (131)- Hourly (Operations, Maintenance, Lab) (250)- Staff (including temporary) (259)

All work groups above were issued the written survey.

Y NoneISO



A59-04 Does documentation exist to show that an appropriate participation level target was chosen and achieved for each selected work group? [Sections F.3 and F.8 of the CCHMP Safety Program Guidance Document]

1. While 100% participation is difficult to attain, Stationary Sources should ensure they have the maximum participation from each work group.2. 2007 Baker Panel report achieved a 70% response rate.3. CCHMP believes that a low participation rate may be an indicator of safety culture issues.

The Executive Summary of the 2015 SCA report states that more than an overall participation level of 70% of the workers completed the assessment. A breakdown of the work group participation level was provided separately from the 2015 SCA report:- For Shell employees (hourly and staff) - 70%- For Routine Contractors - 50%- For Turnaround Contractors - 35%

Per interview with the Safety Engineer and union representative, a target participation level was not specified for each work group. CCHMP expects that a target participation level is selected as a basis for participation to be evaluated as low participation rates may be an indicator of safety culture issues.

P Ensure that a SCA target participation level is chosen and achieved for each work group.

ISO



A59-05 Did the Process Safety Culture Assessment address the following components: a) Safety Program Performance, b) Individual Performance and Accountability, c) Peer Perception and Accountability, d) Management Commitment and Leadership, e) Hazard reporting program, f) Response to reports of hazards,g) Procedures to ensure that incentive programs do not discourage reporting of hazards, and h) Procedures to ensure that process safety is prioritized during upset or emergency conditions? [T19 CCR §2762.14(b) & Sections F.6 and F.8 of the CCHMP Safety Program Guidance Document]

1. The assessment must address all the listed components. Stationary Sources should consider addressing topics listed in F.6.1 through F.6.4 of the Safety Culture Guidance Document. [Section F.6 of the CCHMP Safety Program Guidance Document]2. Items listed in question a) through d) are from ISO and items d) through h) are from P4.

Per interview with the Safety Engineer and union representative, a breakdown of how the survey questions corresponded with components (a) through (d) was initially developed in 2010 for the previous SCA. However, no such mapping was conducted for the new questions included in the 2015 survey. CCHMP was unable to verify from existing documentation that the repeated questions from the 2010 survey were mapped to a specific component.

As the most recent SCA was conducted prior to the adoption of the Program 4 regulations and falls outside the 18-month window for being considered an initial PSCA, elements (e) through (h) are not required to be considered in the 2015 SCA.

P Ensure that future PSCAs address the required components per T19 CCR §2762.14(b) and Section F.6 of the Safety Program Guidance Document.

ISO



A59-06 Does the Stationary Source also maintain the following records for each Safety Culture Assessment: a) Criteria for rejection of any results or findings, b) Criteria used for determining if no actions will be taken on assessment results or recommendations, c) Rationale for prioritization of action items, d) Documentation of communications to work force, e) Qualitative and quantitative comparisons in subsequent assessments of whether improvement plans affected observable safety behavior or culture? [Section F.8 of the CCHMP Safety Program Guidance Document]

The 2015 SCA report describes that several paper forms which were partially completed (e.g., first page was completed, but the second page was left blank potentially by mistake) were removed from the assessment results to not skew the overall question scores. Survey responses with a few blank answers were maintained in the assessment and all free-text comments were maintained.

Per the 2015 SCA report, there were no planned criteria for rejecting any actions on the assessment results. The report mentions how low percentage responses with "negative" responses are considered indicative of poor safety culture and low percentage responses with "positive" responses are not assumed to indicate a positive safety culture.

Per the 2015 SCA report, the rationale for prioritizing action items is based on how difficult an action might be to complete (i.e., actions requiring multiple disciplines or additional technical support may have longer implementation target dates), whether the action involves work groups that exist only during Turnarounds (e.g., turnaround contract partners), or actions that involve changing Shell IT or computer-related programs due to global IT processes.

The communication of the 2015 SCA report to the workforce is documented on page 9 of the report. The primary means of communication is the report itself (available via intranet), but verbal communication during various face-to-face meetings also served to promote awareness of the SCA results with several examples being listed within the report.

Y NoneISO



A quantitative comparison of the 2015 SCA results with the 2010 SCA results was conducted and discussed on pages 9 and 10 of the 2015 SCA report. Per the summary, 9 of the 20 questions from the written survey were kept the same between both studies to measure culture change. The responses from the questions were plotted and the results illustrated using a line graph on page 10 of the report. The graph correlates the "favorability" of the response (whether the response was more favorable, neutral, or less favorable) with the percentage of the overall responses. The graph shows a trend of increasing favorability, indicative of an improving Safety Culture.



A59-07 Was the written PSCA report:1) Meeting the CalARP requirements developed within 90 calendar days of completion of the assessment;2) Developed with employee participation pursuant to the employee participation program;3) Made available and communicated with the action plan to employees, their representatives and participating contractors within 60 days of the completion of the report? [T19 CCR §2762.14(d & h)]

1. This question applies to PSCA performed after October 1, 2017. See clarification 4 in this question for PSCA performed prior to effective date of P4. 2. PSCA report shall include: (1) the method(s) used to assess the process safety culture; (2) the conclusions of the process safety culture assessment; (3) the rationale for the conclusions; and (4) the recommendations to address the findings from the PSCA [T19 CCR §2762.14(d)]3. P4 identifies that the three year interim assessment must also be communicated and made available to employees, their representatives and participating contractors within 60 days of the completion of the report. [T19 CCR §2762.14(h)]4. ISO requires the stationary source to both develop the report and present it to management and the workforce within 6 months of data collection. The written report shall also include the action plan. [Section F.8 of the CCHMP Safety Program Guidance Document] 5. Stationary must discuss in advance with CCHMP reports that are not completed and communicated within 9 months of data collection. [Section F.8 of the CCHMP Safety Program Guidance Document]

Per Section 6.3 of the PSCA policy, the PSCA Team shall complete the written report within 90 days of completion of the assessment. The report shall include the following items:- The method(s) used to assess the process safety culture;- The conclusions of the process safety culture assessment;- The rationale for the conclusions; and, - The recommendations and actions to address the findings from the PSCA

Per Section 6.6 of the PSCA policy, the PSCA Report and Action Plan, and the three-year interim assessment, shall be communicated and made available to employees, their representatives and participating contractors within 60 days of the completion of the report.

The policies above reflect the current PSCA policy and applies to PSCAs performed after 10/1/2017. As the most recent SCA was conducted prior to the adoption of the Program 4 regulations and falls outside the 18-month window for being considered an initial PSCA, this Program 4 requirement is not being applied to the 2015 SCA.

There is an ISO requirements for developing and presenting the SCA report, including the action plan, to management and the workforce within 6 months of completing data collection. CCHMP reviewed the 2015 SCA report which was developed after data collection was completed November 2015. Per the report, communication of the report to the work force was made shortly after the report was developed. Examples of how the report was communicated are



ID# Question Clarifications Findings Answer ActionsCategory Typelisted below:- Martinez Minute newsletters sent on 1/20/2016 to all employees and those contract partner supervisors with Shell computer access- E-mail sent to all employees and those contract partner supervisors with Shell computer access- Report posted on Health and Safety Department webpage- Agenda topic in the Joint Health and Safety Committee- Agenda topic in the Shell Contractors United for Safety Ya'll Come meeting

However, a written action plan was not developed and made available to employees; see A59-08 regarding the development of a written improvement plan.

A59-08 Has the owner or operator developed a written improvement plan with a clear list of corrective actions to be implemented within 3 months of the report presentation along with identifiable milestones? [Sections F.7 and F.8 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources MUST establish goals and metrics for the improvement of safety culture at the site. These goals should encompass the state of the group values, attitudes, perceptions, competencies and patterns of behavior. The improvements must be made into a plan of action designed with metrics to assess its effectiveness in achieving the Stationary Source's stated goals. 2. Stationary Sources need to track the progress made for items in their improvement plan. [Section F.7.2 of the CCHMP Safety Program Guidance Document]3. Section F.7.1 of the CCHMP Safety Program Guidance Document states “It may be necessary to conduct shorter interim assessments to ensure that the action plan is on track to achieve the defined objectives.” The P4 requirement to complete interim assessments within three years, T19 CCR §2762.14(f), should assist in keeping the action plan on track; see question A59-15.

CCHMP was informed that a written improvement plan was not produced from the 2015 SCA with a clear list of corrective actions to be implemented within 3 months of the report presentation along with identifiable milestones. Per interview with the HSSE Manager, actionable items were developed and communicated verbally throughout the organization. However, it is required by CalARP Program 4 and Section F.8 of Safety Program Guidance Document to develop a written report and improvement plan.

N Ensure that a written improvement plan is developed for the 2015 SCA and that future SCAs will have improvement plans developed within 3 months of PSCA report presentation.




A59-09 Has the Stationary Source developed metrics from the improvement plan to monitor the effectiveness in achieving the facility’s stated goals for the safety culture program? [Section F.7.2 of the CCHMP Safety Program Guidance Document]

1. Stationary Sources MUST establish goals and metrics for the improvement of safety culture at the site. These goals should encompass the state of the group values, attitudes, perceptions, competencies and patterns of behavior. The improvements must be made into a plan of action designed with metrics to assess its effectiveness in achieving the Stationary Source's stated goals. 2. Stationary Sources need to track the progress made for items in their improvement plan. [Section F.7.2 of the CCHMP Safety Program Guidance Document]3. Section F.7.1 of the CCHMP Safety Program Guidance Document states “It may be necessary to conduct shorter interim assessments to ensure that the action plan is on track to achieve the defined objectives.” The P4 requirement to complete interim assessments within three years, T19 CCR §2762.14(f), should assist in keeping the action plan on track; see question A59-15

CCHMP was informed that metrics were not developed to monitor the effectiveness in achieving the facility's stated goals for the 2015 SCA. See A59-08 regarding the development of a written improvement plan.

N Ensure that metrics are developed from all improvement plans to monitor the effectiveness in achieving the stated goals for the process safety culture program at Shell.

ISO

A59-10 Has the Safety Culture been reassessed at least once every 5 years? [ISO Section 450-8.016(h) & T19 CCR §2762.14(b)]

1. Program 4 states that “The owner or operator shall conduct an effective PSCA and produce a written report and action plan within eighteen (18) months following the effective date of this Article and at least once, every five (5) years thereafter.” [T19 CCR §2762.14(b)] 2. P4 wording links due dates for subsequent PSCAs to the initial assessment. 3. After the initial assessment, Stationary Sources must perform safety culture assessments at least every 5 years. [ISO Section 450-8.016(h)]

Data collection for the most recent SCA was conducted between September 2015 and November 2015; data collection for the previous SCA was completed by November 2010. As such, the current SCA meets the requirement of reassessment at least once every five years.









A59-12 Does the submitted RMP and Safety Plan accurately reflect the Safety Culture Assessments performed at the Stationary Source? [T19 CCR §2745.2(d) & Section E.10 of the CCHMP Safety Program Guidance Document]

1. P4 allows the stationary source up to 24 months to update the RMP, or until September 30, 2019. [T19 CCR §2745.1(a)]2. The Safety Plan must include:(a) A description of what Safety Culture means to the Stationary Source;(b) The purpose and overall objectives of safety culture assessments;(c) A discussion of the type of data gathering technique(s) used (written survey, interviews, etc.) and rationale;(d) A description of how the Stationary Source ensures that the Safety Culture Assessment is performed as expected and how the results will be evaluated for their site; and(e) Plans for future revalidations. [Section E.10 of the CCHMP Safety Program Guidance Document]

CCHMP reviewed the most recently submitted RMP (certification dated 6/20/2014) and noted that the document has not been updated to include a description of the Process Safety Culture Assessments performed at Shell. Shell has until September 30, 2019 to update the RMP to meet this requirement. See A49-27 regarding updates to the RMP.

Page 57 of the submitted Safety Plan (certification dated 8/26/2016) describes the two SCAs conducted at Shell and provides a general description of the themes for improvement that were generated from the 2015 SCA.

Y NoneISO



A59-13 Has the owner or operator developed, implemented and maintained an effective Process Safety Culture Assessment (PSCA) program with participation from affected operating and maintenance employees and employee representatives throughout all phases of in the implementation of the PSCA program? [T19 CCR §2762.14(a) & §2762.10(a)(1)]

CCHMP reviewed I(A)-71 - Process Safety Culture Assessment Program (PSCA policy; revision dated 2/19/2018) which describes the Process Safety Culture Assessment (PSCA) as an anonymous assessment seeking to gather workers' (employees and contractors) perspective of the current, or recently changing Process Safety Culture as it pertains to Health, Safety and Environment at the Shell Martinez Refinery (SMR). The assessment is to be conducted at least every five years and is meant to identify positive improvements and perspectives as well as areas that present opportunities for Process Safety, Personal Safety, and Environmental improvements.

Per interview with the Safety Engineer and union representatives, the union representatives participate in the development and implementation of the written survey and preparation of the PSCA report.

As the most recent SCA was conducted prior to the adoption of the Program 4 regulations and falls outside the 18-month window for being considered an initial PSCA, this requirement is not applied to the 2015 SCA.


New



A59-14 Was the PSCA conducted or overseen by a team:

a) That includes at least one person knowledgeable in refinery operations and at least one employee representative;b) Consistent with the employee participation program;c) That consulted with at least one employee or another individual with expertise in assessing process safety culture in the petroleum refining industry? [T19 CCR §2762.14(c)]

1. Program 4 states that “The owner or operator shall provide for employee participation in the development and implementation of the PSCA, report, and recommendations, pursuant to section 2762.10.“ [T19 CCR §2762.14(c)]

Per Section 6.2 of the PSCA policy, the PSCA Team is comprised of representatives from Contract Partners, Company Management, and Union representatives and, at a minimum, consists of at least one person with knowledge in refinery operations and an employee representative.

CCHMP has reviewed the existing site policy on employee participation (C(A)-4, Attachment 3: Employee Participation; revised 2/15/2018) which states that affected operating and maintenance employees and employee representatives participate, through all phases, in the development, training, implementation, and maintenance of PSM elements and the performance of PSCAs.



New



A59-15 Did the PSCA team conduct a written interim assessment of the implementation and effectiveness of each PSCA corrective action within three (3) years following the completion of the PSCA report? If a corrective action is found to be ineffective, did the owner or operator implement changes necessary to ensure effectiveness in a timely manner not to exceed six months? [T19 CCR §2762.14(f)]

* Verify in A60-07 that the three year interim assessment was communicated and made available to employees, their representatives and participating contractors within 60 days of the completion of the report. [T19 CCR §2762.14(h)]

Per Section 6.4 of the PSCA policy, the PSCA Team, or the Internal Assurance Effectiveness Review Team, shall conduct a written interim assessment of the implementation and effectiveness of each PSCA corrective action within three years following the completion of the PSCA report. If a corrective action is found to be ineffective, the team shall work with the Action Owner to implement changes necessary to ensure effectiveness in a timely manner, not to exceed six months.



New

A59-16 Did the stationary source manager, or his or her designee, serve as signatory to all process safety culture assessment reports and corrective action plans? [T19 CCR §2762.14(g)]

Per Section 6.5 of the PSCA policy, the Refinery Manager, or designee, shall serve as signatory to all process safety culture assessment reports and corrective action plans.



New



A59-17 Did employees and employee representatives have access to all documents or information developed or collected by the owner or operator related to the PSCA program including information that might be subject to protection as a trade secret? [T19 CCR §2762.10(a)(3)]

Per interview with employees and employee representatives, the PSCA Team (which included employee representatives) had access to the 2015 safety culture survey results including all free-text responses recorded. Employees were given access to the 2015 SCA report and a spreadsheet displaying the collected data on the facility's intranet. Union representatives had access to the data collected for the PSCA and aided in the generation of the report. However, the ability for employees and their representatives to have access to information developed or collected as part of the PSCA that might be subject to protection as trade secret is not included in a written policy; CCHMP recommends including a description in the employee participation policy regarding employee and employee representative access to the PSCA information.



New


S01R - Hot Work Permit (Program 4)


S01-01 Hot Work Permit

Does/did the stationary source develop and implement a written procedure for the issuance of hot work permits? [T19 CCR §2762.11(a), ISO Section 450-8.016(a)(10) & T8 CCR 5189(k)]

1. P4 requires the owner or operator to issue a hot work permit for hot work operations conducted on or near a covered process. [T19 CCR §2762.11(a)]2. The permit shall certify that the applicable portions of the fire prevention and protection requirements contained in Sections 4848 and 5189 have been implemented prior to beginning the hot work operations. [T19 CCR §2762.11(b) & T8 CCR 5189(k)].3. Per discussion with CalOSHA (Dec 07), a hot work program that incorporates all the provisions of Sections 4848 and 6777 including training of personnel, on-the-job hazard identification and signature on the permit constitutes "certification".

CCHMP reviewed Procedure I(F)-3: Safety Department Permits, rev.26, revised June 2017. The purpose of this procedure is to communicate the differences in the types of Departmental and Safety permits used at Shell Martinez Refinery (SMR), the requirements necessary for issuing and handling these permits, and when each type of permit is required. A safety permit is required before a source of ignition may be created anywhere on refinery property or before any person is permitted to enter a confined space where gas could accumulate or ventilation may be impaired.

The source of ignition include the following: welding, burning, portable internal combustion engines, electrical power tools, portable electronic products, chipping or braking concrete, sandblasting, grinding, drilling soldering, lead burning, and other work or operation which by nature may produce flame, sparks or sufficient heat to ignite flammable vapors. Reference is made to Attachment F: Safety Permit that needs to be completed and approved by the Department involved. The main sections of the Safety Permit include the following:- Date, Time Issued and Expiration. - Contractor/Shell Department & Job Description- Atmospheric Test Results- Equipment Condition/ Hazardous Energy Control- Confined Space- Hot Work- Protective Equipment Required- JSA Must Be Completed prior to Starting Work- Permit Conditions and Requirements Understood

CCHMP reviewed 26 completed hot work permits and noted that the permits included the information above and had the required signatures of the operations department, the maintenance department, and the fire watch.

Y NoneAbr



S01-03 Hot Work Program

Has management designated an individual responsible for authorizing cutting and welding operations in areas not specifically designed or approved for such processes? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 3.2.1.3]

Does the facility ensure that before welding or cutting is begun, inspection and authorization by a designated management representative is required? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.3 and 3.2.2.3]

1. This includes inside tank farms, process units, etc.; and any activity that may potentially generate a spark; i.e., cutting, welding, grinding, working with pyrophoric iron, hot taps, etc. [CCHMP Interpretation] 2. Secure the authorization for the cutting or welding operations from the designated management representative [T8 CCR 4848(a) via ANSI/ASC Z49.1-94, 3.2.2.3]3. Before hot work operations begin in a nondesignated location, a written hot work permit by the permit-authorizing individual shall be required. [T8 CCR §4848(a) via NFPA 51B 3-3.1]4. Management must require that a supervisor or contractor supervisor be responsible for ensuring that cutting and welding are so scheduled that plant operations that might expose combustibles to ignition are not started during cutting or welding? [29 CFR §1910.252(a)(2)(xiv)]

Each hot work permit requires the signatures of the following:- Operations Team leader or Unit Operator- Engineer/ Maintenance Team Leader (craftsman)- Entry Supervisor (for confined space entry)- Fire Watch

Per Procedure I(F)-3, there are three types of permits: 1) Level I Low Energy Permits2) Level II Hot Permits3) Level III Hot Permits

Level I Low Energy Permits are written for work and equipment that does not require an open flame such as electrical power tools or portable internal combustion engines. Level II Hot Permits are for welding/cutting/grinding/etc. on new piping not connected to any process equipment or on structural steel and for Weld bays. Level III Hot Permits are Safety Permits written for all sources of ignition that are not covered under Level I or Level II for work that could take place in the covered process area.

The level of authorization required depends on the type of hot work performed. For either a Level II or III Permit, a fire watch would be required. Level II Hot Permit requires the review of safety requirements at the job site by the Maintenance group responsible for the job (either SMR/Contractor Representative) and a Level II Certified Employee will sign and date the top right hand of the permit space titled "Time Issued". For Level III Hot Permit, the operations personnel shall check the job site to verify that all the precautions necessary to complete the job safely are in place. All Level III Permits must be co-signed by the H&S Refinery Safety Leader or other Health & Safety Qualified Representative, written and signed by Level III competent employees only.

Y NoneAbr




Has the stationary source determined and documented that the flammable gas or vapor content is less than 20% of the LEL before the hot work permit is issued? [T8 CCR §6777(b)]

1. This includes testing with well-maintained and calibrated portable measuring devices. [CCHMP Interpretation]

CCHMP reviewed 26 completed hot work permits and noted that the permits documented the time and test results for different parameters such as % Oxygen, % LEL, H2S(PPM), CO (PPM), and Benzene (PPM). Per this review, none of the % LEL readings were higher than 0.

Y NoneAbr


Do the hot work permits require that suitable fire extinguishing equipment be maintained ready for use when working with a source of ignition? [T8 CCR §6777(d)]

1. Fire extinguishing equipment shall be ready for instant use [29 CFR §1910.252(a)(2)(ii) 2. Before a hot work permit is issued, the permit-authorizing individual must verify that fully charged and operable fire extinguishers that are appropriate for the type of possible fire shall be available immediately at the work area. [T8 CCR §4848((a) via NFPA 51B 3-3.2(j)]3. Sufficient fire extinguishing equipment must be ready for use where welding and cutting work is being done; management must assure that proper personal protective and fire protection equipment is used; and assure that fire protection and fire extinguishing equipment are properly located at the site. [T8 CCR §4848((a) via ANSI/ASC Z49.1-94, 6.2.1.1 and 3.2.2.4]4. These requirements should also be stated in a policy/procedure. [CCHMP Interpretation]

Per a review of 26 completed hot work permits, covered under the Hot Work Section of the permit, each permit documented if there was a fire extinguisher at the site and what type. The permits also documented if there was a charged fire hose or if a shield arc or guard (used to contain sparks/heat) was used. CCHMP was able to view a live hot work in the Logistics area and confirmed that there was a charged fire hose available and a shield arc or guard area was in place to contain sparks from the hot work.

Y NoneAbr




Does the facility ensure that where practical, the work is moved to a designated safe location? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.1.2]

Does the facility ensure that if the object to be welded or cut cannot readily be moved, all movable fire hazards in the vicinity are taken to a safe location? [T8 CCR §4848(a) and ANSI/ASC Z49.1-94,

1. Check that where objects to be welded or cut are not movable and where fire hazards cannot be removed, guards are used to confine the heat, sparks, and slag, and to protect the immovable fire hazards and nearby personnel [T8 CCR §4848(a) via NFPA 51B 3-3.2(l) and ANSI/ASC Z49.1-94, 6.1.4] 2. The requirement for first assessing whether the object to be welded or cut could be moved to an approved hot work area to perform the work should be in a hot work policy/procedure [CCHMP Interpretation] 3. Additional precautions should be taken if combustible metals are in the area or will be the focus of the hot work. This includes equipment or piping constructed of magnesium, titanium, or zirconium. Examples include welding or cutting on titanium heat exchangers. [CCHMP Interpretation]4. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHS Interpretation] 5. Supervisors shall ensure that materials are not exposed to ignition by taking one or more of the following actions: have the work moved to a location free from combustibles and away from hazardous areas; have the combustibles moved a safe distance from the work or properly shielded against ignition if the work cannot readily be moved; or schedule welding and cutting so that such materials are not exposed during welding and cutting operations. [T8 CCR §4848(a) and ANSI/ASC Z49.1-94, 3.2.2.2]

CCHMP reviewed 26 completed hot work permits and verified that the permits document that additional precautions are taken for fire hazards.

Per interview with SME, when practical the work is moved to a safe location. If not, the area is cleared of fire hazards or protected from fire hazards through use of shields, blankets, etc. All precautions taken are documented on the hot work permit.

Y NoneAbr




Does the permit authorizing individual require a fire watch and ensure precautions are taken to prevent ignition of combustibles when performing hot work:a) In a location where other than a minor fire might develop; b) When combustible materials in building construction or contents are closer than 35 feet to the point of operation; c) When combustible materials are more than 35 feet away but are easily ignited by sparks; d) When wall or floor openings within a 35 feet radius expose combustible materials in adjacent areas, including concealed spaces in walls or floors; or e) When combustible materials are adjacent to the opposite side of partitions, walls, ceilings, or roofs and are likely to be ignited (by conduction or radiation)? [T8 CCR §4848(a) via NFPA 51B 3-4.1 & 3-3.2(g)], ANSI/ASC Z49.1-94, 3.2.2.4, and 6.2.2]

1. Additional firewatchers shall be posted where it is necessary to observe areas that are hidden from the view of a single firewatcher (e.g., other side of partitions, walls, ceilings, etc.) if combustible materials could be ignited. [T8 CCR 4848(a) via NFPA 51B 3-4.3 and ANSI/ASC Z49.1-94, 6.2.3]2. Welding shall not be attempted on a metal partition, wall, ceiling or roof having a combustible covering nor on walls or partitions of combustible sandwich-type panel construction [T8 CCR §4848(a) via NFPA 51B 3-3.2(h)] 3. Cutting or welding on pipes or other metal in contact with combustible walls, partitions, ceilings, or roofs shall not be undertaken if the work is close enough to cause ignition by conduction [T8 CCR §4848(a) via NFPA 51B 3-3.2(i)] This includes ignition by convection, conduction and radiation. This includes hot taps [CCHMP Interpretation] 4. If hot work is done near walls, partitions, ceilings, or roofs of combustible construction, fire-retardant shields or guards shall be provided to prevent ignition. [T8 CCR §4848(a) via NFPA 51B 3-3.2(f)]5. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

CCHMP reviewed 26 completed hot work permits (mostly Level IIs and Level IIIs), and verified that as required, the Hot Work permits identified that a fire watch was needed. The permits documented who the fire watch was and included both a signature and printed name.

CCHMP was able to view a live hot work in the Logistics area and confirmed that a fire watch was present due to the work area falling into one of the categories listed in this question, parts a-e. The hot work procedure requires the presence of a fire watch when conducting Level II and Level III Hot Permits as described in S01-03. The Procedure I(F)-3 and the Hot Work Permit specify the requirements covered in this question.

