United States of America

OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION

1120 20^th Street, N.W., Ninth Floor

Washington, DC 20036-3457

SECRETARY OF LABOR,
Complainant,
v.
BP PRODUCTS NORTH AMERICA, INC., and BP-HUSKY REFINING, LLC,	OSHRC Docket No. 10-0637
Respondents,
UNITED STEEL WORKERS LOCAL 1-346
Authorized Employee Representative.

ON BRIEFS:

Allison Graham Kramer, Attorney; Heather R. Phillips, Counsel for Appellate Litigation; Joseph M. Woodward, Associate Solicitor; M. Patricia Smith, Solicitor; U.S. Department of Labor, Washington, DC

For the Complainant

Gregory Dillard, Esq.; Christopher Bacon, Esq.; Tara Porterfield, Esq.; Vinson & Elkins, LLP, Houston, TX

For Respondent BP Products North America, Inc.

Felix C. Wade, Esq.; Angela M. Courtwright, Esq.; J. David Campbell, Esq.; Ice Miller, LLP, Columbus, OH

For Respondent BP-Husky Refining, LLC

Kim Nibarger, USW H&S Specialist; United Steelworkers International Union, Pittsburgh, PA

For the Authorized Employee Representative

Mark S. Dreux, Esq.; Valerie N. Butera, Esq.; Arent Fox, LLP, Washington, DC

For Amicus Curiae American Petroleum Institute

Jonathan L. Snare, Esq.; Alana F. Genderson, Esq.; Morgan, Lewis & Bockius LLP, Washington, DC

For Amici Curiae American Chemistry Council and American Fuel & Petrochemical Manufacturers

DECISION

Before: MacDOUGALL, Chairman; ATTWOOD and SULLIVAN, Commissioners.

BY THE COMMISSION:

BP Products North America, Inc. operates a petroleum refinery in Oregon, Ohio. The refinery is owned by BP-Husky Refining, LLC. As part of its Refinery National Emphasis Program, a team of compliance officers and industrial hygienists from the Occupational Safety and Health Administration inspected the refinery from September 10 through December 18, 2009. On March 8, 2010, OSHA issued three citations to Respondents (referred to collectively as “BP”) under the Occupational Safety and Health Act of 1970, 29 U.S.C. §§ 651-678, two of which were settled in their entirety prior to the hearing in this matter. The proceedings before Administrative Law Judge Sharon D. Calhoun concerned sixty-five items in Willful Citation 2, all of which allege violations of OSHA’s process safety management of highly hazardous chemicals (“PSM”) standard, 29 C.F.R. § 1910.119.[1] This standard “contains requirements for preventing or minimizing the consequences of catastrophic release of toxic, reactive, flammable, or explosive chemicals. These releases may result in toxic, fire or explosion hazards.” 29 C.F.R. § 1910.119(a).

For the alleged violations, the Secretary proposed a total penalty of $2,870,000. Following a nineteen-day hearing, the judge vacated all but five of these items, each of which she affirmed as serious and for which she assessed a total penalty of $35,000. Fifty-six of the Willful Citation 2 items are on review before the Commission.[2] These items concern various aspects of pressure relief equipment, cross-connections between systems in the refinery, and the siting of various buildings and facilities. For the reasons that follow, all but two of the items are vacated as a result of the Secretary’s failure to prove a prima facie case.[3] The two affirmed items—Items 31a and 31b that concern cross-connections—are grouped as serious and assessed a single penalty of $7,000.

I. Items 2a through 12a, and 4b through 12b

Background on RAGAGEP

The PSM standard took effect in May 1992 as a performance standard. Process Safety Management of Highly Hazardous Chemicals, 57 Fed. Reg. 6356, 6356, 6360 (Feb. 24, 1992). One significant aspect of the PSM standard is the requirement that employers compile information about their process equipment and use this information to self-assess the equipment for hazards, and then, if necessary, to implement corrective safeguards. 29 C.F.R. § 1910.119(d), (e), (j). Here, the PSM provision cited in Items 2a through 12a requires an employer to “document that equipment complies with recognized and generally accepted good engineering practices” as part of its process safety information under § 1910.119(d); and the provision cited in Items 4b through 12b requires the employer to “correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in paragraph (d) . . . ) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.” 29 C.F.R. § 1910.119(d)(3)(ii), (j)(5).

Items 2a through 12a, and 4b through 12b involve a concept, central to an employer’s compliance responsibilities under the PSM standard, that the Commission has not previously addressed: “[R]ecognized and generally accepted good engineering practices” (“RAGAGEP”). This concept is referenced in two paragraphs of the standard, § 1910.119(d)(3)(ii) and (j)(4)(ii), the former of which is at issue on review here, and it is also discussed in the PSM standard’s non-mandatory Appendix C. RAGAGEP is not defined in either the text of the PSM standard, its preamble, or the non-mandatory appendix.[4] However, non-mandatory Appendix C provides some examples of what could be used to “establish” RAGAGEP, such as: requirements contained in published consensus standards and codes and “technically recognized report[s]” from engineering societies. 29 C.F.R. § 1910.119, App. C.3. At issue in this case is whether the Secretary has met his burden to establish that BP was obligated under the PSM standard to comply with the specific engineering practice that he asserts is RAGAGEP.

Background on Inlet Pressure Drop

BP’s refinery uses numerous pressure vessels in its refining process. Pressure relief valves are needed to protect against excessive pressure in many of these vessels. Each relief valve referenced in Items 2a through 12a, and Items 4b through 12b, is attached to a pipe (known as an “inlet line”) that connects the relief valve to a vessel. The allegations in these citation items relate to an aspect of pressure relief known as “inlet pressure drop” or “IPd.” IPd is the amount of pressure loss that results from friction that is created when material flows through an inlet line and into an open pressure relief valve.

A relief valve opens when pressure in the vessel protected by the valve exceeds the “set pressure,” which is normally the vessel’s maximum allowable working pressure. The valve then closes once the pressure at the valve decreases to the “reseat” pressure, which is fixed below the set pressure to ensure that the valve closes properly. The difference between the set pressure and reseat pressure is called the “blowdown.” The IPd exceeds the blowdown when a loss in pressure between the vessel and the valve (due to friction) is greater than the difference between the set and reseat pressures. An IPd that exceeds the blowdown may cause the valve to “chatter”—meaning that it rapidly opens and closes—potentially resulting in a failure of the relief installation and a catastrophic release of material, in this case hydrocarbons. Thus, IPd is one of the stability factors in relief installations. The limits of IPd and its relationship with RAGAGEP are at issue in Items 2a through 12a and Items 4b through 12b.

Admissibility of Middough Reports

As a preliminary matter, we must address the admissibility of certain documents prepared by Middough, Inc., a safety consulting firm retained by BP to “revalidate” all of the refinery’s pressure relief valves; these documents are known in this case as the “Middough reports.” The revalidation project undertaken by BP and Middough began in 2008 and was continuing at the time of the OSHA inspection. As part of this $6 million, multi-year revalidation project, Middough was required to perform calculations and analyses on a valve-by-valve basis—on IPd as well as other stability factors—for the 1,800 pressure relief valves at the refinery.

Middough issued several draft reports as the project progressed. There is no dispute that the calculations concerning the IPd, as used by the Secretary for each of the relief installations at issue in Items 2 through 12, come exclusively from the Middough reports. BP argues that pursuant to an OSHA policy concerning voluntary self-audits, it was impermissible for OSHA to base any of the alleged violations on information included in the Middough reports. However, given the specific circumstances present here, we conclude that BP’s concern is unfounded.

Before the judge, BP asserted that the “revalidation project was intended to update the [process safety information] for its relief valves” as required under § 1910.119(d). Thus, the reports BP received as a result of this project are not voluntary self-audits.[5] In addition, we note that BP itself submitted the Middough reports concerning the valves at issue into evidence, and did not object when the Secretary submitted into evidence a summary report from Middough (which was based on the valve-specific reports submitted by BP). Thus, BP cannot now object to the Secretary’s use of the Middough reports as evidence. Fed. R. Evid. 103(a) (“A party may claim error in a ruling to admit . . . evidence only if the error affects a substantial right of the party and . . . a party, on the record: (A) timely objects or moves to strike; and (B) states the specific ground, unless it was apparent from the context[.]” (emphasis added)); see Commission Rule 71, 29 C.F.R. § 2200.71 (“The Federal Rules of Evidence are applicable.”). We, therefore, find the Middough reports admissible.

Analysis

As to Items 2a through 12a, and 4b through 12b, compliance is the only element of the Secretary’s prima facie case at issue on review. Under the “a” citation items, the Secretary alleges that BP failed to document that each of the identified pressure relief valves[6] and associated inlet lines (collectively referred to as “relief installations”) complied with RAGAGEP because each had an IPd greater than 3%. Under the “b” citation items, the Secretary alleges that BP failed to ensure that these relief installations had an IPd of not more than 3%. The Secretary asserts that a 3% IPd limit is the only engineering practice that meets the RAGAGEP criteria for IPd within relief valve installations. In other words, the Secretary’s position is that an IPd measuring above 3% did not comply with paragraph (d)(3)(ii)’s documentation requirement; and BP’s continued use of these relief installations—with IPds “outside acceptable limits” (anything above 3%)—did not comply with paragraph (j)(5)’s requirement to correct equipment deficiencies.

The Middough reports show that at the time of OSHA’s inspection, the IPd for each relief installation identified in Items 4 through 12 was above 3%.[7] Therefore, according to the Secretary, none of these relief installations were RAGAGEP-compliant with respect to IPd. BP argues that it established RAGAGEP based on its own engineering knowledge and industry experience and that the Secretary’s 3% IPd limit is too restrictive. Resolution of these citation items, thus, turns on whether the Secretary has proven that a 3% IPd limit is—exclusively—RAGAGEP for the relief installations at issue.

Throughout these proceedings, the Secretary has consistently asserted that an IPd limit of 3% was the only RAGAGEP available to BP—indeed, the only “recognized” and “generally accepted” practice for any oil refining company in the United States.[8] To support his argument, the Secretary points to a variety of sources, including valve manufacturers’ manuals, consensus standards from the American Petroleum Institute (“API”) and the American Society of Mechanical Engineers (“ASME”), and Ohio state law. As the PSM standard is a performance-oriented standard, however, the most relevant source of RAGAGEP is the one on which the employer relied—in this case, the applicable standard from API in effect at the time of the alleged violation.[9] Section 4.2.2 of API Recommended Practice 520, Part II (“API 520”)[10] states that “[w]hen a pressure-relief valve is installed on a line directly connected to a vessel, the total non-recoverable pressure loss between the protected equipment and the pressure-relief valve”—in other words, the IPd—“should not exceed 3 percent of the set pressure of the valve . . . .” However, API’s standard further states that, as an alternative to this limit, “[a]n engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent.” (Emphasis added.)

BP’s corporate-wide IPd policy relied on the “engineering analysis” option of this consensus standard to allow for an IPd limit above 3% for existing relief installations.[11] Specifically, the IPd policy BP had in place at the start of OSHA’s inspection stated as follows:

For existing installations involving pressure relief valves, an inlet line pressure loss should not exceed the lower of a) the blowdown pressure[12] or b) 7% of the set pressure (gauge units). If the pressure does not decrease to below the reseat pressure, then experience has shown that the valve will remain open. This constitutes the engineering analysis required by [API 520, § 4.2.2] to allow higher inlet line pressure losses.

BP’s policy was in the process of being revised at that time, and the IPd limit was officially lowered to 5% six weeks later.

There is no dispute that § 4.2.2 of API 520 is recognized and generally accepted for purposes of the PSM standard and that following its requirements would constitute a good engineering practice. Indeed, in its discussion of how to document process safety information, non-mandatory Appendix C to the PSM standard recognizes that “codes and standards . . . published by such organizations as the . . . American Petroleum Institute” are one type of resource that employers may rely on “to establish good engineering practices.”[13] This particular version of API 520 was current at the time of the alleged violations (see footnote 10 supra) and was reaffirmed without amendment two years later in 2011. See Process Safety Management of Highly Hazardous Chemicals, 57 Fed. Reg. at 6375, 6390 (revising rule to require RAGAGEP—rather than reference codes and standards—in response to comments that, among other things, “some of these standards may be outdated and no longer represent a consensus of ‘good engineering practices’ ”).

The Secretary argues that no refinery, including BP, could have used the engineering analysis option of API 520 because API did not explain in its standard (or elsewhere) how to perform such an analysis. The Secretary reasons, therefore, that API’s 3% IPd limit is the only RAGAGEP since, without an acceptable methodology for conducting an engineering analysis, no circumstance existed that would have permitted an IPd limit above 3%. This reasoning ignores that API 520 on its face does not provide that the engineering analysis must follow a specific, consensus methodology. The applicable section simply requires “[a]n engineering analysis of the valve performance at higher inlet losses . . . .” In addition, if the Secretary is correct, it would have been pointless for API to adopt the engineering analysis option in 1994, and then reaffirm this requirement in 2003 and 2011. Given the language and history of API 520, we conclude that the Secretary has failed to prove that RAGAGEP under the specific circumstances of this case was confined to a 3% IPd limit. For these reasons, we find that while a 3% IPd limit, when used by a refinery for its relief installations (both new and existing), constitutes RAGAGEP, it is not necessarily the only RAGAGEP—in other words, the outer limit—for existing relief installations, such as the ones at issue here.

Although there is evidence in the record concerning BP’s IPd policies, which relied on API’s engineering analysis option to allow for an IPd above 3%, the parties were clearly litigating whether a 3% IPd limit is, in fact, the only RAGAGEP for existing relief installations.[14] None of the allegations at issue in Willful Citation 2, Items 2 through 12 state that an IPd limit other than 3% is in controversy and the citation language comports with the Secretary’s position throughout these proceedings. 29 U.S.C. § 658(a) (citations must “describe with particularity the nature of the violation”); see L & L Painting Co., 22 BNA OSHC 1346, 1349 (No. 05-0050, 2008) (citation omitted) (citation must be drafted “ ‘with sufficient particularity to inform the employer of what he did wrong, i.e., to apprise reasonably the employer of the issues in controversy’ ”). From opening argument through his two briefs to the Commission, the Secretary has maintained that a 3% IPd limit is the only possible RAGAGEP for the relief installations at issue. See footnote 8 supra. Moreover, the Secretary never sought to amend the citation—either before the judge or the Commission on review—and has not argued that the judge should have sua sponte amended the pleadings to change the legal theory underlying the citation.[15]

Accordingly, given that an IPd limit higher than 3% could constitute RAGAGEP under the circumstances of this case, the Secretary has not established the violative conduct alleged in Items 2a through 12a, and 4b through 12b.[16] These items are, therefore, vacated.

II. Items 13a, 14a, 16a, 17a, and 18a

Items 13a, 14a, 16a, 17a, and 18a involve five pressure relief valves that the Secretary alleges were not RAGAGEP-compliant: the valves addressed in Items 13 and 14 were undersized, and the valves addressed in Items 16, 17, and 18 had excessive backpressure. Only the “a” citation items, which allege violations of § 1910.119(d)(3)(ii) and which require the employer to “document that equipment complies with [RAGAGEP],” are at issue on review. Under the “b” citation items, which the judge vacated, the Secretary alleged violations of § 1910.119(j)(5), which requires the employer to “correct deficiencies [in other words, non-RAGAGEP conditions] before further use or in a safe and timely manner when necessary means [referred to as ‘interim measures’] are taken to assure safe operation.” The Secretary did not petition for review of the “b” items. Before the judge, BP did not argue that the company had documented RAGAGEP compliance for these valves; rather, BP asserted that it was not required to have done so because the company instituted interim measures, as permitted under (j)(5), pending replacement of the valves at issue. In affirming the “a” items, the judge concluded that because BP conceded these valves were deficient, the Secretary established that BP violated the (d)(3)(ii) documentation requirement.

BP’s argument on review is one of regulatory interpretation. The company contends that because (j)(5) expressly authorizes an employer to continue operating non-RAGAGEP equipment if interim measures are taken to ensure safe operation, (d)(3)(ii) cannot be read to require immediate compliance with RAGAGEP in such circumstances. In response, the Secretary appears to concede the effectiveness of BP’s interim measures as to the valves in question, but he asserts that (d)(3)(ii) nevertheless requires equipment to always be RAGAGEP-compliant. According to the Secretary, (j)(5)’s interim measures clause prescribes “stopgap measures” that are additional duties when an employer is in violation of (d)(3)(ii). Specifically, he claims that having non‑RAGAGEP equipment violates (d)(3)(ii) and that violation triggers the additional duty to either correct the deficiency immediately or in a safe and timely manner when interim measures are taken. Consequently, the Secretary contends that there is no inconsistency in violating (d)(3)(ii) while complying with (j)(5).

When determining the meaning of a standard, we must first look to its text and structure. Superior Masonry Builders, Inc., 20 BNA OSHC 1182, 1184 (No. 96-1043, 2003). “If the meaning of [regulatory] language is ‘sufficiently clear,’ the inquiry ends there.” Beverly Healthcare-Hillview, 21 BNA OSHC 1684, 1685 (No. 04-1091, 2006) (consolidated), aff’d in relevant part, 541 F.3d 193 (3d Cir. 2008). “[I]n situations in which the meaning of regulatory language is not free from doubt,” however, the provision is considered ambiguous. Martin v. OSHRC (CF&I), 499 U.S. 144, 150-51 (1991) (brackets omitted); see Exelon Generation Co. v. Local 15, 676 F.3d 566, 570 (7th Cir. 2012) (“A regulation is ambiguous as applied to a particular dispute or circumstance when more than one interpretation is plausible and the text alone does not permit a more definitive reading.”).

Both BP and the Secretary argue that the plain language of the PSM standard compels their respective positions. BP points out that (d)(3)(ii) is part of the PSM standard’s information gathering procedure (given that paragraph (d) governs “process safety information”) and therefore, by its own terms, is solely a documentation requirement, not a substantive one. Substantive requirements, BP notes, are found in paragraph (j), addressing “mechanical integrity,” and (j)(5) expressly authorizes an employer to continue operations when equipment is deficient by taking interim measures to assure safe operation. BP argues that under the Secretary’s reading, (j)(5) would be rendered a nullity because (d)(3)(ii) would preclude an employer from making use of (j)(5)’s interim measures option when faced with deficient equipment—in other words, the only way an employer could remain in full compliance would be to either immediately correct the deficiency or shut down the process until the equipment was made fully compliant with RAGAGEP. The Secretary counters that the text of (d)(3)(ii) does not include an exception to the documentation requirement for use of interim measures.

The language of (d)(3)(ii) does not clearly resolve this question. On the one hand, the Secretary’s reliance on the absence of an explicit interim measures exception in (d)(3)(ii) is misplaced because the obligation to document RAGAGEP compliance is not continual. Paragraph (d)(3)(ii), using the verb form of “document,” directs the employer to take an action that naturally takes place at a particular point in time. That point in time is specified in paragraph (d), which contains the cited requirement as a subsidiary provision, specifically stating that written process safety information is to be completed “[i]n accordance with the schedule set forth in paragraph (e)(1)”—that is, every five years.^[17] 29 C.F.R. § 1910.119(d), (e)(1), (e)(6). Therefore, on its face, the requirement to document compliance with RAGAGEP applies only every five years. On the other hand, (d)(3)(ii) does not make clear to what extent the employer must ensure RAGAGEP compliance between the five-year documentation cycles. Thus, we find the language of (d)(3)(ii) ambiguous.

In the context of the PSM standard’s other provisions, we conclude that the Secretary’s interpretation of (d)(3)(ii) is unreasonable. See FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 132 (2000) (“The meaning—or ambiguity—of certain words or phrases may only become evident when placed in context.”); Otis Elevator Co., 24 BNA OSHC 1081, 1087 n.10 (No. 09-1278, 2013) (reviewing language of cited provision, “along with the structure and context of the standard,” to determine scope), aff’d, 762 F.3d 116 (D.C. Cir. 2014). Paragraph (j) of the PSM standard expressly addresses an employer’s duty to maintain mechanical integrity, and (j)(4)(iii) requires process equipment to be inspected as frequently as is “consistent with applicable manufacturers’ recommendations and good engineering practices, and more frequently if determined to be necessary by prior operating experience.” 29 C.F.R. § 1910.119(j)(4)(iii). Here, the Secretary has neither asserted nor shown that a manufacturer’s recommendation, good engineering practice, or prior operating experience necessitated BP’s continual monitoring for RAGAGEP compliance. Absent such a showing, and because the duty imposed by the standard to discover non-RAGAGEP conditions is not continual, the duty to ensure RAGAGEP compliance must also not be continual. Indeed, under the Secretary’s interpretation of (d)(3)(ii), the inspection requirement under (j)(4)(iii) would become superfluous because, to ensure compliance with (d)(3)(ii), the employer would have to continually inspect for the equipment’s compliance with RAGAGEP. See Ryder Truck Lines, Inc., 1 BNA OSHC 1326, 1328 (No. 391, 1973) (refusing to construe one part of standard in a way that would “render [another] meaningless or superfluous,” because “[b]y so doing we would act in contravention of well settled principles of statutory construction”).