Y NoneAbr




Has the stationary source ensured that the fire watch is maintained for at least ½ hour after the completion of the hot work operation to detect and extinguish smoldering fires; and that fire watchers are qualified individuals, knowledgeable about fire reporting procedures, and emergency rescue procedures, who are assigned duties to detect and prevent spread of fires? [T8 CCR §4848(a) via NFPA 51B 3-4.2 and ANSI/ASC Z49.1-94, 6.2.2 and 6.2.4]

1. Verification of fire watch qualifications may be from training documentation, or listing the requirements on the back of the permit. [CCHMP interpretation]2. Fire watch shall be trained in the use of fire extinguishing equipment, familiar with facilities for sounding an alarm in the event of a fire, watch for fires in all exposed areas, try to extinguish them only when obviously within the capacity of the equipment available, or otherwise sound the alarm. [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 6.2.4]3. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

CCHMP reviewed Procedure I(F)-3 Section 7.4 that includes the fire watch responsibilities. Listing under this subject includes: " Fire watch must be maintained for at least 30 minutes following completion of hot work operation.” CCHMP also reviewed the back of the Safety Permit that provides several items under Fire Watch Instructions. Item #7 of these instructions states: "Upon completion of the job and before departing from the site, make sure there are no hot sparks, burning embers, etc., still present. Return any firefighting equipment to its original location. Fire watch must be maintained for at least 30 minutes following completion of hot work operation."When viewing a live hot work in the field, CCHM interviewed the fire watch and confirmed that he will stay at least 30 minutes after the job is completed.

Y NoneAbr


Are all welding and cutting equipment inspected as required to assure it is in safe operating condition?

When equipment is found to be incapable of reliable safe operation, is the equipment repaired by qualified personnel prior to its next use or withdrawn from service? [T8 CCR §4848(a) via ANSI/ASC Z49.1-94, 3.1.1]

Per interview with SME, all welding and cutting equipment are inspected as part of the hot permit process to assure it is in safe operating condition. If equipment is found to not be safe or reliable, the equipment is no longer used and taken in for repair and replacement.

Y NoneAbr


Does the facility ensure that the area is inspected by the permit-authorizing individual at least once per day while the hot work permit is in effect to ensure that it is in a fire-safe area? [T8 CCR §4848(a) via NFPA 51B 3-3.4]

1. The permit-authorizing individual shall determine the length of the period for which the hot work permit is valid. [T8 CCR §4848(a) via NFPA 51B 3-3.3]2. Document that safety precautions were met on the permit, and/or must be met within the hot work policy. If only stated in the policy, the stationary source should document on the permit that the policy was followed. [CCHMP Interpretation]

Safety/Department Permits Procedure I(F)-3 Section 7.1 specifies the responsibilities of issuing operating department personnel. A listing under this topic states: “Periodically (at least once per day) inspect the job in progress to confirm the safety precautions stipulated are being carried out." (This is a responsibility shared with personnel in the maintenance organization-- SMR and Contractor.) Per interview with SME, as part of issuing a permit, the operations personnel representative is required to go and check on the job while it is still in progress.

Y NoneAbr




Does the submitted RMP and Safety Plan accurately reflect the Hot Work Permit Program at the stationary source? [T19 CCR §2745.2(d) and ISO Section 450-8.016]


The submitted RMP revised December 2016 Page 59-60 and Safety Plan dated August 2016 Page 35 accurately reflect the Hot Work Permit Program at the stationary source

Y NoneAbr

S01-22 Audit Follow-Up


1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.

There were no ensure action items associated with the previous CalARP/ISO audit to be addressed here. This question is not applicable.

N/A NoneAbr


S03c - Lockout/Tagout (Program 4)


S03-01 Cleaning, Servicing, and Adjusting Operations

Does the stationary source ensure that, if necessary, the moveable parts are mechanically blocked or locked out to prevent inadvertent movement during this period in order to perform the specific task? [T19 CCR §2760.3(d)] [T8 CCR §3314(c)]

1. For the purpose of Section 3314, "locked out" means the use of devices, positive methods and procedures, which will result in the effective isolation or securing of prime movers, machinery and equipment from mechanical, hydraulic, pneumatic, chemical, electrical, thermal or other energy sources. [T8 CCR §3314] 2. Exception: Minor tool changes and adjustments, and other minor servicing activities, which take place during normal production operations are not covered by the requirements of Section 3314 if they are routine, repetitive, and integral to the use of the equipment or machinery for production, provided that the work is performed using alternative measures which provide effective protection. [T8 CCR §3314] 3. Examples of movable parts include pump impeller blades, mixer blades, fan blades, turbine blades, gear assemblies, etc., [CCHMP Interpretation]4. 2008 National Electric Code/NFPA 70 Section 430.102 (A)(b) states, "The provision for locking or adding a lock to the disconnecting means shall be installed on or at the switch or circuit breaker used as the disconnecting means and shall remain in place with or without the lock installed."5. This includes motor windings, gas and steam turbine shafts and blades. Securing could include blocking in steam or gas to turbine drivers, etc. [CCHMP Interpretation]

Section 6.6 of Procedure C(F)-5 - Isolation Procedures (Isolation Procedure; revision dated 3/2017) describes the use of blocks when there is other potential or mechanical energy that has not been isolated by other means. Additionally, for any installed blocks (e.g., chains, brackets, stands, etc.) that can be locked, a lock shall be installed by Operations and by each Craftsperson to the block.

Y None



S03-02 Cleaning, Servicing, and Adjusting Operations

Does the stationary source ensure that prime movers, equipment, or power driven machines equipped with lockable controls or readily adaptable to lockable controls are locked out or positively sealed in the "off" position during repair work and set-up operations; and for machines, equipment, or prime movers not equipped with lockable controls or readily adaptable to lockable controls are de-energized or disconnected from the source of power, or other actions taken to prevent the equipment, or machine from inadvertent movement or release of stored energy? [T19 CCR §2760.3(d)] [T8 CCR §3314(d)]

1. This includes the on/off switch or button, speed controls, steam or gas control valves, power switches, motor control room controls such as breakers, etc. [CCHMP Interpretation]2. For the purpose of Section 3314, "locked out" means the use of devices, positive methods and procedures, which will result in the effective isolation or securing of prime movers, machinery and equipment from mechanical, hydraulic, pneumatic, chemical, electrical, thermal or other energy sources [T8 CCR §3314]3. Exception: Minor tool changes and adjustments, and other minor servicing activities, which take place during normal production operations are not covered by the requirements of Section 3314 if they are routine, repetitive, and integral to the use of the equipment or machinery for production, provided that the work is performed using alternative measures which provide effective protection [T8 CCR §3314]4. Lockout and/or tag out procedure are used to protect workers from exposure to hazardous materials and/or source of energy that might still be present in a work area [Guidelines for Process Safety Documentation, CCPS, 1994, pg. 307]5. 2008 National Electric Code/NFPA 70 Section 430.102 (A)(b) states, "The provision for locking or adding a lock to the disconnecting means shall be installed on or at the switch or circuit breaker used as the disconnecting means and shall remain in place with or without the lock installed."

Isolation of energy sources from the equipment prime mover prior to performing maintenance is captured in two separate procedures: C(F)-3 - Lockout of Non-Electrically Driven Equipment (Non-Electrical LOTO Procedure; revision dated April 2017) and C(F)-4 - Lockout of Electrically Driven Equipment (Electrical LOTO Procedure; revision dated October 2017).

For non-electrically driven equipment, the driver or prime mover equipment is required to be isolated by at least one block valve (single valve) on the supply side and one block valve on the exhaust, with valves proven to provide positive isolation. Additional isolation measures (e.g., double valve, blind, etc.) may be necessary if positive isolation cannot be proven by the single valve configuration. All valves used in the isolation of the energy source (air, steam, or hydraulics) must be locked with a chain and tagged with a weatherproof tag stating "Do Not Open this Valve"; additionally, bleeders used in the double block and bleed configuration must be tagged with a "DANGER - DO NOT CLOSE THIS VALVE" tag.

For electrically driven/powered equipment, operations personnel are responsible for locking out the equipment. There are multiple procedures for locking out various types of equipment (e.g., motors or motor-operated valves; electric heaters, analyzers, and other non-motorized electrical equipment; equipment requiring a rack-out to de-energize). However, each procedure follows a general format: de-energization (i.e., open/rack-out the breaker) and locking and tagging the connection to the energy source with a "DO NOT OPERATE" tag (for breakers that do not have a permanent locking means, a temporary/portable locking

Y None


ID# Category Question Clarifications Findings Answer ActionsTypedevice is used); verification of de-energization by attempting to start the de-energized equipment; attaching the "Electrical Lockout Check List" and additional "DO NOT OPERATE" tags at the local start/stop station for the equipment; electricians are responsible for conducting voltage verification and attaching an "ABSENCE OF VOLTAGE VERIFIED" tag to the breaker/motor lockbox, which is verified by operations prior to beginning maintenance.

S03-03 Repair Work and Setting-Up Operations

Does the stationary source require that: a) Accident prevention signs or tags or both be placed on the controls of the equipment, machines and prime movers during repair work and setting-up operations; andb) Stationary source provides accident prevention signs, tags, padlocks, seals, or other similarly effective means, which may be required for cleaning, servicing, adjusting, repair work or setting-up operations? [T19 CCR §2760.3(d)] [T8 CCR §3314(d) and (e)] [29CFR §1910.147(c)]

1. 2008 National Electric Code/NFPA 70 Section 430.102 (A)(b) states, "The provision for locking or adding a lock to the disconnecting means shall be installed on or at the switch or circuit breaker used as the disconnecting means and shall remain in place with or without the lock installed."2. Where an employer has a uniform system with unique and personally identifiable locks designed for lockout, that are placed on the source of energy, accident prevention signs or tags are not required [T8 CCR 3314(d)3].

The Isolation Procedure generally describes how various pieces of equipment must be tagged prior to being worked on:- 6.4.1.3: Locks and tags shall be placed to make it clear to anyone who wants to use or work on the equipment that the valve is isolated.- Attachment F of the LOTO procedure describes blind tagging requirements (maintenance blind and turnaround blind tagging)- 6.6.1.1: Blocks are tagged with a weatherproof tag stating "DANGER - DO NOT OPERATE"Additionally the Lock Out procedures, C(F)-3 and C(F)-4, both identify that the local start/stop controls for equipment being locked out must be tagged with a "DO NOT OPERATE" tag.

Per Attachment B of the Isolation Procedure, tags are available at the S&S, in vending machines, or from the associated Super Shopper.

Y None



S03-04 Cleaning, Repairing, Servicing, and Adjusting Prime Movers, Machinery and Equipment

Does the stationary source ensure that signs, tags, padlocks, and seals have means by which they can be readily secured to controls; and ensures that tagout devices’ attachment means are of a non-reusable type, attachable by hand, self-locking, and non-releasable with a minimum unlocking strength of no less than 50 pounds? [T19 CCR §2760.3(d)] [T8 CCR §3314(e)]

1. Lockout and tagout devices shall be capable of withstanding the environment to which they are exposed for the maximum period of time that exposure is expected. [OSHA §1910.147 (c)(5)(ii)(A)(1)]2. This applies when tagout is used as a substitution for lockout [CCHMP Interpretation of T8 CCR §3314 and §2320.4(a)]3. When a tagout device is used on an energy-isolating device that is capable of being locked out, the tagout device shall be attached at the same location that the lockout device would have been attached, and the employer shall demonstrate that the tagout program will provide a level of safety equivalent to that obtained by using a lockout program. [OSHA §1910.147(c)(3)(i)]

Attachment B of the Isolation Procedure identifies the various tags used to identify locked-out equipment. A note is included that states "Tags shall be attached with a self-locking, non-releasable, all environment-tolerant, one-piece nylon tie with a minimum unlocking strength of no less than 50 lbs."

Y None

S03-05 Cleaning, Repairing, Servicing, and Adjusting Repetitive Process Machines

Does the stationary source require that the operating stations where the machine may be activated is at all times under the control of a qualified operator or craftsman; and be in clear view or positive communication with all participants? [T19 CCR §2760.3(d)] [T8 CCR §3314(f)]

1. This question applies to repetitive process machines, such as numerical control machines, which require power or current continuance to maintain indexing and where repair, adjustment, testing, or setting up operations cannot be accomplished with the prime mover or hazardous energy source disconnected [T8 CCR §3314(f)]2. "Participants" mean any other person(s) engaged in the repair, adjustment, testing, or setting up operation in addition to the qualified operator or craftsman having control of the machine operating station [T8 CCR §3314]

Per interview with the Senior Electrical Engineer, there are no repetitive process machines in use which require power or current continuance for repair, adjustment, testing, or setting up operations.

N/A None


Does the stationary source require that all participants be beyond the reach of machine elements which may move rapidly and present a hazard to them? [T19 CCR §2760.3(d)] [T8 CCR §3314(f)]

1. This question applies to repetitive process machines, such as numerical control machines, which require power or current continuance to maintain indexing and where repair, adjustment, testing, or setting up operations cannot be accomplished with the prime mover or emergency source disconnected [T8 CCR §3314(f)]

See S03-05 regarding the use of repetitive process machines.

N/A None




Does the stationary source require that where machine configuration or size requires that the operator leave his control station to install tools, and where machine elements which may move rapidly, if activated, exist, such elements must be separately lockout out by positive means? [T19 CCR §2760.3(d)] [T8 CCR §3314(f)]

1. This question applies to repetitive process machines, such as numerical control machines, which require power or current continuance to maintain indexing and where repair, adjustment, testing, or setting up operations cannot be accomplished with the prime mover or emergency source disconnected [T8 CCR §3314(f)]

See S03-05 regarding the use of repetitive process machines.

N/A None



S03-08 Hazardous Energy Control Procedure

Does/did the stationary source develop and use a written energy control procedure, which clearly and specifically outlines the following:a) The scope, purpose, authorization, rules, and techniques to be used for the control of hazardous energy; b) The means to enforce compliance including, but not limited to a statement of the intended use of the procedure; c) The means to enforce compliance including, but not limited to the procedural steps for shutting down, isolating, blocking and securing machines or equipment to control hazardous energy; andd) The means to enforce compliance including, but not limited to the procedural steps for the placement, removal, and transfer of lockout devices and tagout devices and the responsibility for them? [T19 CCR §2760.3(d)] [T8 CCR §3314(g)]

1. The energy control procedure applies when employees are engaged in the cleaning, repairing, servicing or adjusting of prime movers, machinery, and equipment [T8 CCR §3314(g)]2. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]

The Isolation Procedure describes the process for isolating process streams, including utility streams, from plant equipment and piping. Additionally, separate procedures were developed for locking out both non-electrically driven equipment (Procedure C(F)-3, Non-Electrical LOTO procedure; revision dated April 2017) and electrically driven equipment (Procedure C(F)-4, Electrical LOTO procedure; revision dated October 2017).

Section 6.3 of the Isolation Procedure states that Operations is responsible for developing and maintaining an isolation package for each piece of equipment and isolation job. The package includes a drawing marked with valve isolation points, isolation test points, the valves used to install blinds, and blind points; a written list of the above items; the completed Isolation Matrix (Attachment E) that identifies the isolation method for each isolation point; completed Deviation Forms (Attachment C), if any; and an Enhanced JSA for Blinding (Attachment D), if required.

The Electrical LOTO procedure is further broken down and provides procedures on the lock-out process for three different scenarios: lock-out of low voltage (under 600V) electrically driven equipment, lock-out of low voltage electrically powered equipment, and lock-out of electrically driven/powered equipment requiring a lockbox. Each of the procedures above details the process for de-energizing equipment, how lockout devices are applied to the power source and controls of the equipment, and re-energizing equipment after work has been completed.

Y NoneAbr



S03-09 Hazardous Energy Control Procedure

Does the energy control procedure clearly and specifically outline the means to enforce compliance including, but not limited to the requirements for testing a machine or equipment, to determine and verify the effectiveness of lockout devices, tagout devices and other energy control devices? [T19 CCR §2760.3(d)] [T8 CCR §3314(g)]

1. The energy control procedure applies when employees are engaged in the cleaning, repairing, servicing or adjusting of prime movers, machinery, and equipment [T8 CCR §3314(g)]2. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]

The Electrical LOTO Procedure includes steps for the verification of de-energization of electrical equipment. Operations personnel are required to verify de-energization of electrically driven equipment after opening a breaker/switch or having electricians rack out the breaker by pressing the start button at the local controls station (and any additional controls stations if applicable). Crafts persons working on the de-energized equipment are required to separately verify de-energization prior to conducting maintenance.

Y NoneAbr

S03-10 Hazardous Energy Control Procedures

Does the stationary source document hazardous energy control procedures, which include separate procedural steps for the safe lockout/tagout of each machine or piece of equipment affected by the hazardous energy control procedure? [T19 CCR §2760.3(d)] [T8 CCR §3314(g)]

1. The procedural steps for the safe lockout/tagout of prime movers, machinery or equipment may be used for a group or type of machinery or equipment, when either of the following two conditions exist: a. the operational controls named in the procedural steps are configured in a similar manner, b. the locations of disconnect points are identified, and c. the sequence of steps to safely lockout or tagout the machinery or equipment are similar; or 2. the machinery or equipment has a single energy supply that is readily identified and isolated and has no stored or residual hazardous energy. [T8 CCR §3314(g)]3. The facilities should have separate control of energy procedures for each type of equipment or unique equipment. This is per CalOSHA. If a facility does not have separate procedures, CCHMP should only provide a

Lockout of electrical equipment is described generally by the Electrical LOTO procedure. Additionally, work plans may be developed for specific maintenance work (e.g., turnaround work) which include relevant switching procedures. Lockout of non-electrical equipment is described in the equipment-specific isolation packages maintained by each operations group.

Y None



S03-11 Energy Control Procedure

Does the stationary source conduct a periodic inspection of the energy control procedure at least annually to evaluate their continued effectiveness and determine necessity for updating the written procedures; and ensure that the periodic inspection is performed by an authorized employee other than the one(s) utilizing the hazardous energy control procedures being inspected? [T19 CCR §2760.3(d)] [T8 CCR §3314(j)]

1. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]

Per interview with the Health & Safety Manager, Permit-to-Work audits are conducted on a monthly basis that involves a review of active permits. The audits are conducted by members of the Health & Safety department.

Y None


Does the stationary source ensure that where lockout is used for energy control, the periodic inspection includes a review, between the inspector and authorized employees of their responsibilities under the hazardous energy control procedure being inspected; stationary source certifies that the periodic inspections have been performed; and the periodic inspection certification includes the following: a) Identifies the machine or equipment on which the energy control procedure was being utilized;b) The date of the inspection; c) The employees included in the inspection; andd) The person performing the inspection? [T19 CCR §2760.3(d)] [T8 CCR §3314(j)]

1. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]2. The periodic inspections shall be conducted to correct any deviations or inadequacies identified. [OSHA §1910.147 (c)(6)(B)]3. A periodic inspection of the energy control procedure(s) must occur at least annually. [T8 CCR §3314(j)]

The SMR Permitted Work Audit document (revised 7/5/2017) includes 5 questions related to Electrical LOTO and 11 questions related to Process Isolation. Each audit document identifies the following information: Unit-Equipment being audited, date of audit, auditor, a list of auditees, the permit number, type of permit (Dept, Level I, Level II, Level III, or PRCS), and a description of the work being done. CCHMP reviewed a sampling of 39 completed Permit-to-Work audits for Electrical LOTO/Process Isolation that were completed since the previous audit and noted no issues.

Y NoneAbr




Does the stationary source ensure that whenever outside servicing personnel are to be engaged in activities covered by this section, the stationary source's lockout or tagout procedures are followed? [T19 CCR §2760.3(d)] [T8 CCR §3314(k)]

1. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]2. Outside servicing personnel refers to contractors [CCHMP Interpretation]

Per interview with the Senior Electrical Engineer, crafts persons (including outside servicing personnel) working on electrically locked-out equipment must follow the requirements of C(F)-4 to verify positive energy isolation prior to performing maintenance. The procedure involves verification of the Operations and Electrician's locks and appropriate tags on the multiple padlock device, attaching the craftsperson's lock and "DO NOT OPERATE" tag on the lockbox, and verifying that the equipment does not start up when pressing the start button at the local controls station.

Contractors involved in conducting maintenance on isolated process equipment are made aware of Shell's isolation and LOTO procedures prior to working in the field and are required to follow the isolation procedure/package specific to the equipment being worked on.

Y None

S03-14 Training Does the stationary source document the following training: a) Are authorized employees trained on hazardous energy control procedures and on the hazards related to performing activities required for cleaning, repairing, servicing, setting-up and adjusting prime movers, machinery and equipment; b) Is each affected employee instructed in the purpose and use of the energy control procedure; and c) Are all other employees whose work operations may be in an area where energy control procedures may be utilized, instructed about the prohibition relating to attempts to restart or reenergize machines or equipment which are locked out or tagged out? [T19 CCR §2760.3(d)] [T8 CCR §3314(l)]

Training on the Isolation Procedure is provided to new Operations and Maintenance employees as part of the Orientation & Basic Skills (O&BS) classes. Computer-based refresher training on energy control is completed annually through the Shell Open University system. Training on the Electrical and Non-Electrical LOTO procedures is provided to all personnel working in the field and is refreshed annually. Per interview with the [Jim Flores' title], Life Critical Procedures (LCP) training includes a review of six safe work practices, including Electrical and Non-Electrical LOTO. Two of the six topics are included in the LCP training conducted annually to complete a training cycle of three years.

Y None



S03-15 Low-Voltage Equipment or Systems

Does the stationary source ensure that an authorized person is responsible for notifying all involved personnel before working on de-energized electrical equipment or systems unless the equipment is physically removed from the wiring system? [T19 CCR §2760.3(d)] [T8 CCR §2320.4(a)]

1. This applies to low-voltage electrical safety 2. Locking is not required (a) where suitable tagging procedure is used and (b) where the disconnecting means is accessible only to personnel instructed in these tagging procedures [T8 CCR §2320.4(a)] 3. Suitable accident prevention tags shall provide: (a) the reason for placing the tag; (b) the name of the person placing the tag and how that person may be contacted; and (c) the date the tag was placed [T8 CCR §2320.4(a) and T8 CCR §2320.6] 4. Low-voltage refers to energies up to 300 volts. [29 CFR §1910.269 Appendix B(II)(B)]5. Work on cord and plug-connected electric equipment for which exposure to the hazards of unexpected energization or start up of the equipment is controlled by the unplugging of the equipment from the energy source and by the plug being under the exclusive control of the employee performing the work, is exempted from T8 CCR §3314 (c ) and (d) [T8 CCR §3314(d)]

For low-voltage electrical equipment (defined to be less than 600 volts), the Electrical LOTO procedure requires the Operator to de-energize the equipment by opening the circuit breaker and locking and tagging the equipment. The tag serves as the notification to involved personnel that the system is de-energized. Per interview with the Senior Electrical Engineer, the Shell Electrical Group receives a permit from Operations granting permission to de-energize low voltage equipment and systems.

Y None




Does the stationary source ensure that an authorized person is responsible for locking the disconnecting means in the "open" position with the use of lockable devices, such as padlocks, combination locks or disconnecting of the conductor(s) or other positive methods or procedures which will effectively prevent unexpected or inadvertent energizing of a designated circuit, equipment or appliance before working on de-energized electrical equipment or systems unless the equipment is physically removed from the wiring system? [T19 CCR §2760.3(d)] [T8 CCR §2320.4(a)]

1. This applies to low-voltage electrical safety 2. Locking is not required (a) where suitable tagging procedure is used and (b) where the disconnecting means is accessible only to personnel instructed in these tagging procedures [T8 CCR §2320.4(a)] 3. Suitable accident prevention tags shall provide: (a) the reason for placing the tag; (b) the name of the person placing the tag and how that person may be contacted; and (c) the date the tag was placed [T8 CCR §2320.4(a) and T8 CCR §2320.6] 4. Low-voltage refers to energies up to 300 volts. [29 CFR §1910.269 Appendix B(II)(B)]5. 2008 National Electric Code/NFPA 70 Section 430.102 (A)(b) states, "The provision for locking or adding a lock to the disconnecting means shall be installed on or at the switch or circuit breaker used as the disconnecting means and shall remain in place with or without the lock installed."6. Work on cord and plug-connected electric equipment for which exposure to the hazards of unexpected energization or start up of the equipment is controlled by the unplugging of the equipment from the energy source and by the plug being under the exclusive control of the employee performing the work, is exempted from T8 CCR §3314(c) and (d) [T8 CCR §3314(d)]

Sections 6.4 and 6.6 of Procedure C(F)-5 identify that Operations personnel are responsible for opening the circuit breaker or lockable local disconnect switch for electrically driven/powered equipment below 600V and attaching a multi-padlock device, Operation's lock and a "DO NOT OPERATE" tag to the breaker/switch. For controls that do not have a permanent locking means, a temporary/portable lockout device shall be used.

Y None




Does the stationary source ensures the following:a) That an authorized person is responsible for tagging the disconnecting means with suitable accident prevention tags conforming to the provisions of T8 CCR Section 2320.6 before working on de-energized electrical equipment or systems unless the equipment is physically removed from the wiring system; andb) That an authorized person is responsible for effectively blocking the operation or dissipating the energy of all stored energy devices which present a hazard, such as capacitors or pneumatic, spring-loaded and like mechanisms before working on de-energized electrical equipment or systems unless the equipment is physically removed from the wiring system? [T19 CCR §2760.3(d)] [T8 CCR §2320.4(a)]

1. This applies to low-voltage electrical safety and when locking is not required if (a) suitable tagging procedure is used and (b) the disconnecting means is accessible only to personnel instructed in these tagging procedures [T8 CCR §2320.4(a)]2. Suitable accident prevention tags shall provide: (a) the reason for placing the tag; (b) the name of the person placing the tag and how that person may be contacted; and (c) the date the tag was placed [T8 CCR §2320.4(a) and T8 CCR §2320.6]3. Low-voltage refers to energies up to 300 volts. [29 CFR §1910.269 Appendix B(II)(B)]4. Energy source is any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy [OSHA §1910.147(b)]5. 2008 National Electric Code/NFPA 70 Section 430.102 (A)(b) states, "The provision for locking or adding a lock to the disconnecting means shall be installed on or at the switch or circuit breaker used as the disconnecting means and shall remain in place with or without the lock installed."6. Work on cord and plug-connected electric equipment for which exposure to the hazards of unexpected energization or start up of the equipment is controlled by the unplugging of the equipment from the energy source and by the plug being under the exclusive control of the employee performing the work, is exempted from T8 CCR §3314(c) and (d) [T8 CCR §3314(d)]

See S03-16 regarding locking of low-voltage electrically driven/powered equipment.

N/A None



S03-18 Re-energizing low-voltage Equipment or Systems

Does the stationary source ensure that an authorized person is responsible for determining that all persons are clear from hazards, which might result from the equipment or systems being energized before energizing equipment, or systems, which have been de-energized? [T19 CCR §2760.3(d)] [T8 CCR §2320.5(a)]

1. This applies to low-voltage electrical safety.2. Low-voltage refers to energies up to 300 volts. [29 CFR §1910.269 Appendix B(II)(B)]

Sections 6.4.3 and 6.6.3 of C(F)-4 identify the requirements for lockout removal on low-voltage electrically driven/powered equipment. The steps identify that operations is required to verify completion of work and that equipment is safe to operate, remove all tags and locks from the equipment controls and circuit breaker/switch, and close the breaker/switch to put the equipment back in service. Per interview with the Senior Electrical Engineer, the Shell Electrical Group receives a permit from Operations granting permission to re-energize low voltage equipment and systems.

Y None

S03-19 Re-energizing Equipment or Systems

Does the stationary source ensure that an authorized person is responsible for removing locking devices and tags before energizing equipment or systems, which have been de-energized; and that locking devices, and tags may be removed only by the employee who placed them? [T19 CCR §2760.3(d)] [T8 CCR §2320.5(a)]

1. Locking devices and tags shall be removed upon completion of the work and after the installation of the protective guards and/or safety interlock systems [T8 CCR §2320.5(a)] 2. When an employee has left the premises or is otherwise unavailable, other persons may be authorized by the employer to remove the locking devices and tags in accordance with a procedure determine by the stationary source [T8 CCR §2320.5(a)]

See S03-18 regarding the removal of locking devices prior to re-energizing equipment.

Y None



S03-20 Safety Precautions

Does the stationary source ensure the following:a) That when access to opened enclosures containing exposed energized electrical equipment is not under the control of an authorized person, suitable temporary barriers or barricades shall be installed;b) That when working on or near exposed energized conductors or parts of equipment, conductive measuring tapes, ropes or similar measuring devices shall not be used; and c) That prior to climbing poles or other elevated structures supporting overhead electrical lines or equipment, an inspection is completed to assure that such poles or structures are in safe condition for the work to be performed? [T8 CCR §2320.7(a)]

1. This applies to low-voltage electrical safety. [T8 CCR §2320.7]2. Low-voltage refers to energies up to 300 volts. [29 CFR §1910.269 Appendix B (II)(B)]3. If poles or structures are determined to be unsafe for climbing, they shall not be climbed until made safe by guying, bracing or other adequate means. [T8 CCR §2320.7(d)]

Per interview with the Senior Electrical Engineer, access to open enclosures containing energized electrical equipment is restricted to Qualified Persons (individuals familiar with the construction and operation of the equipment and the hazards involved and has received training to perform the required tasks for that equipment). With regards to working on or near exposed energized equipment, Shell follows NFPA 70E Section 130.4(F) requirements with regards to using non-conductive tools. Elevated line work is conducted using insulated buckets. If a structure is required for elevated electrical work, it is inspected prior to use.

Y None

S03-21 Audit Follow-Up


* Complete the status column in the previous CalARP/ISO audit's Summary of Action Item table for this prevention program.* Identify a new action item along with periodic written updates to CCHMP (e.g., monthly) to complete outstanding action items or proposed remedies identified that are past due.1. This question is only applicable to stationary sources that have had prior CalARP/ISO audits by CCHMP.


N/A NoneAbr


ATTACHMENT C

Summary of Action Items

Summary of Action Items and Proposed Remedies

ID# Question Actions Proposed Remedy Due DateFindings

A38-07 Do the PHA(s) address the following:a) Hazards of the process? [T19 CCR §2762.2(c)(1) & ISO Section 450-8.016(d)(1)]b) Damage Mechanism Review (DMR) reports and Hierarchy of Hazard Control Analysis reports that are applicable to the process units? [T19 CCR §2762.2(c)(3)&(4)]

Ensure that PHAs address HCAs for the unit and that this is documented in the PHA.

Updated PHA procedure (I(A)-50) to reflect the requirement to conduct an HCA for all PHA recommendations for each scenario that currently identifies the potential for a major incident, and to be documented in the PHA report.

ClosedPer CCHMP review all seven PHAs addressed the hazards of the process. Examples of hazards reviewed include failure of equipment, equipment inadvertently placed in the wrong position, and loss of utilities.




Wednesday, July 17, 2019 Page 1 of 48Shell Refinery - 2018 CalARP Audit Findings


A40-12 Has the owner or operator developed and implemented an effective written training program that includes: a) The requirements that an employee must meet in order to be designated as qualified; and b) Employee testing procedures to verify understanding and to ensure competency in job skill levels and work practices that protect employee and public safety and health? [T19 CCR §2762.4(d)]

Ensure that the written maintenance training policy, or other policies, are modified to include additional details on: "maintenance role fundamentals" (i.e., Phase 1 training); "job role and equipment specific task and procedures training" (i.e., Phase 2 training); how training effectiveness is assessed (e.g., minimum test scores).

Update Maintenance Training Policy D(A)-1 with these recommended changes. Review changes with stakeholders (i.e. Maintenance Supervisor Team) prior to implementing or publishing document.

11/1/2019Operator initial and refresher training is adequately covered within the following policies: C(A)-40, C(A)-41, C(A)-42, C(A)-43, C(A)-44 and C(A)-45. See A40-01 for a description of these policies. The collection of these policies define the requirements and expectations listed in the question. See the findings for A40-01 and A40-03 that summarize what was reviewed associated with implementation of these policies.

CCHMP reviewed the facility's Maintenance Training Policy, D(A)-1 (revised June 2016, rev 3). This policy identified that once an individual completes training and/or meets performance standards he/she will be deemed "certified". This policy is very similar to the Operations Training Policy, C(A)-40, in that it provides a high level overview only. For example, the policy identifies the following would be performed: Training Needs Analysis, Training Plan, phases of training (Phases 1-4), Training Delivery, Assess Training Effectiveness. In reviewing the information listed in the maintenance policy, CCHMP was unable to locate additional details on the training content. Specifically, was unable to locate additional details for: "maintenance role fundamentals" [Phase 1 training]; "job role and equipment specific task and procedures training" [Phase 2 training]; how training effectiveness is assessed (e.g., minimum test scores).

A40-14 Did the owner or operator make sure that effective participation takes place with affected operating and maintenance employees and employee representatives in all phases of training in the CalARP Program? [T19 CCR §2762.10(a)(2) and §2762.4(f)]

Ensure that affected maintenance employees and employee representatives effectively participate throughout all phases in the implementation of the maintenance training program.

Determine with USW PSM Representative how to best utilize represented employees for maintenance training. Update Maintenance Training Policy D(A)-1 with requirements.

11/1/2019This is a Program 4 requirement that became effective on 10/1/17. As described in A46-01, the facility's Process Safety Management policy, C(A)-4 (revised February 2018, rev 0) identified that employees would participate in all phases of each CalARP program element. CCHMP was unable to confirm that the facility further defined what participation in "all phases" means for the Training Program.

CCHMP confirmed that employees and their representatives have participated in the training of new operators and in refresher training related to being qualified for operator positions.

CCHMP was informed that existing maintenance employees are required to team up with newly hired maintenance employees. CCHMP was unable to obtain information related to maintenance employee refresher training related to whether maintenance employees or their representatives were involved with the process of providing input on training topics or in providing training to others.



A42-08 Are employees involved in operating a process informed of, and effectively trained in the change in a timely manner, prior to implementation of the change? [T19 CCR §2762.6(f) & ISO Section 450-8.016(a)(6)(C)]

Ensure documentation of MOC training provided to employees is maintained that identifies training was provided in a timely manner and

Site will evaluate current method to document MOC training and take action to improve documentation to show employees were effectively trained in the change in a timely manner.

4/30/2020Per interview with SME and a review of the MOC Policy referenced in A42-01, operating, maintenance and contractor employees may be trained or informed of changes by various methods. These include department mentor's email, team meetings, training sessions, training modules, or writing about the change in the daily in the daily in the daily guidelines, depending on the change. Training is documented and attached to the MOC in KMS or MOC package. For larger projects, a management of change training signoff sheet is completed and maintained by the Department Mentor. CCHMP reviewed two examples of such training documentation of the change and noted the signoff included the initials and date of training for the different shift team members.

Per interview and live navigation, at the beginning of a shift, each operator signs on to the computer, reviews the shift turnover notes and department email, and checks for any updates including MOC information. All operators must document that they have reviewed the MOCs related to their department. Per interview, training required for most of the smaller changes are done via email to the operations shift teams with information/clarification on the change. However, there is no confirmation that the MOC initiator receives from the email recipients on whether they opened the email on change training and understood the training or if they had any questions. Training for bigger changes are completed by classroom or onsite review of the impact of the change. The training on the change that is provided via email needs to be confirmed via the MOC process. Also see A42-05 for a consider action to complete this task as part of the MOC action items process.



A43-04 Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that effective safety, operating, maintenance, and emergency procedures are in place and adequate? [T19 CCR §2762.7(b)(3) & ISO Section 450-8.016(a)(7)(B)]

Ensure that the PSSR process captures and verifies that effective maintenance procedures are in place and adequate.

Update remaining KMS PSSR documentation templates to ensure that questions on effective maintenance procedures and maintenance training are part of the PSSR

10/31/2019Attachment 1 (PSSR Questions in KMS), Questions 9, 10, 12 and 13 address the availability of effective procedures: - Are necessary startup, shutdown, operating, and special procedures in place? - Are necessary maintenance procedures in place? - Have the emergency procedures been updated if necessary (unit operation emergency)?- Have the safety and emergency response procedures been updated if necessary?

Similar questions addressing safety, operating, and emergency procedures are found in Attachments 2 and 4 in the PSSR policy as well as 6 of the 9 KMS PSSR module templates. However, not all Attachments and KMS templates included a verification item for maintenance procedures, which encompass all written procedures used to ensure the ongoing integrity of process equipment. As such, CCHMP identifies the current PSSR program as having a gap in addressing the potential impacts of a change on maintenance procedures.

CCHMP reviewed a sampling of completed MOC/PSSR packages and noted that the PSSR section verified that the necessary startup, shutdown, operating, maintenance (when the template used included a verification), emergency and special procedures are in place and that a redundant check was completed prior to the introduction of regulated substances to a process.



A43-07 Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a process that training of each operating employee and maintenance employee affected by the change has been completed? [T19 CCR §2762.7(b)(5) & ISO Section 450-8.016(a)(7)(B)]

Ensure that the PSSR process captures and verifies that training to affected maintenance personnel is provided.

Update remaining KMS PSSR documentation templates to ensure that questions on effective maintenance procedures and maintenance training are part of the PSSR.

Site will evaluate current method to document MOC training and take action to improve documentation to show employees were effectively trained in the change in a timely manner.

4/30/2020Attachment 1 (PSSR Questions in KMS), Questions 14 and 15 address the training of operations and maintenance personnel affected by the change (both questions include a statement to attach training documentation):- Have the affected onshift operators been informed of and trained in the change? - Have the affected maintenance employee and contractors been informed of and trained in the change?

Similar questions concerning operator training are found in Attachments 2 and 4 in the PSSR policy as well as 9 of the 9 KMS PSSR module templates. However, verification of training of maintenance employees affected by the change is not universally covered and is only addressed in 5 of the 9 KMS templates. As all changes made via KMS require a PSSR to be completed and not all of the KMS PSSR templates address the training of affected maintenance employees, CCHMP identifies this as a gap in regards to addressing the training of affected maintenance personnel in the PSSR process.

CCHMP reviewed a sampling of completed MOC/PSSR packages which identify that a redundant check of the training provided to affected operations and maintenance personnel (if included in the KMS template) is conducted prior to the introduction of regulated substances to a process. CCHMP reviewed one completed MOC/PSSR package which included documented signoffs from operations personnel that received face-to-face training. The primary method of training involves an email notification sent to affected operations and maintenance personnel to inform them of the change. Per interviews with a Mentor and a Production Unit Manager, operators are also informed of upcoming changes through the start-of-shift meetings and receive informal face-to-face meetings with the Operations Specialists or Operations-Maintenance Coordinators.



A45-01 Has the owner or operator developed, implemented, and maintained effective written procedures for promptly investigating and reporting any incident that results in or could reasonably have resulted in a major incident, or catastrophic release of a regulated substance? [T19 CCR §2762.9(a) & ISO Section 450-8.016(a)(9)(A)]

Ensure that the incident investigation procedure is revised to include steps for reporting and conducting an effective RCA investigation for any incident that results in or could have reasonably resulted in a major incident, and that the procedure is implemented and maintained. The revised procedure needs to include the definition of Major Incident per CalARP Program 4 regulations.

Ensure that any incidents that occurred after 10/1/17 are reassessed for major incident and potential major incident applicability and investigated as necessary using appropriate employee participation.

Ensure that incidents that resulted in, or could have reasonably resulted in a MCAR are investigated using the appropriate investigation method, as required per the SMR incident investigation procedure.

Updated Incident Investigation procedure I(A) – 6 to include these requirements. (complete)

Incidents after 10/1/17 will be reviewed to determine if they were potential major incidents and actions taken to close any gaps found.

The 3 MCARs that were identified in the audit will be reviewed to ensure that they meet regulatory requirements for Incident Investigation.

12/15/2019CCHMP reviewed the Incident Investigation Procedure: I(A)-6/EM-11.1 Investigations and Incident Reporting (rev.15, dated Sept 2016) which includes requirements for reporting and investigating MCARs, potential MCARs, and catastrophic releases and still references the Program 3 section of CalARP regulations (2760.9), and ISO. CCHMP notes the procedure does not include the new Program 4 requirements (effective 10/1/17) for incident investigation defined in section 2762.9 of the CalARP regulations, meaning there is no mention of major incidents or incidents that could have reasonably resulted in a major incident.

The procedure identifies requirements for conducting an ISSA for investigation recommendations involving a major change that could reasonably result in a MCAR. CCHMP notes that this is the previous requirement under ISO, and that the current requirement under CalARP Program 4 states a HCA/ISSA must be conducted for any major change resulting from recommendations, regardless of incident potential. See A58-01 for more discussion on this topic.

The incident investigation procedure must be updated to include the new CalARP Program 4 requirements. CCHMP was informed that a draft incident investigation policy is currently in-progress to include P4 requirements. CCHMP was unable to review this draft policy during the audit.

Per CCHMP's review, the incident investigation procedure identifies that all personnel are required to report any incident they are aware of to the appropriate supervisor as soon as possible. The supervisor is responsible for gathering facts and reporting the incident to the Department Manager. Incidents are reported into the Fountain Incident Management (FIM) database. Requirements for reporting incidents in FIM are further defined in procedure I(A)-18 Incident Reporting (rev. 8, dated Sept 2014). This document includes procedures for employees to enter incidents into FIM ("First Report"), and submit a "0-60 report" to quickly notify appropriate personnel and leadership of an incident via email. CCHMP was informed that the 0-60 report is a copy of the First Report entered into FIM. CCHMP reviewed the 0-60 report emails for the incidents mentioned later in this question. Each 0-60 report contained the following: department or unit responsible, title or short description of the incident, full incident description, specific location where incident occurred, responsible supervisor, date incident occurred, immediate corrective actions taken, and classification as near miss or incident with consequence.

The procedure also defines steps and responsibilities for screening FIM First Reports and routing the incident First Report


ID# Question Actions Proposed Remedy Due DateFindingsto the appropriate supervisor ("Responsible Supervisor") for review and to complete more questions in FIM about the incident, conduct risk ranking and determine if the incident should be investigated ("First Input" module). Once the First Input is completed by the Responsible Supervisor, the submitted incident is officially established in FIM where immediate corrective actions are assigned (where appropriate), and investigation of the incident is determined and tracked to closure. CCHMP was informed per SME interview that the FIM database is used to track incidents company-wide, and CCHMP confirmed this via live-navigation of FIM.

The incident investigation procedure I(A)-6 includes steps to classify the actual and potential severity of incidents using the Downstream Manufacturing (DSM) Risk Assessment Matrix (RAM) in Attachment A of the procedure. The RAM matrix defines severity on a scale of 0 to 5 (5 being most severe), and likelihood on a scale of A to E (E being more likely). The consequences are defined for each severity level for the following categories: People, Assets, Environment, and Reputation. CCHMP notes that incidents classified as 3 or higher for severity using RAM would likely be a CalARP-qualifying incident. Per the procedure, appropriate level (Level 1, 2, or 3) and method of investigation (Causal Learning, TOP, Tech Study, etc.) is determined based on the incident classification. These levels and methods are defined in the procedure.

CCHMP notes that Level 3 is the highest level of investigation used at the stationary source that is intended to define the root causes of the incident, and may take multiple weeks to complete. Level 3 investigations could use the Causal Learning methodology or a root cause analysis (RCA). Level 2 investigations typically take 1-2 weeks and could be a Tech Study or a combination of TOP and Causal Learning (TOP/CL), where TOP (triangle of prevention) is an investigation technique used by USW workers. CCHMP was informed that a Tech Study is typically used for incidents that involved an equipment failure, and TOP/CL is used to for incidents that involved a human element and is a causally reasoned method that uses a timeline and cause/effect diagram to identify causes.

Per the incident investigation procedure, MCARs will be investigated with a root cause methodology (Level 3 investigation), and potential MCARs will be investigated with either Level 2 or Level 3 investigations. Per interview with SME, catastrophic releases would be investigated using a Level 3 investigation, and near miss catastrophic releases could be investigated using Level 2 or 3 investigations depending on the incident.



CCHMP reviewed a list of incidents and near misses since the previous CalARP/ISO audit (May 2015 to March 2018) maintained in FIM (about 1000), and lists tracking open and closed investigations over this time period. One list has closed out investigations from 8/17/15 to 8/16/17. CCHMP notes that this list includes 19 total incidents indicating if classified as MCAR, or potential MCAR. The incidents are classified as follows: one MCAR, 4 potential MCARs, 14 blank/other. CCHMP notes that none of these qualify as major incidents/potential major incidents since they occurred before 10/1/17. The second list has open investigations from 9/7/17 to 2/12/18 (9 total, 4 potential MCARs, 5 blank/other). CCHMP notes that 3 of the potential MCARs and two of the other incidents occurred after 10/1/17, meaning these could qualify as major incident/potential major incidents. The stationary source should reassess incidents that occurred after 10/1/17 for major incident and potential major incident applicability, and conduct an RCA for these incidents using appropriate employee participation if they qualify. Additionally, CCHMP notes that 3 of the potential MCARs are being investigated using a Tech Study Level 1 investigation, which is not consistent with the procedure which says a Level 2 or 3 would be used.

CCHMP was informed that only the closed investigations have a completed report for review. CCHMP reviewed a sample of 6 investigation reports for the following incidents (including dates incidents occurred and investigation methodology used):

1. F44 Tube Leak (4/26/16); CL Level 32. FXU Tubing Failure and Release (8/16/17); TOP/CL Level 33. Loss of SP2 Sulfur Seal #2 (1/11/17); TOP/CL Level 24. HCU TA H2S exposure (100 ppm) (5/2/17); TOP/CL Level 25. Tier 1 Release of Antioxidant and Gasoline (3/28/17); TOP/CL Level 26. Loss of Power to Substations 1203 & 1206 (12/19/16); TOP/CL Level 2.

Per the closed investigation tracking list, incident 6 was classified as an MCAR, and incidents 2-5 were classified as potential MCARs. Per SME interview, incident 1 should have been classified as a potential MCAR.

CCHMP identified that the MCAR incident was investigated using a Level 2 investigation, which is not the appropriate level as required per the incident investigation procedure (Level 3). See questionnaire A57 for more discussion on this MCAR investigation report.



CCHMP was informed that no catastrophic releases have occurred at the stationary source since the previous CalARP/ISO audit. Upon review of the incidents entered into FIM, CCHMP was unable to identify any catastrophic releases.



A45-07 Does the RCA incident investigation report include the following:a) Date and time of the incident;b) Date and time the investigation began;c) A detailed description of the incident;d) The factors that caused or contributed to the incident, including direct causes, indirect causes and root causes, determined through the root cause analysis; e) A list of any DMR(s), PHA(s), HCA(s), and Safeguard Protection Analyses (SPA(s)) that were reviewed as part of the Investigation; f) Interim recommendations to prevent a recurrence or similar incident; g) Recommendations for permanent corrective action [T19 CCR §2762.9(i)]h) Whether the cause of the incident and/or recommendations resulting from the investigation are specific only to the process or equipment involved in the incident, or are applicable to other onsite processes or equipment? [ISO Section 450-8.016(a)(9)(D)]

Ensure that MCAR investigation reports include at a minimum all elements required per the stationary source incident investigation procedure, I(A)-6/EM-11.1, or modify the procedure.

Updated Incident Investigation procedure I(A) – 6 to include elements.

ClosedPer CCHMP review of the 2016 MCAR investigation report (i.e., Loss of Power to Substations), the investigation began within 48 hours of the incident. The report also included recommendations, see A57-04 for more details.




CCHMP identifies that the incident investigation procedure should be revised to include elements a-g of this question. It is suggested that elements a-j in section 2750.9(b) be included in the RCA report for a major incident, or incident that could have reasonably resulted in a major incident.



A45-12 Has the report been provided to and, upon request, reviewed with employees whose job tasks are affected by the incident and made available to operating, maintenance, and other personnel whose job tasks are relevant to the incident findings, including contractor employees where applicable? [T19 CCR §2762.9(k) & ISO Section 450-8.016(a)(9)(F)]

Ensure that MCAR/potential MCAR investigation findings are reviewed with all affected personnel whose job tasks are relevant to the incident findings, including contract employees where applicable, and that this review is documented.

The incident investigation process will be updated to meet the regulatory requirements for reviewing investigation findings with affected personnel whose job tasks are relevant to the incident findings, including contract employees. This will include a way to document which personnel the findings were shared with and how/where to retain that documentation.

12/15/2019Per interview with SME, learning sessions are used to report out incident investigation findings to personnel, however these learning sessions may not be consistently done for CalARP/ISO qualifying incidents and may not include all affected personnel whose job tasks are relevant to the incident findings including contract employees where applicable. These learning sessions are also not consistently documented.






A47-05 Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job including, but not limited to, the following: a) The potential hazards related to their job;b) Applicable refinery safety rules;c) And in the applicable provisions of the owner or operator’s emergency action pland) And the requirements of HSC Section 25536.7? [T19 CCR §2762.12(c)(1) & ISO Section 450-8.016(a)(11)]

Ensure that SMR revises their contractor auditing process to encompass all contractors working on or near a covered process.

Site will revise contractor auditing program to meet the Program 4 requirements.

4/30/2020Per review of Procedure I(A)-42, section 6.6.2 SMR Contractor PSM Audit and Record Review, the procedure states that no fewer than 12 contractors (including routine, turnaround, and projects) who work on a covered process shall be selected and audited using the Contractor HSSE PSM Audit checklist.


The evaluation sheet lists the company name and the SMR Contract Owner and Contract Holder. SMR audited 12 contractors in 2017, 12 in 2016, and 12 in 2015 for a total of 36 contractors. Per the list generated by procurement, there are a total of 70 contractors listed as HSSE high risk, 20 listed as HSSE Medium risk and 94 listed as HSSE Low risk. The list provided by the procurement group has 54 contractors that are not part of the HSSE group. SMR will need to modify their process as any contractor working on or near a covered process is subject to the contractor auditing requirements. CCHMP found a different issue during the previous audit. Although it is not a regulatory requirement to modify the contractor policy, SMR is encouraged to revise Procedure I(A)-42 so that it focuses on auditing all contractors that come onsite including the medium and low risk contractors.






A48-11 Does the emergency response program include training for all employees in relevant procedures and relevant aspects of the Incident Command System? [T19 CCR §2765.2(a)(3) & ISO Section 450-

Ensure that What-If and Red-Tag drills are completed as specified in policy C(A)-24 or modify the policy. (This is a modified repeat)

C(A)-24 to be modified to match current site practices.

12/15/2019Section 2.2 of EM-2.2 defines the various levels of emergency response training for refinery personnel including a list of required knowledge that a person must demonstrate competency in for each level. The defined levels are as follows:

- First Responder Awareness Level (maintenance personnel, engineers, other technical staff with field duties) - qualified to identify hazardous substance releases and notify proper authorities.

- First Responder Operations Level (lab technicians, lab foremen, operators, and operations foremen) - qualified to respond to releases defensively and from a safe distance, as part of the initial response efforts.

- Hazardous Materials Technician (basic fire crew (BFC), auxiliary fire crew (AUX), trauma/emergency medical team (TIGER), high-angle rescue (SHARC), and health and safety inspectors) - qualified to respond to releases in order to stop the release.

- Hazardous Materials Specialist (response action team (RATs)) - qualified to respond with and provide support to Hazardous Materials Technicians and have specialized knowledge for responding to various substances/chemicals.

- On Scene Incident Commander (Safety Supervisor, RSL, or Sr. Safety Inspector) - qualified to assume control of the scene at the incident.

Attachment 1 of EM-2.2 includes the training requirements for emergency response team which includes BFC, AUX, TIGER, SHARC, and RAT.

CCHMP was informed that the emergency response team at the facility is completely made up of volunteer site personnel. The team has about 150 personnel from various departments and shifts throughout the refinery. The stationary source maintains a spreadsheet of responders indicating their name, department, team #, response qualifications, truck assignments, and completed training for each quarter. CCHMP reviewed the training spreadsheet for 13 personnel on the emergency response team with various qualifications. The spreadsheet indicates responder availability based on completion of medical clearance and training requirements. CCHMP was informed per SME that if required trainings have not been completed, that responder is on the "unavailable" list meaning that they cannot be called to respond until they have completed required training. CCHMP notes that the


ID# Question Actions Proposed Remedy Due DateFindingsspreadsheet indicates responder availability for each quarter of the year (from 2017 to Q1-2018).