The unreasonableness of the Secretary’s (d)(3)(ii) interpretation is also borne out by (j)(5)’s regulatory history. The proposed version of (j)(5) (originally designated (j)(4)) lacked the interim measures option and in explaining this proposed provision, OSHA made clear that equipment deficiencies that are “outside acceptable limits” must be corrected “before further use.” Process Safety Management of Highly Hazardous Chemicals, 55 Fed. Reg. 29,150, 29,156, 29,165 (Jul. 17, 1990). When the final rule was issued, however, OSHA stated that it had received “some excellent comments” asserting “that the phrase ‘before further use’ would mean that the process would have to be shutdown, and that shutdown has its own inherent hazards,” and is not always necessary. 57 Fed. Reg. at 6391. In response, OSHA chose to add the interim measures option, stating that “[t]he comments have convinced [the agency] that there may be situations where it may not be necessary that the deficiencies be corrected ‘before further use’ as long as the deficiencies are corrected in a safe and timely manner when necessary means are taken to assure safe operation.” Id. (emphasis added). In other words, OSHA decided that instead of requiring an employer to shut down a process, it would allow continued operation of non‑RAGAGEP equipment when interim measures are in place. This fundamentally undermines the Secretary’s argument that (j)(5) only supplements (d)(3)(ii) because it directly contradicts his claim that the interim measures option is insufficient as compared to RAGAGEP.[18] See Phelps Dodge Corp., 11 BNA OSHC 1441, 1444 (No. 80-3203, 1983) (“Inasmuch as the language of the standard is susceptible of different meanings, the preamble is the best and most authoritative statement of the Secretary’s legislative intent.”), aff’d, 725 F.2d 1237 (9th Cir. 1984); see also Tops Markets, Inc., 17 BNA OSHC 1935, 1936 (No. 94-2527, 1997) (relying on preamble to lockout/tagout (LOTO) standard to interpret ambiguous provision), aff’d, 132 F.3d 1482 (D.C. Cir. 1997) (unpublished).

In sum, the only reasonable interpretation of (d)(3)(ii) is that (j)(5)’s interim measures option dictates the timing for when non-RAGAGEP equipment must be documented as RAGAGEP-compliant. In other words, if interim measures have been implemented and the deficiency is corrected “in a safe and timely manner,” an employer need not document that such equipment conforms to RAGAGEP until the deficiency has been corrected. Because the Secretary does not contend on review that BP’s interim measures were insufficient or that the deficiencies were not corrected “in a safe and timely manner,” the cited provision’s documentation requirement did not apply here. Accordingly, we vacate Items 13a, 14a, 16a, 17a, and 18a.

III. Items 15a and 15b

Items 15a and 15b address a valve that provides pressure relief to the “Second Stage Butane Treater Drum” in the refinery’s Alky 1 Unit and allege violations of the same PSM provisions discussed above. Specifically, the Secretary claims that the valve in question was undersized and that BP failed to document that it complied with RAGAGEP, in violation of § 1910.119(d)(3)(ii) (Item 15a), and BP failed to correct the deficient valve “before further use or in a safe and timely manner,” in violation of § 1910.119(j)(5) (Item 15b). The judge agreed that the valve was undersized and that the company failed to document compliance with RAGAGEP, but she vacated both citation items based on her finding that BP’s employees were not exposed to the hazards associated with the drum at issue because testimony from BP technical manager Timothy Smith established that it had been taken out of service four months before the OSHA inspection began.[19] See Briones Util. Co., 26 BNA OSHC 1218, 1219 (No. 10-1372, 2016) (“To establish a violation of an OSHA standard, the Secretary must prove that . . . employees were exposed to the violative condition.”). On review, the Secretary contends that the judge ignored conflicting testimony on this issue and the weight of the record evidence shows that the drum was not taken out of service until after the start of the OSHA inspection.

While we agree that the judge failed to address the conflicting testimony of David Hasselbach, the refinery’s technical authority, regarding the timeframe in which the drum was taken out of service,[20] upon consideration of the entire record, we find that the Secretary has failed to establish that the drum was in service at the time of the inspection. See Dover Elevator Co., 16 BNA OSHC 1281, 1283 n.3 (No. 91-0862, 1993) (“The Commission . . . is empowered to review the evidence independently and make its own factual findings.”); Little Beaver Creek Ranches, Inc., 10 BNA OSHC 1806, 1810 (No. 77-2096, 1982) (“[T]he Commission’s review authority includes the authority to decide all issues it could have decided as the initial decision maker.”). Three operator log entries show that the drum was taken out of service several months before the start of OSHA’s inspection in September 2009. A log entry dated May 20, 2009, states:

The [Butane Treater Drum] is being mothballed. The caustic is out and waiting on [BP’s oil movement and storage group] to be able to push the butane out. Need to blow out to and from them, then [LOTO] their valves with our locks so they do not open by mistake.

Additionally, two log entries from June 1, 2009, state that the drum was “off line (circulating pump off),” and that the “[c]austic injection pump stroke to [the drum]” was “[n]ot needed” because the “[t]reater is empty.” These contemporaneous log entries—showing that the drum was “being mothballed” at the end of May and was “off line” and “empty” eleven days later—align with Smith’s testimony and rebut that of Hasselbach.[21]

The remaining record evidence is, at best, too ambiguous to support the Secretary’s case. Rich Rothbard, the refinery’s operations coordinator, testified that the drum was taken out of service in 2007; while this conflicts with the May and June 2009 log entries, his testimony provides no support for the Secretary’s position that the drum was in service during the OSHA inspection. The Secretary also points to the Middough reports and an internal tracking sheet prepared by the refinery’s “PSV Evaluation Team,” both of which, he contends, show that the valve in question was evaluated as if it were in service. However, Smith testified that the revalidation study treated the drum as if it would potentially be put back into service at some future time, thereby preserving that option for the refinery, and Dr. Melhem testified that it was not unusual for a refinery conducting a revalidation to treat out-of-service equipment as though it might be put back into service in the future.

Under these circumstances, we conclude that the record is insufficient to show the Butane Treater Drum was in service at the time of the inspection; therefore, the Secretary has not proven the employee exposure element of his prima facie case.[22] See Kaspar Wire Works, Inc., 18 BNA OSHC 2178, 2195 (No. 90-2775, 2000) (“The Secretary bears the burden of proving employee exposure to cited hazards, which requires [him] to show that it is reasonably
predictable . . . that employees have been, are, or will be in the zone of danger.”), aff’d, 268 F.3d 1123 (D.C. Cir. 2001). Accordingly, we vacate Items 15a and 15b.

IV. Items 19a through 27a, 19b through 27b

Items 19a through 27a and 19b through 27b involve nine of the refinery’s “heat exchangers”—vessels consisting of a shell with tubes inside, where one fluid flows through the tubes and another fluid flows through the shell to transfer heat between the fluids. The Secretary asserts that these heat exchangers were “not protected by pressure relieving devices that would prevent the pressure inside . . . from rising above acceptable limits” and that the absence of these devices violated § 1910.119(d)(3)(ii) (Items 19a through 27a) and § 1910.119(j)(5) (Items 19b through 27b). In the course of these proceedings, however, the Secretary has more specifically asserted that to be RAGAGEP-compliant each vessel needed two pressure relieving devices (“PRDs”)—one on the “tube side” and one on the “shell side”—and that the PRDs were required to be located directly on the vessel, not on a line connected to the vessel.

The judge vacated Items 19a through 27a based on the Secretary’s failure to prove either actual or constructive knowledge of the violative conditions. The judge found that there was no evidence BP knew of the missing PRDs and that the company could not have been expected to detect their absence due to the difficulty in discovering the lack of PRDs by looking at the refinery’s Piping and Instrument Diagrams (P&ID). The judge also vacated Items 19b through 27b, finding that the Secretary failed to establish noncompliance with (j)(5) given that, after the company received the Middough reports, BP instituted interim measures to assure safe operation of the heat exchangers. On review, the Secretary focuses on the judge’s conclusion that constructive knowledge was lacking and argues that, prior to its receipt of the Middough reports, BP should have discovered (and thereafter remedied) the missing PRDs after reviewing the P&ID for the cited vessels, as well as from prior process hazard analyses (PHAs), which are governed by paragraph (e) of the PSM standard, conducted at the refinery.

The Secretary’s challenge to the judge’s knowledge finding, however, cannot be meaningfully addressed here because, based upon our review of the record, the Secretary has failed to establish BP’s noncompliance with either of the cited provisions.[23] As to Items 19a through 27a, (d)(3)(ii) requires the employer to “document that equipment complies with [RAGAGEP].” 29 C.F.R. § 1910.119(d)(3)(ii) (emphasis added). The record is silent on documentation for the heat exchangers. As is apparent from his briefs both below and on review, the Secretary has attempted to prove only that the vessels were not, in fact, RAGAGEP-compliant, which he has failed to do. Without evidence regarding any failure to document, Items 19a through 27a must be vacated.

As to Items 19b through 27b, as noted above, (j)(5) requires employers to “correct deficiencies in equipment that are outside acceptable limits.” The Secretary argues that the vessels at issue were deficient because they did not comply with RAGAGEP, which he asserts—by citing to the 2007 ASME Boiler and Pressure Vessel Code (ASME Code)—requires that PRDs be mounted on both “sides” of each vessel. While the Secretary fails to specify any particular ASME Code provision or language that compels this action, Part UG-125(a) states that “all pressure vessels . . . , irrespective of size or pressure, shall be provided with overpressure protection . . . .” Assuming one could view each heat exchanger at issue as consisting of two pressure vessels—one within the other (the pressurized tubes that are within the shell, and the shell itself, which is also pressurized)—the ASME Code would then require each vessel to be protected with a PRD. Nevertheless, Part UG-125(g) of the ASME Code also states that PRDs “need not be installed directly on [the] . . . vessel” (with certain exceptions) if: (1) “the source of pressure is external to the vessel and is under such positive control that the pressure in the vessel cannot exceed the maximum allowable working pressure at the operating temperature”; or (2) “there are no intervening stop valves between the vessel and the [PRD].” Therefore, even if we assume that each heat exchanger consists of two pressure vessels, for the Secretary to establish that they were non-compliant with the ASME Code (and thus not RAGAGEP-compliant), he must show that at least one side of each heat exchanger was unprotected by a PRD or that the two circumstances described in Part UG-125(g), where vessel-mounted PRDs are not required, are inapplicable to the heat exchangers.

The Secretary has failed to make either showing. With respect to whether at least one side of each heat exchanger was unprotected, the record is unclear. Smith testified that there was pressure relief provided by another vessel’s relief valve for seven of the nine cited heat exchangers (Items 19 through 22 and 25 through 27), but he did not specify if this was the case for both sides. The record is also vague regarding the remaining two vessels cited in Items 23 and 24. The relevant testimony as to these vessels refers to the absence of a PRD, but it is unclear whether this refers to a lack of protection at all (that is, no protection for either side, either on or connected to the vessel), or simply that there were no PRDs located on the vessels themselves.[24] Finally, with respect to the location of the PRDs, either on or away from any of the cited vessels, there is nothing in the record addressing the two circumstances in the ASME Code in which PRDs are not required to be on the vessel, and the Secretary has not addressed what evidence in the record, if any, shows that these two circumstances were not present here.^[25] See, e.g., Carmickle v. Comm’r, Soc. Sec. Admin., 533 F.3d 1155, 1161 n.2 (9th Cir. 2008) (“We do not address this [ALJ] finding because Carmickle failed to argue this issue with any specificity in his briefing.”).

In short, the Secretary has not: (1) explained why the ASME Code should be read as requiring overpressure protection on both sides of a heat exchanger; (2) shown, even if the ASME Code includes such a requirement, that the cited vessels lacked overpressure protection for at least one side; and (3) proven that the circumstances in which the ASME Code allows PRDs to be away from a vessel were not present in this case. Accordingly, we vacate Items 19b through 27b.

V. Items 31a and 31b

In Items 31a and 31b, the Secretary alleges that BP violated two provisions of the PSM standard with regard to the refinery’s “fire water” system, a pressurized ring of piping throughout the facility that contains water for fighting fires. The refinery, built in 1919, originally had a single water circuit throughout, supplying water for various uses, including fighting fires. In the 1980s, BP began the process of removing these “cross-connections” between the fire water system and other water systems. At the time of the OSHA inspection, however, several cross-connections remained.

Item 31a alleges a violation of § 1910.119(d)(3)(iii), which provides that “[f]or existing equipment designed and constructed in accordance with codes, standards, or practices that are no longer in general use, the employer shall determine and document that the equipment is designed, maintained, inspected, tested, and operating in a safe manner.” The Secretary asserts that because the current best practice is to have a completely independent fire water system to ensure that water is not diverted for other uses and hydrocarbons resulting from the refining process do not contaminate water intended to fight fires, the refinery’s cross-connections violate (d)(3)(iii).

Item 31b alleges a violation of § 1910.119(e)(3)(i), which provides that PHAs—which employers are required to conduct and then update and revalidate at least every five years—“shall address . . . [t]he hazards of the process.”^[26] The Secretary asserts that BP did not address in any PHA “the existence of permanent connections between the [refinery] fire water system and process systems that could lead to the contamination of fire water supply with hydrocarbons or other process fluids.”

The judge vacated these items. Specifically, she noted that one of BP’s expert witnesses, Bradley Wolf, and its emergency response specialist, Chris Herman, testified that there was no credible risk that the fire water could be contaminated due to the cross-connections. Thus, according to the judge, there was no need for any PHA to address the cross-connections, nor was there a need to determine and document that the cross-connections were “designed, maintained, inspected, tested, and operating in a safe manner.” 29 C.F.R. § 1910.119(d)(3)(iii). On review, the Secretary contends that this “no harm, no foul” approach misses the point of the cited provisions—to assess and address potential hazards like the cross-connections here.

To begin, we agree with the Secretary that no hazard need be proven to establish applicability of the cited provisions. By its plain terms, (d)(3)(iii) does not require that an actual hazard be shown for the provision to apply; rather, the provision presumes a hazard when outdated equipment is involved. See, e.g., Oberdorfer Indus., Inc., 20 BNA OSHC 1321, 1330 (No. 97-0469, 2003) (consolidated) (“Wh[en] the standard presumes a hazard, . . . the Secretary is not obligated to show that the conditions in question are themselves hazardous in order to prove a violation.”). BP’s own expert, Wolf, acknowledged that it is now best practice to build fire water systems independent of other water systems, even if that has not always been the practice:^[27]

[T]he current best practice—and if you build a brand[-]new refinery right now, you would strive to create a totally independent pressurized fire ring system around your plan[t] independent of any of the other—as independent as it can be of the other water systems, noting that most water systems, especially in this case, get their water from [an outside source] to start with.

* * *

[But] [i]f we go back long enough and specifically when this plant was built in 1919, the common practice was—as I understand it, because obviously I wasn’t here and building plants in 1919, was a single utility water—or a single water circuit throughout the plant. So the water was available for things like washing down and diluting and filling up tanks when they needed to be, as well as the fire system. So it was one pressurized system. And that design over time has evolved to independent systems for a few good reasons.

* * *

[H]av[ing] an adequate volume and quality of water available in the event there’s a fire is the key reason why you want to have a standalone system.

Wolf also testified that “[y]ou wouldn’t design [BP’s fire water system] as it is now if you’re starting from scratch.” This testimony—from BP’s own expert—shows that the cross-connections at issue were “designed and constructed in accordance with . . . practices that are no longer in general use.” See 29 C.F.R. § 1910.119(d)(3)(iii) (emphasis added). In this respect, the record is sufficient to establish the applicability of (d)(3)(iii). Additionally, given the presumption of a hazard with regard to the cross-connections, BP was required to conduct and document a PHA with regard to them. See 29 C.F.R. § 1910.119(e)(3)(i) (“The process hazard analysis shall address . . . [t]he hazards of the process.”). Accordingly, (e)(3)(i) applies as well.

Regarding noncompliance, the Secretary contends that the record shows the cited cross-connections were not evaluated by BP prior to the OSHA inspection because the company failed to produce any documents in response to the Secretary’s discovery request for “[a]ny and all risk analyses or other documents relating to the cross-connections between the process water systems and plant firewater systems identified in . . . Item 31a.” Though the Secretary’s First Request for Production—which he asserts contains this request—is not in evidence, BP does not dispute on review that the Secretary requested the required documentation.[28] In addition, the record is bereft of any risk analyses, PHAs, or other documentation showing that BP determined that the cross-connections were safe. See MCC of Fla., Inc., 9 BNA OSHC 1895, 1899 (No. 15757, 1981) (employer’s “failure to produce [records] at the hearing strongly indicate[s] that the required records were not maintained”). The absence of a PHA is particularly glaring given that a PSM compliance audit BP conducted several months before the OSHA inspection identified the cross-connections as “not [being] in accordance with” National Fire Protection Association (NFPA) and API standards, and it called for “inclusion of these cross-connections in a process hazard analysis.”[29] Given the Secretary’s discovery request and BP’s apparent failure to respond to it, we find that the Secretary has established noncompliance with (d)(3)(iii) and (e)(3)(i).

As for the knowledge element of the Secretary’s case, the record shows that refinery management was aware of the existence of the cross-connections in the mid-1980s. Also, the report from BP’s PSM compliance audit stated that “[f]ire water should be supplied by a system that is independent of all other uses and be from a reliable source” and that the system “did not meet some recognized and generally accepted good engineering practices” in part because, as noted above, the “cross-connections of the fire water main with process equipment were not in accordance with” NFPA and API standards. See N&N Contractors, Inc., 18 BNA OSHC 2121, 2122 (No. 96-0606, 2000) (“To meet [his] burden of establishing employer knowledge, the Secretary must show that the cited employer either knew or, with the exercise of reasonable diligence, could have known of the presence of the violative condition.”), aff’d, 255 F.3d 122 (4th Cir. 2001). As to employee exposure, BP expert Wolf acknowledged that “the two overriding [concerns]” regarding cross-connections between the fire water system and other water systems are hydrocarbon “contamination” of the fire water and “having enough water available if you have a fire.” In other words, these cross-connections can impair the refinery’s ability to fight fires, so all the employees in the refinery were exposed to that condition. See Fabricated Metal Prods., Inc., 18 BNA OSHC 1072, 1074 (No. 93-1853, 1997) (“[T]he Secretary . . . must show that it is reasonably predictable . . . that employees have been, are, or will be in the zone of danger.”). In light of the foregoing, the Secretary has established violations of both (d)(3)(iii) and (e)(3)(i). Accordingly, we affirm Items 31a and 31b.

The Secretary maintains that these grouped violations are willful. Conduct is not willful, however, if the employer has “made a good faith effort to comply with a standard or eliminate a hazard, even though [its] . . . efforts were not entirely effective or complete.” A.E. Staley Mfg. Co., 19 BNA OSHC 1199, 1202 (No. 91-0637, 2000) (consolidated). Here, BP had already begun the complex process of removing the “cross-connections” between the fire water system and other water systems and its PSM compliance audit identified the still existing cross-connections as an issue to be resolved, setting a “due date” for resolution of March 31, 2010. We consider this a good faith effort to address the potential hazard associated with the cross-connections sufficient to negate willfulness. As the Secretary notes, however, the cross-connections could have compromised the refinery’s ability to effectively fight fires, putting employees at risk of injury or death. Moreover, employees were exposed to this violative condition for the entirety of the citation period, as the different water systems were connected throughout that time. Thus, we find that a serious characterization is appropriate here. Pressure Concrete Constr. Co., 15 BNA OSHC 2011, 2018 (No. 90-2668, 1992) (characterizing a violation as serious “does not mean that the occurrence of an accident must be a substantially probable result of the violative condition but, rather, that a serious injury is the likely result should an accident occur”).

These same considerations factor into our determination that an appropriate penalty for the violation is the maximum in effect at the time of the violation.[30] Accordingly, we characterize these grouped violations as serious and assess a single penalty of $7,000. See 29 U.S.C. § 666(b) (“Any employer who has received a citation for a serious violation . . . shall be assessed a civil penalty of up to $7,000 for each such violation.”); Capform, Inc., 19 BNA OSHC 1374, 1378 (No. 99-0322, 2001) (gravity of violation for penalty purposes “depends upon the number of employees exposed, the duration of the exposure, the precautions taken against injury, and the likelihood that any injury would result.”), aff’d, 34 F. App’x 152 (5th Cir. 2002) (unpublished).