Per the spreadsheet, 3 of the 13 responders were indicated as unavailable at least one of the quarters in 2017. CCHMP notes that all members qualified on the BFC and/or AUX fire crew (12 of the 13 reviewed) have completed the Texas A&M Fire School (TEEX). CCHMP notes that the spreadsheet indicates when the next TEEX training is due for each person. EM-2.2 requires that TEEX training be completed at least every 3 years. CCHMP notes that the next due date for TEEX for the 12 personnel qualified on the BFC and/or AUX goes past this three year requirement, however these trainings are not yet due (2019-2021). CCHMP was informed per SME interview that there are only a couple TEEX trainings scheduled per year, so the requirement is that the TEEX training be completed by the end of the third calendar year. CCHMP believes it would be beneficial to revise EM-2.2 to reflect this practice.

CCHMP also reviewed printouts from the site training tracking software, SOU, for 3 of the 13 responders on the spreadsheet from 2015-current. One member is qualified as AUX, SHARC, and TIGER. The second member is qualified as AUX, SHARC, TIGER, and RAT. The remaining member is qualified as AUX, BFC, and SHARC. Per review of the SOU records, each member completed BFC and AUX training, and annual fire extinguisher hand-on annual training. CCHMP notes that each person completed the required annual SHARC refreshers.

CCHMP also reviewed training records from SOU for 3 maintenance personnel and noted that each completed Incident Command System training.

CCHMP was also informed that the stationary source conducts various drills to train operators on emergency operating procedures and assess the effectiveness of the site ERP and emergency response team. The stationary source completes 3 types of drills related to emergency response: Red-Tag, What-If, and Emergency Response drills. Per interview with SME, the Emergency Response drills involve exercising scenarios with the emergency response (ER) team in various areas of the refinery. CCHMP was informed that the scenarios are determined based on a list of 13 pre-defined scenarios including goals and objectives for each. Some examples include: vapor cloud explosion resulting in fire, earthquake with leak resulting in fire or toxic vapor release, medical and rescue response, loss of primary containment (LOPC) resulting in leak/spill, etc. Per interview with SME, the drills are conducted quarterly and if an incident actually occurs


ID# Question Actions Proposed Remedy Due DateFindingswhere the ER team is activated, then that response is used to satisfy the quarterly drill for that quarter. Per interview with SME, these quarterly drills/actual responses are documented in an excel spreadsheet. CCHMP reviewed the spreadsheet for 2015-2018 that indicates the following: year, quarter, date completed, and specific emergency response elements, situations, medical, environmental, and security aspects to test during the drill. CCHMP notes that ER drills have been completed on a quarterly basis. The remaining ER drills for Q2, Q3, and Q4 of 2018 identify the planned scenarios and elements that will be evaluated.

Per SME interview, Red-Tag and What-If drills are more focused on operations emergency response. The requirements for conducting these drills are specified in C(A)-24 Emergency Procedure and Abnormal Situation Drills Policy (rev. 3, dated June 2015). CCHMP reviewed this policy which defines types and required frequencies of drills including Abnormal Situation (What-If), and Emergency Procedure (Red-Tag). Per the policy, What-If drills involve scenarios based on plant upsets (could be past or current) that are typically created by personnel in the unit (e.g. Sr. Production Specialist, Shift Team Leader (STL), Operator, etc.) CCHMP was informed that these drills could be conducted in the field, as a table-top, or a combination. Red-Tag drills involve exercising emergency operating procedures in the units.

Per SME interview and C(A)-24, each operating Team (1-4) will complete a minimum of one What-If drill and one Red-Tag drill each month, and within a 3-year period all operators must complete drills for all emergency procedures associated with the units they are qualified to operate. The policy indicates that each drill will be documented to identify that it has been completed as scheduled. CCHMP was informed that documentation of completed What-If and Red-Tag drills are managed by each department in the refinery (e.g. OPCEN, DCD, etc.).

CCHMP reviewed documentation for completed What-If and Red-Tag Drills for OPCEN and DCD for 2015-2018. Reports are documented by year and department and include the following information: drill number, drill description, due date (month and year), date completed, teams, team leader, and What-If. The drill description column includes a list of emergency procedures drilled on, and the What-If column has a brief description of the scenario completed for each Team. Per CCHMP review, from Jan 2015- Feb 2018, 152 of each What-If and Red-Tag drills should have been completed for each department (based on the at least one per month requirement for each of the 4 Teams).

CCHMP notes that the OPCEN report is divided into 2 parts:


ID# Question Actions Proposed Remedy Due DateFindingsOPCEN North, and OPCEN South. Per CCHMP review the following gaps were identified for each department:

1. OPCEN North: 18 What-If and 5 Red-Tag drills were not completed, and of the drills that were completed, 42 were completed past the due date (ranging from a couple weeks to months).

2. OPCEN South: 20 What-If and 3 Red-Tag drills were not completed, and of the drills that were completed, 47 were completed past the due date (ranging from a couple weeks to months).

3. DCD: 26 What-If and 17 Red-Tag drills were not completed, and of the drills that were completed, 3 were completed past the due date (ranging from a couple weeks to months).

CCHMP issued an ensure item in A28-10 during the previous CalARP/ISO audit regarding gaps in completing What-If and Red-Tag drills required per C(A)-24, which has not been addressed. As such, CCHMP has re-issued a modified repeat ensure item in this questionnaire.



A49-29 Does the owner or operator implement and document an effective Stop Work Procedure that ensures:a) Employees, and employees of contractors has authority to refuse to perform a task where doing so could reasonably result in death or serious physical harm;b) Employees, and employees of contractors has authority to recommend to the operator in charge of a unit that an operation or process be partially or completely shut-down, based on a process safety hazard; and,c) The authority of the qualified operator in charge of a unit to partially or completely shut-down an operation or process, based on a process safety hazard? [T19 CCR §2762.16(f)(1) & (g)]

Ensure that the draft Stop Work Procedure I(A)-70 is finalized, issued and that both contractors and employees are made aware of the policy.

I(A)70 Stop Work Procedure was issued on 3/31/18. Employees and Contractors were made aware of the policy through various means including notification in the Martinez Minute, L4GZ, SCUFs and Lunch and Learns.

ClosedCCHMP reviewed a draft Stop Work Procedure (I(A)-70, rev. Jan., 2018) which states that the procedure ensures that "all employees and contractors have the authority to stop work when they believe a condition exists that places themselves, their co-workers, the environment, or our community at risk, or could adversely affect the safe operation of our workplace." And that "Stop Work Authority (SWA) and Intervention are core principles, and necessary activities to support the Shell Martinez Goal Zero values."

Section 6.4 address 'non-operational work or activities stop work authority' for the individual to notify the SMR employee responsible for the area of concern. If the communication to the reporting party did not fully address the initial concern, there is a dispute resolution process in section 6.5. If the determination was made to shut the work activity, it can only be restarted in the conditions in section 6.6 has been met.

Section 6.2 address 'non-operator seeks stop work authority of process unit' for situations where any non-operations person requests SWA for perception of an operating unit or equipment that could reasonably result in death or serious physical harm has the authority to recommend to the unit operator to shutdown part or all the unit. Then follow the steps in section 6.3.

Section 6.3 address 'unit operator seeks stop work authority for own process unit' and unit operator shall consult with shift team leader (STL) if action has been taken or if further consultation is necessary. STL shall notify refinery safety leader (RSL) and refinery team leader (RTL) of the action. The unit operator of the unit in question should be included in the resolution. The unit or equipment shall only be restarted if the conditions in section 6.6 has been met.

Section 6.6 specifies that there needs to be agreement from the unit operator of the unit in question, the unit's STL and the RTL and completion of the Pre-startup safety review for operating process. For non-operational work, the RSL shall ensure the work is safe to restart.




Ensure that the human factors program is modified to incorporate the following into appropriate evaluations keeping in mind employee participation requirements: the complexity of tasks and contractor fatigue.

Site wide LCC checklist and process specific checklists (MOOC, PHA, Incident Investigation, and Procedures) were updated (as applicable) to include questions on the complexity of tasks and contractor fatigue. The 5-year facility wide LCC review included these questions.

ClosedCCHMP reviewed the facility's Policy for Management of Overtime Limits, G(A)-28 (revised July 2017, rev 7). The policy identifies the maximum number of days and hours an employee may work during normal operations and during outages. The policy covers both 12-hour and 10-hour shifts. For example, if working a 12-hour shift during normal operations, the limit is working 7 consecutive days or nights; if working 12-hour shift during an outage, the limit is 14 consecutive days or nights.



CCHMP reviewed completed LCCs from the following PHAs completed in 2016: Pentane Storage, Distillate Hydrotreating Unit, Delayed Coker, Distillate Saturation Unit, Sulfur Recovery Unit #4. CCHMP observed LCC questions related to a number of the items listed in the question. CCHMP was unable to locate questions related to task complexity or contractor fatigue.



CCHMP reviewed LCCs associated with operating and maintenance procedures. Similar to previously described, CCHMP


ID# Question Actions Proposed Remedy Due DateFindingsobserved questions related to a number of the items listed in the question although was unable to locate questions related to task complexity or contractor fatigue.

CCHMP was informed that part of the Contractor HSSE PSM audit process, a question is asked regarding contractor fatigue. The question asked is "Does your company have a system for tracking compliance to API RP 755 (Fatigue Management Policy)?" CCHMP was informed this is relatively new question, as it started to be asked during Contractor HSSE PSM audits in 2016. CCHMP was also informed that approximately three years ago Shell developed a macro to sample contractor hours submitted for payment to get a feel for their compliance with Shell's fatigue management policy. Timekeepers at Shell have run the macro in the past and it occasionally highlighted individual contractors that exceeded the fatigue policy. Contract Holders were subsequently informed and asked to check with the contracting company to bring this to their attention. CCHMP was informed that the use of the macro was not a requirement nor part of the Timekeeper's normal work process and it is currently not being used.




A50-08 Does the Stationary Source ensure that employees who completed the latent conditions checklist AND appropriate members of management review and sign off that the checklist was appropriately applied? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

Ensure that appropriate members of management actually review the completed PHA and Facility-Wide LCCs to make sure they were appropriately applied as well as the LCCs have signatures from both management and representative employees.

Internal PHA facilitator guidance document updated to ensure that LCC concerns raised are resolved prior to management signature via action taken, recommendation created or further review and determination that not applicable.

Facility wide LCC (5 year review) was completed and signed by management and employee representatives.

ClosedPHA:CCHMP confirmed for each of the PHAs reviewed (listed in A50-02), that documentation was maintained (e.g., names, titles, dates, and signatures) of employees who completed the PHA LCC and managers who approved the LCC.

CCHMP observed several items listed in one of the PHA LCCs, Distillate Hydrotreating Unit PHA, that identified potential human factors concerns and CCHMP was unable to locate any corrective actions for them. For example: -- "Labeling isn't always clear in the field. Unit is 20 years old, labels are starting to fall off", -- "Tag names for some alarms are ambiguous", -- "There are a couple instruments that have been broken for some time".

In addition, for the DSU PHA LCC, it was identified that old style start/stop switches exist and have different switch positions from newer switches. The LCC identified the older switches were "marked in the field to avoid confusion". The LCC further identified the situation was okay by operations.

CCHMP was informed that for the PHA LCCs described above with potential issues, the PHA scribe wrote items down in the LCC as the group discussed them although the team did not identify these items as concerns to be corrected. In reviewing the items with site personnel, CCHMP recognized that not all of the items listed in the LCC may have been cause for concern and needed a PHA recommendation for correction. Nevertheless, management is suppose to review the completed LCCs to verify they were appropriately applied. Listing items like instrumentation being broke for some time should have triggered some type of comment or response and included identification that work orders or something was done to address the issue.

CCHMP also observed that 3 of the 5 PHAs initially reviewed used old versions of LCCs dated 2005 (i.e., Distillate Hydrotreating Unit, Delayed Coker, Distillate Saturation Unit) even though the PHAs were performed in 2016 and the LCCs were revised in 2013. The PHA Coordinator is responsible for reviewing the PHA LCCs and typically would be making sure the correct LCC was used. CCHMP was informed that there was a transition of PHA Coordinator leads at the time these PHAs and LCCs were completed and there was some miscommunication.

Procedures:CCHMP reviewed the process used by operations to create and


ID# Question Actions Proposed Remedy Due DateFindingsrevise operating procedures. For every new or revised operating procedure a "Review Transmittal" accompanies the procedure. This form includes signatures of operators who completed the LCC along with managers who approved the changes made to the procedures and verification that the LCC was completed properly. CCHMP reviewed a number of modified procedures from the DCU and confirmed that LCCs were completed, along with the modified procedure along with the Review Transmittal form. The process followed was consistent with A(A)-32 Controlling (Reviewing/Revising) Operating Procedures policy.

For maintenance procedures the process was found to be slightly different. During CCHMP's previous 2015 audit, the facility reviewed their maintenance activities and only found one maintenance procedure that needed to have a human factors evaluation. This procedure was reviewed and signed off by maintenance employees as well as maintenance management and documented in the revision history of the procedure. This procedure has not changed so no additional LCC review of it has occurred. For the 2018 audit, the facility modified their process for evaluating human factors evaluations on maintenance documents (i.e., policy A(A)-37)) and started implementing it while CCHMP was onsite. Maintenance documents include the one maintenance procedure, a number of work instructions, maintenance policies and maintenance guidance documents. The total number of these maintenance documents is roughly estimated to be around 200. Also, CCHMP was informed A(A)-37 will apply to engineering Instrumented Protective Function (IPF) procedures, which there are approximately 400 of them. The process for reviewing all maintenance documents, which now is in the neighborhood of 600 documents, includes a Decision Tool to determine which one of three LCCs should be used with which maintenance document. Unfortunately, this process had not produced any documentation for CCHMP to review during the audit. A(A)-37 includes a transmittal form very similar to that used by operations to include signatures of those who completed the LCC along with managers who approved the changes made to the procedures and verification that the LCC was completed properly.

Incident Investigations:CCHMP reviewed several completed investigations (listed in A50-06). Each investigation included a management sign-off form that included manager/sponsor signatures as well as facilitator/trainer participants.

Facility-Wide:CCHMP was informed that the facility-wide LCC was completed in March 2013 and included members of management on the team


ID# Question Actions Proposed Remedy Due DateFindingsas well as represented employees. CCHMP was informed there was not any official management or represented employee sign-off on this LCC.



A50-10 Does the Stationary Source ensure a formal "feedback" loop is developed to inform personnel of the recommendations from the checklist and to ensure that the recommendations developed will adequately address the concerns? [Section B: Chapter 3.2 of the CCHMP Safety Program Guidance Document]

Ensure that a formal feedback loop is developed associated with the Incident Investigation process to discuss concerns identified on the latent conditions checklist with the employees involved along with the resulting proposed corrective actions and that this is documented.

The incident investigation process will be updated to include a method for the incident investigation team members to have input to action items via a feedback loop.

1/31/2020PHA:CCHMP was informed that the PHA Coordinator maintains a spreadsheet that tracks the closure of all PHA recommendations. This spreadsheet also highlights which PHA recommendations came from a PHA LCC question in order to remind personnel that an email must be sent to affected personnel (i.e., the PHA team) to specifically ask for feedback on the effectiveness of the resolution. CCHMP reviewed copies of emails sent to affected personnel and team member's responses identifying the issues were adequately resolved.

Procedures:CCHMP interviewed individuals assigned as Mentors (e.g., responsible for writing procedures and training operators in the units). Mentors are assigned the role of revising existing and developing new operating procedures in conjunction with completing the human factors LCCs. CCHMP was informed that operating procedures are reviewed on a set frequency and involve the Mentor first reviewing the procedure and completing a LCC, then a qualified operator (i.e., Content SME) is assigned to review the proposed modifications and documented LCC. CCHMP confirmed this practice through operator interviews and if the procedure was inaccurate, Content SMEs would mark the procedure up as appropriate to make sure it is properly modified. As described in A50-09, each operating procedure LCC should have an answer of "yes" or "N/A" so rarely does a Content SME have comments on the actual LCC.

Similar to that described in A50-08 and A50-09, the process used to evaluate maintenance documents will include a feedback loop for select represented maintenance employees to be a document's "Content SME" although the Maintenance Department might not use that exact term. That "Content SME" will be involved with the maintenance document review and LCC review.

Incident Investigations:CCHMP reviewed three incidents that included LCC evaluations. These incidents are described in A50-09. For the investigations reviewed, CCHMP found that the facility mapped each LCC concern to an incident investigation recommendation and this process typically is done by a Solutions Development Team, which is different than those who participated in the LCC. Per SME interviews, CCHMP was informed that the investigation team has been sent emails after completion of the investigation to read over and sign off on the process. As discussed during the audit, CCHMP does not treat email communication as an effective two-way communication tool. Additional effort is needed to make sure


ID# Question Actions Proposed Remedy Due DateFindingsthat those involved with completing the LCCs understand how issues are proposed to be resolved and to get their input.


A50-14 Did the owner or operator include a written analysis of human factors where relevant in the design phase of a major change, MOOCs, HCAs, incident investigations and PHAs? [T19 CCR §2762.15(b)]

Ensure that a process(es) is developed to analyze for human factors issues keeping in mind employee participation requirements associated with: 1) design phase of a major change, and 2) HCAs and ISSAs.

C(A)-15 MOC process will be updated to include considerations for Human Factors for Major Changes. I(A)43 HCA/ISS process will be updated to clarify that human factors are considered during the HCA process. I(A)-15, Human Factors, was updated, to include this information also.

12/15/2019Design Phase of a Major Change:The facility has not developed a process to analyze for human factors issues associated with the design phase of a major change. This is one of the new Program 4 requirements.

MOOCs:CCHMP was informed that the facility developed a customized LCC for MOOC from the County's original LCC. The questions selected are listed in the facility's master LCC spreadsheet that shows what questions are used for what customized LCCs. The facility also follows the County's SP Guidance and has adopted the MOOC checklists listed in Attachment B. This is further described in A54-05.

HCAs:The facility has not developed a process to analyze for human factors issues associated with HCAs or ISSAs.

Incident Investigations:As described in A50-02 and elsewhere in this questionnaire, the facility developed customized LCCs and has used them to evaluate latent conditions within qualifying MCAR incidents. As described in A45-01, the facility has not incorporated Major Incident Program 4 requirements into their incident investigation process.

PHAs:As described in A50-02 and elsewhere in this questionnaire, the facility developed customized LCCs and has used them to evaluate latent conditions within PHAs.




Ensure SPA is performed for PHA scenarios where there is a potential for major incident.

Ensure the CO Boilers and CGHT PHAs are reviewed for any additional scenarios where a safeguard protection analysis may need to be completed.

Update the PHAs completed after CalARP Program 4 came in to effect (10/01/2017) that do not include LOPAs for each scenario where there is a potential for a major incident.

Updated PHA procedure C(A)-50 to reflect the requirement to perform a Safeguard Protection Analysis (SPA) – Layers or Protection Analysis (LOPA) in SMR – for each scenario where there is a potential for a major incident. (complete)

4/30/2020Per CCHMP review of 7 PHAs conducted between 2015 and 2017, each of the PHAs included a LOPA analysis. Per interview, SMR uses LOPA as the method for performing a safeguard protection analysis.







Ensure SPA documentation includes the necessary maintenance and testing required to ensure that all IPLs function as designed.

Update PHA procedure (I(A)-50) to reflect the requirement of documenting, in the PHA report, the necessary maintenance and testing required to ensure that all Independent Protection Layers (IPLs) function as designed.

SPA documentation (i.e. safeguards) is translated to a unit "HEMP CE list," which will contain the "critical activity" for each HEMP CE.

An addendum will be added to PHAs that’s require an update.

4/30/2020Per CCHMP review of 7 PHAs, the SPA (using LOPA) is incorporated into the PHA report. The PHA worksheets include columns for the LOPA (safeguards, verification, probability of failure on demand, LOPA analysis, recommendations, and comments).





SMR has clearly defined conditions that are acceptable to be used and when. For example for initiating events related to human error the team has to take into consideration the skill of the craft and when the task is done. Another example is that probability of explosion can be used as a conditional modifier and control of ignition sources can be used for certain rates of release and distance from the ignition source. Another commonly used event frequency that is clearly defined in the DEP is for general human error probabilities where the event frequency is determined by the human error * number of critical steps * opportunities/year


Per CCHMP review, the written reports for the two LOPAs conducted after the P4 regulations became effective did not


ID# Question Actions Proposed Remedy Due DateFindingsinclude necessary maintenance and testing to ensure all Independent Protection Layers (IPL) function as designed.




Ensure that an LCC is completed to consider human systems for each investigation of an MCAR and potential MCAR, as required per the incident investigation procedure.

Incident Investigation Procedure I(A)- 6 was enhanced to ensure human systems in incidents will be reviewed. Incidents will be reviewed to determine in they were potential MCARs and if necessary, appropriate human systems evaluations will occur.

12/15/2019As mentioned in A45-01, the Incident Investigation Procedure: I(A)-6/EM-11.1 Investigations and Incident Reporting (rev.15, dated Sept 2016) includes requirements for investigating Major Chemical Accidents or Releases (MCARs) and incidents that could have reasonably resulted in a MCAR, but not major incidents or incidents that could have reasonably resulted in a major incident. See A45-01 for more discussion on this topic and related ensure item.




Potential MCARs:

1. FXU Tubing Failure and Release (8/16/17)2. Loss of SP2 Sulfur Seal #2 (1/11/17)3. HCU TA H2S exposure (100 ppm) (5/2/17)4. Tier 1 Release of Antioxidant and Gasoline (3/28/17)

MCAR event:







Ensure to review the operating procedures to identify possible inclusion of actionable steps in caution or support statements that need to be placed as procedure action steps.

Ensure to review the operating procedures for correct placement of caution/ notes statements.

Review and revise as necessary A(A)-32 Controlling Operating Procedures and add additional question to ensure that this is addressed. Ensure that this item is included in the Procedure Writer’s Training curriculum. Mentors will review and correct individual procedures as needed during the normal 3-year review process.

Procedures that were walked down with CCHMP will be reviewed and addressed as needed.

4/20/2020Procedure A(A-32): Controlling (Reviewing/Revising) Operating Procedures, dated Nov. 2016 addresses the steps to edit, review and revise procedures and what position is responsible for these reviews. The purpose of this procedure is to establish the requirements for controlling, reviewing and revising operating procedures (including Work Instructions) in accordance with MOC requirements. The procedure has several requirements including a functional review, a technical review, a compliance review including the use of Latent Conditions Checklist, preliminary and final review and approval, a final edit review and placing the document into the controlled system.


Based on a review of the referenced procedures and the procedure walks completed, CCHMP noted the following concerns:- Some of the procedures include caution statements or supporting information with actionable steps that need to be corrected to the procedure action steps. An example is a note in Procedure DHT-4115 that has been added as a result of a DHT PHA action item implementation that indicates "Without wash water from stripped sour water or condensate from utilities, corrosive ammonia salts will build up quickly in the circuit, for this reason It is recommended that the Corrosion Materials Engineer be notified anytime DHT loses wash water." This supporting information includes an actionable step that needs to be placed into the procedure steps.- The placement of caution statements also need to be reviewed to make certain that they are placed before the applicable process step rather than steps away from the applicable process step (e.g., SR4-2101).







A56-07 Does the facility provide employees and their representatives with specialized refresher training on an as needed basis? [Section B: Chapter 9.3 of the CCHMP Safety Program Guidance Document]

Ensure that specialized latent conditions checklists (LCCs) training associated with PHAs and qualifying Incident Investigations are performed and documented prior to completion of the LCCs.

Ensure that refresher training is provided to Content SMEs on completing the latent conditions checklists used when creating and revising operating procedures.

Ensure that initial and refresher training is provided to appropriate maintenance employees on completing the latent conditions checklists for maintenance procedures associated with the Create and Revise Maintenance Procedures policy, A(A)-37.

PHA Facilitators will be retrained on the PHA Facilitator Checklist and the importance of accurate date recording for LCC training.

Update the E-Learning course for Procedure Writers to contain information on applying Latent Conditions Checklists to Operating Procedures. Also, ensure that this course is assigned to all Mentors and Hourly Content SMEs.

Ensure that Maintenance Procedure Writers attend the F2F Procedure Writer Workshop and subsequent refresher electronic – learning. Training material to cover LCC. A(A)-37, to be revised as needed.

12/15/2019CCHMP reviewed specialized training associated with completing LCCs for PHAs. CCHMP reviewed a total of 7 PHAs. CCHMP found the following training documentation discrepancies:-- DSU PHA LCC training was documented 9/14/16 and the completed LCC was dated 9/12/16 - Further review of the PHAWorks software identified the training actually took place on 9/12/16 and the training sign-in sheet was improperly dated-- SRU4 PHA LCC training was documented 7/12/16 and the completed LCC was dated 7/11/16 - Further review identified the training actually took place on 7/11/16 and the training sign-in sheet was improperly dated-- DHT PHA LCC training was documented 8/29/16 and the completed LCC was dated 7/26/16 - no additional documentation was found on the date of the LCC training-- DCU PHA LCC was identified as completed by five people although only four were listed on the LCC training just in time training sheet. LCC training was performed on the same day as the LCC completion, 8/8/16.

CCHMP reviewed specialized training associated with completing LCCs for Incident Investigations. As described in A52-01, the facility had 5 events that were classified as potential MCARs (Major Chemical Accidental Releases) and 1 MCAR since the previous CCHMP audit. The facility only completed LCCs for 2 of the potential 5 MCARs and the 1 actual MCAR. CCHMP issued an ensure action item in A52-01 to complete the additional LCCs. CCHMP reviewed the specialized LCC training for the 2 potential MCARs and the 1 actual MCAR. -- Tier 1 Tubing Failure Release of Gasoline, potential MCAR event took place on 3/28/17. LCC training was not performed as both individuals who completed the LCC were trained incident investigation facilitators knowledgeable in human factors and LCCs. There was no date listed on the LCC.-- FXU Debut Temporary Facilities Tubing Release, potential MCAR event took place on 8/16/17. The LCC training form identified just in time LCC training occurred on 9/18/17 although trainee's identified their training took place on 2/27/18. CCHMP was informed that the training took place on 9/18/17 although it was not documented. There was no date listed on the LCC.-- Loss of Electrical Power to Subs 1203 and 1206, actual MCAR event that occurred on 12/19/16. LCC training was performed on 12/22/16, the same day as listed on the completed LCC.

CCHMP discussed just in time training with three Mentors. CCHMP was informed that mentors work with Content SMEs on revising and updating operating procedures. Mentors provide Content SMEs with initial training on LCCs. This training was the


ID# Question Actions Proposed Remedy Due DateFindingssame training as provided to the Mentors, which included training on how to write procedures as well as using LCCs. Mentors document this training with Content SMEs using sign-in sheets. CCHMP was informed that subsequent training is provided through SOU through the Latent Conditions Checklist course. CCHMP was unable to confirm that the Latent Conditions Checklist course has been assigned to any of the Content SMEs or any other employee. As such, some of the Content SMEs are not being provided sufficient specialized refresher training on LCCs.

During CCHMP's previous audit, the facility had used a LCC to evaluate their maintenance operations and found one procedure, Rodout Device, met the requirement to perform a human factors evaluation. At that time personnel received just in time training on using a LCC. For this audit, CCHMP was informed that the facility revised their practice on performing human factors evaluations on maintenance procedures and expanded that to all maintenance documents. The following maintenance policy was recently revised to describe this process: Create and Revise Maintenance Procedures policy, A(A)-37 (revised February 2018, rev 3). This policy includes three LCCs to be used depending on the ranking of the maintenance document to be reviewed. CCHMP was informed that this policy was issued while CCHMP was onsite although it has not been fully implemented. Training on the new policy has not occurred, nor has there been any training on the newly created LCCs associated with the policy. CCHMP was informed that the facility is working on developing the just in time LCC training for this policy and intends to borrow from the training provided for LCC reviews of operating procedures, incident investigations and PHAs.

CCHMP was informed that the facility provided just in time training to the team involved with completing the facility-wide LCC completed in December 2013. Documentation of this training was maintained. The next facility-wide assessment will occur by the end of 2018.



A57-05 Is the Root Cause Analysis method one of the recommended methods from CCPS or was it reviewed by CCHMP to determine substantial equivalency? [ISO Section 450-8.016(c)(1) and Section C.2.2.1 of the CCHMP Safety Program Guidance Document]

Ensure that the stationary source works with CCHMP to determine if the site RCA methodology is equivalent to CCPS recommended methods, and that CCHMP's determination is documented.

Site working with CCHMP to demonstrate equivalency of site method to CCPS recommended methods. Minor actions required.

4/30/2020As mentioned in A45-01, the MCAR incident was investigated using a Level 2 Causal Learning/TOP technique instead of the root cause analysis methodology (Level 3) that is required per the incident investigation procedure. See A45-01 for related ensure item.

Per interview with SME, the Level 3 RCA is no longer used at the stationary source. CCHMP was informed that the stationary source is moving toward using TOP/CL methodology for each Level of investigation (Level 1, 2, or 3), which will be reflected in the updated procedure that is currently in-progress. CCHMP notes that the Causal Learning methodology is not one of the recommended methods from CCPS and has not been reviewed by CCHMP to determine if it is equivalent to one of the approved methods. The stationary source needs to work with CCHMP to determine if the TOP/Causal Learning methodology is an equivalent RCA methodology.

A57-07 Does the owner or operator provide effective training to employees and employee representatives before serving on a RCA team sufficient to understand the methodology and tools expected to be used on the team, study concepts, process hazards, results and conclusions? [T19 CCR §2762.4(e)]

Ensure that training provided to investigation facilitators the RCA investigation methodology is documented.

Updated Incident Investigation procedure I(A) – 6 to include this requirement for individual investigations. Develop centralized program to manage all trained facilitator qualifications.

4/20/2020Per interview with SME, the 2016 MCAR investigation team consisted of 3 members, 2 which have been formally trained as facilitators for the investigation methodology used. CCHMP was able to review training documentation on the methodology for one of these members. The documentation included an email confirming participation in the training course and a picture of the class participants with names (dated 9/8/14). CCHMP was unable to review this documentation for the other member trained in the methodology.

CCHMP was informed that a just in time training was completed before the investigation began for the remaining member, however this training was not documented.




Ensure that a method is established to perform HCAs/ISSAs using appropriate employee participation for situations identified within the question related to a major incident.

Updated Incident Investigation procedure I(A) – 6 to include union representation when HCA/ISSAs are required.

ClosedCCHMP was informed that the facility has not made or proposed any major changes to their processes nor has there been any qualifying incidents / investigations since October 2017. Related to HCA documentation, there were no HCAs/ISSAs to review associated with question items b) through d). The facility had one MCAR event in 2016, but the RCA report did not identify any recommendations consistent with a major change. CCHMP was also informed that the facility currently does not have a method to track "major incidents" as personnel was led to believe through Cal OSHA discussions that tracking potential MCAR events would encompass all major incidents. Although similar, there is a difference between potential MCAR events and potential major incidents. Therefore, it is unclear to CCHMP whether the facility has performed HCAs when required.

CCHMP reviewed the facility's Inherently Safer Systems / Hierarchy of Control policy, I(A)-43 (revised February 2018, rev 7). This policy identifies that ISSAs are required in the development and analysis of PHA recommendations. Several items are noted on this policy that are either inconsistent with the Program 4 requirements or could assist with Program 4 compliance:-- "Major incident" is not mentioned in the policy-- "Highly hazardous material" is not mentioned in the policy-- "1st Order" and "2nd Order" inherent is not mentioned in the policy-- Program 3 CalARP regulations were cited in the policy instead of Program 4 -- Section 6.1 identifies that ISSA needs to be performed on major changes that could reasonably result in a MCAR. Program 4 requires HCA to be performed associated with a major change regardless of incident potential.-- Section 6.1 identifies that ISSA needs to be performed on incident investigations associated with actual or potential catastrophic releases of a regulated substance. HCAs are now required under Program 4 associated with major incidents instead of catastrophic releases.

CCHMP also noticed a discrepancy associated with policy I(A)-43 is it defines 'major change' that is consistent with ISS requirements but conflicts with Program 4. Currently, I(A)-43 defines major change as a "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". This is the same wording as listed in Contra Costa County's ISS Guidance Document for evaluating ISS for a "new process". Program 4 defines major change as, "(1) introduction of a new process, or (2) new process equipment, or new regulated substance that results in any operational change


ID# Question Actions Proposed Remedy Due DateFindingsoutside of established safe operating limits; or (3) any alteration in a process, process equipment, or process chemistry that introduces a new hazard or increases an existing hazard." CCHMP believes the current wording listed as major change in I(A)-43 should remain for ISO applicability for ISS, but needs to be modified to satisfy Program 4 HCA requirements.

CCHMP reviewed "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. This policy is used for evaluating new processes and projects for ISS consideration and is further described in A58-06. CCHMP found Program 4 requirement gaps in this policy similar to I(A)-43.





Ensure each HCA performed includes documentation of a top-down approach for listing the first order then second order inherent safety measures, and then, if necessary, passive, active or procedural risk reduction measures.

Develop HCA template to include documentation of a top-down approach (1st order, 2nd order, passive, active, and procedural) for risk reduction measures. Document which template is required for the program HCA in I(A)43 and reference the HCA template and I(A)43 in individual program procedures.

12/15/2019Existing Process:The existing process HCA/ISSA is completed during PHAs using an Inherently Safer System Checklist from the County's SP Guidance Document and is documented through the completion of the ISS checklist and PHA. CCHMP reviewed two PHAs: Catalytic Gasoline Hydrotreating Unit (completed in October 2017) and CO Boilers (completed in December 2017). The facility did not identify any written recommendations subject to HCA evaluations associated with these PHAs.

New Processes:CCHMP reviewed Procedure 2.15A & 2.15B and was unable to locate the Program 4 requirement of a top down HCA approach. CCHMP was informed that there has been no new process, new process unit or new facility ISSA/HCA evaluations since the last CCHMP audit. The facility has evaluated projects for ISSA applicability. CCHMP reviewed three project ISSAs completed since the last audit. The documentation ranged from completed ISS checklists to more of a report format. CCHMP was informed that the level of detail used for the documentation has depended upon the size and complexity of the project. None of the ISSA documentation mentioned the top down approach for HCAs identified in the question. CCHMP reviewed the following project studies (see A58-06 for more information related to new process HCAs/ISSAs evaluations):-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17, not required under ISO or Program 4-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18, not required under ISO or Program 4-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through 1/17, not required under Program 4 but subject to ISO.




ID# Question Actions Proposed Remedy Due DateFindingsPHA Recommendations:CCHMP reviewed ISSA documentation for select completed PHA recommendations. The format used for the documentation was consistent with that identified in Attachment G of the facility's PHA policy, I(A)-50. As described below, the format used does not incorporate all the items listed in the question. The documentation includes: -- The name of the PHA study; -- Team members and roles; -- PHA scenario; -- Summary of recommendation and ISS strategy taken;-- Other options considered but not taken and reason why they were not implemented:-- Process Safety Manager review and approval signature and date.




Ensure that new process/project evaluations follow Procedure 2.15A & 2.15B in using the ISS Checklists (versus summarizing an ISS narrative) or modify the policy to incorporate an alternate approach.

I(A)-43 and/or Procedure 2.15A/2.15B will include requirements to determine whether a project or MOC meets the definition of a "major change" (which includes "new process"). Procedure will clearly state the requirements to complete an HCA for any "major change" and the template that will be used for each phase of a major change capital project. ISS Checklists will be designed to allow text narrative to be entered or attached to the checklist where appropriate.

12/15/2019CCHMP reviewed the facility's policy titled, "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. SEO is Safety, Environmental and Operability reviews. ISS is Inherently Safer Systems. The policy identified that ISS is reviewed at three distinct phases of the design process: Select (SEO1), Define (SEO2) and Execute (SEO3). Associated with each of these phases, different SEO/ISS questions are asked using three different checklists. Per interviews, these phases match those listed in the County's SP Guidance Document (e.g., chemistry forming, design scoping, and basic design). This Shell policy also has a fourth checklist that is to be used prior to startup that also includes ISS questions.


Shell evaluated each of the following for ISS events though not all of them were subject to ISS requirements. The first two projects listed below were small in scale and did not meet the criteria in the County's ISS guidance or Program 4. The third was significantly larger and more complex and did meet the criteria in the County's ISS guidance but did not meet that identified under Program 4 (even if the event had happened after 10/1/17).-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through 1/17

For the first two projects, the facility followed their Procedure 2.15A & 2.15B policy and evaluated each using their ISS checklist as well as their SEO design checklist. These projects are new and have only completed up to phase 1 for ER 3334 and through phase 2 for ER 3257 of the facility's design process. Projects must complete all three phases before a project can be considered viable. The last project, ER 3227, has passed all three phases of review and was subject to the County ISS requirements since the new project met the ISS condition of "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". CCHMP reviewed documentation associated with this project and was unable to


ID# Question Actions Proposed Remedy Due DateFindingslocate completed ISS checklists for any of the three phases. CCHMP was informed that this large project went through multiple rounds of HAZOP reviews at each of the three phases of its design. CCHMP was informed that the facility's simple ISS checklists are not useful for large projects like these and instead the teams evaluated ISS opportunities through the HAZOP and through discussions. Similar large project ISS reviews in the past had been documented through more of a narrative approach than using the ISS checklist. CCHMP was unable to locate any ISS narrative summary for this project. CCHMP reviewed Procedure 2.15A & 2.15B policy and was unable to locate a discussion of using a narrative ISS summary to document ISS reviews.




A58-08 Does the Stationary Source adequately document their Inherently Safer Systems analysis for new processes for each phase? Documentation maintained should include, as applicable, but is not limited to:a) ISS team makeup, responsibilities, qualifications and experience;b) Criteria used to require an ISS review for the process;c) The relevant ISS questions asked and answered (e.g., can quantities be reduced, can other chemicals be used, can different equipment be used, etc.);d) The information available during the ISS assessment (e.g., chemical compatibility matrix, chemical properties, material and energy balances, PFD, P&ID, etc.);e) How process improvements were reviewed and the determination of the process that was determined to be the inherently safest process;f) The process used to determine that the equipment sizes are minimized and the results of this determination;g) The process used to determine the minimum inventories needed and the results of this determination;h) The process used to simplify the covered

Ensure new process / project ISS evaluations are documented at each phase of the assessment consistent with Section D.1.1 of the CCHMP Safety Program Guidance Document.

Ensure three separate reports are developed, one for each phase of ISS review, for project ER 3227 and each contain the information identified in the question.

1. Update I(A)-43 to clearly state documentation requirements for ISS evaluations. 2. Create ISS checklists and/or templates to document ISS review reports during each phase of the ISS review (1. Chemistry forming 2. Design scope/development 3. Basic design). Checklist will include what new hazards and/or safeguards are being introduced by the major change, and ISS analysis will be conducted for each of the new hazards and/or safeguards.3. Develop reports for each phase of the ISS review for ER-3227, and ensure each report contains the information identified in the question.

12/15/2019Section 6.2 of Procedure 2.15A & 2.15B identifies that the team is to document all of the items listed in the question. Of the three project ISS evaluations reviewed in A58-06, only one of them, ER 3227, was subject to County ISO ISS requirements, and therefore, subject to this question. CCHMP reviewed the documentation associated with this project and was unable to confirm that items b) through k) listed in this question were documented for any phase.



ID# Question Actions Proposed Remedy Due DateFindingsprocess, if applicable, and the results of this process;i) The process used to reduce the waste made from the project and the results of the determination; j) Applicable items considered from the ISS checklist in Attachment C of the SP Guidance Document; andk) For applicable items from the ISS checklist in Attachment C of the SP Guidance Document that were not considered, the Stationary Source should document why each item was not considered. [Section D.1.1 of the CCHMP Safety Program Guidance Document]



A58-12 Does the owner or operator within 30 days of completing the HCA/ISS adequately document their analysis in a report, including: a) A description of the composition, experience, and expertise of the members of the team that performed the HCA/ISS analysis; b) A description of the methodology and approach used by the team;c) A description of each process safety hazard analyzed by the team, including identifying, characterizing and prioritizing process safety hazards;d) Identification and description of the inherent safety measure(s) and safeguards analyzed by the team, including publicly available information on inherent safety measures and safeguards identified and analyzed;e) The conclusions of the analysis;f) The rationale for the inherent safety measures and safeguards recommended by the team for each process safety hazard, including documenting first and second order inherent safety measures and remaining risks (passive, active, procedural);g) An action plan, including a timeline to implement the recommendations? [T19 CCR §2762.13(g), ISO

Ensure the final report for new process ISS evaluation for ER 3227 is modified to include the following:-- Identification and a description of the inherently safer system(s) analyzed in the ISSA; -- A description of the methodology used to analyze the inherently safer systems(s); -- The conclusions of the analysis; -- The rationale for the conclusions; and -- An action plan, including a timeline to implement the inherently safer system(s) recommended in the ISSA.

Develop final report for ER-3227 and ensure final report includes the requirements from the action item

12/15/2019CCHMP reviewed a number of policies relating to HCAs/ISSAs (e.g., I(A)-43, Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS, I(A)-50, C(A)-15) and none of them identified that an HCA/ISSA report needs to be developed or includes the information within the question within 30 days of completing the analysis. It is not a definitive requirement to include this statement within each policy.


PHA Recommendations:CCHMP reviewed two PHAs completed since October 2017 and did not locate any PHA recommendations that would be subject to ISSA/HCA. CCHMP reviewed documentation of past PHA recommendation ISS evaluation closures and found they satisfied the 2014 ISO regulation items described above under the New Process discussion.


MOC:


ID# Question Actions Proposed Remedy Due DateFindingsSection 450-8.016(i)(2) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

There were no major changes proposed since the last ISO audit.






Ensure items presented in ISSA/HCA studies as infeasible include sufficient documentation to support that conclusion, including the basis for this conclusion in meaningful detail.

Incorporate requirements to document infeasibility in procedure I(A)-43. Incorporate infeasibility as a section in the final ISS report template

12/15/2019In reviewing documentation associated with the project ISS evaluation for ER 3227, three of the project recommendations identified the following wording under the column identified as Inherently Safer Systems: "Other alternative design not viable" or "Other options considered are not viable". CCHMP was unable to locate a discussion of "other alternative design" or "other options considered" associated with ISS options, and more specifically, documentation that supports these rejected ISS options were not feasible.


In reviewing documentation associated with the above PHA recommendations, CCHMP found the following wording used for other options considered but not taken and the reason why they were not implemented: -- "Benefit of this option is grossly disproportionate from the risk" [KGP scenario 15.20, 15.27, 15A.17-- "team considers this option as not viable" [DSU scenarios 15.8, 18.2; CGH scenarios 7A, 3.1, 7A.24.1]-- "Other alternative design not viable" [CFH scenarios 4.1, 4.14; HGHT scenarios 1.4, 5.13; CCU-CGP scenarios 1.9.2, 1.30.1].






A59-04 Does documentation exist to show that an appropriate participation level target was chosen and achieved for each selected work group? [Sections F.3 and F.8 of the CCHMP Safety Program Guidance Document]

Ensure that a SCA target participation level is chosen and achieved for each work group.

I(A)71 – Process Safety Culture Assessment Program procedure updated to address choosing target participation for each work group and addressing how to achieve participation levels.

The 2018/19 PSCA includes target participation levels.

ClosedThe Executive Summary of the 2015 SCA report states that more than an overall participation level of 70% of the workers completed the assessment. A breakdown of the work group participation level was provided separately from the 2015 SCA report:- For Shell employees (hourly and staff) - 70%- For Routine Contractors - 50%- For Turnaround Contractors - 35%

Per interview with the Safety Engineer and union representative, a target participation level was not specified for each work group. CCHMP expects that a target participation level is selected as a basis for participation to be evaluated as low participation rates may be an indicator of safety culture issues.




Ensure that future PSCAs address the required components per T19 CCR §2762.14(b) and Section F.6 of the Safety Program Guidance Document.

I(A)71 – Process Safety Culture Assessment Program procedure updated to address the required components. The 2018/19 PSCA Team ensured the required components were covered in the survey.

ClosedPer interview with the Safety Engineer and union representative, a breakdown of how the survey questions corresponded with components (a) through (d) was initially developed in 2010 for the previous SCA. However, no such mapping was conducted for the new questions included in the 2015 survey. CCHMP was unable to verify from existing documentation that the repeated questions from the 2010 survey were mapped to a specific component.


A59-08 Has the owner or operator developed a written improvement plan with a clear list of corrective actions to be implemented within 3 months of the report presentation along with identifiable milestones? [Sections F.7 and F.8 of the CCHMP Safety Program Guidance Document]

Ensure that a written improvement plan is developed for the 2015 SCA and that future SCAs will have improvement plans developed within 3 months of PSCA report presentation.

I(A)71 – Process Safety Culture Assessment Program procedure updated to address improvement plan requirements and timing. The 2015 SCA Report was revised to specify the improvement plans from the survey. 2018/19 SCA Report, includes improvement plans developed within three months of the PSCA Report finalization.

ClosedCCHMP was informed that a written improvement plan was not produced from the 2015 SCA with a clear list of corrective actions to be implemented within 3 months of the report presentation along with identifiable milestones. Per interview with the HSSE Manager, actionable items were developed and communicated verbally throughout the organization. However, it is required by CalARP Program 4 and Section F.8 of Safety Program Guidance Document to develop a written report and improvement plan.



A59-09 Has the Stationary Source developed metrics from the improvement plan to monitor the effectiveness in achieving the facility’s stated goals for the safety culture program? [Section F.7.2 of the CCHMP Safety Program Guidance Document]

Ensure that metrics are developed from all improvement plans to monitor the effectiveness in achieving the stated goals for the process safety culture program at Shell.

I(A)71 – Process Safety Culture Assessment Program procedure updated to address improvement plan requirements and timing. The 2018/19 PSCA identified metrics to measure culture changes.

ClosedCCHMP was informed that metrics were not developed to monitor the effectiveness in achieving the facility's stated goals for the 2015 SCA. See A59-08 regarding the development of a written improvement plan.


ATTACHMENT D

Summary of Consider Items

Summary of Consider Items and Proposed Remedies

ID# Question Consider Proposed Remedy Due DateFindings

A38-02 Did the owner or operator perform an initial process hazard analysis (PHA) for all processes? [T19 CCR §2762.2(a) and ISO Section 450-8.016(d)(2))]

Consider updating I(A)-50 to reflect the Program 4 changes. The following pages at a minimum should be reviewed (1, 7, 14, 15, 17)

Update PHA procedure (I(A)-50) to reflect the CalARP Program 4 updates.

ClosedPer CCHMP interview with the PSM Manager, SMR has been in the process of identifying PHAs that need to be completed as a result of the new P4 regulations. SMR has identified the additional PHAs to be completed and created a schedule with a full compliance date of 2020. See A58-11 for more details on the PHA schedule.

CCHMP reviewed policy I(A)-50. Per the policy, the purpose is to comply with various regulations (including CalARP, EPA, and OSHA). Section 3.0 states that the Process Safety Department maintains a listing of the covered process units as well as the Master PHA schedule. Per CCHMP review, the policy should be updated to reflect CalARP Program 4 regulations. CCHMP has compiled the different areas of the policy that should be updated and provided this to the SME.



A38-07 Do the PHA(s) address the following:a) Hazards of the process? [T19 CCR §2762.2(c)(1) & ISO Section 450-8.016(d)(1)]b) Damage Mechanism Review (DMR) reports and Hierarchy of Hazard Control Analysis reports that are applicable to the process units? [T19 CCR §2762.2(c)(3)&(4)]

Consider updating the PHA policy for consistent documenting of how CCD are incorporated into the PHA.

Update PHA procedure (I(A)-50) to reflect how the Damage Mechanism Review (DMR) – Corrosion Control Document (CCD) in SMR – is referenced and incorporated during a PHA, and documented in the PHA report.

ClosedPer CCHMP review all seven PHAs addressed the hazards of the process. Examples of hazards reviewed include failure of equipment, equipment inadvertently placed in the wrong position, and loss of utilities.







Consider updating all policies associated with performing PHAs to identify how to manage and document corrective actions that cannot be completed in prescribed time limits (e.g., development of interim safeguards).

Update HEMP procedure (C(A)-49) to reflect the requirement to manage interim safeguards (mitigations) that cannot be completed in prescribed time limits (per 19 CCR §2762.16(e)(14)), including: (A) The rationale for deferring the corrective action(s); (B) The documentation required under the MOC process; (C) A timeline describing when the corrective action(s) will be implemented; and (D) An effective plan to make available the rationale and revised timeline to all affected employees and their representatives.

12/15/2019CCHMP has reviewed a list of PHA action items and found an example of an action where an interim safeguard was implemented prior to the completion of the recommendation. This was for FAM#928895 which is scheduled to be completed 8/31/2020. The action items is to add instrumentation to enable independent shutdown of compressors. Per CCHMP review an interim mitigation item that has been completed was to have ESP low level alarms on LV-192.

Per CCHMP interview however there is not a concrete policy to ensure that interim safeguards are implemented when there is a potential for a major incident. Also the current deferral process does not include all the documentation listed in A38-21.

A38-28 Has the owner or operator retained copies of the documented resolution of the recommendations as appendices to the report for the life of the process? [T19 CCR §2762.2(k), §2762.16(e)(15) & ISO Section 450-8.016(d)(3)]

Consider creating a process and updating the policy so that resolution of action items is documented and appended to the PHA report.

Update PHA procedure (I(A)-50) to reflect the requirement of documenting the resolution of each recommendation as appendices to the PHA file.

ClosedCCHMP reviewed 7 PHAs. 5/7 PHAs were completed before the P4 regulations came into effect. Based on this, the 5 PHAs were not required to have the recommendations kept as an appendix to the PHA. CCHMP was able to review a print out of the recommendations and documented resolution for the recommendations for all five of the PHAs.

For the 2 PHAs that were completed after the P4 regulations came into effect, CCHMP reviewed the PHA reports and notes that the action items are not due. Shell should create a process moving forward such that the documented resolution of the action items is included as an appendix to the report. If this is not performed before PHA recommendations are considered overdue, it will be an ensure item in future audits.



A40-13 Has the owner or operator developed and implemented an effective training program to ensure that all affected employees are aware of and understand all Program 4 elements described in this Article? [T19 CCR §2762.4(e)]

Consider expanding and completing training by October 1, 2019 for all affected employees to be aware of and understand all Program 4 elements.

Consider incorporating a feedback loop into the Program 4 training to make sure the training is effective.

A site specific Program 4 training will be provided and become part of affected employee onboarding for the site and for those already on site, a basic training will be given. This will include a method to ensure understanding from those who received training.

9/30/2019CCHMP was informed that new hire (both maintenance and operator) training classes include a session on the PSM program. This training has been performed for a number of years. CCHMP reviewed the training documentation for new hires and found it covered a number of PSM topics although not specifically all of the Program 4 additions, including: damage mechanisms, safeguard protection analysis, human factors, CalARP management systems, management of organizational change, process safety culture assessment. New hires are also trained on Shell's HEMP (Hazards and Effects Management Process) and barrier thinking concepts which has similarity to safeguard protection analysis. New hires are also trained on corrosion control documents, which is Shell's terminology for damage mechanism. They are separately trained on human factors as well. After reviewing other training provided to new hires, CCHMP was unable to verify they are trained on management of organizational change or process safety culture assessment.

The new Program 4 requirements require that "all affected employees are aware of and understand all Program 4 elements". Affected employees are not just new operators and maintenance personnel. Affected employees also refers to existing operators and maintenance personnel, engineers, STLs, mentors, SMEs, Production Specialists, OMCs, planners, management, and most employees onsite. CCHMP suggests that Program 4 training should be provided to all employees. This initial training needs to be completed by 10/1/19. Since this training is not yet due to be completed, nor has it been effectively completed, CCHMP has identified this question as N/A.

Program 4 also greatly expanded the roles of operators and maintenance personnel in that they are to participate in all phases of each of the Program 4 topics. It is difficult to participate in a topic if one doesn't know what the topic is.

CCHMP also suggests that the training process developed should incorporate a feedback loop to make sure the training is effective.