VI. Items 32 through 40

Items 32 through 40 concern “facility siting”—assessing and addressing potential damage that a workplace explosion or fire could cause to occupied buildings. In the mid-1990s, BP conducted a blast protection assessment for the refinery and memorialized the results in a report dated May 11, 1994 (“the 1994 Report”), which was updated in March 1995 (“the 1995 Report”). Thereafter, BP began a facility siting program, under which the company planned and implemented a variety of actions to address the fire/explosion risk to thirty-three buildings. The program set as the highest priority those areas where employees worked around the clock and closest to the process units, and set as the lowest priority those areas where employees worked farther away from the process units. This resulted in a plan with three phases: buildings in and closest to the process units would be evaluated in the first phase; buildings located further from the process units would be evaluated in the second phase; and buildings located closer to the perimeter of the facility would be evaluated in the third phase.

In these citation items, the Secretary asserts that BP failed to resolve several recommendations in the 1994 and 1995 Reports in violation of § 1910.119(e)(5). This provision requires that employers address PHA findings and recommendations:

The employer shall establish a system to promptly address the [PHA] team’s findings and recommendations; assure that the recommendations are resolved in a timely manner and that the resolution is documented; document what actions are to be taken; complete actions as soon as possible; develop a written schedule of when these actions are to be completed; communicate the actions to operating, maintenance and other employees whose work assignments are in the process and who may be affected by the recommendations or actions.

Here, the Secretary alleges that BP failed to “document the actions to be taken, develop a schedule to implement the actions, and execute the actions necessary to control hazards associated with building collapse and damage due to explosion overpressures” regarding nine refinery facilities: the “WGI Insulators Building,” “Blender control room,” “Boiler Shop,” “E&I Shop,” “HSEQ Building,” “Laboratory,” “Main Office Building,” “WGI Administrative Building,” and “WGI Electricians Building.” The Secretary further points to two BP “Preliminary Building Damage Evaluation” reports, from 2006 and 2008, as evidence that as late as 2009, BP was aware that it had not properly responded to the 1994 and 1995 Reports.

The judge vacated these items, finding that the Secretary failed to establish that BP was not in compliance. She observed that “[a]lthough the citation is couched in terms of failure to document the resolution of recommendations, the Secretary’s primary issue [is that the] facility siting PHA recommendations . . . were not resolved on [his] timetable.” The judge also noted that BP’s facility siting program contained documentation on the progress of its efforts to resolve recommendations for the cited buildings, including several interim measures BP implemented at eight of the nine cited buildings. In light of this documentation and the interim measures, along with testimony from another BP expert, John Arendt, that the company’s facility siting program was reasonable, the judge concluded that the Secretary failed to establish a violation of (e)(5).

On review, the Secretary contends that the judge’s ruling was error because BP knew, as early as 1994, that the nine cited buildings “posed a risk of serious injury or death to occupants from a vapor cloud explosion” and that the interim measures were insufficient to address these risks, which were present for at least 15 years. BP responds that the company’s facility siting program satisfied the cited provision because neither the 1994 nor the 1995 Report recommended immediate modifications to the cited buildings; rather, BP asserts, these documents merely “recommended further study and, where cost-effective, steps to reduce [risk regarding] certain buildings, starting in the process core.”

We agree with BP that resolution of these citation items depends on what, in fact, the 1994 and 1995 Reports recommended. The 1994 Report contains a “Discussion of Results” section and a “Recommendations” section, and the 1995 Report contains a “Major Findings” section and a “Recommendations” section. Notably, though, none of the citation items asserts that BP failed to meet the provision’s mandate to “address . . . findings.” 29 C.F.R. § 1910.119(e)(5) (emphasis added). Rather, the citation describes the violative conduct as BP having failed to “establish a system to assure that the [PHA] team’s recommendations are resolved.” (Emphasis added.) There is no indication that the parties ever agreed to a broader reading of the citation before the judge. Compare Fed. R. Civ. P. 15(b)(2) (“When an issue not raised by the pleadings is tried by the parties’ express or implied consent, it must be treated in all respects as if raised in the pleadings.”); Jones v. Miles, 656 F.2d 103, 107 n.7 (5th Cir. 1981) (citing to transcript to support finding that parties tried issue by consent). Therefore, the only question is whether the Secretary established that BP failed to “assure that the recommendations” in the 1994 and 1995 Reports were “resolved in a timely manner and that the resolution is documented,” and it “complete[d the] actions as soon as possible.” 29 C.F.R. § 1910.119(e)(5).

The 1994 Report considered two types of risk: “Individual Risk,” defined as “the frequency of death or serious injury for a person most at risk from a given activity due to their location, habits, or time periods” of exposure; and “Population Risk,” defined as “the frequency of accidents involving multiple fatalities.” The 1994 Report’s “Recommendations” section stated that “Individual Risk reduction must be considered for all target buildings,” including the nine cited ones, and “Population Risk reduction should be considered on the ‘as low as reasonably practicable’ basis for half the buildings,” again including the nine cited ones. The 1994 Report also identified ten buildings—none of which is a cited facility—to be specifically “assess[ed] . . . for possible mitigation measures” because they were in “the top 20 per cent based on Individual Risk calculations (nine buildings) and one additional building, the Nerve Center, due [to] its Population Risk result.” The 1994 Report further recommended that “[i]f analysis shows that the [risk] mitigation methods are cost effective for” these ten high-risk buildings, “it should be considered for the rest of the list,” including the cited buildings. At the same time, it stated that “a measured response is called for” because “no single site building is indicated to have an exceedingly high Individual Risk by the proposed criteria.”

As for the 1995 Report, its “Recommendations” section stated that as to four of the cited buildings—the WGI Electricians Building, Laboratory, Blender control room, and WGI Administrative Building—BP was to “consider relocating some of the people currently housed in that process building. This will reduce the population risks and require a lesser spend for cost-effective mitigations.”[31] (Emphasis added.) In sum, with respect to the nine cited facilities, the 1994 Report did not recommend actual corrective action—it simply stated that a “measured response” was appropriate and certain risk mitigation should be “considered.” Similarly, the one pertinent recommended action in the 1995 Report’s “Recommendations” section was for BP to merely “consider” relocations for four of the cited facilities.

We find no support in the record for the Secretary’s contention that BP’s facility siting program—specifically the measures aimed at the cited buildings—failed to “consider” risk reduction and take the “measured response” called for by the 1994 and 1995 Reports. BP’s program involved assessing thirty-three buildings, ten of which (not among those cited here) were located in the process unit and therefore “targeted” in the 1994 Report as high-risk. The risk issues associated with these ten buildings were remediated between 2001 and OSHA’s inspection in 2009, primarily through relocation of personnel out of the process unit and, for those remaining inside, building new structures to house them. Meanwhile, BP instituted “interim” measures to address lower-risk buildings, including the nine cited facilities. For each of the nine facilities, BP installed new film on the windows, secured the lighting, and reviewed the building’s ability to withstand overpressure. Additionally, BP made specific changes at these buildings to address risks, such as posting evacuation signs and instructions in the WGI Insulators Building, Blender control room, and WGI Electricians Building; confirming that an eyewash station was within 50 yards of the WGI Insulators Building; upgrading the fire protection system in the Blender control room; providing fire extinguishers for the Blender control room and Boiler Shop; ensuring that adequate exterior fire protection was in place for the Laboratory; and beginning construction of a new Laboratory.

The Secretary suggests that the 1994 and 1995 Reports informed BP that the nine cited buildings could collapse in an explosion, and so the company’s actions were insufficient because they did not meaningfully address the hazard of building collapse from an explosion event. This is the wrong benchmark, however, for assessing the adequacy of BP’s response.[32] Given how the Secretary has alleged the violations, the company’s compliance is measured solely by the recommendations in the 1994 and 1995 Reports. We conclude, based on the foregoing, that BP addressed them. Accordingly, we vacate Items 32 through 40.[33]

ORDER

Willful Citation 2, Items 2a through 18a, 4b through 12b, 15b, 19a through 27a, 19b through 27b, and 32 through 40, are vacated. Willful Citation 2, Items 31a and 31b, are affirmed as serious and a single penalty of $7,000 is assessed for these grouped violations.

SO ORDERED.

/s/

Heather L. MacDougall

Chairman

/s/

James J. Sullivan, Jr.

Dated: September 27, 2018 Commissioner

ATTWOOD, Commissioner, concurring and dissenting in part:

I join all parts of the majority’s decision, except Part I, which addresses Willful Citation 2, Items 2a through 12a, and 4b through 12b. For the reasons that follow, I would affirm as serious Items 6a and 6b, 9a through 12a, and 9b through 12b. I agree to vacate Items 2a through 4a, 4b, 5a, 5b, 7a, 7b, 8a, and 8b, but on different grounds than my colleagues.

As the majority explains, each of these citation items pertains to a condition known as inlet pressure drop (“IPd”). The Secretary argues that the relief installations identified in Items 2 through 12 are not compliant with recognized and generally accepted good engineering practices (“RAGAGEP”)—a requirement under OSHA’s standard for process safety management of highly hazardous chemicals, 29 C.F.R. § 1910.119—because the IPds for these installations exceeded 3%, and BP failed to conduct any engineering analysis (let alone a sufficient one) to support any higher levels. I agree with my colleagues that the Secretary failed to establish that a 3% IPd limit is the only RAGAGEP on which BP could have relied. Section 4.2.2 of American Petroleum Institute Recommended Practice 520, Part II (“API 520”) expressly permits an employer to conduct an engineering analysis to allow for an IPd above 3%, and this option was certainly available to BP.[34]

My colleagues do not dispute that the “Middough reports” show some of the relief installations at issue had IPds in excess of 5%,[35] and they recognize that the record “suggests” an IPd in excess of 5% for the relief installations at issue would not have “provide[d] an appropriate safety margin.” My colleagues nonetheless conclude that these citation items should be vacated because no other issue—besides whether a 3% IPd limit constitutes the only RAGAGEP—has been asserted by the Secretary or litigated by the parties. I disagree with this analysis, and therefore reach the other issues raised by the parties with respect to these citation items.

I. What constitutes RAGAGEP is an issue in controversy

My colleagues rest their decision to vacate the IPd citation items on their narrow resolution of the following question—do the allegations include whether the referenced relief installations were RAGAGEP-compliant, or are they limited by the Secretary’s assertion that a 3% IPd limit is the only RAGAGEP? They conclude that “the parties were clearly litigating whether a 3% IPd limit is, in fact, the only RAGAGEP for existing relief installations.” In fact, as my colleagues explicitly recognize, the Secretary did not simply argue that a 3% IPd limit was the only RAGAGEP—he acknowledged that API 520 allows for an IPd limit higher than 3% if it is supported by an engineering analysis “of the valve performance at higher [IPds].” My colleagues seek to minimize this acknowledgement by focusing solely on the Secretary’s claim that API 520 provides no acceptable methodology for conducting such an engineering analysis, leaving 3% as the only appropriate consensus limit.

That has not been the Secretary’s only contention, however. He argues in the alternative that BP’s internal IPd limit standards of 7% and then 5% were not RAGAGEP because the engineering analyses that BP relied on to support these standards were not analyses “of the [actual] valve performance at higher [IPds]” as specified in the API 520 exception to the 3% limit. As discussed in more detail in Part II of this opinion, BP witnesses testified that at the time OSHA’s inspection began, the engineering analysis used to support BP’s 7% IPd limit involved calculating each valve installation’s IPd and comparing this calculation to the “lower of” the valve’s blowdown specification or “7% of the set pressure.” As the blowdown for the valves at issue was presumed (by OSHA as well as BP) to be 7% of the set pressure, the analysis compared this value to the valve’s calculated IPd. If the IPd was calculated at 7% or less, BP would find the valve to be in conformance with BP’s internal guidance. BP followed this same methodology in the analysis it relied upon to support its revised 5% IPd limit, but used 5% of the set pressure as the point of comparison rather than 7%.

In looking beyond the 3% IPd limit and addressing whether BP’s internal standards were RAGAGEP-compliant, the Secretary argued below that, in order to comply with API 520’s exception to the 3% limit, BP’s engineering analysis was required to include more than a simple mathematical calculation. The Secretary finds support for this claim in the factors (such as verifying the valve’s blowdown and reviewing records for evidence of chatter) that the API working group considered in its (failed) attempt to come up with a recommended method for determining whether a valve’s performance at a higher IPd limit was acceptable, as well the testimony of the Secretary’s expert witness, Harold Fisher. The Secretary similarly argues in his briefs to the Commission that, “[a]t a minimum, a sound analysis should have included an assessment of the individual valve installation’s characteristics and configuration to provide some assurance that the valve has not been chattering.”

Like the Secretary, BP has litigated the broader issue of what constitutes RAGAGEP.[36] As I read BP’s briefs before the judge as well as before us, it makes two types of arguments. First, BP raises several legal arguments supporting its primary assertion that the Secretary cannot enforce the 3% IPd limit. For example, BP argues that the judge correctly determined that the Secretary was improperly attempting to incorporate the 3% IPd limit into the RAGAGEP standard without engaging in rulemaking. However, BP also argues that its internal guidelines (originally requiring IPds at or below 7% and later 5%) constitute RAGAGEP. Thus, BP argues in its briefs to the Commission that its engineering analysis “[c]omplied with RAGAGEP.” The parties’ arguments, therefore, do not merely focus on whether a 3% IPd limit is the only RAGAGEP, but also address whether BP’s 5% and 7% IPd limits constitute RAGAGEP under API 520 (which, as the majority notes, is the consensus standard on which BP’s policy explicitly relies).

Finally, even without considering the parties’ arguments concerning RAGAGEP, it is clear that the language of the citation itself apprised BP that what constitutes RAGAGEP for IPd on each referenced relief installation is, indeed, in controversy. 29 U.S.C. § 658(a) (citations must “describe with particularity the nature of the violation”); L & L Painting Co., 22 BNA OSHC 1346, 1349 (No. 05-0050, 2008) (citation omitted) (citation must be drafted “ ‘with sufficient particularity to inform the employer of what he did wrong, i.e., to apprise reasonably the employer of the issues in controversy’ ”). Certainly, the Secretary’s position has been that a 3% IPd limit is the only RAGAGEP (absent a valid engineering analysis that points to a different number) for the types of relief installations at issue. But the citation items themselves concern whether the IPds for these relief installations are compliant with RAGAGEP, and the fact that RAGAGEP is the focal point of these items is evident in the language used by the Secretary in the citation.

Specifically, in Items 2a through 12a, the Secretary cites to 29 C.F.R. § 1910.119(d)(3)(ii) and, consistent with that provision’s language, alleges in each item that “[t]he employer does not document that [a particular relief valve] providing pressure relief protection to [a particular pressure vessel] complies with recognized and generally accepted good engineering practices, in that, it has an inlet pressure drop greater than 3%.” (Emphasis added.) In Items 4b through 12b, the Secretary cites to 29 C.F.R. § 1910.119(j)(5) and, consistent with that provision’s language, alleges that “[t]he employer does not correct deficiencies in equipment that are outside acceptable limits . . . as defined by process information in [§] 1910.119(d),” and further alleges that “[t]he employer does not ensure [that the valve referenced in the corresponding “a” item], located in [a particular unit], has an inlet pressure drop of not more than 3%.” (Emphasis added.) And then, in the section pertaining to abatement for each “a” and “b” item, the Secretary instructs BP to:

submit an abatement plan describing the actions it is taking to ensure that it is in compliance with the standards including documentation that each pressure relief valve and associated piping for all process units have been evaluated and, if necessary, repaired or replaced to ensure inlet pressure drop is limited in accordance with recognized and generally accepted good engineering practices, such as API Recommended Practice 520 and the [American Society of Mechanical Engineers] Boiler and Pressure Vessel Code.

(Emphasis added.) Cf. L & L Painting Co., 22 BNA OSHC at 1349 (holding that citation provided notice that calculation of medical removal plan benefits was issue in controversy where citation tracked language of cited provision—29 C.F.R. § 1926.62(k)(2)(i)—and specified that employee “ ‘did not receive [MRP] benefits as defined under this standard, on or about 5/26/04’ ”).

Although I view the citation’s language as clearly apprising BP that RAGAGEP was an issue in controversy, even if the Secretary’s reference to the 3% IPd limit could be said to have muddied the issue, I find that the record, as discussed at length above, establishes that any lack of particularity was cured at the hearing and in the parties’ subsequent briefs. See Meadows Indus., Inc., 7 BNA OSHC 1709, 1710-11 (No. 76-1463, 1979) (“Lack of particularity in a citation may be cured at the hearing.”). Therefore, I reach the issue clearly tried by the parties here: whether the record shows that the relief installations at issue were not RAGAGEP-compliant.[37]

II. The Secretary has established that an IPd limit above 5% is not RAGAGEP-compliant

I agree with my colleagues that a 3% IPd limit for the types of relief installations at issue is not the only RAGAGEP available to BP. In my view, however, the record establishes that at the time of the violative conduct, an IPd limit above 5% was not RAGAGEP-compliant for the relief installations at issue. The record also establishes that BP continued to use the relief installations with IPds measuring above 5%, without instituting interim measures to assure their safe operation. For these reasons, as discussed in more detail below, I would affirm the “a” and “b” items that concern relief installations with IPds in excess of 5%.

BP’s 7% IPd limit

When OSHA’s inspection commenced on September 10, 2009, BP’s corporate-wide internal standard for pressure relief systems required that the IPd limit for existing relief installations not exceed the lesser of 7% or the blowdown. Because BP understood at the time that the manufacturers’ blowdown specification for the relief valves at issue was 7%,[38] BP’s internal standard for these installations was, in effect, an IPd limit of 7%. In an internal guidance document dated August 2007, BP provided the following “engineering analysis” to support this internal standard:

For existing installations involving pressure relief valves, an inlet line pressure loss should not exceed the lower of a) the blowdown pressure or b) 7% of the set pressure (gauge units). If the pressure does not decrease to below the reseat pressure, then experience has shown that the valve will remain open. This constitutes the engineering analysis required by API to allow higher inlet line pressure losses. API RP-520 Part II, 5th Edition section 4.2.2 states:

“An engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent.”

BP asserts that its engineering analysis consisted of calculating each relief installation’s IPd and comparing it to the valve’s blowdown[39] to verify that the calculation was less than the blowdown. In other words, BP’s analysis in support of its 7% IPd limit begins with the premise that these valves will reseat properly (i.e., without “chatter”) as long as the IPd does not exceed the blowdown. BP reasoned that because the manufacturers supply the valves with a blowdown specification of 7%, an IPd that does not exceed 7% would allow the valves to function properly. Before OSHA’s inspection, BP (through Middough) had begun the process of calculating the IPd in each existing relief installation to assess whether, in conformance with its internal standard, the IPd in fact did not exceed 7%.

The record supports BP’s assumption that as long as no other factors affect the stability of a relief valve, the valve should function properly if the IPd is lower than the blowdown. However, the record also shows that at the time of the citation, for an IPd limit to have constituted a “good engineering practice,” it must have been low enough to include a safety margin. Specifically, Fisher and Melhem, as well as Steve Cloutier, BP’s former technical authority on pressure relief systems, agreed that such a safety margin is necessary to account for calculation inaccuracies and imperfections (sticking and misalignment, for example).

Citing to Melhem’s testimony, BP maintains that “[a] refinery’s internal guidelines comply with the PSM Standard so long as they result in IPd below blowdown,” i.e., an IPd limit up to 7%. BP, however, ignores the advice Melhem gave to its Texas City, Texas refinery before the OSHA inspection of its Ohio refinery commenced in this case. When the Texas refinery provided Melhem with BP’s 7% IPd guideline, he told BP personnel that the basis behind that limit—“7% is at or below the blowdown”—is “not without merit.” But Melhem also advised BP that there should be a safety margin, of which there was none, and he “would like to see” an IPd safety margin of 2% for existing relief installations.[40] Through his company ioMosaic, Melhem issued a report to BP in December 2008—nine months before the inspection here commenced—that recommended lowering its IPd limit for existing relief installations to 5%. Thus, BP’s rationale for its 7% IPd limit was flawed because its IPd policy did not incorporate a safety margin as recommended by its own expert and confirmed by the testimony of the Secretary’s expert witness.

Given the necessity of a safety margin, I find that the Secretary has established that BP’s 7% IPd limit was not a “good engineering practice” and, thus, not RAGAGEP.

BP’s 5% IPd limit

Starting in December 2008, a corporate BP committee held meetings to discuss updating BP’s IPd policy for existing relief installations. A final draft of the updated internal standard, which lowered the IPd limit to 5%, was formally issued by BP on October 26, 2009, six weeks after OSHA commenced its inspection in this case. The Secretary argues that this 5% IPd limit was not based on an adequate engineering analysis because BP merely calculated each “valve’s IPd and compar[ed] it to the valve’s rated, or assumed, blowdown number,” and no evidence in the record shows that “BP analyzed the performance of the valve, as recommended by API [520].” BP concedes this is what its engineering analysis entailed, but BP maintains that the analysis was conducted by “experienced professionals,” and the results “mirrored generally accepted industry practices within the refining industry.”