A41-06 Does the inspection and testing certification record identify:a) The date of the inspection; b) The name of the person who performed the inspection or test; c) A description of the inspection or test performed; d) The results of the inspection or test; and e) The serial number or other identifier of the equipment on which the inspection or test was performed? [T19 CCR §2762.5(b)(3) & ISO Section 450-8.016(a)(5)(D)]

Consider improving access to the old SAP system in order to facilitate accessing historical data regarding inspections and certification.

Site believes current process to access old SAP data is sufficient. Historical data does not need to be available immediately and is utilized in determining repair or inspection plans. Site will continue to maintain access to the system with multiple people.

N/APer CCHMP review of IMS (database used to track corrosion and inspections) for select PSV, piping, and pressure vessels, each report includes the history of inspections by date, the name of the persons who performed the inspections, a description of the inspection performed, the results of the inspection, and the serial number of the equipment that was inspected. See A41-05 for information about the specific equipment selected for review.

CCHMP also reviewed documentation for nine PSVs which were in the PEI file room and found that each file contained a stand-alone pop tests along with the information specified in items (a)-(e) of the question.

Per review of the process pump database, the pumps selected had reports that contained items (a)-(e) of the question and are stored either electronically, in binders, or both. The rotary equipment inspection team is working on converting all hard copies of pump reports to electronic copies. However, there are currently two databases that contain pump information: SAP and the database that replaced it, GSAP. The SME was able to access the older SAP database with some effort. This is because SMR archived that database after switching to the new database. The older database will be maintained and can be accessed but it is not readily available to people who want to look at older pump data.



A41-14 Does/did the owner or operator complete a Damage Mechanism Review (DMR) for each process for which a damage mechanism exists? [T19 CCR §2762.5(e)(1)]

Consider adding wording in the CCD policy that the remaining CCDs must be completed by 10/2022.

The Pressure Equipment Integrity Department maintains a CCD Schedule that shows all of the CCDs and due dates. The schedule was updated to reflect the deadlines. It is deemed unnecessary to add this statement to the procedure as the schedule contains the information.

ClosedPer review, SMR has generated a number of CCDs (corrosion control documents) for the different process units. For each unit, the number of CCDs that was performed is specified. A CCD performs the same function as a Damage Mechanism Review. The damage mechanisms covered by the CCDs are environmental, wet corrosion, embrittlement, CUI (corrosion under insulation), and a few others.

SMR generated CCDs for each of the process units as follows:- Cracked Products (8 CCDs)- Clean fuels (6 CCDs)- Distilling/Hydroprocessing (6 CCDs)- OPCEN (8 CCDs)- Utilities (3 CCDs)

SMR has also identified the following areas as needing CCDs to comply with Program 4 requirements: the wharf, recovered oil processing, blender, tanks, ETP, and process water. Per SME, these would be the last areas that would require CCDs. These CCDs would need to be completed by 10/2022 in order to meet the requirements of Program 4.

There are 9 CCDs (out of the 31 total) due for revalidation in 2018, the rest with target dates of 2019-2022.

CCHMP reviewed the following CCDs:

Opcen- Distillates Saturation Unit (Revision 3, September 2014)- SRU-4 (Revision 3, September 2016)- Dimersol (Revision 4, August 2017)- Flexicoker (Revision 6, December 2010) (in the process of being reviewed as of the audit.)

Cracked Products- Delayed Coker (Revision 5, October 2016)

Clean fuels- DHT (Distillate Hydrotreater) (Revision 5, February 2016)

Per review of SMR's CCD program, SMR is meeting the regulation ahead of schedule. SMR has performed CCDs on most of their processes which is above the 50% mark set for October 2020.



A41-15 Does/did the owner or operator ensure the DMR was updated at least once every five (5) years; and reports retained for the life of the process unit? [T19 CCR §2762.5(e)(2 & 12)]

Consider changing the CCD revalidation frequency in policy C(A)-47 to at least once every 5 years to match the Program 4 requirements.

Consider revalidating all of the CCDs completed before 10/2017 used to meet the 50% target completion by 10/2022 in order to meet the timeline set forth in the Program 4 regulation and to update policy C(A)-47 accordingly.

C(A)-47 CCD Policy to be updated to include Program 4 requirements for revalidation frequency.

The Pressure Equipment Integrity Department maintains a CCD Schedule that shows all of the CCDs and due dates. The schedule was updated to reflect the Program 4 deadlines.

6/30/19Per review, Procedure C(A)-47, Corrosion Control Document Management (Revision 2, dated 8/31/17) states in section 9.2 that "a comprehensive review (revalidation) of CCDs should be conducted by a CCD revalidation team on a 4-8 year interval depending on the criticality of the unit." The 4-8 year interval would not meet the requirement of the new Program 4 requirement of updating the CCDs every 5 years.

For the CCD revalidations below, and all of the CCDs used to meet the 50% target completion that were completed before 10/2017, must be revalidated by 10/2022 in order to meet the timeline set forth in the Program 4 regulation.

For the CCD of the Delayed coker unit, revalidations were done as follows:Rev 5 - 10/2016 (most recent)Rev 4 - 06/2011Rev 3 - 07/2006Rev 2 - 03/2000

For the CCD of the Distillate Saturation Unit, revalidations were done as follows:Rev 3 - 09/2014 (most recent)Rev 2 - 04/2010Rev 1 - 05/2005

For the CCD of the Distillate Hydrotreater, revalidations were done as follows:Rev 5 - 02/2016 (most recent)Rev 4 - 09/2011Rev 3 - 08/2006Rev 2 - 06/2001Rev 1 - 07/1998

For the CCD of the Sulfur Recovery Unit, revalidations were done as follows:Rev 3 - 09/2016 (most recent)Rev 2 - 06/2011Rev 1 - 05/2006Rev 0 - 02/2004



A41-18 Does the written DMR report include the following: a) The process unit(s) reviewed; b) Damage mechanisms analyzed; c) Results of the analyses conducted; d) Recommendations for temporary mitigation; e) Recommendations for preventionf) Completed corrective action items appended to the report? [T19 CCR §2762.5(e)(9) & §2762.16(e)(15)]

Consider appending completed corrective action items to CCD reports and update policy C(A)-47 accordingly.

Action items are documented in a separate table in the same electronic folder as all of the CCD documentation for a unit. If action items are completed immediately (before the report is due) the report is updated. Other action items are managed through our site system. Once completed the Corrosion Materials Engineer will review the action and update the CCD report for the unit.

CCD reports are evergreen. When an action item is completed the CCD is updated to reflect the action item completion and to keep the CCD current between the 5 year full reviews. C(A)-47 to be updated to show this practice.

Action called complete

6/30/2019CCHMP reviewed the CCDs for the following processes:- Delayed Coker Unit (DCU)- Distillates Saturation Unit (DSU)- Distillate Hydrotreater (DHT)- SRU-4- Flexicoker- Dimersol

The reports include the damage mechanisms analyzed for each of the process units. There is a table in each report that lists the applicable damage mechanism, the areas affected, the likelihood or estimated rates, and notes. In other sections of the report there are tables for Process Limits (Integrity Operating Windows) and a piping inspection strategy. There is also a section for additional monitoring. The piping strategy table includes the location, the class, the suggested rate (IPY-inches per year degradation), corrosion type (localized or general), deadleg corrosion mechanism, and deadleg corrosive orientation.

Per review of section 4.0, the CCD details the preventive measures that are in place for the applicable damage mechanisms. Depending on the corrosion loop being evaluated for each of the CCDs, the damage mechanisms could include oxidation, sulfidation, aqueous corrosion, environmental cracking, fouling, mechanical degradation, or a combination of damage mechanisms. For example, the piping material for the furnace tubes is made of 9 Cr - 1 Mo which offers better corrosion resistance to naphthenic acid and sulfidation.

Per review of the CCDs, each has at the back a list of recommendations and action items. However, the recommendations and action items are not appended to the reports. CCHMP did a live navigation with the SME in the FAM/RADAR database (the tracking tool for action items) for the updated CCD for the flexicoker and the CCD for the DCU. The 2016 CCD report for the DCU had recommendations with completion dates that were tracked in a separate file and the FAM/RADAR database. The 2018 CCD report for the Flexicoker is still in progress but there are recommendations listed in FAM/RADAR. Per the SME, recommendations that cannot be closed out immediately go into FAM/RADAR so that they can be tracked to completion.

Some of the recommendations in FAM/RADAR could be considered temporary mitigations. A temporary mitigation might be for using a different type of material for a piece of equipment. For example, one recommendation from the 2016 DCU CCD that


ID# Question Consider Proposed Remedy Due DateFindingswas approved was to temporarily install a CS (carbon steel) body and disk valve for a butterfly valve instead of 316 SS (stainless steel). The 316 SS butterfly was the best configuration for this valve but it had a lead time of about 6 months. This temporary mitigation was to replace a valve that was not working properly and for which there was no spare. This was covered by an MOC. There are other recommendations covered in FAM/RADAR that would just be tracked that have target dates but not expiration dates as in the case of the CS valve.

A42-05 Do the Management of Change procedures address modifications to and/or development of new operating and maintenance procedures prior to any change? [T19 CCR §2762.6(b)(3) & ISO Section 450-8.016(a)(6)(B)]

Consider modifying the MOC policy and electronic MOC documentation to more clearly identify what is accomplished under MOC versus PSSR. The MOC actions that should be clearly defined under the MOC subsection rather than PSSR include the completion/or development of new operating and maintenance procedures, PSI revisions including P&ID changes and documentation that training for the change has been completed as part of the MOC process.

PSSR template checklist “Approval for Start Up” section will be revised to clearly identify that the confirmation is a verification check independent of the MOC.

10/31/2019Per a review of the completed MOCs referenced in A42-01, the MOCs include a section that is titled "Details of MOC Items and Related Action Items" that only has actions to approve the completion of MOC but no specific actions for the MOC completion such as addressing modifications to and/or development of new operating and maintenance procedures prior to any change. The MOC includes a subsection titled "PSSR" that addresses completion of such actions but it was not entirely clear to CCHMP what activities were completed under the MOC versus the PSSR.

Per interview with SME and OPCEN Department Manager and the review of the completed MOCs, the MOCs/PSSRs include three approval levels. The MOC initiator/OMC (Operations Maintenance Coordinator) sign off that "MOC is installed correctly". Per interview, the sign off by Operations Specialist and Department Manager represents the redundant check that the MOC actions have been completed. However, the MOC action item completions and all of the approvals are shown under the PSSR action items.

The MOC actions required and responsible person/department to complete those actions should be included in the electronic MOC action items tracking independent of what is identified under PSSR actions. It is suggested that the electronic MOC documentation be updated to identify the procedures and or PSI modifications to be completed including P&IDs to be corrected/revised, and documentation that training for the change has been completed, responsibilities for these actions and completion date of the actions as part of the MOC process. It is suggested that a separate section address the PSSR actions to more clearly identify what activities were performed as a redundant check for the MOC completion.



A42-15 Does/did the owner or operator review the Damage Mechanism Report or conduct a Damage Mechanism Review (DMR) as part of a major change on a process for which a damage mechanism exists, prior to approval of the change and document the findings in the MOC? [T19 CCR §2762.6(c), §2762.5(e)(3)]

Consider updating the MOC policy to require the review of the DMR report or to conduct a DMR as part of a major change evaluation on a process for which a damage mechanism exists, prior to approval of the change and document the findings in the MOC.

Update C(A)-15 to include a review and update of the CCD (DMR), as part of the MOC technical evaluation and documentation process.

10/31/2019Per interview and a review of the MOCs completed, the MOC Technical Evaluation does include a review of damage mechanism if applicable. However, the MOC policy does not address a requirement for such review. Per interview with SME, they would know whether a change qualified as a P4 major change. Although it is not a regulatory requirement for the MOC policy to specifically require a Damage Mechanism Review (DMR) or to review the DMR report as part of a major change review, it is

A42-16 Does/did the owner or operator perform a Hierarchy of Hazard Control Analysis (HCA) as part of a major change on a process prior to implementation of the change and document the HCA recommendations in the MOC? [T19 CCR §2762.6(c)]

Consider updating the MOC policy to require an HCA be conducted as part of a major change evaluation on a process prior to implementation of the change and document the HCA recommendations in the MOC.

Update C(A)-15 to include a HCA be conducted as part of the MOC technical evaluation and documentation process for a Major Change.

10/31/2019Per interview with SME, a Hierarchy of Hazard Control Analysis (HCA) will be completed as part of a major change on a process prior to implementation of the change and the HCA recommendations will be documented in the MOC. However, the MOC policy makes no mention of this requirement. Similar to A42-15, although it is not a regulatory requirement for the MOC policy to specifically require an HCA as part of a major change review, it is suggested.



A43-05 Does/did the owner or operator confirm, as a verification check, independent of the management of change process, that prior to the introduction of regulated substances to a new covered process or new process unit, that a PHA, Hierarchy of Hazard Control Analysis, Damage Mechanism Review and Safeguard Protection Analysis have each been performed and recommendations have been resolved or implemented before startup? [T19 CCR §2762.7(b)(4) & ISO Section 450-8.016(a)(7)(B)]

Consider updating C(A)-14 and the PSSR process to include the Program 4 requirements for reviewing Hierarchy of Hazard Control Analyses, Damage Mechanism Reviews, and Safeguard Protection Analyses prior to the introduction of regulated substances to a new covered process or new process unit.

Update C(A)-14 and KMS PSSR templates to ensure the Program 4 requirements have been met for HCA, DMR, SPA for a major change of a new covered process or new process unit.

10/31/2019Attachment 1 (PSSR Questions in KMS), Question 3 addresses recommendations from two analyses:- Have all recommendations or gap closures from Hazard Assessment and Further Risk Analysis been incorporated into the design and implemented?

Per interview with the PSM Manager, no new processes have been constructed and is confirmed by a review of the PSSR sampling described in A43-02. However, the language of the PSSR policy, C(A)-14, and the templates used to document compliance should be updated to include the additional review of Hierarchy of Hazard Control Analyses, Damage Mechanism Reviews and Safeguard Protection Analyses prior to the introduction of regulated substances to a new covered process or new process unit.

A44-05 Does/did the owner or operator append the report with the actual completion dates when deficiencies were corrected? [T19 CCR §2762.16(e)(15) & ISO Section 450-8.016(a)(8)(D)]

Consider replacing FAM with RADAR in C(A)-27.

C(A)-27 obsoleted and C(A)29 updated to refer to RADAR.

ClosedPer review of the Compliance Audit reports from 2014 and 2017, only the action items from the 2014 Compliance Audit have been completed. A table of completed action items is kept in FAM. SMR has since replaced FAM with a new system called RADAR which is now used to store action items. The Compliance Audit reports and completed recommendations are maintained at the facility and can be provided upon request. For the 2017 Compliance Audit, only 5 of 16 recommendations have been completed so far and the rest of the action items have target completion dates that will meet the required 1.5 year regulatory timeline. Per policy C(A)-27, Target Date changes are to be approved via email and this email will be attached to the action in FAM. This approval will include the unit or area manager, the appropriate refinery team leader (RTL) sponsor and the assurance coordinator (AC). The AC will determine who is required to grant final approval which could include the Regional Vice President depending on the risk ranking of the finding and the category of the assurance project.



A44-09 Has the owner or operator made the compliance audit report available to employees and employee representatives for review and comment? [T19 CCR §2762.8(c) & §2762.10(a)(3)]

Considering adding to C(A)-29 the requirement to make the report available to employees and employee representatives for review and comment to meet the Program 4 requirement.

C(A)-29 revised to add this requirement.

ClosedPer interview with SME, once the Compliance Audit report is complete, an email is sent to the employees and employee representatives informing them that the Compliance Audit report is complete. Any employee may view the report in the PSM department as the report is not made available online or distributed to the facility outside of the leadership team.

A44-10 Has the owner or operator followed the corrective action work process documented in §2762.16(d) and (e) when developing the resolution and implementation of compliance audit recommendations? [T19 CCR §2762.8(d)]

Consider updating C(A)-29 so that it specifies RADAR as the database for tracking findings and corrective actions from internal audits.


ClosedPer review of policy C(A)-29, the findings and corrective actions from the internal audits and external audits are recorded in FAM by the assurance coordinator. C(A)-27, Fountain Assurance Manager (FAM) Practice, Revision 12, dated November 2016, provides the work process for managing findings and action items from audits and other sources. In the Implement Mitigation section there is a statement that the action taken to close out a recommendation or action item should effectively address the action required. "If this differs from the action required, the auditee needs to agree to any changes and document in FAM." It also states that the Action Party, "should verify the effectiveness of the corrective action with their Line Manager before closure in FAM."

A44-11 As part of performing the compliance audit, has the owner or operator consulted with operators with expertise and experience in each process audited and documented the findings and recommendations from these consultations in the audit report? [T19 CCR §2762.8(f)]

Consider adding to C(A)-29 the requirement to consult operators with expertise in the areas being audited to meet the Program 4 requirement.


ClosedPer review of policy C(A)-29, the Internal Audit Selection and Competency, the audit pool includes individuals from all levels of the organization and across different disciplines and departments. However, the procedure does not specify that an operator with a particular skill set will be consulted or that the recommendations made by the operator will be captured in the compliance audit.

Per interview with the SME, the compliance audit teams for both the 2014 audit and the 2017 audit consulted with operators with expertise and experience whenever the audit team went out to a process unit or an area that required specific expertise. However, the recommendations that came from the operators were not documented separately. These recommendations were included as part of the overall recommendations.



A45-03 Was an incident investigation team established and did it, at a minimum, consist of:a) A person with expertise and experience in the process involved;b) A contractor employee and contractor employee representative if the incident involved work of the contractor; c) A person with expertise in overseeing the investigation and analysis;d) Other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident; ande) A person with expertise in the owner or operator’s incident investigation methodology? [T19 CCR §2762.9(d) & ISO Section 450-8.016(a)(9)(C)]

Consider revising the incident investigation procedure to include the team composition requirements for investigations of incidents that resulted in, or could have reasonably resulted in a major incident.

Consider documenting in the investigation report the additional key personnel that were consulted for their knowledge and expertise on the process during the incident investigation.

Consider documenting when contractor employees and contractor representatives are included on the investigation team if the incident involved the work of the contractor.

Incident Investigation procedure I(A)-6 updated to include these requirements. The Incident Report Template was updated (as applicable) to include these requirements.

ClosedAs mentioned in A45-01, CCHMP reviewed a sample of 5 investigation reports for the following incidents that were identified as potential MCARs at the stationary source:

1. F44 Tube Leak (4/26/16)2. FXU Tubing Failure and Release (8/16/17)3. Loss of SP2 Sulfur Seal #2 (1/11/17)4. HCU TA H2S exposure (100 ppm) (5/2/17)5. Tier 1 Release of Antioxidant and Gasoline (3/28/17)

Each investigation report documented the investigation team members. CCHMP notes that each team included a person with expertise in the incident investigation methodology, a person with expertise in overseeing the investigation and analysis, and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident (e.g. engineers, heat transfer specialists, etc.). See A57-08 and A57-09 for additional discussion on team composition for the 2016 MCAR investigation. CCHMP identifies that one of these incidents (number 5, above) involved the work of the contractor, however a contractor employee and representative were not documented as being on the investigation team. Per interview with SME, the contractor company was interviewed and provided information as part of the investigation, however this was not documented. CCHMP found that whether the team included a person with expertise and experience in the process involved was not consistently documented in the investigation report. Per interview with SME, personnel with expertise and experience in the process involved in the incident were consulted during the investigations. CCHMP believes it would be beneficial to document in the report the additional key personnel consulted during incident investigations, but were not on the main investigation team.

As mentioned in A45-01, the incident investigation procedure has not been updated to include CalARP Program 4 requirements for incident investigations, meaning that the stationary source does not have a system to identify, report, and investigate incidents that resulted in, or could have reasonably resulted in a major incident. CalARP Program 4 requires that these incidents are investigated using a root cause analysis (RCA). The incident investigation procedure should be revised to include the CalARP Program 4 RCA team composition requirements for investigations of incidents that resulted in or could have reasonably resulted in a major incident.

CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified


ID# Question Consider Proposed Remedy Due DateFindingsany incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents.

A45-07 Does the RCA incident investigation report include the following:a) Date and time of the incident;b) Date and time the investigation began;c) A detailed description of the incident;d) The factors that caused or contributed to the incident, including direct causes, indirect causes and root causes, determined through the root cause analysis; e) A list of any DMR(s), PHA(s), HCA(s), and Safeguard Protection Analyses (SPA(s)) that were reviewed as part of the Investigation; f) Interim recommendations to prevent a recurrence or similar incident; g) Recommendations for permanent corrective action [T19 CCR §2762.9(i)]h) Whether the cause of the incident and/or recommendations resulting from the investigation are specific only to the process or equipment involved in the incident, or are applicable to other onsite processes or equipment? [ISO Section 450-8.016(a)(9)(D)]

Consider revising the incident investigation procedure, I(A)-6/EM-11.1, to include elements a-g in this question in addition to elements a-j in section 2750.9(b) for RCA reports of incidents that resulted in, or could have reasonably resulted in a major incident.

Incident Investigation procedure I(A)-6 updated and/or the Incident Report Template was updated (as applicable) to include these requirements.

ClosedPer CCHMP review of the 2016 MCAR investigation report (i.e., Loss of Power to Substations), the investigation began within 48 hours of the incident. The report also included recommendations, see A57-04 for more details.




CCHMP identifies that the incident investigation procedure should be revised to include elements a-g of this question. It is suggested that elements a-j in section 2750.9(b) be included in the RCA report for a major incident, or incident that could have reasonably resulted in a major incident.



A45-10 Did/does the owner or operator address and resolve each corrective action from an RCA incident investigation including interim actions and document the final resolutions promptly but no later than one and one-half (1.5) years after the completion of the investigation unless the owner or operator demonstrates in writing that it is infeasible to do so? [T19 CCR §2762.9(g & l), §2762.16(e)(12) & ISO Section 450-8.016(a)(9)(E)]

Consider revising the incident investigation procedure to include that corrective actions including interim actions from a RCA for an incident that resulted in, or could have reasonably resulted in a major incident will be resolved no later than one and one-half (1.5) years after the completion of the investigation, and corrective actions requiring a process shutdown shall be completed during the first regularly scheduled turnaround of the applicable process, subsequent to completion of the incident investigation, unless the owner or operator demonstrates in writing to CCHMP it is not feasible to do so.

Consider revising the incident investigation procedure to identify that the owner or operator may reject a team recommendation if the owner or operator can demonstrate in writing that one of the following applies:(A) The analysis upon which the recommendation is based contains material factual errors;(B) The recommendation is not relevant to process safety; or(C) The recommendation is infeasible; however, a determination of infeasibility shall not be based solely on cost.

Consider revising the incident investigation procedure to include that the owner or

Incident Investigation procedure I(A)-6 updated and/or the Incident Report Template was updated (as applicable) to include the requirements on timing of action items.

Either Incident Investigation procedure I(A)-6 or a different document (as applicable) will be updated to include the requirements on rejecting or revising a recommendation.

4/20/2020See A57-04 for discussion on how the recommendations from the 2016 MCAR investigation (i.e., Loss of Power to Substations) were resolved. CCHMP notes that all 4 recommendations were resolved no later than 1.5 years after the completion of the investigation, which is consistent with the incident investigation policy.


CCHMP notes that since the CalARP Program 4 regulations became effective (10/1/17) the stationary source has not identified any incidents that resulted in, or could have reasonably resulted in a major incident, meaning that the stationary source has not conducted any RCAs for these types of incidents. See A45-01 for further discussion regarding this topic and related ensure item.

CCHMP identifies that the incident investigation procedure does not include requirements for addressing recommendations from a RCA for a major incident, or incident that could reasonably have resulted in a major incident. The procedure also does not include criteria for when the stationary source can reject or change a recommendation from the incident investigation.


ID# Question Consider Proposed Remedy Due DateFindingsoperator may change a team recommendation if the owner or operator can demonstrate in writing that an alternative inherent safety measure would provide an equivalent or higher order of inherent safety, or, for a safeguard recommendation, an alternative safeguard would provide an equally or more effective level of protection.

A45-12 Has the report been provided to and, upon request, reviewed with employees whose job tasks are affected by the incident and made available to operating, maintenance, and other personnel whose job tasks are relevant to the incident findings, including contractor employees where applicable? [T19 CCR §2762.9(k) & ISO Section 450-8.016(a)(9)(F)]

Consider updating the incident investigation procedure to include requirements for providing investigation findings resulting from incidents that resulted in or could have reasonably resulted in a major incident to employees.

Incident Investigation procedure I(A)-6 was updated to clarify this requirement.

ClosedPer interview with SME, learning sessions are used to report out incident investigation findings to personnel, however these learning sessions may not be consistently done for CalARP/ISO qualifying incidents and may not include all affected personnel whose job tasks are relevant to the incident findings including contract employees where applicable. These learning sessions are also not consistently documented.






A45-18 Did the incident investigation team review the related DMRs that were performed and incorporate the applicable findings from these DMRs into the incident investigation? [T19 CCR §2762.9(f)]

Consider revising the incident investigation procedure to include that the incident investigation team will review the related damage mechanism reviews (DMRs) that were performed and incorporate the applicable findings from these DMRs into the incident investigation of major incidents or incidents that could have reasonably resulted in a major incident.

Incident Investigation procedure I(A)-6 updated and the Incident Report Templates were updated to include the requirements associated with DMRs.

ClosedAs mentioned in A45-01, the stationary source does not have a procedure implemented for reporting and investigating major incidents or incidents that could reasonably have resulted in a major incidents. The incident investigation policy should be updated to include Program 4 incident investigation requirements including that the incident investigation team will review the related damage mechanism reviews (DMRs) that were performed and incorporate the applicable findings from these DMRs into the incident investigation.

Per CCHMP's review of the incident investigation tracking list maintained at the stationary source, 5 incidents occurred after CalARP Program 4 became effective (10/1/17). Each of these investigations is open, meaning that the investigation is in-progress and a final report has not been issued. CCHMP identified that 3 of 5 of these incidents were classified as potential MCARs, and 2 were not classified as MCAR or potential MCAR. Per interview with SME, none of these incidents were assessed for whether they qualified as major incidents or incidents that could have reasonably resulted in a major incident. Since these investigations are still open, CCHMP is not able to confirm if damage mechanisms were identified as contributing factors in any of these incidents.

Per interview with SME, if an a damage mechanism was related to an incident, the appropriate expertise (e.g. from the Pressure Equipment Integrity (PEI) group) would participate on the investigation team and necessary documentation regarding damage mechanisms including corrosion control documents (CCDs), would be reviewed as part of the investigation.

CCHMP notes that if any of these incidents are determined as major incidents or could have reasonably resulted in major incidents, and damage mechanisms are identified as contributing factors, then the related DMRs must be reviewed and applicable findings incorporated into the investigation.



A46-01 Did the owner or operator develop, implement and maintain a written plan to effectively provide for employee participation in the Accidental Release Prevention elements in consultation with employees and employee representatives throughout all phases in the development, training, implementation and maintenance of the Accident Release Prevention elements? [T19 CCR §2762.10(a)(2) & ISO Section 450-8.016(a)(3)]

Consider updating the individual prevention program policies to reflect the employee participation plan including addressing participation in "all-phases" in the development, training, implementation and maintenance of the Accident Release Prevention elements.

C(A)4 covers the employee participation requirements for the site and meets regulations. No update required. As Process Safety procedures are updated they will be reviewed to consider the addition of employee participation language

ClosedCCHMP reviewed Process Safety Management policy (C(A)-4 rev. Feb., 2018) attachment 3 discusses the employee participation at SMR and that SMR actively encourages employee participation through all phases in performing PHAs, SPAs, HCAs, DMRs, MOCs, PSSRs, MOOCs, process safety culture assessments and incident investigations. It further states that the employee representatives (USW and IBEW) have the authority to select employees to participate in overall PSM program development and implementation planning and to participate in PSM teams and other activities related to PSM elements.

PHA: CCHMP reviewed I(A)-50 (rev. 7, 12/1/2016), section 6.1.1 states that process hazard analysis shall be performed by a team including at least one operations representative (qualified operator with at least 3 years experience with the process unit being assessed).

SPA: CCHMP was not provided any policy that address SPA/LOPA. CCHMP noted that of the PHAs reviewed, LOPA was integrated into the HAZOP and the HAZOPs were conducted by a team including union representation. See discussion in A38-16.

DMR: CCHMP reviewed C(A)-47 (rev. 2, 8/31/2017), section 3.0 states Corrosion Control Documents are developed and/or maintained (revalidations) by a team consisting of the Unit Operations Support Engineer (OSE), Operations Specialist, PEI Unit Inspector, and Corrosion & Materials Engineer (CME).

HCA: CCHMP reviewed I(A)-43 (rev. 07, Feb., 2018) and did not see any discussion related to employee participation.

MOC: CCHMP reviewed C(A)-15 (rev. 12, Feb 2018), section 6.0 states the MOC process provides for Employee Participation per ARMS Process Safety Management procedure, C(A)-4.

PSSR: CCHMP reviewed C(A)-14 (rev. 11, Dec. 2014) and was unable to confirm it specifies personnel who must be involved in PSSR.

MOOC: CCHMP reviewed the I(A)-53 'Management of Organizational Change' (rev.6, 2/20/2018), Section 6.3.1 specifies that the MOOC process will typically start by forming a MOOC Change Review Team. The change team should include those personnel who will be most affected by the change (representatives of the affected positions), and are likely to be the most familiar with the potential impacts of the change. Section 6.1 states that the MOOC process provides for Employee Participation


ID# Question Consider Proposed Remedy Due DateFindingsper ARMS Process Safety Management procedure, C(A)-4.

PSCA: CCHMP reviewed the I(A)-71 'Process Safety Culture Assessment (PSCA) Program (rev.0, Feb 2018), Section 6.2 defines the PSCA Team is to be comprised of representatives from Contract Partners, Company Management, and Union Representatives. The Team is given the task to design, deliver, and evaluate the assessment.

II/RCA: CCHMP reviewed Procedure I(A)-6/EM-11.1 Investigations and Incident Reporting (rev. 15, Sept. 2016). This is the policy for the work process for incident investigation. It states that the USW investigation tool, TOP, is an example Level 2 investigation methods.

Other ARPE programs (Compliance Audits, Mechanical Integrity. Operating Procedures, Training): CCHMP reviewed C(A)-40 (rev. 2, Jan 2017) Operations Training Policy and D(A)-1 (rev. 3, June 2016) and did not find any specific discussion of employee participation.



A47-01 When selecting a contractor, does the owner or operator obtain and evaluate information regarding the contract owner or operator's safety performance and programs and ensure that the contractors and subcontractors use skilled and trained workforce pursuant to HSC Section 25536.7? [T19 CCR §2762.12(b)(1) & ISO Section 450-8.016(a)(11)]

Consider adding the requirements of HSC 25536.7 to I(A)-42 regarding the 20 hour safety training and the need for contractors to have skilled and trained workforce meeting a certain percentage requirement.

I(A)-42 will be reviewed and HSC 25536.7 will be referenced

2/28/2020Per review of Procedure I(A)-42, Contractor HSSE Selection and Management, Revision 7, (no date), Shell uses CMS (Contract Management System) to store all contracts. In Attachment A of the procedure is an outline for the Selection of contractors and assuring HSSE capabilities. In Attachment B, Contract HSSE Risk Assessment Guideline, SMR has a matrix to determine the HSSE Contract Risk. The matrix has Red for high, yellow for medium, and blue for low. For the red area:-- Description: Work in process area, LSR (life saving rules) activities -- Chemical Risk: Yellow/Red-- Generic Activity Risk: Yellow/Red

Per interview with SME, SMR uses a third-party vendor to compile data on contractors. Each contractor is given a risk ranking based on the work that is performed using the criteria above. The third-party vendor will only provide contractors who meet the requirements established by SMR. If a contractor were to fall below a certain safety performance level, the contractor would be flagged in the system. If the contractor's safety performance continued to slide, the contractor would be removed from the SMR vendor list.

The SME also indicated that almost all of the contractors who perform work in or around the process area are under long-term contracts and thus would not be subject to the Program 4 requirement HSC 25536.7 section 2(b)(9) as the contracts were signed in 2013. However, for contractors who do not have long-term contracts, SMR is meeting the P4 requirement by using the total hours worked by the contract employees and calculating a percentage based on that. SMR still has until July 2018 to meet the 20 hour safety training requirement.



A47-04 Does/did the owner or operator periodically evaluate and document the evaluation of the performance of the contract owner or operator in fulfilling their obligations as specified in T19 CCR §2762.12(c)? [T19 CCR §2762.12(b)(5-6) & ISO Section 450-8.016(a)(11)]

Consider managing the various field audits performed on contractors to minimize duplication and include more contracting companies. This applies to all of the field audits that are performed as part of the different audit programs at SMR: SCUFS, Permitted Work, and Contract Holder audits.

Contractor auditing gaps will be addressed and all of the Shell programs will be taken into account as part of the update to the program.

2/28/2020Per interview with SME, SMR has a program called SCUFS (Shell Contractors United for Safety) that is made up of Shell contractors who meet once a month to go over findings from SCUFS field audits at SMR. These field audits take place monthly. There is also a Permitted Work Field Audit program headed by the SMR HSSE team in which a team of Shell employees go out into the field to perform field audits on permitted work. Auditees include contractors but contractors are not the primary focus of the program. Each Permitted Field Audit is documented by the HSSE team. CCHMP reviewed a sampling of 36 SMR Permitted Work Audits from 2015, 2016, 2017, and one from 2018 and found that about half of the audits were performed on three contractors.

Per SME interview, SMR provides training requirements to the third-party vendor which is then uploaded to the system. These requirements include the use of PPE, Emergency Procedures, LOTO, confined space entry, and other skills assigned as appropriate for the job that the contract employee will be doing. For job specific training, SMR relies on the third-party vendor to determine the appropriate level of training required to perform certain tasks. Per review of 7 of the 36 PSM office audits completed by the SMR audit team, each contractor provided documentation that covered competency performance measures which evaluate the skill level of each contract employee related to the job being performed.

Per SME, the site Contract Holder is also to play a role in conducting field audits of their contractors independent of the Permitted Field Audits performed by the HSSE group. However, SMR does not currently specify this in Procedure I(A)-42.



A47-05 Does/did the contract owner or operator assure that each contract employee is trained in the work practices necessary to safely perform his or her job including, but not limited to, the following: a) The potential hazards related to their job;b) Applicable refinery safety rules;c) And in the applicable provisions of the owner or operator’s emergency action pland) And the requirements of HSC Section 25536.7? [T19 CCR §2762.12(c)(1) & ISO Section 450-8.016(a)(11)]

Consider updating I(A)-42 so that it specifies that all contractors working on or near a covered process (e.g., defined by certain HSSE classifications) should be audited within a specific timeframe.

I(A)42 or a similar document will be updated to reflect the audit requirements.

2/28/2020Per review of Procedure I(A)-42, section 6.6.2 SMR Contractor PSM Audit and Record Review, the procedure states that no fewer than 12 contractors (including routine, turnaround, and projects) who work on a covered process shall be selected and audited using the Contractor HSSE PSM Audit checklist.


The evaluation sheet lists the company name and the SMR Contract Owner and Contract Holder. SMR audited 12 contractors in 2017, 12 in 2016, and 12 in 2015 for a total of 36 contractors. Per the list generated by procurement, there are a total of 70 contractors listed as HSSE high risk, 20 listed as HSSE Medium risk and 94 listed as HSSE Low risk. The list provided by the procurement group has 54 contractors that are not part of the HSSE group. SMR will need to modify their process as any contractor working on or near a covered process is subject to the contractor auditing requirements. CCHMP found a different issue during the previous audit. Although it is not a regulatory requirement to modify the contractor policy, SMR is encouraged to revise Procedure I(A)-42 so that it focuses on auditing all contractors that come onsite including the medium and low risk contractors.




A49-27 Does the submitted RMP and Safety Plan accurately reflect the existing management system at the Stationary Source? [T19 CCR §2745.2(d), ISO Section 450-8.016 and Section E.2 of the CCHMP Safety Program Guidance Document]

Consider updating the RMP and SP to better reflect the Program 4 safety programs and responsibilities when fully implemented.

Both the RMP and SP are due in 2019 and will be updated to reflect Program 4.

8/31/2019Section 4 of the RMP (rev. Dec. 5, 2016) and the Safety Plan (rev. Aug. 2016) describes an integrated management system that is in place at SMR to oversee implementation of safety prevention elements. There is a tabular representation of the safety program elements and the corresponding program owner responsible for the implementation of the program. CCHMP notes that the list may not be current as it listed the HR Manager as the owner for the operating procedure and training topics rather than the L&D Manager and the list did not reflect all the current CalARP Program 4 prevention program elements. However, the facility has until September 30, 2019 to update the RMP and Aug 2019 for a SP update.




Consider evaluating the use of a computerized tool for evaluating contract employee hours as they relate to Shell's fatigue policy and API RP 755.

Contractor fatigue was addressed in the revision of the Latent Condition Checklists per the req. Periodic reviews of contractor gate logs occur. This is sufficient for this action.

ClosedCCHMP reviewed the facility's Policy for Management of Overtime Limits, G(A)-28 (revised July 2017, rev 7). The policy identifies the maximum number of days and hours an employee may work during normal operations and during outages. The policy covers both 12-hour and 10-hour shifts. For example, if working a 12-hour shift during normal operations, the limit is working 7 consecutive days or nights; if working 12-hour shift during an outage, the limit is 14 consecutive days or nights.



CCHMP reviewed completed LCCs from the following PHAs completed in 2016: Pentane Storage, Distillate Hydrotreating Unit, Delayed Coker, Distillate Saturation Unit, Sulfur Recovery Unit #4. CCHMP observed LCC questions related to a number of the items listed in the question. CCHMP was unable to locate questions related to task complexity or contractor fatigue.



CCHMP reviewed LCCs associated with operating and maintenance procedures. Similar to previously described, CCHMP


ID# Question Consider Proposed Remedy Due DateFindingsobserved questions related to a number of the items listed in the question although was unable to locate questions related to task complexity or contractor fatigue.

CCHMP was informed that part of the Contractor HSSE PSM audit process, a question is asked regarding contractor fatigue. The question asked is "Does your company have a system for tracking compliance to API RP 755 (Fatigue Management Policy)?" CCHMP was informed this is relatively new question, as it started to be asked during Contractor HSSE PSM audits in 2016. CCHMP was also informed that approximately three years ago Shell developed a macro to sample contractor hours submitted for payment to get a feel for their compliance with Shell's fatigue management policy. Timekeepers at Shell have run the macro in the past and it occasionally highlighted individual contractors that exceeded the fatigue policy. Contract Holders were subsequently informed and asked to check with the contracting company to bring this to their attention. CCHMP was informed that the use of the macro was not a requirement nor part of the Timekeeper's normal work process and it is currently not being used.




A51-04 Did the Stationary Source perform Procedural PHAs to evaluate potential active failures or unsafe acts in the procedure such as missed or out of sequence steps and including raising questions regarding the availability of personnel to perform a task as specified in the procedure? [ISO Sections 450-8.016(b)(1) and Section B: Chapter 4.3 of the CCHMP Safety Program Guidance Document]

Consider performing additional procedural PHAs even for procedures that fall out of the critical procedure classification if the PHA team deems it beneficial or if other criteria is identified.

Review and revise as necessary I(A)-48 and I(A)-49 on selecting which procedures will be considered as Critical and also the multiple different methods for reviewing Critical Operating Procedures. These methods will include, but not be limited to, our current procedure HAZOP Review process.

1/15/2020CCHMP has reviewed I(A)-49 (Procedures HAZOP, last revised 11/16) which states that Procedures HAZOPs (called critical procedure audits at SMR) are performed on all critical operating procedures. Per CCHMP review, SMR has 44 critical operating procedures.

Per CCHMP's 2015 audit, there was an action item to change the process of critical procedure audits from looking at just "critical steps" to reviewing all steps in the procedure. Per CCHMP interview, now every step in a critical procedure is included in a critical procedure audit.

CCHMP has reviewed 4 Procedural PHAs:

1) CCU-2100, CCU Shutdown (critical procedure audit study dates of 6/14/27, 7/17/17, and 8/7/17)

2) CFH-4270, Loss of DEA Circulation to H2S Absorber and Continued Operation of CFH (critical procedure audit study date 5/24/17)

3) FXU-2127, J-201 Air Compressor Shutdown (critical procedure audit study date 2/15/17)

4) SR3-2100, SR3 Shutdown for Turnaround (critical procedure audit study date 3/22/17)

Per CCHMP review, the Procedural PHA team has evaluated the hazards of the procedure and has created recommendations to improve the procedure when needed.

Per CCHMP interview with SME, the Procedural PHA team discusses each step. If there is no consequences the team will document no consequences of concern.

Additionally CCHMP reviewed the critical procedure list and notes that some procedures have fallen off the list. Per interview, this occurs during the 3 year review, if during the review the procedure is deemed by the team no longer critical it will be removed from the list and a procedural PHA will not be done.

Per interview there are no immediate plans to perform procedural PHAs on procedures that are not identified as critical. CCHMP suggests all facilities should consider performing more procedural PHAs.




Consider updating C(A)-49 to include that SPA will be performed for all scenarios where the PHA identifies potential for a major incident. CCHMP notes that this may not be the only P4 update required for this policy.

Updated HEMP procedure (C(A)-49) to reflect the requirement to perform a Safeguard Protection Analysis (SPA) – Layers or Protection Analysis (LOPA) in SMR – for each scenario that currently identifies the potential for a major incident.

ClosedPer CCHMP review of 7 PHAs conducted between 2015 and 2017, each of the PHAs included a LOPA analysis. Per interview, SMR uses LOPA as the method for performing a safeguard protection analysis.







Consider better documenting in the SPA reports why the initiating event frequency was chosen for scenarios with multiple initiating event frequencies.

Updated PHA Guidance Document so that PHA LOPA worksheets contain commentary of why certain initiating events were chosen for scenarios with multiple initiating event frequencies (IEFs). This applies for scenarios with multiple initiating events for which the most conservative IEF is chosen for the LOPA.

ClosedPer CCHMP review of 7 PHAs, the SPA (using LOPA) is incorporated into the PHA report. The PHA worksheets include columns for the LOPA (safeguards, verification, probability of failure on demand, LOPA analysis, recommendations, and comments).





SMR has clearly defined conditions that are acceptable to be used and when. For example for initiating events related to human error the team has to take into consideration the skill of the craft and when the task is done. Another example is that probability of explosion can be used as a conditional modifier and control of ignition sources can be used for certain rates of release and distance from the ignition source. Another commonly used event frequency that is clearly defined in the DEP is for general human error probabilities where the event frequency is determined by the human error * number of critical steps * opportunities/year


Per CCHMP review, the written reports for the two LOPAs conducted after the P4 regulations became effective did not


ID# Question Consider Proposed Remedy Due DateFindingsinclude necessary maintenance and testing to ensure all Independent Protection Layers (IPL) function as designed.

A51-17 Has the owner or operator developed a documented corrective action work process to promptly complete all corrective actions that includes the following:a) Final decision for each recommendation;b) Corrective actions implemented for each accepted recommendation including completion date and assignment of responsibility;c) Rejection of recommendations;d) Any alternative safeguards;e) Team members written comments on any rejected or changed findings and recommendations;f) Whether an SPA was promptly revalidated or updated if prompted by a PHA, HCA, DMR or SPA corrective action;g) Prioritize the completion of corrective actions to address process safety hazards to prevent the potential for a major incident;h) Corrective actions to be completed within 2.5 years after the SPA; andi) Corrective actions to be completed during the first regularly scheduled turnaround? [T19 CCR §2762.2.1(h) & §2762.16(e)]

Consider updating C(A)-49 to reference the current database tool used for action item tracking.

C(A)-49 was updated. ClosedPer CCHMP review of C(A)-49, the following process is used for LOPA recommendations: "The local management team, including the unit Production Unit Manager (PUM) and any other affected managers, meets with the PHA team to review the draft PHA report and agree upon the PHA Team's final recommendations......" Per the policy, the recommendations are entered into Fountain Assurance Management (FAM). Per CCHMP interview, this database is no longer being used and has been replaced by RADAR. The policy should be updated to include the correct references.

Furthermore, the policy states that the due date set for the recommendations usually follows the CCHMP ISO 1 year requirement or the DSM Prioritization Tool.




Consider revising the incident investigation policy to include that human systems will be considered for investigations of major incidents and incidents that could have reasonably resulted in a major incident.

Incident Investigation procedure I(A)-6 updated to clarify requirements for human systems/LCC.

ClosedAs mentioned in A45-01, the Incident Investigation Procedure: I(A)-6/EM-11.1 Investigations and Incident Reporting (rev.15, dated Sept 2016) includes requirements for investigating Major Chemical Accidents or Releases (MCARs) and incidents that could have reasonably resulted in a MCAR, but not major incidents or incidents that could have reasonably resulted in a major incident. See A45-01 for more discussion on this topic and related ensure item.




Potential MCARs:

1. FXU Tubing Failure and Release (8/16/17)2. Loss of SP2 Sulfur Seal #2 (1/11/17)3. HCU TA H2S exposure (100 ppm) (5/2/17)4. Tier 1 Release of Antioxidant and Gasoline (3/28/17)

MCAR event:






A53-04 Did the owner or operator develop a schedule for revising existing operating and maintenance procedures based on a human factors analysis? [T19 CCR §2762.15(e) & Section B: Chapter 6.1.2.4 of the CCHMP Safety Program Guidance Document]

Consider reviewing and applying the latest SMR developed maintenance procedure A(A)-37 for review and updating of the Instrumented Protective Functions (IPFs) procedures.

A(A)-37 does include process for updating IPFs. Action considered closed.

ClosedAs described in A53-02, operating procedures are reviewed every three years and this review includes a review of human factors LCCs.

CCHMP reviewed Procedure A(A)-37: Create and Revise Maintenance Procedures, rev. 3, February 2018. This procedure establishes fundamental requirements for creating and revising field maintenance activities. This procedure applies to all employees who create and approve maintenance procedures, work instructions and safe work practices. The procedure uses a decision tool that assesses task complexity, familiarity and criticality to determine the combined risk and the choice of one of three levels of LCC checklists.

Per interview with the Training Supervisor responsible for development of maintenance procedures, SMR previously (about 2013) reviewed all written maintenance procedures and work instructions and ranked them per the procedure tool available. At that time, only one maintenance procedure and the Instrument Protective Functions (IPFs, approximately 200 procedures) were ranked as true procedures. The other procedures were identified as work instructions that did not require human factors LCC or step by step sign offs. As of 3/1/2018, all procedures previously documented for maintenance activities will be reviewed. Those procedures that have actual maintenance activities will be risk ranked based on the new policy A(A)-37. The maintenance procedures will address one of the human factors LCCs appropriate to the level of the risk ranking. A more recent review of maintenance procedures identified 86 procedures that involve maintenance activities and there are additional maintenance related procedures that will be selected and reviewed that would be included in the review. Per interview with the maintenance training supervisor, SMR will review approximately 100 to 200 maintenance related procedures and complete at least 50 percent by 9/30/2020 and one hundred percent by 9/30/2022, per the P4 CalARP requirements.

The IPFs have their own Procedure (C(A)-13: Requirements for Safety Instrumented Functions) that does not specify which LCC is used for review of the IPF procedures. For review and updating of the IPFs procedures, SMR should also consider reviewing and applying the latest developed maintenance procedure A(A)-37.



A53-09 Has the Stationary Source trained employees responsible for developing and maintaining the procedures in rules for writing effective instructions? [Section B: Chapter 6.1.2.5 of the CCHMP Safety Program Guidance Document]

Consider providing live training on effective procedure writing using human factors LCCs for first time maintenance procedure writers and provide computer based training as a supplement to the live training and also as a refresher training.

Add Maintenance Procedure Writers to the roster for all future Procedure Writer training sessions and add E-Learning Procedure Writer course to their SOU profile.

12/15/2019Each of the six refinery Production Departments has identified a production mentor who is responsible for developing and maintaining the operating procedures. The Training Department manager trains the Production Department mentors on a face to face training basis on written guidelines that summarize the accepted manner in which procedures are to be reviewed, revised, and maintained. The training manager also covers the rules for writing effective instructions, and how to manage procedures and documentation of the review process.

The training department also maintains a computer based training module on writing effective procedures that includes a handout titled "Basic Procedure Writing Skills". The production mentors complete this training as a part of their refresher training on writing effective procedures.

Per interview with the Training Supervisor responsible for training the maintenance department employees, the computer based training module will be used to train maintenance employees assigned to reviewing and maintaining the maintenance procedures. CCHMP reviewed this training module that takes about half an hour to complete and found it to be an effective tool for this training. However, maintenance staff that will be assigned to writing procedures may not have any familiarity for writing effective procedures using latent conditions checklists. CCHMP believes that live training similar to that for operating procedures should be provided to the first time maintenance procedure writers and computer based training can be used as a supplement to the live training and also as a refresher training.




Consider specifying roles for the actionable steps for procedures that require more than one field operator or the more complex procedures like shut down or startup and critical procedures in addition to emergency procedures.

Consider conducting additional activities to assess whether human factors considerations exist (e.g., perform procedural walks in the field).

A(A)-32 Controlling Operating Procedures and associated LCC will be updated to add this consider for steps where this would add value.

Additional activities to assess human factors will be addressed in the proposed remedy for A51-04.

12/15/2019Procedure A(A-32): Controlling (Reviewing/Revising) Operating Procedures, dated Nov. 2016 addresses the steps to edit, review and revise procedures and what position is responsible for these reviews. The purpose of this procedure is to establish the requirements for controlling, reviewing and revising operating procedures (including Work Instructions) in accordance with MOC requirements. The procedure has several requirements including a functional review, a technical review, a compliance review including the use of Latent Conditions Checklist, preliminary and final review and approval, a final edit review and placing the document into the controlled system.


Based on a review of the referenced procedures and the procedure walks completed, CCHMP noted the following concerns:- Some of the procedures include caution statements or supporting information with actionable steps that need to be corrected to the procedure action steps. An example is a note in Procedure DHT-4115 that has been added as a result of a DHT PHA action item implementation that indicates "Without wash water from stripped sour water or condensate from utilities, corrosive ammonia salts will build up quickly in the circuit, for this reason It is recommended that the Corrosion Materials Engineer be notified anytime DHT loses wash water." This supporting information includes an actionable step that needs to be placed into the procedure steps.- The placement of caution statements also need to be reviewed to make certain that they are placed before the applicable process step rather than steps away from the applicable process step (e.g., SR4-2101).







A53-19 Has the Stationary Source incorporated the following into maintenance procedures: a) Elements listed in A53-16;b) List the craft or personnel to which the procedure is applicable;c) Labeled graphics should be included for the user’s benefit;d) Sufficient detail must be used to reduce interruptions (i.e., times that the user must stop the procedure or put the procedure down);e) The procedure should include the Scope and Purpose;f) Special tools and equipment necessary to complete the job should be listed at the beginning of the procedure;g) Specific or unique cleaning supplies should be noted;h) Appropriate health and safety information should be included or referenced;i) The personal protective equipment necessary to complete the procedure should be listed at the beginning of the procedure and immediately before the step to which they apply; j) Should include required follow-up actions or tests and identify the user who must be notified as appropriate;k) Consider identifying critical maintenance tasks; andl) Consider including self-checks that should be used

Consider comparing and incorporating the elements included in Section B, Chapter 6.2 of the Safety Program Guidance Document and this question into maintenance procedure writing training.

Will review and add the elements into the Procedure Writers training curriculum where appropriate.

12/15/2019Per interview with the Training Supervisor responsible for training the maintenance department employees (SME), SMR had previously screened the maintenance procedures and identified one procedure to review for compliance with the ISO requirements and that procedure was:- CDM-1P: Safe Use of Bleeder Cleaner/ Rodout Devices, reviewed 4/1/2016.

CCHMP also reviewed an LCC that was completed for this procedure that contained 20 questions. The LCC did not identify any corrective actions.

Per interview with the SME, the computer based training module referenced in A53-09 is planned to be used to train maintenance employees assigned to reviewing and maintaining the maintenance procedures. CCHMP reviewed this training module and found it to be an effective approach for this training. A combination of this training module with the three types of Human Factors LCCs included with Procedure A(A)-37: Create and Revise Maintenance Procedures generally address the requirements for this question. However, the elements included in Section B, Chapter 6.2 of the Safety Program Guidance Document should be compared with the computer based training for writing effective procedures and also incorporated into a live training for effective procedure writing.