The Secretary, not BP, has the burden on this issue and I find that he has failed to show BP’s 5% IPd limit did not constitute RAGAGEP. See Motiva Enters., LLC, 21 BNA OSHC 1696, 1699 n.3 (No. 02-2160, 2006) (noting that Secretary bears “burden of proving that the combination of activities at issue here constituted a ‘process’ under the PSM standard”); cf. Am. Sterilizer Co., 18 BNA OSHC 1082, 1086 (No. 91-2494, 1997) (“When, as here, the Secretary alleges a violation of a broadly-worded training standard and the employer defends by showing that it has provided the type of training at issue, the burden shifts to the Secretary to show some deficiency in the training provided.”). At the time OSHA issued the citation here, there was no guidance from API or OSHA (beyond the text of API 520) addressing what such an engineering analysis must entail. The Secretary focuses on the word “performance” in the relevant portion of API 520—“[a]n engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent”—to argue that BP’s engineering analysis was deficient because, among other alleged shortcomings, BP did not independently verify the manufacturers’ blowdown. But no evidence in the record shows that BP had reason to believe the manufacturers’ representation of blowdown performance for the relief valves at issue was so inaccurate that an appropriate safety margin would not sufficiently address any deficiencies.

The Secretary’s expert witnesses—Fisher and Patricia Hamlin—advocated for a “bright line” 3% IPd limit for both new and existing relief installations. The preponderance of the evidence, however, shows that for existing installations, using an IPd limit that incorporated a 2% safety margin constituted a good engineering practice. Specifically, Melhem testified that it was “common industry practice” to allow IPds, after a valve was installed, to increase from 3% to 5% to avoid the serious risks associated with shutting down the equipment, implementing corrective actions, and then restarting equipment.[41] Cloutier’s testimony concerning BP’s consideration of these risks is consistent with Melhem’s testimony. According to Cloutier, to determine the appropriate IPd limit for existing installations, “we have to decide which is worse, the illness or the cure,” and to bring a unit down and change its design, or cut into an existing configuration, to correct an IPd between 3% and 5% is less safe than allowing a 5% IPd. Finally, the testimony in support of a 3% IPd limit for existing installations mostly focuses on the 3% limit’s inclusion in multiple consensus standards, rather than the necessity of a particular safety margin. But as discussed by my colleagues, this testimony is not consistent with API 520’s inclusion of an engineering analysis option to allow for an IPd above 3%.

The other aspect of BP’s engineering analysis—its valve-by-valve analysis—involved calculating each valve’s IPd to ensure that it was below 5% and then comparing that level with the manufacturer’s blowdown specification. Fisher disputed the adequacy of this analysis, but mostly focused on BP’s failure to consider “dynamic factors,”[42] and its reliance on the manufacturers’ certifications of blowdown performance, neither of which were recognized as pertinent considerations by the refining industry or API at the time OSHA issued the citation. Under these circumstances, I conclude that the Secretary has failed to show that BP’s adoption of a 5% IPd limit for existing relief installations was, at the time OSHA issued the citation, not a good engineering practice and that its corresponding engineering analysis was not compliant with API 520.[43] As such, I find that the Secretary failed to show that BP’s 5% IPd limit did not constitute RAGAGEP.

III. Citation 2, Items 4b through 12b

Under the PSM standard, an employer is required to “complete a compilation of written process safety information” (“PSI”) “before conducting any process hazard analysis” (“PHA”) required by the standard; this PSI must include, among other things, “information pertaining to the equipment in the process.” 29 C.F.R. § 1910.119(d) (introductory paragraph), (d)(3)(i) (identifying specific types of information included in “information pertaining to the equipment in the process”). Once the PSI is compiled, the employer must conduct an initial PHA to “determine and evaluate the hazards of the process being analyzed,” and then conduct a PHA revalidation every five years thereafter. 29 C.F.R. § 1910.119(e)(1)-(3), (6). In addition to conducting PHAs, employers must also inspect and test process equipment—including pressure vessels and piping systems. 29 C.F.R. § 1910.119(j)(1), (4). If “deficiencies in equipment” are identified “that are outside acceptable limits” as defined by the PSI, paragraph (j)(5)—the cited provision—requires the employer to “correct” the deficiencies, and to do so either “before further use or in a safe and timely manner when necessary means are taken to assure safe operation.” 29 C.F.R. § 1910.119(j)(5).

It is undisputed that after Middough calculated and documented the IPds concerning the relief installations identified in Items 4b through 12b, BP continued to operate the pressure vessels and rely on the associated relief valves. Because I find that the Secretary failed to prove that BP’s 5% IPd limit was not RAGAGEP and the relief installations referenced in Items 4b, 5b, 7b, and 8b all had IPd levels that did not exceed 5%,[44] I agree to vacate these items based on the Secretary’s failure to establish that the identified installations had “deficiencies in equipment” under paragraph (j)(5) that would have required corrective action.

Each of the relief installations referenced in Items 6b, 9b, 10b, 11b, and 12b had an IPd that exceeded 5%.[45] The Secretary asserts that BP failed to comply with paragraph (j)(5) by taking no action to mitigate the risks posed by the elevated IPds (“the deficiencies”) in these relief installations. In response, BP argues that even if the relief installations were not in compliance with RAGAGEP, “it is undisputed that the Refinery implemented any necessary interim actions to assure safe operation, fully complying with [paragraph (j)(5)].” To support this assertion, BP cites to the testimony of one of its technical managers, but does not specify what “interim actions” were actually taken “to assure safe operation.” In the part of this testimony relating to “interim actions” taken with respect to the installations referenced in these five citation items, the technical manager testified that his team conducted “risk assessments” using Middough’s IPd levels and determined that the systems could operate safely until a subsequent scheduled shutdown to perform maintenance (known as a “turnaround”), at which time BP would modify the systems to reduce the IPds to below 3%. In other words, although BP conducted risk assessments, no interim actions were taken to reduce the hazards associated with the elevated IPds. Indeed, even though all of the deficiencies were initially identified by Middough in either 2008 or 2009, none of them had been fixed as of the technical manager’s testimony in June 2012, and permanent corrective actions were not scheduled until either the 2012 or 2013 turnarounds.

Consequently, the outstanding issue is whether performing a risk assessment was a “necessary means” of “assur[ing] safe operation” under § 1910.119(j)(5), thus allowing BP to correct the deficiencies “in a safe and timely manner.” The Secretary claims the risk assessments are not a means of assuring safe operation under the standard, emphasizing that BP “did not offer any evidence of interim measures that would ensure safe operation until the deficiencies could be corrected.” I agree.

Paragraph (j)(5) sets three criteria for delaying correction of a deficiency until after “further use”: it must be corrected (1) “in a safe . . . manner,” (2) “in a . . . timely manner,” and (3) “when necessary means are taken to assure safe operation.” See Superior Masonry Builders, Inc., 20 BNA OSHC 1182, 1184 (No. 96-1043, 2003) (determination of standard’s meaning starts with its text and structure). The criterion to correct the deficiency “in a safe . . . manner” relates to what must occur when the correction is made, whereas here, the pertinent inquiry concerns what must occur prior to the correction. The timely manner criterion sets a time limit for the period prior to the completion of the correction and means “timely” from the standpoint of safety.

As for the last criterion—“when necessary means are taken to assure safe operation”—it must refer to a concept that addresses neither the manner in which the correction is made nor the timeliness of the correction. See TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001) (“It is ‘a cardinal principle of statutory construction’ that ‘a statute ought, upon the whole, to be so construed that, if it can be prevented, no clause, sentence, or word shall be superfluous, void, or insignificant.’ ”). BP’s risk assessments, however, addressed only the timeliness criterion—the refinery analyzed the risk associated with waiting until the next turnaround before correcting the deficiencies but, as BP’s technical manager admitted, no “interim mitigations” were taken to reduce the risk posed by the elevated IPds. This contradicts BP’s position that the risk assessments alone—at least under the circumstances here—constituted a means of assuring safe operation under the standard.[46]

In addition, the Secretary’s contention that “necessary means . . . taken to assure safe operations” includes only those actions that mitigate the risk is supported by the final rule preamble, in which OSHA discusses a comment submitted by AMOCO Corp. AMOCO commented that “there are occasionally instances when a piece of equipment exceeds what is deemed ‘acceptable’, and interim measures are taken to bring the equipment back into conformance with safe operating parameters.” Process Safety Management of Highly Hazardous Chemicals, 57 Fed. Reg. at 6391 (emphasis added). Immediately following its recitation of this comment, OSHA concludes the discussion of this issue by echoing AMOCO’s suggestion:

The comments have convinced OSHA that there may be many situations where it may not be necessary that the deficiencies be corrected “before further use” as long as the deficiencies are corrected in a safe and timely manner when necessary means are taken to assure safe operation.

Id. (emphasis added). See Superior Rigging & Erecting Co., 18 BNA OSHC 2089, 2091 (No. 96-0126, 2000) (“[T]he preamble to a standard is the most authoritative evidence of the meaning of the standard.”) (citing Tops Markets, Inc., 17 BNA OSHC 1935, 1936 (No. 94-2527), aff’d without published opinion, 132 F.3d 1482 (D.C. Cir. 1997); Am. Sterilizer Co., 15 BNA OSHC 1476, 1478 (No. 86-1179, 1992)).

Although the clause at issue—“when necessary means are taken to assure safe operation”—is included in a “broad, performance-oriented standard” that “may be given meaning in particular situations by reference to objective criteria, including the knowledge of reasonable persons familiar with the industry,” the measures taken must at least be within the parameters set by the language of the standard. Siemens Energy & Automation, Inc., 20 BNA OSHC 2196, 2198 & n.4 (No. 00-1052, 2005) (observing that employer’s interpretation of performance standard was contrary to standard’s plain meaning). Because BP’s risk assessments addressed only the timeliness of the deficiencies’ subsequent correction, they cannot qualify as “necessary means . . . to assure safe operation” under § 1910.119(j)(5). Accordingly, I would affirm Items 6b and 9b through 12b, all of which identify relief installations with IPds above 5%, but vacate Items 4b, 5b, 7b, and 8b, which identify installations with IPds equal to or less than 5%.

IV. Citation 2, Items 2a through 12a

Section 1910.119(d)(3)(ii) requires the employer to “document that equipment complies with [RAGAGEP].” As I discuss above, the Secretary has failed to prove that the existing relief installations with IPds of 5% or less are not RAGAGEP-compliant. Moreover, the Secretary has not argued that the Middough reports documenting IPds that complied with RAGAGEP otherwise failed to satisfy the cited provision’s documentation requirement. Accordingly, I agree to vacate Items 2a through 5a, 7a, and 8a, all of which identify relief installations with IPds that did not exceed 5%.[47] However, as noted above, the relief installations referenced in Items 6a and 9a through 12a had IPds over 5%, which the Secretary has shown is not a good engineering practice and, thus, not RAGAGEP. I find, therefore, that the documentation for these relief installations was not compliant with § 1910.119(d)(3)(ii) when the citation was issued,[48] and would affirm Items 6a and 9a through 12a.[49]

V. Characterization

“The hallmark of a willful violation is the employer’s state of mind at the time of the violation—an ‘intentional, knowing, or voluntary disregard for the requirements of the Act or . . . plain indifference to employee safety.’ ” Kaspar Wire Works, Inc., 18 BNA OSHC 2178, 2181 (No. 90-2775, 2000) (citation omitted), aff’d, 268 F.3d 1123 (D.C. Cir. 2001).

[I]t is not enough for the Secretary to show that an employer was aware of conduct or conditions constituting the alleged violation; such evidence is already necessary to establish any violation . . . . A willful violation is differentiated by heightened awareness of the illegality of the conduct or conditions and by a state of mind of conscious disregard or plain indifference . . . .

Hern Iron Works, Inc., 16 BNA OSHC 1206, 1214 (No. 89-433, 1993). This state of mind is evident where “ ‘the employer was actually aware, at the time of the violative act, that the act was unlawful, or that it possessed a state of mind such that if it were informed of the standard, it would not care.’ ” AJP Constr., Inc. v. Sec’y of Labor, 357 F.3d 70, 74 (D.C. Cir. 2004) (emphasis and citation omitted).

The judge, having vacated the IPd citation items, did not address their willful characterization. The Secretary argues that Items 6a, 6b, 9a through 12a, and 9b through 12b (the items I would affirm) should be characterized as willful because BP exhibited plain indifference to employee safety. Although this issue, in my view, poses a close question, for the reasons discussed below, I conclude that the Secretary has failed to establish BP had a willful state of mind.

The Secretary first asserts that BP maintained a 7% IPd limit while knowing that this allowed for no safety margin and was not supported by any “technical basis.” It is true that when ioMosaic submitted its report to BP in December 2008 following its review of the relief systems at BP’s refinery in Texas City, BP was specifically informed that to avoid conditions such as chatter in its relief installations, there had to be a safety margin between the IPd limit and the blowdown setting. Also, the record shows that at this time, BP personnel in positions of authority, such as Cloutier, were well aware of the need for such a safety margin.

But rather than ignore the ioMosaic report, corporate BP initiated a review of its IPd policy in December 2008 that culminated in the decision to lower the company’s internal standard to 5%. This process began with committee meetings held from December 2008 to February 2009 to discuss updating BP’s policy document, which at that time set forth the 7% IPd limit for existing relief installations. Serving on this committee was Cloutier and Ed Zamejc, another one of BP’s former technical authorities on pressure relief systems, as well as representatives of an engineering firm that provides technical support to refineries and chemical plants. As to the maximum allowable IPd for existing installations, there was a difference of opinion between Cloutier and Zamejc about what the internal standard should be. Based on his 30 years of experience in the area of pressure relief, Cloutier had found that “people” at other companies “accepted . . . an upper limit [of] 5% on the inlet pressure loss,” and he advocated that BP lower its IPd limit for existing installations to 5%. Also, Cloutier preferred an IPd limit with a 2% IPd safety margin, because he believed that the blowdown listed by the valve manufacturer was a “soft number.” But, according to Cloutier, Zamejc argued that the “physics on the [valve] disk allowed” the IPd “to go right up to the blowdown of the valve” and that he recommended maintaining the IPd limit at 7%. Zamejc testified that he believed a 7% IPd limit could be defended on a technical basis “based on it being within the operating range of the valve.”

After discussing the issue, the committee decided during its January and February 2009 meetings to leave the IPd limit at 7% for existing installations. The committee then sent the draft policy document to BP’s five U.S. refineries, including all of their engineering authorities, for feedback. In the summer of 2009, the committee reconvened and reexamined the draft, addressing the comments received and concerns raised. Then, at some point in September 2009, the committee decided that the IPd limit for existing installations should be lowered to 5%. Cloutier testified that, at that point, a decision to reduce the limit in accordance with his opinion was now possible because Zamejc had retired several months earlier, in March 2009. Cloutier also noted that there was agreement within BP’s refinery community that the IPd limit should be reduced, and the report from ioMosaic recommended the same. A final draft of the revised internal standard was placed into BP’s document control system for approval by “higher levels” in September 2009, and it was formally issued on October 26, 2009, six weeks after OSHA’s inspection in this case commenced on September 10, 2009.

In short, the record does not support the Secretary’s contention that BP ignored the information ioMosaic provided the company about its 7% IPd limit and the need to account for a safety margin. And because it is not clear from the record on what day in September BP’s committee decided to lower the IPd limit to 5%, the Secretary cannot claim that BP’s decision to lower its IPd limit—the culmination of a lengthy undertaking that began more than eight months earlier—was motivated solely by OSHA’s inspection of the refinery.

The Secretary also argues that BP’s decision to lower its internal standard to 5% shows “BP knew that IPd[s] in excess of 5% were hazardous to employees.” According to the Secretary, despite BP’s knowledge of this hazard, it allowed the five relief installations at issue to “lurch into the range [above 5%] that BP presumably agreed was dangerous” and then failed to “promptly correct any deficiencies,” thus showing plain indifference to employee safety. Based on the evidence discussed above, including Melhem’s communications with BP and the well-informed view Cloutier expressed on the matter as a member of BP’s committee, I agree that BP knew, before OSHA inspected the refinery in September 2009, that an IPd in excess of 5% could be hazardous when the valve’s blowdown is presumed to be 7%. But given the scope of Middough’s revalidation project and the procedures BP had in place for evaluating deficiencies, the Secretary has not established that BP exhibited plain indifference to employee safety by failing to promptly correct the relief installations with IPds exceeding 5%.

The record shows that Middough’s project was a multi-year, comprehensive undertaking to conduct a valve-by-valve review of all 1,800 pressure relief valves across the entire refinery, which included around twenty process units. As far as identifying and correcting IPd deficiencies, BP used Middough’s IPd calculations—once they had been approved by the refinery’s technical authority on relief systems and completed for an entire unit—to assess the “risk” posed by the deficiencies and prioritize when the deficiencies would be corrected. Although it is not entirely clear at what point in the process the elevated IPd levels for these particular relief installations were assessed, it appears that risk assessments were performed following receipt of the earliest versions of the Middough reports (i.e., those that are in the record).[50]

I view the Middough revalidation project as a genuine effort by BP to address and improve safety. The project shows that, even before OSHA’s inspection of the refinery, BP was committed to addressing IPd deficiencies in its relief systems. While BP clearly violated the cited standard by deciding not to institute interim measures to assure the safe operation of its relief installations, those decisions were made only in light of the company’s comprehensive risk assessments of the relief installations.[51] Therefore, in the context of the revalidation project as a whole, the violations do not reflect an indifference to employee safety. In short, the Secretary has simply not shown that BP’s process for responding to the deficiencies identified by Middough was anything but a sincere attempt to address those deficiencies, taking into account the risks associated with corrective action and additional startups and shutdowns.[52]

Based on this evidence, I find that BP’s determination to wait until a scheduled turnaround to correct IPd deficiencies in existing relief installations—IPds above 5%, where the blowdown is presumed to be 7%—has not been shown to constitute plain indifference to employee safety.[53] See E.R. Zeiler Excavating, Inc., 24 BNA OSHC at 2055 (finding Secretary failed to establish plain indifference as to cave-in protection violation based on judge’s “finding that [employee] ‘erroneously, but honestly’ believed the trench was safe”). Accordingly, I find that the Secretary failed to establish that BP exhibited a willful state of mind with respect to Items 6a, 6b, 9a through 12a, and 9b through 12b.

For all of these reasons, I disagree with my colleagues’ basis for vacating Willful Citation 2, Items 2a through 12a, and 4b through 12b, and would affirm Items 6a and 6b, 9a through 12a, and 9b through 12b as serious,[54] and vacate Items 2a through 4a, 4b, 5a, 5b, 7a, 7b, 8a, and 8b on other grounds. For the reasons stated by my colleagues, I join their decision to affirm Willful Citation 2, Items 31a and 31b, as serious and vacate Willful Citation 2, Items 13a through 18a, 15b, 19a through 27a, 19b through 27b, and 32 through 40.

/s/

Cynthia L. Attwood

Dated: September 27, 2018 Commissioner

United States of America

OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION

1924 Building - Room 2R90, 100 Alabama Street, S.W.

Atlanta, Georgia 30303-3104

Secretary of Labor, Complainant,
v.
BP Products North America, Inc., & BP-Husky Refining, LLC, Respondent,	OSHRC Docket No. 10-0637
and
United Steelworkers Local 1-346, Authorized Employee Representative.

Appearances:

Patrick L. DePace, Esquire, Linda Hastings, Esquire,

U. S. Department of Labor, Office of the Solicitor, Cleveland, Ohio

For Complainant

Jordana W. Wilson, Esquire

U. S. Department of Labor, Office of the Solicitor, Washington, D.C.

For Complainant

Gregory C. Dillard, Esquire, Christopher Bacon, Esquire, and Tommer Yoked, Esquire

Vinson & Elkins, LLP, Houston, Texas

For Respondent BP Products North America, Inc.

Felix C. Wade, Esquire

Ice Miller, Columbus, Ohio

For Respondent BP Husky

Kim Nibarger

United Steelworkers, Pittsburgh, PA 15222

For the Authorized Employee Representative

Mark Lowry

United Steelworkers, BP Toledo Refinery, Toledo, Ohio

For the Authorized Employee Representative

Before: Administrative Law Judge Sharon D. Calhoun

DECISION AND ORDER

On March 8, 2010, the Secretary issued three citations to BP Products North America, Inc. (BPP), and BP-Husky Refining, LLC (BP-Husky), alleging twenty serious, forty-two willful, and three other-than-serious violations of the Occupational Safety and Health Act of 1970 (Act), 29 U.S.C. §§ 651, et seq. The Secretary issued the citations following an inspection conducted by the Occupational Safety and Health Administration (OSHA) at a refinery in Oregon, Ohio. The Secretary proposed penalties totaling $3,042,000.00 for the three citations.

BPP and BP-Husky timely contested the citations. The undersigned held a nineteen-day hearing in this matter from June 4, 2012, to June 28, 2012, in Detroit, Michigan.[55] The United Steelworkers Local 1-346 (Union) elected party status in this proceeding.

Prior to the hearing, the Secretary and BPP settled all items alleging serious violations in Citation No. 1 and all items alleging other-than-serious violations in Citation No. 3 (The parties submitted a written agreement to the undersigned on December 7, 2012). The Secretary agreed to withdraw Citation Nos. 1 and 3 against BP-Husky (Exh. JX-54). The undersigned approves the parties’ settlement agreement, as reflected in the Order below.

The first day of the hearing, the Secretary withdrew Item 42 of Citation No. 2 (Tr. 52). In his post-hearing brief, the Secretary also withdrew Item 2b, Item 3b, and Instance (a) of Item 41 of Citation No. 2 (Secretary’s brief, p. 2).

BPP and BP-Husky stipulate the Commission has jurisdiction over this proceeding under § 10(c) of the Act. BPP also stipulates it is an employer engaged in a business affecting commerce under § 3(5) of the Act. BP-Husky contends it is not an employer under § 3(5) of the Act (Tr. 23).

Remaining for disposition are Items 1 through 41 of Citation No. 2, which allege willful violations of various subsections of 29 C.F.R. § 1910.119, the Process Safety Management (PSM) standard. The Secretary proposed a penalty of $70,000.00 for each item, for a total proposed penalty of $2,870,000.00.

Item 1 of Citation No. 2 alleges a willful violation of 29 C.F.R. § 1910.119(d)(3)(i), for failing to maintain required process equipment information.

Items 2 through 27 of Citation No. 2 are grouped items. Items 2a through 27a (as well as Items 28, 29, and 30) allege willful violations of 29 C.F.R. § 1910.119(d)(3)(ii), for failing to document that equipment in the process complies with recognized and generally accepted good engineering practices. Items 4b through 27b allege willful violations of 29 C.F.R. § 1910.119(j)(5) for failing to correct deficiencies in equipment that are outside recognized and generally accepted good engineering practices.

Item 31a alleges a willful violation of 29 C.F.R. § 1910.119(d)(3)(iii) for failing to determine and document equipment is designed, maintained, inspected, tested, and operating in a safe manner. Item 31b alleges a willful violation of 29 C.F.R. § 1910.119(e)(3)(ii) for failing to identify any previous incident which had a likely potential for catastrophic consequences in the workplace.

Items 32 through 40 allege willful violations of 29 C.F.R. § 1910.119(e)(5) for failing to establish a system to promptly address the findings and recommendations of the employer’s process hazard analysis team.

Item 41 alleges a willful violation of 29 C.F.R. § 1910.119(j)(4)(ii) for (in instances (b) and (c)) failing to follow recognized and generally accepted good engineering practices for the employer’s inspection and testing procedures.

The Secretary, BPP, and BP-Husky submitted post-hearing briefs on February 25, 2013. The undersigned finds BP-Husky is an employer under § 3(5) of the Act. The undersigned vacates Items 1 through 12; Items 13b and 14b; Item 15; Items 16b, 17b, and 18b; and Items 19 through 41 of Citation No. 2. The undersigned affirms Items 13a, 14a, 16a, 17a, and 18a. The affirmed items are classified as serious. A penalty of $7,000.00 is assessed for each affirmed item, for a total penalty of $35,000.00.

Background

BPP operates a refinery located at 4001 Cedar Point Road in Oregon, Ohio (Oregon is a suburb of Toledo, Ohio). BP-Husky is a joint venture with a business interest in the refinery. BPP purchased the refinery (which was built in 1919) in 1991 (Tr. 119-123).

The Ohio refinery manufactures different grades of gasoline and diesel from crude oil in its numerous process units. BPP pumps crude oil from storage tanks on the property to the different units and refines it by boiling the crude oil and removing chemical fractions as they cool (Tr. 152, 552, 991, 1841-1842, 2039-2046, 3137).

OSHA implements a program known as the Petroleum Refinery Process Safety Management National Emphasis Program (NEP). As part of the NEP, in the second half of 2009 OSHA requested documents relating to process safety management at the Ohio refinery from BPP and BP-Husky. OSHA also reviewed reports of safety audits conducted at the refinery by consultants commissioned by BPP. OSHA then randomly selected certain pressure vessels and piping equipment, and requested documents relating to them (Tr. 692). OSHA reviewed the paperwork before inspecting the refinery.

On September 10, 2009, a team of compliance safety and health officers (CSHOs) and industrial hygienists (IHs) from OSHA began an inspection of the refinery. During the inspection, OSHA focused on the specific pressure vessels and piping equipment for which BPP provided documentation (Tr. 693). The OSHA inspection focused on three units: the Fluid Catalytic Cracker (FCC) Unit, which processes 50,000 barrels of crude oil a day, and the ALKY 1 and ALKY 2 Units, which remove sulfur from the crude oil (Tr. 695, 1736-1737, 1821, 1841-1842, 2039-2046).

The Middough Report

BPP commissioned safety consultant Middough to conduct an extensive revalidation project for the refinery. The project began in 2008 and was continuing at the time of the OSHA inspection. Middough issued several draft reports as its revalidation project progressed. BPP spent more than $6 million in engineering costs for the Middough revalidation project and more than $10 million in equipment upgrades in response to the Middough findings (Tr. 2916).

OSHA requested copies of the Middough draft reports from BPP. BPP provided copies of the reports, including drafts issued in July, October, and December of 2009 (Exh. CX-2, CX-3; RBPP-84; Tr. 618-619). OSHA Industrial Hygienist (IH) Leonard Zielinski testified, “[W]e were told that [BPP] had a study done. We asked who the—you know, how the study was done and we came to the understanding that it was done by the Middough Report, so we asked for—we made a request for that report” (Tr. 619).

On July 28, 2000, OSHA published its Final Policy Concerning the Occupational Safety and Health Administration’s Treatment of Voluntary Safety and Health Self-Audits, 65 Fed. Reg. 46489 (2000). The summary of the rule states, “[OSHA’s] policy provides that the Agency will not routinely request self-audit reports at the initiation of an inspection, and the Agency will not use self-audit reports as a means of identifying hazards upon which to focus during an inspection.” Id.

Although the OSHA publication is a policy and not a regulation, it provides well-reasoned guidance regarding the use of an employer’s self-auditing information. The goal of OSHA’s policy is to encourage employers to proactively address worksite safety without raising concerns they are inadvertently providing OSHA with a roadmap for issuing citations. Employers should not have to fear that self-auditing will lead to self-incrimination.

In Solis v. Grede Wisconsin Subsidiaries, 24 BNA OSHC 1061 (D. Wis. 2013), the court for the Western District of Wisconsin considered the Secretary’s motion to compel compliance with an administrative subpoena duces tecum he issued for internal audit documents prepared by Grede. The court denied the Secretary’s motion to compel, citing OSHA’s Final Policy on self-audits (the court provisionally granted the Secretary’s motion to compel compliance with the subpoena duces tecum “if and when OSHA discloses independently-identified hazards found at” Grede’s facility. Id. at 1064). Although the court’s decision in Grede is not precedential in this proceeding, its reasoning accords with the undersigned’s view of the issue. The court states:

Despite providing this public assurance—with the obvious goal of encouraging companies to thoroughly investigate and correct health and safety violations, thereby protecting far more workers than OSHA could hope to achieve through its own investigations alone—OSHA now takes the position that its assurance was never adopted as a rule and, therefore, in no way binds the agency. In the court’s view, however, it is irrelevant whether one calls this guidance a “rule” or merely a “final policy,” or even whether it is legally binding on the agency for purposes outside of the exercise of its agency subpoena power. What is important is that it creates a reasonable expectation of privacy that businesses rely on in conducting internal safety audits; in turn, this expectation serves OSHA’s paramount goal of promoting safety in the workplace.

Id. at 1063.

OSHA explicitly states in its Final Policy that OSHA “will not use self-audit reports as a means of identifying hazards upon which to focus during an inspection.” OSHA made extensive use of the Middough reports during its inspection of the refinery. In many instances, the CSHOs did not otherwise verify the self-identified deficiencies or conduct independent hazard assessments. The majority of the items at issue were self-identified by BPP and BP-Husky in documentation provided to OSHA. OSHA’s use of BPP and BP-Husky’s self-audit reports is in blatant contravention of its Final Policy. Although the undersigned is troubled by the Secretary’s ill-advised use of the Middough reports, I am not using the Middough reports as a basis for vacating the alleged violations self-identified in the reports.

Is BP-Husky an Employer as Defined by § 3(5) of the Act?

BP-Husky argues it is not an employer under § 3(5) of the Act and thus should be dismissed from this proceeding. Based upon a review of the record, the undersigned disagrees. It is determined that BP-Husky is an employer within the meaning of the Act.[56] BP-Husky remains a party to this case.[57]

DISCUSSION

Citation No. 2

Elements of the Secretary’s Burden of Proof

To prove a violation of an OSHA standard, the Secretary must show by a preponderance of the evidence that: (1) the cited standard applies; (2) the employer failed to comply with the terms of the cited standard; (3) employees had access to the violative condition; and (4) the employer either knew or could have known with the exercise of reasonable diligence of the violative condition.

JPC Group Inc., 22 BNA OSHC 1859, 1861 (No. 05-1907, 2009).

BPP and BP-Husky contend the Secretary failed to establish the elements of noncompliance, employee access, and employer knowledge for the alleged violations. They do not dispute the applicability of the cited standard.

Applicability of the Cited Standard

The PSM standard is found in Subpart H--Hazardous Materials of OSHA’s general standards. Section 1910.119 addresses “Process safety management of highly hazardous chemicals,” and states, “This section contains requirements for preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals. These releases may result in toxic, fire or explosion hazards.”

Section 1910.119(a)(1)(ii) provides:

This section applies to the following:

. . .

(ii) A process which involves a flammable liquid or gas (as defined in 1910.1200(c) of this part) on site in one location, in a quantity of 10,000 pounds (4535.9 kg) or more[.]

George Yoksas, OSHA’s area director for its Milwaukee office, testified 10,000 pounds “equate[s] to something on the order of 1,300 gallons” (Tr. 152). The refinery at issue performs a series of chemical processes, including the FCC Unit that processes 50,000 barrels of crude oil a day (Tr. 1736-1737). This quantity of crude oil (a flammable liquid) is more than sufficient to bring the refinery and its processes within the ambit of the PSM standard. BPP and BP-Husky do not dispute that the various cited subsections of the PSM standard apply to the cited conditions. (“One element is undisputed: that the cited standards apply to BPP as operator of the Refinery and as employer of the BPP workers at the site” (BPP’s brief, p. 5, footnote 3).)

The Secretary has established the first element of his burden of proof for all the items at issue. The PSM standard applies to the cited conditions.

Item 1: Alleged Willful Violation of § 1910.119(d)(3)(i)

Missing U-1 Form

Item 1 of Citation No. 2 alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not maintain a U-1 form for the Isobutane Recycler Coalescer (PR 511468).

Section 1910.119(d)(3)(i) provides:

[T]he employer shall complete a compilation of written process safety information before conducting any process hazard analysis required by the standard.

. . .

(3) Information pertaining to the equipment in the process. (i) Information pertaining to the equipment in the process shall include:

(A) Materials of construction;

(B) Piping and instrument diagrams (P&ID’s);

(C) Electrical classification;

(D) Relief system design and design basis;

(E) Ventilation system design;

(F) Design codes and standards employed;

(G) Material and energy balances for processes built after May 26, 1992; and

(H) Safety systems (e.g. interlocks, detection or suppression systems).

Background

The American Society of Mechanical Engineers (ASME) developed a form, known as a U-1 form, which pressure vessel manufacturers use to provide information to their customers (Tr. 137). After it has designed and constructed a pressure vessel, the manufacturer issues a copy of the U-1 form to the purchaser. The U-1 form contains important information relating to the safe use of the pressure vessel (Tr. 137-138, 2370).

CSHO Anthony Lowe is one of the CSHOs who inspected the Ohio refinery. He explained the importance of the U-1 form:

When we do inspections, we always ask for, if you’re looking at pressure vessels, et cetera, we always ask for the U-1 report, and that’s basically the birth certificate for that vessel. It talks about the maximum allowable working pressures, maximum allowable working temperatures, et cetera, on the vessel. So it’s important stuff to look at to make sure that, you know, when you look at what the company is doing, that they’re not exceeding those.

(Tr. 695).

OSHA requested copies of the U-1 form for five pressure vessels chosen at random (Tr. 696). OSHA also targeted pressure vessels identified by BPP’s consulting company, Middough, who audited the Ohio refinery at BPP’s request and issued several safety reports. OSHA reviewed the Middough reports as part of its inspection. In March 2009, Middough identified the Isobutane Recycler Coalescer (PR 511468) at issue here as not having a U-1 form available (Exh. RBPP-57; Tr. 702). During his inspection, CSHO Lowe requested a copy of the U-1 form for the Isobutane Recycler Coalescer. BPP and BP-Husky informed him they did not have a copy available (Tr. 739-740).

Steve Rowe is BPP’s Safety and Operations Risk Director and the site engineering authority (Tr. 2368). Rowe acknowledged that the U-1 form at issue was missing (Tr. 2370). He contacted the National Board and requested a copy of the U-1 form. The National Board did not have a copy on file (Tr. 2376-2377).

Rowe testified that all of the information provided for a pressure vessel in a U-1 form was available at the Ohio refinery for the Isobutane Recycler Coalescer (Tr. 2391-2395). The information is found within the drawings of the pressure vessel, the bill of material on the drawings, the design code book, and the vessel’s name plate. With the exception of the name plate (which is physically located on the pressure vessel) the listed items are located either electronically or in the engineering vault in the administrative building (Exh. RBPP-14; Tr. 2390-2396, 2410-2412, 2418).

Once Rowe became aware the U-1 form for the Isobutane Recycler Coalescer was missing, he was able to locate the required information for the vessel within 30 minutes (Tr. 2420).[58] OSHA Area Director George Yokas and CSHO Lowe conceded the required information was available at the Ohio refinery (Tr. 169, 740).

Compliance with the Terms of the Standard

Section 1910.119(d)(3)(i) requires an employer to compile specified written PSM information for its equipment, including pressure vessels. The cited standard requires only that the written information be available—it does not specify the form the documentation should take.

Section 1910.119(d)(3)(i) does not mention the U-1 form. In fact, the U-1 form does not provide most of the information listed in § 1910.119(d)(3)(i)(A) through (H). OSHA Area Director Yoksas acknowledged the divergence between the requirements of the standard and the information provided by the U-1 form:

Q. Now the U-1 form would not include process safety information, such as piping and instrument diagrams, P&Ds, correct?

Yoksas: Correct.

Q. And it wouldn’t include information about electrical classification, correct?

Yoksas: The U-1 report? Correct.

Q. And what I’m doing is I’m going through (A) through (H) in the regulations identifying which ones of those don’t apply. The U-1 form won’t have anything about relief systems design and design basis, correct?

Yokas: Correct.

Q. It will not have anything about ventilation system design?

Yoksas: Correct.

Q. It will not have anything about material energy balances, correct?

Yokas: Correct.

Q. It will not have anything about safety systems, correct?

Yoksas: Correct

(Tr. 170-171).

OSHA’s Area Director conceded that a U-1 form would not provide the information required for six out of the eight required specifications set out in the standard (only the materials of construction (§ 1910.119(d)(3)(i)(A)) and the design codes and standards employed (§ 191.119(d)(3)(i)(F)) are supplied by the U-1 form. See Exhibit RBBP-13). Despite the discrepancy between the information required by § 1910.119(d)(3)(i) and the information provided by the U-1 form, the Secretary charges in the alleged violation description (AVD) of Item 1 that BPP and BP-Husky did “not maintain a U-1 form for the Isobutane Recycler Coalescer.” The AVD otherwise does not specify what information required by § 1910.119(d)(3)(i)(A) through (H) is missing.

The Secretary’s flawed AVD dooms his case with respect to Item 1. By couching the alleged violation in terms of the missing U-1 form, the Secretary impermissibly creates a significant requirement not found in the cited standard. The Secretary’s focus on the U-1 form is misplaced. BPP and BP-Husky cannot be found in violation of a standard for not possessing a document the cited standard does not require.

Furthermore, the record establishes BPP and BP-Husky had compiled the required information. Yoksas and CSHO Lowe conceded the information was on site. The Secretary has failed to establish BPP and BP-Husky were not in compliance with the terms of § 1910119(d)(3)(i). Item 1 is vacated.

Items 2 through 12: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

IPDs[59] Exceeding 3%

The AVDs of Items 2a through 12a are identical except for the identifying pressure safety valve number, the specific pressure vessel, and the IPD percentage. Items 2a through 12a follow this formula:

29 CFR 1910.119(d)(3)(ii): The employer does not document that the equipment in the process complies with recognized and generally accepted good engineering practices:

a. BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document that PSV-[identifying number] providing pressure relief protection to [specific pressure vessel] complied with recognized and generally accepted good engineering practices in that it has an inlet pressure drop greater than 3%. PSV-[identifying number] was determined to have an inlet pressure drop of [ ]%.

The cited relief valves and their IPDs are:

Item 2a: PSV-134 on the Debutanizer Reflux Drum in the Alky Unit had an IPD of 3.8%;

Item 3a: PSV-137 on the First Stage Butane Treater Drum in the Alky Unit had an IPD of 4.6%;

Item 4a: PSV-447 on the Depropanizer Feed Treater Drum in the Alky Unit had an IPD of  5.4%;

Item 5a: PSV-1299 on the Cat Gas Light Oil/BFW Preheater had an IPD of 5.0%;

Item 6a: PSV-1301 on the FCC Feed Drum in the FCC Unit had an IPD of 6.3%;

Item 7a: PSV-1321 on the Fractionator Tower in the FCC Unit had an IPD of 3.2%;

Item 8a: PSV-1338A on the First Stage Drum in the FCC Unit had an IPD of 3.2%;

Item 9a: PSV-1280 on the FCC Feed Drum in the FCC Unit had an IPD of 7.7%;

Item 10a: PSV-1281 on the FCC Feed Drum in the FCC Unit had an IPD of 7.7&;

Item 11a: PSV-1332 on the Stripper Tower in the FCC Unit had an IPD of 8.8%;

Item 12a: PSV-440 on the Rerun Tower in the Alky Unit had an IPD of 6.8%.

Items 4b through 12b (the Secretary withdrew Items 2b and 3b) refer to the same pressure safety valves and IPDs identified respectively in Items 4a through 12a. The items state:

29 CFR 1910.119(j)(5): The employer does not correct deficiencies in equipment that are outside acceptable limits (as defined by process information in 29 CFR 1910.119(d) before further use or in a safe and timely manner:

a. BP-Husky Refining, LLC - Oregon, Ohio: The employer does not ensure PSV-[identifying number], located in [specific pressure vessel], has an inlet pressure drop of not more than 3%. PSV-[identifying number] was determined to have an inlet drop of [ ]%.

Items 2a through 12a allege BPP and BP-Husky violated § 1910.119(d)(3)(ii), which provides:

The employer shall document that equipment complies with recognized and generally accepted good engineering practices.

Items 2b through 12b allege BPP and BP-Husky violated § 1910.119(j)(5), which provides:

The employer shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in paragraph (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.

The disposition of these items depends upon the interpretation of the phrase “recognized and generally accepted good engineering practices,” or RAGAGEP. The Secretary argues that numerous industry consensus standards establish the RAGAGEP requires employers maintain an inlet pressure drop of no more than 3%. Because the inlet pressure drop of the cited relief valves in the refinery exceeded 3%, the Secretary contends they were mechanically deficient.

OSHA’s inspection team used the Middough report to find IPDs in excess of 3%. OSHA did not independently verify the IPDs or perform hazard assessments of the cited valves. OSHA safety engineer James Lay testified, “We evaluated the calculations that had been done by Middough against RAGAGEP and issued the citations on that basis. . . . The assumption was, if you’re not in compliance with RAGAGEP, there is potential for hazard” (Tr. 516).[60]

BPP and BP-Husky argue BPP has established its own RAGAGEP based on its engineering knowledge and industry experience, and that the Secretary’s 3% inlet pressure drop limit is too restrictive.