ID# Question Consider Proposed Remedy Due DateFindingsduring maintenance activities? [Section B: Chapter 6.3.1 of the CCHMP Safety Program Guidance Document]



A56-05 Does the Stationary Source maintain training documentation (e.g., curriculum, instructor qualifications, course duration, course participants, and means used to ensure participants understood training) for: a) Basic awareness of human factors initial training;b) Overall human factors program; and c) Specialized training (e.g., completion of Latent Conditions Checklist)? [Section B: Chapter 9.2 of the CCHMP Safety Program Guidance Document]

Consider including the training topics on the Sign In Sheet/Training Roster form for new hire operator training.

Consider modifying the SOU Human Factors training, associated with I(A)-15, to identify that latent conditions checklists are used to evaluate maintenance procedures.

A separate training sign in sheet will be used for Human Factors in future New Hire sessions.

Updated I(A) -15 training to reference maintenance procedures. (closed)

12/15/2019CCHMP was informed that human factors training is required for all new operators and maintenance employees. Currently, the H&S Representative and Environmental Representative provide this training during one of the new hire training sessions. CCHMP reviewed documentation associated with this 2-hour course and confirmed it contained training on basic awareness and on the overall human factors program. The facility documents who receives this training and uses a Q&A process with breakout sessions to verify understanding. CCHMP was informed that some of the individuals performing the training were involved with the original human factors program development or had received the training in the past. Section 8.0 of the Human Factors policy I(A)-15 identified that employees who received the initial awareness training or refresher training on Human Factors are qualified to train others on the application of the LCCs.

For new hire operator training documentation, CCHMP reviewed an agenda that identified human factors training was to be provided on 1/8/18. CCHMP was informed that face-to-face training documentation is maintained on sign-in sheets. Reviewing the Sign In Sheet/Training Roster for the new operator hires and although it listed the attendees, it did not identify that initial human factors training was actually provided. CCHMP spoke with the trainer and confirmed training was provided on that day. For maintenance new hires, their initial face-to-face training on human factors (dates ranged from 2/2/16 through 1/24/18) was documented on Sign In Sheet/Training Rosters along with attendee signatures.

CCHMP was informed that all other site personnel review their initial Human Factors training, associated with I(A)-15, through the Shell Open University (SOU). This training is computer based and includes instruction and quizzes. Every individual assigned to take this course is tracked and documented when training is completed. CCHMP reviewed the SOU course and confirmed it covered basic awareness and the overall human factors program. The training also touches on the use of latent conditions checklists for PHA, operating procedures, incident investigations and management of organizational change. CCHMP notes there was no mention of using latent conditions checklists for maintenance procedures. CCHMP reviewed SOU training documentation on Human Factors for the entire site for all employees, a list of over 650 employees. Human Factors training was documented for each employee. CCHMP also reviewed training for 8 operations and maintenance personnel and confirmed that test results are maintained to verify employee understanding.


ID# Question Consider Proposed Remedy Due DateFindingsCCHMP reviewed specialized just in time human factors training associated with incident investigations. This training was documented on sign-in sheets and kept online along with other incident investigation information. Power Point slides are used to perform training on the LCC process prior to the incident investigation team completing the LCC. CCHMP reviewed the training slides and confirmed it included discussion of the LCCs. Just in time training conducted takes between 10-15 minutes.

CCHMP reviewed specialized just in time human factors training associated with PHAs. Documentation of this training was included within the PHA reports. CCHMP reviewed the training slides and confirmed it included discussion of the LCCs.

A57-14 Does the submitted RMP and Safety Plan accurately reflect the Root Cause Analysis method and Accident History information maintained by the Stationary Source? [T19 CCR §2745.2(d), ISO Sections 450-8.016, 450-8.016(e), and Sections E.4 and E.6 of the CCHMP Safety Program Guidance Document]

Consider revising the Safety Plan at the next submittal to include the 2016 MCAR in the 5-year accident history.

Safety Plan is due in 2019 and the 2016 MCAR will be included.

8/31/2019The 2016 RMP and SP accurately reflect the accident history maintained by the stationary source, however, the site RCA methodology is not accurately reflected. See A57-05 for further discussion on this topic. The stationary source must work with CCHMP to determine if the incident investigation methodology is equivalent to RCA methodologies approved by CCHMP. See A57-05 for further discussion and related ensure item.

As mentioned in A57-13, the MCAR event that occurred 12/19/16 is not included in the submitted Safety Plan (dated 8/26/16). The Safety Plan should be updated at the next submittal due in 2019 to include the 2016 MCAR event in the 5-year accident history.




Consider updating the ISS/HCA policies to incorporate the following:-- Major incident-- Highly hazardous material definition-- Citing Program 4 CalARP regulations -- HCAs are to be performed associated with a major change regardless of incident potential-- HCAs are to be performed associated with major incidents instead of catastrophic releases.

Consider modifying I(A)-43 to differentiate between the Program 4 and ISO definitions for ‘major change’ and impacts to HCAs/ISSAs.

I(A)-43 will be updated to clarify when HCA/ISS is required and the definitions of major change.

12/15/2019CCHMP was informed that the facility has not made or proposed any major changes to their processes nor has there been any qualifying incidents / investigations since October 2017. Related to HCA documentation, there were no HCAs/ISSAs to review associated with question items b) through d). The facility had one MCAR event in 2016, but the RCA report did not identify any recommendations consistent with a major change. CCHMP was also informed that the facility currently does not have a method to track "major incidents" as personnel was led to believe through Cal OSHA discussions that tracking potential MCAR events would encompass all major incidents. Although similar, there is a difference between potential MCAR events and potential major incidents. Therefore, it is unclear to CCHMP whether the facility has performed HCAs when required.

CCHMP reviewed the facility's Inherently Safer Systems / Hierarchy of Control policy, I(A)-43 (revised February 2018, rev 7). This policy identifies that ISSAs are required in the development and analysis of PHA recommendations. Several items are noted on this policy that are either inconsistent with the Program 4 requirements or could assist with Program 4 compliance:-- "Major incident" is not mentioned in the policy-- "Highly hazardous material" is not mentioned in the policy-- "1st Order" and "2nd Order" inherent is not mentioned in the policy-- Program 3 CalARP regulations were cited in the policy instead of Program 4 -- Section 6.1 identifies that ISSA needs to be performed on major changes that could reasonably result in a MCAR. Program 4 requires HCA to be performed associated with a major change regardless of incident potential.-- Section 6.1 identifies that ISSA needs to be performed on incident investigations associated with actual or potential catastrophic releases of a regulated substance. HCAs are now required under Program 4 associated with major incidents instead of catastrophic releases.

CCHMP also noticed a discrepancy associated with policy I(A)-43 is it defines 'major change' that is consistent with ISS requirements but conflicts with Program 4. Currently, I(A)-43 defines major change as a "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". This is the same wording as listed in Contra Costa County's ISS Guidance Document for evaluating ISS for a "new process". Program 4 defines major change as, "(1) introduction of a new process, or (2) new process equipment, or new regulated substance that results in any operational change


ID# Question Consider Proposed Remedy Due DateFindingsoutside of established safe operating limits; or (3) any alteration in a process, process equipment, or process chemistry that introduces a new hazard or increases an existing hazard." CCHMP believes the current wording listed as major change in I(A)-43 should remain for ISO applicability for ISS, but needs to be modified to satisfy Program 4 HCA requirements.

CCHMP reviewed "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. This policy is used for evaluating new processes and projects for ISS consideration and is further described in A58-06. CCHMP found Program 4 requirement gaps in this policy similar to I(A)-43.





Consider modifying the ISS/HCA policies to describe and document first order then second order inherent safety measures, and then, if necessary, passive, active or procedural risk reduction measures in every HCA/ISSA report.

Our main policy I(A)-43 for HCAs/ISSAs will be updated to include this requirement.

12/15/2019Existing Process:The existing process HCA/ISSA is completed during PHAs using an Inherently Safer System Checklist from the County's SP Guidance Document and is documented through the completion of the ISS checklist and PHA. CCHMP reviewed two PHAs: Catalytic Gasoline Hydrotreating Unit (completed in October 2017) and CO Boilers (completed in December 2017). The facility did not identify any written recommendations subject to HCA evaluations associated with these PHAs.

New Processes:CCHMP reviewed Procedure 2.15A & 2.15B and was unable to locate the Program 4 requirement of a top down HCA approach. CCHMP was informed that there has been no new process, new process unit or new facility ISSA/HCA evaluations since the last CCHMP audit. The facility has evaluated projects for ISSA applicability. CCHMP reviewed three project ISSAs completed since the last audit. The documentation ranged from completed ISS checklists to more of a report format. CCHMP was informed that the level of detail used for the documentation has depended upon the size and complexity of the project. None of the ISSA documentation mentioned the top down approach for HCAs identified in the question. CCHMP reviewed the following project studies (see A58-06 for more information related to new process HCAs/ISSAs evaluations):-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17, not required under ISO or Program 4-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18, not required under ISO or Program 4-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through 1/17, not required under Program 4 but subject to ISO.




ID# Question Consider Proposed Remedy Due DateFindingsPHA Recommendations:CCHMP reviewed ISSA documentation for select completed PHA recommendations. The format used for the documentation was consistent with that identified in Attachment G of the facility's PHA policy, I(A)-50. As described below, the format used does not incorporate all the items listed in the question. The documentation includes: -- The name of the PHA study; -- Team members and roles; -- PHA scenario; -- Summary of recommendation and ISS strategy taken;-- Other options considered but not taken and reason why they were not implemented:-- Process Safety Manager review and approval signature and date.




Consider modifying Procedure 2.15A & 2.15B to identify that HCAs need to be performed during the design and review of new processes, new process units, and new facilities, and their related process equipment regardless of incident potential.

Consider incorporating the guideword approach listed in Attachment D of CCHMP's SP Guidance Document into Procedure 2.15A & 2.15B for ISS evaluations during HAZOP method assessments as an option if an ISS checklist is not used.

ISS/HCA Procedure I(A)-43 will be updated with the following:-Include definition of a major change, which includes new processes-Clarify requirement to perform ISS analysis during design phases of a project which include:1. Assess/Select 2. Define 3. Execute

12/15/2019CCHMP reviewed the facility's policy titled, "Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS", revised 6/2016, rev 16. SEO is Safety, Environmental and Operability reviews. ISS is Inherently Safer Systems. The policy identified that ISS is reviewed at three distinct phases of the design process: Select (SEO1), Define (SEO2) and Execute (SEO3). Associated with each of these phases, different SEO/ISS questions are asked using three different checklists. Per interviews, these phases match those listed in the County's SP Guidance Document (e.g., chemistry forming, design scoping, and basic design). This Shell policy also has a fourth checklist that is to be used prior to startup that also includes ISS questions.


Shell evaluated each of the following for ISS events though not all of them were subject to ISS requirements. The first two projects listed below were small in scale and did not meet the criteria in the County's ISS guidance or Program 4. The third was significantly larger and more complex and did meet the criteria in the County's ISS guidance but did not meet that identified under Program 4 (even if the event had happened after 10/1/17).-- ER 3257 FXG Flare MACT Compliance, SEO1 & SEO2 phase analysis dated 10/24/17-- ER 3334 V525 H2 Discharge, SEO1 phase analysis dated 1/9/18-- ER 3227 CGP Energy Recovery Project PSE 11309, dated 11/16 through 1/17

For the first two projects, the facility followed their Procedure 2.15A & 2.15B policy and evaluated each using their ISS checklist as well as their SEO design checklist. These projects are new and have only completed up to phase 1 for ER 3334 and through phase 2 for ER 3257 of the facility's design process. Projects must complete all three phases before a project can be considered viable. The last project, ER 3227, has passed all three phases of review and was subject to the County ISS requirements since the new project met the ISS condition of "major revamp of an existing process resulting in a substantial change in the process configuration or process chemistry". CCHMP reviewed documentation associated with this project and was unable to


ID# Question Consider Proposed Remedy Due DateFindingslocate completed ISS checklists for any of the three phases. CCHMP was informed that this large project went through multiple rounds of HAZOP reviews at each of the three phases of its design. CCHMP was informed that the facility's simple ISS checklists are not useful for large projects like these and instead the teams evaluated ISS opportunities through the HAZOP and through discussions. Similar large project ISS reviews in the past had been documented through more of a narrative approach than using the ISS checklist. CCHMP was unable to locate any ISS narrative summary for this project. CCHMP reviewed Procedure 2.15A & 2.15B policy and was unable to locate a discussion of using a narrative ISS summary to document ISS reviews.




A58-07 For all Inherently Safer System / Hierarchy of Hazard Control Analyses does the owner or operator employ teams with expertise in engineering and process operations including an operator currently working the unit and one member knowledgeable in the ISS/HCA method used to perform, update and document the analyses? [T19 CCR §2762.13(d) and Section D.1.1 of the CCHMP Safety Program

Consider modifying all policies associated with conducting HCAs/ISSAs to identify that HCAs need to be performed with an operator currently working the unit.


12/15/2019PHA Recommendations:CCHMP confirmed that the PHA teams include appropriate personnel listed in the question, including an operator currently working the unit when PHA recommendations are developed. CCHMP was informed that many times the entire PHA team is involved with developing PHA recommendations, and for items needing an ISSA, the entire PHA team participates in that as well. There are situations where an additional barrier is needed that is undefined by the PHA team so the item is referred to others (e.g., Project Development Group) to determine the best course of action. Currently, for those types of ISS evaluations, it has been performed by an engineer or several engineers and has not included an operator currently working the unit. CCHMP reviewed two PHAs completed since October 2017 and did not locate any PHA recommendations that would be subject to ISSA/HCA. CCHMP reviewed other PHA recommendations that were subject to ISS evaluation, which were performed and documented as described above and in A58-12.

New Processes:Per interviews and review of the Procedure 2.15A & 2.15B, team members are selected based on the complexity and phase of the project. Section 6.1 of the policy specifies team participants for the various three phases. Reviewing this table, CCHMP was unable to locate mention of an operator currently working the unit. New project ISS studies are mentioned in A58-06. Two of these studies reviewed were started after 10/1/17 although did not meet the conditions of Program 4 of proposing any "new processes, new process units, and new facilities, and their related process equipment". As such, none of the "new process" ISS evaluations were subject to needing an operator currently working on the unit.

Major Incidents:As previously described, the facility currently does not define major incidents nor track them. An action item has been listed in A58-01 to incorporate major incident into their ISS/HCA evaluation process. The facility has tracked MCAR events. Based on CCHMP's review of the one MCAR event in 2016, there were no recommendations consistent with a major change that triggered an ISSA. CCHMP was informed that it is likely the individuals selected to assess an HCA/ISSA associated with a major incident or MCAR may include corporate design representatives or at a minimum the Project Development Group although that is not defined in policy I(A)-43.

Major Changes:As previously described, there have been no modifications


ID# Question Consider Proposed Remedy Due DateFindingsproposed consistent with the definition of a major change currently listed in the Program 4 regulations. CCHMP was informed that likely the same individuals listed under Major Incidents identified previously would perform the ISSA/HCA.

Existing Processes:The facility evaluates their existing processes for HCA/ISSA within their PHA study. Team members for the HCA/ISSA study are typically the same as the PHA team, which includes one or more engineers, at least one operator from the unit, and a facilitator who is also an engineer. The facilitator is trained on PHA methods as well as on the process used to evaluate for inherently safer systems using the ISS checklists that are listed in the County's SP Guidance Document. CCHMP reviewed the ISSAs performed for the five PHAs listed in A50-02 and confirmed each team composition matched this list. CCHMP also reviewed PHAs completed after October 2017 and confirmed the same team composition.



A58-08 Does the Stationary Source adequately document their Inherently Safer Systems analysis for new processes for each phase? Documentation maintained should include, as applicable, but is not limited to:a) ISS team makeup, responsibilities, qualifications and experience;b) Criteria used to require an ISS review for the process;c) The relevant ISS questions asked and answered (e.g., can quantities be reduced, can other chemicals be used, can different equipment be used, etc.);d) The information available during the ISS assessment (e.g., chemical compatibility matrix, chemical properties, material and energy balances, PFD, P&ID, etc.);e) How process improvements were reviewed and the determination of the process that was determined to be the inherently safest process;f) The process used to determine that the equipment sizes are minimized and the results of this determination;g) The process used to determine the minimum inventories needed and the results of this determination;h) The process used to simplify the covered

Consider updating Procedure 2.15A & 2.15B to clearly identify that each phase of ISS evaluation of a new process or significantly modified process must be documented.

ISS/HCA Procedure I(A)-43 will be updated to clearly identify that each ISS analysis conducted during each phase of the project (Assess, Select, and Define) must be documented with the elements identified in the regulations.

12/15/2019Section 6.2 of Procedure 2.15A & 2.15B identifies that the team is to document all of the items listed in the question. Of the three project ISS evaluations reviewed in A58-06, only one of them, ER 3227, was subject to County ISO ISS requirements, and therefore, subject to this question. CCHMP reviewed the documentation associated with this project and was unable to confirm that items b) through k) listed in this question were documented for any phase.



ID# Question Consider Proposed Remedy Due DateFindingsprocess, if applicable, and the results of this process;i) The process used to reduce the waste made from the project and the results of the determination; j) Applicable items considered from the ISS checklist in Attachment C of the SP Guidance Document; andk) For applicable items from the ISS checklist in Attachment C of the SP Guidance Document that were not considered, the Stationary Source should document why each item was not considered. [Section D.1.1 of the CCHMP Safety Program Guidance Document]



A58-12 Does the owner or operator within 30 days of completing the HCA/ISS adequately document their analysis in a report, including: a) A description of the composition, experience, and expertise of the members of the team that performed the HCA/ISS analysis; b) A description of the methodology and approach used by the team;c) A description of each process safety hazard analyzed by the team, including identifying, characterizing and prioritizing process safety hazards;d) Identification and description of the inherent safety measure(s) and safeguards analyzed by the team, including publicly available information on inherent safety measures and safeguards identified and analyzed;e) The conclusions of the analysis;f) The rationale for the inherent safety measures and safeguards recommended by the team for each process safety hazard, including documenting first and second order inherent safety measures and remaining risks (passive, active, procedural);g) An action plan, including a timeline to implement the recommendations? [T19 CCR §2762.13(g), ISO

Consider modifying all policies associated with conducting HCAs/ISSAs to identify that HCAs need to be documented within 30 days after completing the analysis and need to include the items listed in the question.


12/15/2019CCHMP reviewed a number of policies relating to HCAs/ISSAs (e.g., I(A)-43, Procedure - 2.15A & 2.15B (A) SEO Reviews for all Projects (B) for Projects Subject to ISS, I(A)-50, C(A)-15) and none of them identified that an HCA/ISSA report needs to be developed or includes the information within the question within 30 days of completing the analysis. It is not a definitive requirement to include this statement within each policy.


PHA Recommendations:CCHMP reviewed two PHAs completed since October 2017 and did not locate any PHA recommendations that would be subject to ISSA/HCA. CCHMP reviewed documentation of past PHA recommendation ISS evaluation closures and found they satisfied the 2014 ISO regulation items described above under the New Process discussion.


MOC:


ID# Question Consider Proposed Remedy Due DateFindingsSection 450-8.016(i)(2) and Section D.1.2 of the CCHMP Safety Program Guidance Document]

There were no major changes proposed since the last ISO audit.






Consider updating Procedure 2.15A & 2.15B to describe how feasibility is determined similarly to section 6.7 of I(A)-43.

ISS/HCA will no longer be included in procedure 2.15A&B, and feasibility section will remain in procedure I(A)-43. I(A)-43 will be updated to include clear guidance on how to document feasibility for options considered.

12/15/2019In reviewing documentation associated with the project ISS evaluation for ER 3227, three of the project recommendations identified the following wording under the column identified as Inherently Safer Systems: "Other alternative design not viable" or "Other options considered are not viable". CCHMP was unable to locate a discussion of "other alternative design" or "other options considered" associated with ISS options, and more specifically, documentation that supports these rejected ISS options were not feasible.


In reviewing documentation associated with the above PHA recommendations, CCHMP found the following wording used for other options considered but not taken and the reason why they were not implemented: -- "Benefit of this option is grossly disproportionate from the risk" [KGP scenario 15.20, 15.27, 15A.17-- "team considers this option as not viable" [DSU scenarios 15.8, 18.2; CGH scenarios 7A, 3.1, 7A.24.1]-- "Other alternative design not viable" [CFH scenarios 4.1, 4.14; HGHT scenarios 1.4, 5.13; CCU-CGP scenarios 1.9.2, 1.30.1].








A58-19 Has the owner or operator developed a documented corrective action work process to promptly complete all corrective actions that includes the following:a) Final decision for each recommendation;b) Corrective actions implemented for each accepted recommendation including completion date and assignment of responsibility;c) Rejection of recommendations;d) Any alternative safeguards;e) Team members written comments on any rejected or changed findings and recommendations;f) Whether an HCA was revalidated or updated if prompted by a PHA, HCA, DMR or SPA corrective action;g) Prioritize the completion of corrective actions to address process safety hazards to prevent the potential for a major incident;h) Corrective actions to be completed within 2.5 years after the HCA; andi) Corrective actions to be completed during the first regularly scheduled turnaround? [T19 CCR §2762.13(h) & §2762.16(d-e) and Section D.1.5 of the CCHMP Safety Program Guidance Document]

Consider updating all policies associated with performing HCAs/ISSAs to meet the documentation and timing of completion requirements listed in the question.


12/15/2019The majority of this question is related to Program 4 requirements as only item i) in the question and clarification #7 are from the County ISO ISS guidance document. As previously described, only the existing process ISS studies and PHA recommendations after 10/1/17 have been subject to Program 4 HCA requirements.

None of the existing process ISSAs reviewed by CCHMP identified any ISS recommendations. CCHMP reviewed a total of 8 PHA recommendations that were related to an ISSA action. CCHMP reviewed the completion status of each of these and found the majority were closed out within 1 year after the PHA. Several recommendations were found to need a turnaround, DSU 2016 PHA scenarios 15.8 and 18.2, and the target closure date is 8/30/20.



A58-24 Does the owner or operator retain all HCA/ISSA reports for the life of each process? [T19 CCR §2762.13(i)]

Consider updating all policies associated with performing HCAs/ISSAs to identify that all HCA/ISSA reports are to be maintained for the life of the process.


12/15/2019This is a Program 4 requirement that became effective on 10/1/17. As of the date of this audit, the facility has maintained all HCAs/ISSAs since the Program 4 regulations became effective.

CCHMP reviewed the engineering project policy Procedure 2.15A & 2.15B. Section 6.6 of this policy identified that ISS documentation must be maintained for at least 10 years per County requirements. The CalARP Program 4 requirements now require documentation to be maintained for the life of the process.

CCHMP reviewed the section 10.1 of the HCA/ISSA policy I(A)-43 and found it identified to maintain ISS recommendations indefinitely. CCHMP was also informed that if an ISSA was performed associated with an incident (e.g., MCAR or major incident), the ISSA would be maintained along with other incident documentation indefinitely.


Consider updating all policies associated with performing HCAs/ISSAs to identify how to manage and document corrective actions that cannot be completed in prescribed time limits (e.g., development of interim safeguards).


12/15/2019This is a Program 4 requirement that became effective on 10/1/17. As previously described, only the existing process ISS studies and PHA recommendations have been subject to Program 4 HCA requirements. Since 10/1/17, CCHMP did not find any ISSA/HCA that qualified for interim safeguards. Per discussions with the PHA Coordinator, CCHMP was informed that if a scenario was identified, either through the PHA or ISSA, that scored in the red of Shell's Risk Assessment Matrix (RAM) and permanent solutions could not be implemented within a year, then interim safeguards must be implemented. CCHMP was informed that this has not occurred for ISSA action items since 10/1/17 so this question is not applicable.

CCHMP reviewed I(A)-43 and Procedure 2.15A & 2.15B and was unable to locate descriptions of implementing interim safeguards when necessary. It is not a requirement to include this in policies but is suggested.




Consider recording how the components required by T19 CCR §2762.14(b) and Section F6 of the Safety Program Guidance Document are being addressed by the PSCA.

2018/2019 PSCA was created via a matrix to ensure that each element of the requirements was addressed in one or more questions.

ClosedPer interview with the Safety Engineer and union representative, a breakdown of how the survey questions corresponded with components (a) through (d) was initially developed in 2010 for the previous SCA. However, no such mapping was conducted for the new questions included in the 2015 survey. CCHMP was unable to verify from existing documentation that the repeated questions from the 2010 survey were mapped to a specific component.


A59-10 Has the Safety Culture been reassessed at least once every 5 years? [ISO Section 450-8.016(h) & T19 CCR §2762.14(b)]

Consider conducting a PSCA that meets the Program 4 requirements. The deadline for conducting an effective PSCA and producing a written report and action plan to meet the Program 4 requirements is April 1, 2019.

PSCA that meets Program 4 Requirements was conducted by the 4/1/19 due date.

ClosedData collection for the most recent SCA was conducted between September 2015 and November 2015; data collection for the previous SCA was completed by November 2010. As such, the current SCA meets the requirement of reassessment at least once every five years.



A59-17 Did employees and employee representatives have access to all documents or information developed or collected by the owner or operator related to the PSCA program including information that might be subject to protection as a trade secret? [T19 CCR §2762.10(a)(3)]

Consider revising I(A)-71 to discuss the ability for employees and their representatives to access information developed or collected as part of the PSCA that might be subject to protection as trade secret.

I(A)-71 revised to include requirements listed.

ClosedPer interview with employees and employee representatives, the PSCA Team (which included employee representatives) had access to the 2015 safety culture survey results including all free-text responses recorded. Employees were given access to the 2015 SCA report and a spreadsheet displaying the collected data on the facility's intranet. Union representatives had access to the data collected for the PSCA and aided in the generation of the report. However, the ability for employees and their representatives to have access to information developed or collected as part of the PSCA that might be subject to protection as trade secret is not included in a written policy; CCHMP recommends including a description in the employee participation policy regarding employee and employee representative access to the PSCA information.