Background

Inlet Pressure Drop (IPD)

A pressure vessel in a refinery must have relief protection. Often this protection is provided by a relief valve, which is designed to open at its set point, remain open while pressure relieves, and close as pressure decreases to its blowdown point. Inlet pressure drop (IPD) is the amount of pressure lost due to friction as vapor or liquid passes through piping from a pressure vessel to the relief valve. IPD can be affected by numerous factors, including the length, diameter, configuration, and surface texture of the piping between the pressure vessel and the relief valve, as well as the velocity of the flow of material through the piping. The IPD is the difference between the pressure in the vessel and the pressure at the relief valve. When a vessel exceeds its maximum allowable working pressure (MAWP), it reaches the relief valve’s set point, which is the pressure at which the valve opens to relieve the overpressure. The blowdown point is the pressure at which the relief valve is set to close. The blowdown point is always less than the set point so that the valve remains open long enough to relieve pressure. The IPD is usually described as a percentage of the valve’s set point. For example, if the set point for a relief valve is 100 pounds per square inch (psi) and the calculated IPD in the piping is 3 psi, then the IPD is 3% (Tr. 64, 225, 548-551, 559, 563, 2480-2483).

If an excessive IPD occurs, the relief valve may close prematurely, resulting in a condition known as “chatter” (because it sounds like teeth chattering). During chatter, the relief valve opens and closes so rapidly and violently that it can become damaged and possibly fail (Tr. 550-552, 2193).

Failure of the relief valve could result in the release (loss of containment) of hot hydrocarbons that could explode and burn, causing serious injuries or death to employees in the refinery. The relief valve is the last line of defense against an overpressure resulting in an accidental release of hazardous chemicals. By the time the relief valve is engaged, all other safety systems have failed and the pressure in the pressure vessel has risen to a dangerous level (Tr. 542-543, 552, 2877-2878). In the words of Cassandra Hamlin, the Secretary’s expert in inlet pressure drop hazards, “[W]hat you’re doing in an oil refinery, you’re basically boiling gasoline and the only thing protecting you is the steel that keeps things in. So we use this term that sounds kind of innocuous, ‘loss of containment.’ Well, loss of containment means that hot gasoline, like down at BP Texas City, gets out and potentially could kill a lot of people” (Tr. 552).

The PSM Standard is a Performance Standard

The PSM Standard, § 1910.119, took effect in May 1992 as a performance standard. 57 Fed. Reg. 6390 (1991). Unlike a specification standard, which details precise requirements an employer must meet, a performance standard indicates the degree of safety and health protection required, but leaves the method of achieving the protection to the employer (Tr. 108). Compliance with a performance standard is determined by whether the employer acted as a reasonably prudent employer would:

[T]he employer is required to assess only those hazards that a “reasonably prudent employer” would recognize. See W.G. Fairfield Co., 19 BNA OSHC 1233, 1235, 2000 CCH OSHD ¶ 32,216, p. 48,864 (No. 09-0344, 2000), aff'd, 285 F.3d 499 (6th Cir. 2002); see also Thomas Indus. Coatings, Inc., 21 BNA OSHC 2283, 2287, 2004-09 CCH OSHD ¶ 32,937, p. 53,736 (No. 97-1073, 2007) (“[P]erformance standards ... are interpreted in light of what is reasonable.”). A reasonably prudent employer is a reasonable person familiar with the situation, including any facts unique to the particular industry. W.G. Fairfield Co., 19 BNA OSHC at 1235, 2000 CCH OSHD at pp. 48,864-65; Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793, 1794, 1991-93 CCH OSHD ¶ 29,770, p. 40,489 (No. 90-998, 1992); see also Brennan v. Smoke-Craft, Inc., 530 F.2d 843, 845 (9th Cir. 1976). Under Commission precedent, industry practice is relevant to this analysis, but it is not dispositive. W.G. Fairfield, 19 BNA OSHC at 1235-36, 2000 CCH OSHD at p. 48,865; Farrens Tree Surgeons, 15 BNA OSHC at 1794, 1991-93 CCH OSHD at p. 40,489; see also Smoke-Craft, 530 F.2d at 845 (noting that in absence of any industry custom the need to protect against an alleged hazard “may often be made by reference to” what a reasonably prudent employer “familiar with the industry would find necessary to protect against this hazard”).

Associated Underwater Services, 2012 WL 76200 at *2 (No. 07-1851, 2012).

BPP and BP-Husky contend that OSHA is impermissibly adopting a prescriptive 3% IPD limit, in contravention of the flexibility inherent in a performance standard.

RAGAGEP

Section 1910.119(d)(3)(ii) requires an employer to document its equipment complies with “recognized and generally accepted good engineering practices,” and § 1910.119(j)(5) requires an employer to correct deficiencies in equipment that are outside acceptable limits as defined by RAGAGEP. The Secretary contends, “[T]he numerous industry consensus standards specifying an IPD of no more than 3% constitute applicable RAGAGEP for the process equipment at issue” (Secretary’s brief, pp. 88-89; emphasis in original). BPP and BP-Husky disagree, arguing, “BPP and other peer refineries have developed robust and well-supported relief system guidelines that justify up to 7% IPD on conventional relief valves. . . . [S]o long as the blowdown for an existing relief valve exceeds its IPD, a 5% or even 7% IPD limit for a conventional valve will not be the cause of any unstable operations or chatter” (BPP’s brief, p. 15).

Industry Standards

In 1963, the American Petroleum Institute (API) established 3% of a relief valve’s set point as the IPD limit (Tr. 2861, 2863). In December 1994, the API published its Recommended Practice 520 (RP 520) (“Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries”), amending its previous Recommended Practice by replacing the word “shall” with the word “should.” Amended RP 520 provides:

When a pressure relief valve is installed on a line directly connected to a vessel, the total non-recoverable pressure loss between the protected equipment and the pressure relief valve should not exceed 3 percent of the set pressure of the valve except as permitted in 2.2.3.1 for pilot-operated pressure relief valves. When a pressure relief valve is installed on a process line, the 3 percent limit should be applied to the sum of the loss in the normally non-flowing pressure relief valve inlet pipe and the incremental pressure loss in the process line caused by the flow through the pressure relief valve. The pressure loss should be calculated using the rated capacity of the pressure relief valve. Pressure losses can be reduced materially by rounding the entrance to the inlet piping, by reducing the inlet line length, or by enlarging the inlet piping. Keeping the pressure loss below 3 percent becomes progressively more difficult as the orifice size of a pressure relief valve increases. . . . An engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent.

(Exh. JX-17, p.2, § 2.2.2; emphasis added).

In 2007, the ASME issued its “Boiler & Pressure Vessel Code,” (BPVC) which included “Rules for Construction of Pressure Vessels.” In its Nonmandatory Appendix M of the Rules (“Installation and Operation”), the ASME states: “[T]he flow characteristics of the upstream system shall be such that the cumulative total of all nonrecoverable inlet losses shall not exceed 3% of the valve set pressure” (Exh. JX-55, p. 593).

The Center for Chemical Process Safety (CCPS), a branch of the American Institute of Chemical Engineers (AICHE) which focuses on process safety issues in the chemical process industry, states in its 1998 “Guidelines for Pressure Relief and Effluent Handling Systems”: “The ‘3% rule’ (ASME BPVC, Appendix M) is currently acceptable as the criterion for the upper limit on inlet losses to safety relief valves” (Exh. JX-23, p.35). The CCPS acknowledges, however, that the 3% rule is a reductive approach to a complicated system:

Typically a safety valve comes from the manufacturer with its blowdown set at 7% or more. After allowing for the additional losses in the valve nozzle itself (typically about 3%), the 3% limit on inlet piping loss contains a margin of safety. Somewhat higher values of blowdown may be observed for conventional valves in service conditions of constant superimposed back pressure.

A study of the dynamic response to inlet pressure loss has been performed (Kastor 1986, 1986a, 1990, 1994). The proposed computational model is in general agreement with test results for gas flow. The study concludes that the 3% rule is an oversimplified view of the complex dynamic behavior of a valve. Chatter is not observed at higher loss in certain piping configurations, while chatter can be observed at lower loss levels in other configurations. Guidelines for piping layout and sizing based on this work are yet to be developed and accepted by rule-making bodies. Thus, the 3% rule remains as the accepted good practice.

(Exh. JX-23 at 36).

API Study and Testimony of Cassandra Hamlin and Harold Fisher

The API commissioned Berwanger, Inc., a consulting company specializing in oil, gas, and petrochemicals, to conduct a study on pressure relief valves (PRVs). Berwanger issued an interim report for the study in 2002. The goal of the study was to determine whether the 3% rule is “necessary and sufficient to assure against unstable operation of spring loaded PRVs and to develop validated engineering tools (screening criteria and software) that would allow plant engineers to design and to evaluate PRV installation for stable PRV performance” (Exh. RBPP-384, p.2; Tr. 565). Berwanger surveyed seven refineries who reported they had experienced 45 loss-of-containment incidents resulting from PRV instability (Tr. 573-574).

The owner of Berwanger, Inc., (until she sold the company in 2006) and the project manager for the API study was Cassandra Hamlin (Tr. 536). Hamlin testified as an expert witness for the Secretary at the hearing. Hamlin graduated from Vanderbilt University in 1981 with a degree in engineering. She worked for five years for Exxon as a project manager (Tr. 535). She was qualified, without objection, as an expert in IPD, back pressures, the hazards associated with IPDs and back pressures, RAGAGEP, and pressure relief stability (Tr. 544-547).

Hamlin testified that, as part of the API study, she interviewed Dr. Singh, one of the lead scientists with the Electric Power Research Institute (EPRI) who investigated the partial nuclear meltdown of Three Mile Island in 1979. Dr. Singh informed Hamlin that valve chatter was a contributing factor to the partial meltdown (Tr. 581-582). After conducting a $30,000,000.00 study to determine how best to ensure valve stability, the EPRI concluded there was no correlation that would predict whether or not a valve would become unstable:

Like us at the API, [the EPRI’s] stated goal is to come up with some type of correlation to be able to predict when and when not a valve would become unstable. Their conclusion after spending $ 30 million was that the problem was intractable in the sense that predicting the weather is intractable. You can’t predict weather with 100% certainty because there are just too many variables. . . . In this case, the uncertainties come from—there are so many different relief valves manufactured. One variable is just how slick is the stem that, you know, the disk is sliding on? You know, it’s going to vary greatly from, is it a new relief valve? How was it machined?

So, they concluded it was not a tractable problem in the sense of being able to come up with a correlation that would predict when and when not it would occur. So, they opted, as a solution for their industry, to ensure that they would only install relief valves that they knew would operate safely.

And, what did they do? And, this is what Dr. Singh described to me, they would actually test each and every relief valve in place. They tested it in place, you know, installed in the vessel it’s protecting and it didn’t chatter, good to go.

(Tr. 582-583).

Hamlin contends that under RAGAGEP principles, an employer should only ever “install things you know or have a very high certainty are going to work,” as the EPRI did by requiring each relief valve to be tested in place (Tr. 585). Hamlin’s conclusion is that there are no reasonable alternatives to implementing the 3% rule: “From an engineering standpoint, the burden of proof is never on somebody to have to prove that something is unsafe. In the case of the 3% rule, the only rule we have for these installations, the only one is 3%” (Tr. 585).

Hamlin was emphatic that the 3% rule is both the industry standard and the only possible RAGAGEP a reasonably prudent employer could consider with regard to a pressure relief valve:

[T]he engineering rule is very, very clear. I mean it’s been since—you know, it’s like when Moses came down off of Mount Sinai, the engineering law is going to limit the pressure to 3%[.]

(Tr. 551).

Really, the only rule that’s been around for years and years and years by every publication relevant to this topic that I’ve ever seen has been 3%.

(Tr. 560).

[The 3% rule is] totally ubiquitous in the world.

(Tr. 561).

Harold Fisher is a consultant affiliated with Balky & Associates, a company that specializes in nuclear and chemical process safety. Fisher graduated from Syracuse University in 1961 with a bachelor’s degree in chemical engineering, and later earned a master’s degree in chemical engineering and a master’s degree in engineering with industrial engineering statistics from West Virginia University. He worked as a chemical engineer for forty years with Union Carbide (Tr. 2141-2146). Since 1982, Fisher has chaired the Design Institute for Emergency Relief System (DIERS) (Tr. 2147-2148). Fisher was qualified as an expert witness in RAGAGEP’s application to pressure vessels and pressure relief systems, valve chatter, IPD, and research and literature relevant to RAGAGEP (Tr. 2164-2166).

Fisher concurs with Hamlin that the 3% rule is recognized as the standard observed by industries engaged in chemical processes (Tr. 2297). He testified, “It mentions in the ASME Boiler and Pressure Vessel Code that the inlet pressure drop would be 3% of the set pressure. And there are requirements in the code for that and that’s the expectation of the code and most of the other publications that are out there” (Tr. 2175).

BPP and BP-Husky Argue § 1910.119(d)(3)(ii) Does Not Mandate a Maximum IDP

BPP and BP-Husky contend that by insisting upon the 3% rule, the Secretary is impermissibly imposing a prescriptive requirement on a performance standard. The companies argue that Secretary is selectively ignoring the parts of the industry codes that allow for higher IPDs.

For example, the API’s RP 520 states that the IPD “should not exceed 3 percent of the set pressure,” but goes on to say, “An engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent” (Exh. JX-17, p.2). The preamble to RP 520 indicates it is not the API’s intent to dictate prescriptive rules: “These standards are not intended to obviate the need for applying sound engineering judgment regarding when and where standards should be utilized. The formulation and publication of API standards is not intended to inhibit anyone from using other practices” (Exh. JX-17). The API, through multiple revisions of RP 520, has continued to use the permissive “should” language with regard to the 3% rule, rather than the mandatory “shall” language (Exhs. JX-17 & 18). Furthermore, ASME ‘s endorsement of the 3% rule for IPD is found in the Nonmandatory Appendix M to its “Rules for Construction of Pressure Vessels” (Exh. JX-55, p. 593) (emphasis added).

The companies point out that the industry standards endorsing the 3% rule address specifications for newly-built pressure vessels. BPP and BP-Husky assert that their new pressure vessels are built to the recommended specifications, but the industry standards are inappropriate for older pressure vessels that were in place at the refinery (built in 1919) when BPP originally bought it. OSHA safety engineer Lay agreed that valves with an IPD in excess of 3% can operate safely (Tr. 491).

BPP informed OSHA it had conducted an engineering analysis for IPD (Tr. 153). Based on its analysis, BPP developed internal IPD guidelines in a document referred to as GP 44-70, which was first implemented in April 2006 (Exh. JX-48). BPP engineer Edward Zamjec modeled GP 44-70 on API’s methodology. Based on Zamjec’s research, BPP originally implemented a requirement for existing relief valves to maintain an IPD of 7%, while new installations were required to follow the 3% rule (Tr. 2825). Later, BPP revised GP 44-70 to require an IPD of 5% for existing relief valves (Exh. JX-49; Tr. 158-159).

BPP and BP-Husky argue the Secretary’s interpretation of § 1910.119(d)(3)(ii) denies the employer the option, as contemplated by the drafters of the standard, to develop appropriate internal standards as an alternative to following industry codes. BPP and BP-Husky assert the Secretary is establishing a bright-line test of 3% for IPD in what OSHA intended to be a performance standard.

Compliance with the Terms of the Standard

OSHA’s intent that § 1910.119(d)(3)(ii) be applied as a performance standard is evident in the Preamble to the final rule. The Secretary attempts to get around OSHA’s intent by selectively quoting from the Preamble in his brief:

It is undisputed that the performance standards published by such respected consensus standards organizations are “recognized and generally accepted good engineering practices” under the standard. 57 Fed. Reg. 6390 (“[R]ecognized and generally accepted good engineering practices” include codes and standards published codes and standards published by NFPA, ASTM, ANSI, etc.).[61]

(Secretary’s brief, p. 89).

This edited sentence distorts the meaning of the full sentence, which is: “The Agency believes that this phrase [“recommended and generally accepted good engineering practices”] would include appropriate internal standards of a facility, as well as codes and standards published by NFPA, ASTM, ANSI, NFPA, etc.” Id. (emphasis added). In the full sentence, OSHA puts internal standards on an equal footing with industry codes.

In his brief, the Secretary states, “[I]t is clear from the preamble discussion of this issue that OSHA did not intend that internal standards displace applicable consensus standards,” and cites to, without quoting from, 57 Fed. Reg. 6390 (1992) (Secretary’s brief, p. 90). The actual language of the cited document does not support the Secretary’s position.

The Preamble lays out the concerns of commenters from industries affected by the proposed PSC Standard. Commenters were leery that, instead of being suggested guidelines, the listed codes and standards would become de facto requirements:

Paragraph (j)(3)(ii) also contained examples of codes and standards that an employer could use to comply with the proposed provision. Many rulemaking participants disagreed with this proposed provision. . . . Some commenters were concerned that the Agency would incorporate by reference all of the codes applicable to testing and inspection such as those published by the National Fire Protection Association (NFPA), the American Society for Testing and Materials (ASTM), the American National Standards Institute (ANSI), etc. These commenters asserted that it would be difficult for an employer to obtain all such standards and decide which standards the Agency intended for them to use. They also stated that some of the standards may conflict with each other.

Other commenters were concerned that some of the standards may be outdated and no longer applicable to their process equipment. As a result, many of these commenters suggested that the employer be permitted to use their own internal standards, or that inspection and testing procedures follow recognized and generally accepted good engineering practices.

57 Fed. Reg. 6390 (1992) (citations omitted).

The Preamble goes on to explicitly reject the position the Secretary now advocates, i.e., converting suggested industry codes and standards into statutory requirements: “The codes and standards contained in proposed paragraph (j)(3)(ii) were examples of what the employer could use for inspection and testing of process equipment. The Agency did not intend to incorporate by reference into the standard all of the codes and standards published by these consensus groups.”

Id. (emphasis added).

OSHA safety engineer Lay, however, testified, “We have, in this case, certainly taken the position that any inlet pressure drop exceeding the 3% value referenced in API 520 Part II, the ASME code, ISO 4126, and other published guidance documents, if you can’t document that you are in compliance with that, that’s a (d)(3)(ii) violation” (Tr. 490-491). OSHA IH Zielinski was part of OSHA’s inspection team at the refinery. When asked how OSHA concluded BPP and BP-Husky were in violation of § 1910.119(d)(3)(ii), IH Zielinski replied, “Well, we determined that by looking at the API standard” (Tr. 615).

The Preamble states that the inspection and testing subsection was revised to include the RAGAGEP language, consistent with OSHA’s intent that the subsection remain a performance standard, and not a specification standard.

This proposed provision was a performance-oriented requirement that would provide flexibility for the employer to choose the frequency which would provide the best assurance of equipment integrity.

Several rulemaking participants . . . suggested that if this provision is to be truly performance-oriented, employers should have the flexibility to follow internal standards and manufacturers’ recommendations as well as applicable codes and standards.

OSHA agrees with these rulemaking participants. Since the phrase “recognized and generally accepted good engineering practices” would include both appropriate internal standards and applicable codes and standards, the Agency has decided to use this phrase in this provision of the final rule.

Id. at 6390-6391 (citations omitted; emphasis added).

In the Preamble, OSHA explains in unmistakable terms its intent in drafting the RAGAGEP provisions of the PSM Standard. As a performance standard, § 1910.119(d)(3)(ii) allows the employer the flexibility to achieve compliance by use of appropriate internal standards, as well as by adhering to industry codes and standards. OSHA area director Yoksas praised the flexibility the PSM Standard afforded employers: “And that’s kind of the beauty of a performance standard, that the company can come up with a variety of methodologies for which they would address those hazards under” the PSM Standard (Tr. 117). By insisting compliance with § 1910.119(d)(3)(ii) can only be achieved by following the 3% rule (which is not mandatory even under the cited codes), the Secretary has impermissibly adopted a prescriptive standard. The Secretary’s interpretation contradicts the terms of the cited standard. Area director Yoksas insisted, “[W]e do not enforce consensus standards” (Tr. 110). However, the Secretary is attempting do so here.

In the AVDs of Items 2 through 12, the Secretary does not allege BPP and BP-Husky violated the terms of §§ 1910.119(d)(3)(ii) and (j)(5) by not complying with the relevant RAGAGEP; rather, the Secretary alleges the companies violated the cited standards by allowing eleven of its pressure relief valves to exceed 3% IPD. The Secretary deliberately drafted the AVDs to incorporate the 3% rule into §§ 1910.119(d)(3)(ii) and (j)(5). In doing so, he erased the performance aspect of the RAGAGEP standards.

The Secretary is bound by the language in which he chose to frame the AVDs. Under the Secretary’s interpretation, 3% is the only possible RAGAGEP for IPDs in the refining industry. The Secretary is equating one of the terms of the standard, RAGAGEP, with the 3% rule.

Three of the cited pressure relief valves (Items 9, 10, and 11) had IPDs outside of BPP’s own original IPD limit of 7%, and three more (Items 4, 6, and 12) fell outside of BPP’s revised limit of 5%. However, the Secretary did not cite the companies for failing to comply with an alternative RAGAGEP, such as being outside acceptable limits set by BPP’s internal standards. The Secretary cited BPP and BP-Husky for exceeding 3% IPD, a prescriptive standard he impermissibly shoehorned into a performance standard. The Secretary is held to that violation description. Because the AVD improperly imposes a requirement on employers not found in the cited standards, the Secretary failed to establish BPP and BP-Husky were not in compliance with the appropriate RAGAGEP.

Items 2 through 12 are vacated.

Items 13, 14, and 15: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

Undersized Relief Valves

Items 13, 14, and 15 concern relief valves that were undersized. As in Items 2 through 12, the Secretary alleges BPP and BP-Husky failed to document that equipment complied with RAGAGEP (in violation of § 1910.119(d)(3)(ii) for Items 13a, 14a, and 15a), and failed to correct deficiencies in equipment outside acceptable RAGAGEP limits (in violation of § 1910.119(j)(5) for Items 13b, 14b, and 15b).

Background

BPP hired consultants on two different occasions in the 1990s to conduct safety reviews of the Ohio refinery. In 1990 consultant Kellog issued a relief system report and in 1998 consultant Steward and Bottomly (S&B) issued a similar report. Neither report identified a sizing deviation in connection with the cited valves (Exhs. CX-35 and RBPP-38). In June 2008, consultant Middough issued a draft report that for the first time identified the cited valves as undersized (Exh. RBPP-84; Tr. 3005, 3008). The Middough report identified PSV-115, PSV-124, and PSV-136 as being “not adequately sized for the governing scenario” (Exhs. RBPP-84, RBPP-88, and RBPP-96).

Items 13a and 14a

Compliance with the Terms of the Cited Standard

Item 13a alleges a violation of § 1910.119(d)(3)(ii), stating the employers did not document compliance with RAGAGEP by “ensuring PSV-115, located in the Alky Unit, is properly designed. PSV-115 provides protection to the Recycle Isobutane Coalescer by relieving hydrocarbons to the flare and was determined to be undersized and does not have adequate relieving rate during relief scenarios.” Item 14a alleges a violation of § 1910.119(d)(3)(ii) because BPP and BP-Husky did not document compliance with RAGAGEP by “ensuring PSV-124, located in the Alky Unit, is properly designed. PSV-124 provides protection to the Isobutane Product Coalescer by relieving hydrocarbons to the flare and was determined to be undersized and does not have an adequate relieving rate during relief scenarios.” For PSV-115, the required orifice area of the valve was 0.119 square inches. The actual size was 0.110 (Tr. 634). For PSV-124, the required orifice area was 0.114 square inches. The actual size was 0.11 square inches (Tr. 635).

BPP and BP-Husky concede these deviations, found in its own Middough report, are correct. The Secretary has established the employers failed to comply with the terms of § 1910.119(d)(3)(ii).

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by vessel overpressure due to inadequate relieving rate. Loss of containment could expose employees to death or serious physical injury.

Employer Knowledge

Middough issued the draft report identifying the undersized valves in June 2008, several months prior to the commencement of OSHA’s inspection. BP and BP-Husky were aware of the Middough report and thus knew of the violative condition.

Items 13a and 14a are affirmed.

Items 13b and 14b

Compliance with the Terms of the Cited Standard

Section 1910.119(j)(5) requires employers to “correct deficiencies in equipment that are outside acceptable limits. . . before further use or in a safe and timely manner when necessary means are taken to assure safe operation.” Item 13b alleges a violation of § 1910.119(j)(5), stating the employers did not correct deficiencies in the relief valves because they did “not ensure PSV-115, located in the Alky Unit, is properly designed.” Item 14b alleges a violation of § 1910.119(j)(5), for failing to “ensure PSV-124, located in the Alky Unit, is properly designed.”

Once it was alerted by the Middough report that the relief valves were undersized, BPP followed its Relief System Guidelines by verifying the calculations, analyzing the risk associated with the relief valves, and implementing interim actions that could be put in place pending a permanent solution. BPP “car-sealed”[62] open valves between adjoining vessels and implemented administrative controls to ensure protection was maintained (Tr. 1607-1610, 3005-3011). The implementation of these interim measures changed the risk assessment to “a very low level of concern” (Tr. 3007).[63]

Dr. Georges Melhem owns ioMosaic, a specialist firm in process safety management and relief systems (Tr. 2443). Dr. Melhem earned a Ph.D. in chemical engineering from Northeastern University (Tr. 2442). He was qualified as an expert witness at the hearing in the areas of relief valve and relief systems operation and stability in oil and gas facilities, RAGAGEP for relief valves and relief systems, and risk analysis and risk management related to risk systems (Tr. 2466).

Dr. Melhem testified that an employer is not required immediately to shut down a process or fully correct a deviation as soon as it becomes aware of an equipment deficiency. He stated:

We also discussed that these mitigants, okay, will depend on the risk level. If the risk is extremely high, you shouldn’t be afforded a lot of time. You should fix them then. Shut down and fix them. Or you have to put in interim measures that will give you risk reduction until you can put [in] a permanent fix. If the technical violation or, you know, estimated to be a very low risk, very low risk exposure, the right time to do it is during a turnaround because of all the additional risks that we said would expose your employees to, if you have to do it on a one by one basis.

(Tr. 2544).

Dr. Melhem’s testimony comports with the Preamble’s commentary on § 1910.119(j)(5). Commenters to OSHA’s proposed paragraph that became § 1910.119(j)(5) objected to the requirement that any deficiency in equipment be corrected “before further use.” The Preamble notes:

It was contended that the phrase “before further use” would mean that the process would have to be shutdown, and that shutdown has its own inherent hazards. It was suggested that equipment operating beyond acceptable limits does not always create a serious hazard. Participants asserted that deficiencies might need to be corrected promptly, or in a time and manner to assure safe operation instead. . . . The purpose of this proposed requirement was to require equipment deficiencies to be corrected promptly if the equipment was outside the acceptable limits specified in the process safety information. The comments have convinced OSHA that there may be many situations where it may not be necessary that the deficiencies are corrected in a safe and timely manner when necessary means are taken to ensure safe operation.

57 Fed. Reg. 6391 (emphasis in original).

The Secretary does not contend BPP’s interim measures to minimize the risk created by the undersized valves resulted in unsafe conditions. Section 1910.119(j)(5) did not require BPP to immediately shut down and completely correct the undersized valves before further use. It is within the parameters of the standard, as articulated in the Preamble, for the employer to take interim measures to ensure safe operation of the equipment until such time the equipment can be corrected safely. Here, BPP took interim measures to ensure the safe operation of the deficient relief valves by car-sealing them until it could replace them entirely during a scheduled turnaround.

The Secretary has failed to establish BPP and BP-Husky violated the terms of § 1910.119(j)(5). Items 13b and 14b are vacated.

Items 15a and 15b

Items 15a and 15b allege the companies violated §§ 1910.119(d)(3)(ii) and (j)(5), respectively, because PSV-136, located in the Alky Unit and providing protection to the Second Stage Butane Treater Drum, was undersized. The required orifice area for the relief valve was 0.449 square inches. The relief valve’s actual orifice area was 0.307 square inches (Tr. 635).

BPP took the Second Stage Butane Treater Drum out of service in May of 2009 and drained it of hydrocarbons (Tr. 3012). The vessel remained out of service during OSHA’s inspection and was still out of service at the time of the hearing (Tr. 3013).

Item 15a:

Compliance with the Terms of the Standard

It is undisputed PSV-136 was deficient and BPP and BP-Husky failed to document the relief valve complied with RAGAGEP. The companies failed to comply with the terms of § 1910.119(d)(3)(ii).

Employee Access to the Violative Condition

The Secretary must establish employees had access to the violative condition in order to meet his burden of proof. He fails to do so here. BPP emptied the pressure vessel and took it out of service in May of 2009, four months before OSHA began its inspection of the refinery. Thus, at the time of OSHA’s inspection, the undersized relief valve did not present a hazard while installed on the empty pressure vessel. Area director Yoksas conceded there was no hazard to employees posed by PSV-136 (Tr. 191). OSHA safety engineer Lay agreed that “[i]f the piece of equipment had been properly removed from service . . . that would have been no hazard” (Tr. 464-465). Item 15a is vacated

Item 15b:

Compliance with the Terms of the Standard

Section 1910.119(j)(5) requires employers to correct deficiencies in equipment “before further use.” In this case, after BPP took the Second Stage Butane Treater Drum out of service (before OSHA’s inspection), there was no further use of the pressure vessel. The Secretary has failed to establish BPP and BP-Husky were not in compliance with the terms of the standard. Item 15b is vacated.

Items 16, 17, and 18: Alleged Willful Violations of § 1910.119(d)(3)(ii) and (j)(5)

Back Pressures Exceeded 10%

Items 16, 17, and 18 concern relief valves (PSV-1280, PSV-1281, and PSV-1301) whose back pressures exceeded their set pressures. As in the previous sections, the Secretary alleges BPP and BP-Husky failed to document that equipment complied with RAGAGEP (in violation of § 1910.119(d)(3)(ii) for Items 16a, 17a, and 18a), and failed to correct deficiencies in equipment outside acceptable RAGAGEP limits (in violation of § 1910.119(j)(5) for Items 16b, 17b, and 18b).

Background

Built-up back pressure is the pressure exerted on the side of the vessel opposite to the inlet side, on the outlet piping (relief) side (Tr. 563-564, 2177, 2980). Back pressure exerts force on the valve and can operate independently or with the IPD to close the valve prematurely, raising the risk of chatter (Tr. 2188, 2193, 2521, 2523-2524).

The refinery’s FCC Feed Drum receives hydrocarbons from multiple sources and then feeds them into the FCC Fractionator tower (Tr. 2982). When consultant S&B conducted its safety audit of the refinery in 1998, it discovered PSV-1280 and PSV-1281 could experience back pressure in excess of BPP’s acceptable limits under certain overpressure relief scenarios (S&B did not identify a back pressure issue for PSV-1301) (Exh. RBPP-38). S&B recommended installing safety system trips to shut down the process and prevent the overpressure relief scenarios from occurring). BPP followed S&B’s recommendation and installed the safety system trips in 1999 (Tr. 2976-2980).

In 2007, BPP commissioned Equity Engineering to re-evaluate the FCC Feed Drum. Equity Engineering designed a balance line between the FCC Feed Drum and the FCC Fractionator to remediate concerns related to relief system capacity. Part of this project included re-routing PSV-1301 from a blowdown drum to the flare system. Equity Engineering found no back pressure deviations. The balance line was intended to divert overpressures to the Fractionator, which could better handle them. Shortly after its installation, however, the balance line plugged, rendering it unusable (Tr. 2982-2983). BPP conducted another risk assessment for further operation and determined there was a low risk due to the potential insufficient relief capacity for these valves. BPP implemented several interim remedial actions to ensure safe operation (Tr. 2987). At this time, BPP was unaware of back pressure deviations on PSV-1280, PSV-1281, or PSV-1301 (Tr. 1612, 1280).

In its draft report issued in July 2009, Middough identified PSV-1280, PSV-1281, and PSV-1301 as credible scenarios requiring very high relief rates (Exh. RBPP-108, RBPP-115, RBPP-126).

Items 16a, 17a, and 18a

Compliance with the Terms of the Standard

Items 16a, 17a, and 18a of Citation No. 2 allege BPP and BP-Husky violated § 1910.119(d)(3)(ii) by failing to document three relief valves complied with RAGAGEP. Item 16a alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document compliance with recognized and generally accepted good engineering practices by ensuring PSV-1280, a conventional relief valve, has a back pressure of less than or equal to 10% of its set pressure. This relief device provides protection to the FCC Feed Drum, and relieves hydrocarbons to the flare.

Items 17a and 18a repeat the AVD, each with its respective relief valve identification (PSV-1281 and PSV-1301).

BPP and BP-Husky do not dispute that RAGAGEP for back pressure on conventional spring-loaded valves is generally limited to 10%. The companies concede the back pressures for the three cited relief valves exceeded 10%, as stated in the Middough report. The Middough report calculated PSV-1280 and PSV-1281 had IPDs over 7% and built-up back pressures above 50%. PSV-1301 had an IPD above 6% and a built-up back pressure above 40% (Exhs. RBPP-108, RBPP-115, RBPP-126; Tr. 332-335, 352, 359).

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by excessive back pressures for the three relief valves. Loss of containment could expose employees to death or serious physical injury.

Employer Knowledge

BPP and BP-Husky received a draft of the Middough report in July of 2009. At the time of the inspection, the companies were aware the valves were not in compliance with RAGAGEP.

Items 16a, 17a, and 18a are affirmed.

Items 16b, 17b, and 18b

Items 16b, 17b, and 18b of Citation No. 2 allege BPP and BP-Husky violated § 1910.119(j)(5) by failing to correct deficiencies in the relief valves that were outside acceptable limits before further use or in a safe or timely manner when necessary means were taken to assure safe operation. The items allege BPP and BP-Husky did not ensure PSV-1280, PSV-1281, and PSV-1301 had back pressures of less than 10%.

Upon receipt of Middough’s draft report in July of 2009, BPP implemented its Relief Systems Guidelines by verifying the accuracy of the calculations, conducting a new risk analysis, and implementing interim actions to ensure safe continued operation of the valves until permanent modifications could be completed (Tr. 2991-2992, 3002-3004). BPP added a riser to the water tanks that can feed the FCC Feed Drum to prevent and overflow of water into it. BPP also increased the management review and approval required for continued operation of the valves and the FCC Feed Drum. It also installed a full sized relief valve in an interim location that could be installed without incurring the risks associated with a shutdown of the equipment (Tr. 2987, 2992, 3053).

As noted previously, § 1910.119(j)(5) does not require an employer to immediately shut down an operation and replace a deficient piece of equipment. The standard allows an employer to take interim measures to ensure safe operation of the equipment. The Secretary has adduced no evidence that BPP and BP-Husky’s interim measures failed to ensure safe operation of the equipment until the valves could be replaced during turnaround.

The Secretary has failed to establish violations of he cited standard. Items 16b, 17b, and 18b are vacated.

Items 19 through 27: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

Pressure Relief Devices (PRDs)

Items 19 through 27 address the lack of pressure relief devices (PRDs) on nine heat exchangers. The Secretary alleges BPP and BP-Husky failed to document equipment complied with RAGAGEP (in violation of § 1910.119(d)(3)(ii) for Items 19a through 27a) and failed to correct deficiencies in equipment outside acceptable RAGAGEP limits (in violation of §  1910.119(j)(5) for Items 19b through 27b).

Background

The cited pressure vessels are “shell-and-tube” heat exchangers. The heat exchangers consist of the vessel itself (the “shell” side), and the tubes inside the vessel. One material moves through the vessel outside the tubes while another material moves inside the tubes, allowing the transfer of heat from one material to the other (Tr. 253-255, 1573, 1594-1595).

BPP issued its original GP 44-70 guideline in April 2006. BPP amended GP 44-70 in October 2009, implementing more restrictive requirements for its pressure relief systems (Tr. 2922-2923). In conjunction with its new guidelines, BPP had Middough analyze its heat exchangers. Middough issued a preliminary report in December 2009, toward the end of OSHA’s inspection of the refinery. The Middough report identified the nine cited heat exchangers as potentially needing additional or more direct relief protection (Exh. CX-2).

The specific heat exchangers cited are:

Item 19: Upper Pumparound Cooler (PR543576)

Item 20: Lower Pumparound Cooler (PR543575)[64]

Item 21: Primary Absorber Lean Oil Cooler (PR543585)

Item 22: Primary Absorber Lean Oil Cooler (PR543586)

Item 23: Stripper Reboiler Condensate Pot (PR511134)

Item 24: Stripper Steam Reboiler (PR543538)

Item 25: Stripper CHGO Reboiler (PR543539)

Item 26: Steam Slurry Generator (PR543565)

Item 27: Cat Heavy Gas Oil Cooler (PR543567)

After BPP received the Middough report, the company performed risk assessments to determine if the heat exchangers were safe to continue operating (Tr. 3022). BPP determined the heat exchangers had open flow paths to another vessel’s relief device under normal operating procedures (Tr. 3023). The company concluded no interim measures were necessary for the two Primary Absorber Lean Oil Coolers (Items 21 and 22). BPP implemented the following interim actions for the other exchange heaters to assure safe operation:

1. Item 19: car-sealed open a pathway from the exchanger to relief protection and developed administrative procedures to drain the vessel if it became blocked in;

2. Item 20: installed a bypass around a control valve to piping that provided sufficient relief protection;

3. Item 23: installed an adequately sized relief valve but placed it in an interim position that could be installed without shutting down the exchanger;

4. Item 24: installed an adequately sized relief valve but placed it in a temporary position that could be installed without shutting down the exchanger;

5. Item 25: car-sealed open a pathway from the exchanger to relief protection and developed administrative procedures to drain the vessel if it became blocked in;

6. Item 26: car-sealed open a pathway from the exchanger to relief protection and developed administrative procedures to drain the vessel if it became blocked in; and

7. Item 27: car-sealed open a pathway from the exchanger to relief protection and developed administrative procedures to drain the vessel if it became blocked in.

(Tr. 3051-3053).

BPP developed action plans to permanently install relief valves during the next turnaround (Tr. 847).

Items 19a through 27a

Items 19a through 27a allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document the need for overpressure protection on pressure vessels as required by [RAGAGEP]. The [cited heat exchanger] is not protected by pressure relieving devices that would prevent the pressure inside the vessel from rising above acceptable limits.

Compliance with the Terms of the Standard

The Secretary has established BPP and BP-Husky failed to document compliance with RAGAGEP for the heat exchangers cited in Items 19a through 27a. Both industry consensus standards and BPP’s GP 44-70 required PRDs on heat exchangers.

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by the missing PRDs on the heat exchangers. Loss of containment could expose employees to death or serious physical injury. Without proper PRDs, the piping could rupture, releasing hydrocarbons into the atmosphere (Tr. 825).

Employee Knowledge

CSHO Justin Sternes conducted OSHA’s inspection with regard to the heat exchangers cited in Items 19 through 27. He testified he identified the cited heat exchangers by reviewing the December 2009 draft Middough report commissioned by BPP (Tr. 843). CSHO Sternes’s inspection of the refinery began in October of 2009 (Tr. 809). He stated BPP representatives, including asset coordinator Dan Chovanec, relief systems technical authority David Hasselbach, and technical manager Tim Smith, were not aware until the December 2009 Middough report that the PRDs were missing (Tr. 812, 844). CSHO Sternes conceded he found no evidence that anyone at the Ohio refinery had any knowledge the heat exchangers lacked PRDs until December 2009 (Tr. 845).

The Secretary has failed to establish BPP or BP-Husky had actual knowledge of the violative conditions. CSHO Sternes’s inspection began in October of 2009. It was not until December 2009 that BPP (and Sternes) became aware of the missing PRDs through the Middough report. There is no evidence anyone at BPP or BP-Husky was aware of the missing PRDs.

The Secretary argues BPP and BP-Husky should have known, through the exercise of reasonable diligence that the PRDs were missing. He contends that the cited pressure vessels were installed years before the PSM Standard was enacted and BPP should have detected at some point before the 2009 inspection that the cited heat exchangers lacked PRDs. CSHO Sternes agreed with Hasselbach, however, that it is difficult to discover the absence of PRDs by looking at the piping and IP&Ds (Tr. 845-846, 1598). Indeed, CSHO Sternes was at the Ohio refinery for two and a half months, five days a week, but he learned of the missing PRDs the same way BPP and BP-Husky did—by way of the December Middough report (Tr. 809, 843). The Secretary has failed to establish BPP and BP-Husky had constructive knowledge of the missing PRDs.

Items 19a through 27a are vacated.

Items 19b through 27b

Items 19b through 27b allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not address the need for overpressure protection on pressure vessels. The [cited heat exchanger] is not protected by pressure relieving devices that would prevent the pressure inside the vessel from rising above acceptable limits.

Compliance with the Terms of the Standard

After receiving the Middough report in December 2009, BPP conducted a risk analysis for each heat exchanger. It then implemented interim measures to ensure the safe operation of the heat exchangers. CSHO Sternes did not conduct an independent risk analysis. He did not dispute the effectiveness of the interim measures or challenge the company’s decision to install the PVDs during the next scheduled turnaround (Tr. 846-847).

Again, § 1910.119(j)(5) does not require an employer to immediately shut down an operation and replace a deficient piece of equipment. The standard allows an employer to take interim measures to ensure safe operation of the equipment. The Secretary has adduced no evidence that BPP and BP-Husky’s interim measures failed to ensure safe operation of the equipment until the PVDs could be installed during turnaround.

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the terms of the standard. Items 19b through 27b are vacated.

Items 28, 29, and 30: Alleged Willful Violations of § 1910.119(d)(3)(ii)

Furnaces

Items 28, 29, and 30 address combustion safeguards on furnaces. The Secretary alleges BPP and BP-Husky failed to document the cited furnaces complied with RAGAGEP, in violation of § 1910.119(d)(3)(ii). BPP and BP-Husky contend the cited furnaces fully complied with RAGAGEP.

Background

Refinery furnaces consist of separate fireboxes with many (from 20 to 70) burners that supply the heat required to boil crude oil. If a burner flame dies out, a vapor cloud of unburned fuel may form, creating an explosion hazard (Tr. 1650-1652). API’s recommended practice for furnaces, Instrumentation and Control Systems for Fired Heaters[65]and Steam Generators, is RP 556 (Exh. JX-20). RP 556 emphasizes the importance of combustion safeguards on furnaces:

The greatest danger is from a fuel system that may fail long enough for the flame to die and then reintroduce fuel while the refractory is hot enough to ignite the fuel.

(Exh. JX-20, § 3.9).

CSHO Todd Jensen was OSHA’s team leader for the Ohio refinery inspection. He earned a bachelor’s degree in industrial and environmental health from Ferris State University in Big Rapids, Michigan (Tr. 1113-1114). CSHO Jensen conducted the inspection of the three cited furnaces. He identified the furnaces by reviewing the safety self-audit report commissioned by BPP and issued in May 2009 (Exh. JX-1; Tr. 1163).

CSHO Jensen recommended citing BPP and BP-Husky for failing to document the three furnaces complied with RAGAGEP. Jensen stated:

There [was] instrumentation in the furnaces to detect various temperatures and whatever they were trying to detect in the furnace, but there was nothing that would shut the furnaces down automatically. It would require an operator to intervene with the central board to shut down a furnace or it would require an operator to detect a problem and then radio an employee in the field to go turn a valve or so forth. There was nothing that would automatically shut the furnace down.

(Tr. 1127).

Items 28, 29, and 30

Items 28, 29, and 30 allege:

BP-Husky Refinery, LLC – Oregon, Ohio: The employer does not document compliance with recognized and generally accepted good engineering practices by ensuring combustion safeguards are provided on the [cited heater].

The cited heaters are the Crude Heater A + B firebox (Item 28), the Vac Tower Furnace C firebox (Item 29), and the Naphtha Treater Furnace (Item 30).

Compliance with the Terms of the Standard

The Secretary relied solely on the testimony of CSHO Jensen to establish the violations cited in Items 28, 29, and 30. CSHO Jensen testified he referred only to RP 556 when inspecting the furnaces (Tr. 1165). He treated Table 1 of RP 556 as a checklist, against which he compared the cited furnaces. Table 1 is entitled Typical Alarms and Shutdown Initiators—Fire Heaters. It lists 22 separate items from which employers may choose as combustion safeguards. After reviewing RP 556 (which he regarded as RAGAGEP for furnaces), CSHO Jensen determined BPP failed to comply with it because the cited heaters did not have automatic shutdown devices (Tr. 1127).

RP 556 intends for the employer to have flexibility in determining the best combustion safeguards to use depending on its particular furnaces. The Forward to RP 566 states, “Successful instrumentation depends upon a workable arrangement that incorporates the simplest systems and devices that will satisfy specified requirements” (Exh. JX-20). RPP 556’s Protective Instrumentation Alarms and Shutdown Devices also promotes the employer’s use of discretion to implement combustion safeguards best suited to its individual circumstances:

Because of the lack of the uniformity in the design and operation of fired heaters, each installation must be studied to determine how failures impact reliability and availability (See Table 1 for typical listing of alarms and shutdowns).

The final protective control system should be selected to make sure it cannot cause unsafe conditions and will not contribute to unnecessarily difficult start-ups or lead to nuisance shutdowns.

(Exh. JX-20, § 3.9).

RP 556 provides a list of factors to be considered before a safety instrument system is installed on a furnace:

The purpose of protective controls is to ensure safe operation, start-up, and shutdown conditions for fired heaters. How elaborate these systems need be depends on several factors, including the following:

a. The type of process.

b. The type and size of the heater.

c. What fuels are fired.

d. How reliable the fuel supply is.

e. The type and reliability of the pilots.

f. The operator coverage.

g. Applicable regulations.

h. Process hazard analysis.

(Id.).

Despite the directives of RP 556, CSHO Jensen testified he did not “actually look at the type of process in the Crude Unit or the Naphtha Unit when evaluating” the furnaces (Tr. 1183-1184). His grasp of the types and operations of furnaces was tenuous at times:

Q. So did you look at the type and size of furnace that was used?

Jensen: We looked at the size. Yeah. We looked at the type as well.

Q. Okay. What was the type of furnace that the crude—that’s used in the Crude Unit?

Jensen: I don’t recall what type it is.

Q. Okay. But you looked at it. At one point do you think you knew what type it was?

Jensen: Yeah, I do—yeah. Yes.

. . .

Q. If it’s a larger heater, how does that change what shutdown you need, or control you need?

Jensen: I’m not sure.

Q. When you’re determining what safeguards to put in, why is it important to know what type of fuel is being used?

Jensen: Because you want to know how flammable it is in case you would have a fire in the furnace.

Q. I think you always have a fire in the furnace, don’t you? That’s kind of the point of it.

(Tr. 1184-1186).

Edward Marszal owns a consulting company, Conexis, specializing in the design of safety instrument systems for process industries, including oil refineries. Marszal has a bachelor’s degree in chemical engineering from Ohio State University, which he earned in 1992 (Tr. 3123-3124, 3171). He was qualified as an expert in the design and implementation of engineered safeguards, controls, and instruments (Tr. 3134).

Marszal reviewed BPP’s combustion safeguards in the three cited furnaces. Asked his conclusion about the company’s existing safeguards, Marszal replied, “[M]y opinion is that at the time the safeguards that they had in place were appropriate for the hazards, or the degree of risk that the hazards presented” (Tr. 3143).

Marszal explained that Table 1’s list of alarms and shutdown indicators is “a list of different safeguards that are recommended to be considered for a typical fired heater” (Tr. 3148). It is not a list of mandatory safeguards. Marszal stated he had never recommended installing all of the alarms and shutdowns listed in Table 1 (Tr. 3148). He explained why, from a safety engineering point of view, it would not be effective to install all available safeguards:

[I]f you over-complicate the system, you run the risk of making your system too difficult to use, preventing the workers from getting their job done, then things happen like safety systems get put in bypass, because they’re preventing people from getting their job done and that just makes a more hazardous situation.

(Tr. 3145-3146).

CSHO Jensen had listed the alleged deficiencies of the furnaces in his 1B worksheets, including missing sensors and other controls. Using simplified diagrams of the furnaces, Marszal identified the location of various sensors and controls on the furnaces (Tr. 3149-3165). Marszal testified the controls and instruments on each furnace at the time of the inspection permitted its safe operation. He stated, “My opinion is that at the time of the inspection, the existing system was in accordance with RAGAGEP (Tr. 3149).

Marszal took issue with CSHO Jensen’s interpretation of “automatic” as used in RP 556. Jensen interpreted “automatic shutdown” to require no human intervention. If adequate safeguards had been installed on the furnaces, he stated, a computer system would take over during an upset and bring the furnace into a safe condition independent of the control room operator. Jensen testified manual valves and operator control boards were insufficient to protect workers (Tr. 1127, 1144, 1165).

Marszal testified an automatic shutdown is one that works without human intervention at the valve. A shutdown implemented by remote control (a human operator pushing a button at a location removed from the valve) is still an automatic shutdown (Tr. 3190). Marszal stated, “[T]hey have an automated shutoff valve and what that means is that it’s actuated. You don’t need to go out to the valve and turn a crank. There’s an actuator that has air pressure on it and when you press a button, it will de-energize the circuit, de-pressure the actuator and the valve will go closed, so the valve is automatic, but it wasn’t connected to a flow transmitter or a temperature transmitter that’s automatically sending the signal for the valve to go to the closed position” (Tr. 3190-3191).

Marszal had more experience with furnace systems and demonstrated greater knowledge of their operation than Jensen did. Marszal was able to give detailed answers to the technical questions he was asked. He spoke confidently and without hesitation. Jensen, on the other hand, stumbled over some of the questions concerning RP 556 and the combustion safeguards:

Q. And what API does is it gives a wide range of potential options you are required to consider using on any specific type of furnace, right?

Jensen: I’m not sure. I’d have to read it to see if it says that or not.

Q. You don’t recall?

Jensen: I don’t recall.

Q. You’re not familiar enough with API 556 to know that?

Jensen: Right. Not that much detail.

(Tr. 1171-1172).

Q. Let me ask you to take a look at the last sentence. It says, “Purge systems may be used to prevent plugging.” Is that something that is required?

Jensen: I don’t know.

. . .

Q. So purge systems may be used to prevent plugging. Is that something BP Products Refinery had to have on its system? You talked about plugging earlier, right?

Jensen: Yeah. You’re talking about the “may” in that statement.

Q. Yes.

Jensen: So I don’t know what the purging system is. So are you talking about the word “may”?

Q. Well, I’m asking—you talked about plugging earlier and I’m asking whether or not the refinery had to have purge systems to prevent plugging?

Jensen: I don’t know. I don’t know.

Q. Okay. So you don’t have an opinion on whether or not guidance from “may be used” is a compliance requirement or not?

Jensen: I’m not sure.

(Tr. 1176).

Marszal’s testimony regarding combustion safeguards is accorded more weight than that of CSHO Jensen. Jensen conceded he did not ask anyone at BPP if the company had analyzed the cited furnaces to determine if they had the correct controls and safeguards. Jensen conducted no analysis to determine what safeguards were present and what safeguards were appropriate for the furnace configurations (Tr. 1186-1189). Jensen did not distinguish between RP 556’s use of “shall” and “should,” stating that employers are required to comply with both, and he did not realize RP 556 used “heater” and “furnace” interchangeably (Tr. 1182, 1184).

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with § 1910.119(d)(3)(ii) with respect to the cited furnaces. The Secretary, through CSHO Jensen, is attempting to enforce as mandatory the recommended practices found in RP 556. The Secretary also is incorrectly interpreting RP 556 to require employers to install all of the safeguards listed in Table 1, rather than to select the individual safeguards best suited to the individual furnaces. Items 28, 29, and 30 are vacated.

Item 31: Alleged Willful Violation of §§ 1910.119(d)(3)(iii) and (e)(3)(i)

Cross Connections

Item 31 alleges BPP and BP-Husky failed to document the refinery’s fire water system was operating safely, in violation of § 1910.119(d)(3)(iii) (for Item 31a), and failed to analyze potential hazards posed by connections between the fire water system and the process water system, in violation of § 1910.119(e)(3)(1) (for Item 31b).

Background

Refineries have multiple water systems, including systems for utility purposes, for carrying water used in the process, and for firefighting (Tr. 3276). “Cross connection” means a connection between a fire water system and any other system in the plant (Tr. 3277). A cross connection between a fire water system and a process water system poses two potential hazards: first, the fire water may be diverted for other uses and will have insufficient water pressure to effectively fight fire in an emergency situation, and second, the process water may contaminate the fire water system with hydrocarbons, thus creating a greater fire hazard (Tr. 3280-3282). The Secretary is only concerned with the hazard of cross contamination in Item 31.

BPP’s “fire water system is a pressurized ring of piping throughout the facility that has sufficient quantity and quality of water available in case there’s a need to fight a fire” (Tr. 3276). New refineries are built with a totally independent fire water system (Tr. 3276). The Ohio refinery, which was built in 1919, was designed with a single water circuit throughout the plant (Tr. 3277). When there is a direct connection between the fire water system and the process stream, which could have hydrocarbons in it, the process water can migrate through backflow and contaminate the fire water. Contamination of the fire water affects its foaming ability. Generating foam is the one of the most effective methods of extinguishing refinery fires (Tr. 3280-3282).

Items 31a and 31b

Item 31a alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer permits the existence of permanent connections between the plant fire water system and process systems, that can lead to the contamination of fire water supply with hydrocarbons or other process fluids, in that,

a. In the Isocracker 2 Unit, there is a cross connection at the 6” supply water to the cooler box on the east side of the unit;

b. In the Hydrogen Unit there are two cross connection instances on the blowdown drum;

c. In the Sulfur Recovery Unit there are two filter backwash cross connections;

d. In the Reformer 2 regeneration system, there is a cross connection between the quench and cooling water;

e. There are cross connections on the discharge sides of the fire water booster pumps in the FCC Unit.

Section 1910.119(d)(3)(iii) provides:

For existing equipment designed and constructed in accordance with codes, standards, or practices that are no longer in general use, the employer shall determine and document that the equipment is designed, maintained, inspected, tested, and operating in a safe manner.

Item 31b alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not address in the process hazard analyses, the existence of permanent connections between the plant fire water systems that could lead to the contamination of fire water supply with hydrocarbons or other process fluids, in that,

a. In the Isocracker 2 Unit, there is a cross connection at the 6” supply water to the cooler box on the east side of the unit;

b. In the Hydrogen Unit there are two cross connection instances on the blowdown drum;

c. In the Sulfur Recovery Unit there are two filter backwash cross connections;

d. In the Reformer 2 regeneration system, there is a cross connection between the quench and cooling water;

e. There are cross connections on the discharge sides of the fire water booster pumps in the FCC Unit.

Section 1910.119(e) requires employers to perform an initial hazard analysis on covered processes. Section 1910.119(e)(3)(i) provides:

The process hazard analysis shall address:

(i) The hazards of the process[.]

Compliance with the Terms of the Standard

CSHO Chad Positano recommended issuing the citation addressing BPP’s fire water system in Item 31. CSHO Positano based his recommendation primarily on BPP’s internal 2009 PSM audit, which he characterized as “a finding from BP’s internal audit group that there was evidence that some of the fire water connections potentially posed a hazard the way that they were set up” (Tr. 949-950). After the report was issued on June 3, 2009, BPP and the PSM audit team established deadlines for abatement or remedial action to resolve any issues identified in the audit. The first scheduled deadline was March 31, 2010 (Exh. JX-1; Tr. 958-959).

CSHO Positano did not perform a field inspection of the cross connections (Tr. 970). In fact, Positano testified he did not know what a cross connection looked like and he could not explain how one operated. He testified, “I couldn’t sit here and describe physically what the cross connection would entail, no” (Tr. 970). When asked if he could explain how a cross connection works in the refinery’s water system, CSHO Positano replied, “No, not at this time. I remember the explanation coming from Mr. Herman when I interviewed him during the inspection, but to be able to sit here today and explain those to you, I don’t think I would be able to do that, no” (Tr. 970-971).

CSHO Positano claimed § 1910.119(d)(3)(iii) requires BPP and BP-Husky to document that equipment is in compliance with applicable codes and standards (Tr. 965). Actually, the cited standard requires BPP and BP-Husky to “document that the equipment is designed, maintained, inspected, tested, and operating in a safe manner.” Positano did not review the design documents for the fire water connections (Tr. 964). CSHO Positano could not identify any hazard created by any of the five cited cross connections (Tr. 973-975). For example, when asked if the Isocracker 2 Unit, identified in Instance (a) of Item 31 posed a hazard, Positano replied, “If it did, I don’t know how—if I would describe it, which hazard that might have posed, no” (Tr. 973). Area director Yoksas stated OSHA did not perform any analysis nor did it come to any conclusion “that there is in fact a credible possibility of contaminated process water to get into the fire water through the cross connection in Citation 31a” (Tr. 182).

Bradley Wolf graduated from Lehigh University in Bethlehem, Pennsylvania, in 1979 with a degree in material science. He worked for over a decade with Bagen Mckee, a major builder of refineries (Tr. 3263-3265). Wolf works as an oil refinery consultant (Tr. 3267). He was qualified as an expert in the areas of fire water systems in the refinery industry; the design, operations, and analysis of BPP’s fire water system; and risks associated with BPP’s fire water system (Tr. 3273).

Wolf inspected and photographed each of the cited areas in the field and reviewed the P&ID in December 2011, two years after the OSHA inspection occurred (Tr. 3284). The Secretary contends Wolf’s opinions are immaterial because he visited the Ohio refinery more than a year after the citations were issued. Wolf testified, however, that the conditions were the same as they were at the time of OSHA’s inspection:

You can pretty much tell if something’s been worked on. I didn’t see any new signs of any new construction or anything in the area. It all looked like—I don’t want to call it tired, old equipment. But it’s been there, been used. I was able to review the drawings and the drawings agreed with what was there.

(Tr. 3284-3285).

Wolf’s testimony is deemed material to Item 31. The Secretary presented no evidence showing the conditions had changed since the inspection. Wolf had photographs and P&IDs of each of the cited areas. The Secretary did not show the photographed areas and P&IDs differed from the areas as they existed during the inspection.

Wolf went through each of the cited instances and described how the water system worked in that area in great detail (Tr. 3283-3284, 3312-3317 (Instance (a)); 3321-3332 (Instance (b)); 3332-3338, 3409-3410 (Instance (c)); 3339-3343 (Instance (d)); 3344-3349 (Instance (e)). He testified there was no credible hazard of contamination in the cited areas (Tr. 3285). The cross connections did not violate industry standards (Tr. 3286). Wolf saw no credible risk of reverse flow on any of the connections (Tr. 3358).

Chris Herman has worked for BPP since 1978. For the past 25 years he has been BPP’s emergency response specialist, with the technical authority for all emergency response and fire protection issues in the refinery. Herman has a degree in fire science technologies and is a certified fire protection specialist with the NFPA (Tr. 3415).

Herman testified he participates in four to eight PHAs a year at the refinery, including PHAs for the fire water system (Tr. 3416-3417). He stated there was no credible risk of cross contamination in any of the cited areas (Tr. 3417).

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the terms of §§ 1910.119(d)(3)(iii) and (e)(3)(i). OSHA did not conduct an independent investigation of the alleged violation, but instead attempted to piggyback onto an internal self-audit commissioned by BPP. BPP’s expert Wolf and its emergency response specialist Herman testified there was no credible risk that the fire water could be contaminated at the cited locations. Because there is no credible risk of hazard, there was no need for BPP’s PHA team to address the hazards of the process.

Items 31a and 31b are vacated.

Items 32 through 40: Alleged Willful Violations of § 1910.119(e)(5)

Facility Siting PHA Recommendations

In Items 32 through 40, the Secretary alleges BPP and BP-Husky failed to establish a system to assure that facility siting process hazard analysis (PHA) recommendations for nine buildings were resolved in a timely manner and that the resolution is documented, in violation of § 1910.119(e)(5).

Background

Ronald Unnerstall was BPP’s Business Unit Leader (the highest position at the refinery) from 2006 to 2009. When he arrived, a facility-siting program was in place. The program consisted of an “inside-out” strategy that addressed higher risks first by focusing on buildings located nearest the process units and progressively working outward toward the perimeter of the refinery (Tr. 3627). The program reserved the highest priority for areas where employees worked around the clock and who were closest to the process units. Lower priority was given to areas where employees worked farther away from process units (Tr. 1497). The cited buildings were part of later phases of BPP’s program because they were located outside the process block (Tr. 4029).

By 2009, BPP had initiated a standardized site implementation plan (SIP) to address risks related to permanent buildings across its U. S. refineries. As part of the SIP, BPP developed a structured approach toward implementing building risk mitigation plans (Tr. 3692-3698). BPP used additional documents to provide more technical detail and prioritize their facility planning (Exhs. RBPP-12, RBPP-282, RBPP-283; Tr. 3699-3701, 4026, 4030).

Between 2001 and 2012, the refinery spent a cumulative $69.6 million dollars on facility siting. The refinery spent $33 million dollars on facility siting between 2006 and 2009. BPP relocated approximately 435 employees to hardened shelters and strengthened buildings as part of the facility siting plan since 2006. BPP has built 109,000 square feet of new space (Tr. 3757-3758, 4061, 4078, 4099).

Items 32 through 40

Items 32 through 40 allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document the actions to be taken, develop a schedule to implement the actions, execute the actions necessary to control hazards associated with building collapse and damage to explosion overpressures to the [cited building], which could result in serious or fatal injuries to the building occupants.

The cited buildings are:

Item 32: WGI Insulators Building (PR-532430);

Item 33: Blender control room (PR-532354);

Item 34: Boiler Shop (Pr-532473);

Item 35: E&I Shop (PR-532419);

Item 36: HSEQ Building (PR-532380);

Item 37: Laboratory (PR-532490);

Item 38: Main Office Building (PR-532399/532400);

Item 39: WGI Administrative Offices (PR-532480); and

Item 40: WGI Electricians Building (PR-532416)

Section 1910.119(e)(5) provides:

The employer shall establish a system to promptly address the team’s findings and recommendations; assure that the recommendations are resolved in a timely manner and that the resolution is documented; document what actions are to be taken; complete actions as soon as possible; develop a written schedule of when these actions are to be completed; communicate the actions to operating, maintenance and other employees whose work assignments are in the process and who may be affected by the recommendations or actions.

BPP and BP-Husky’s Argument

BPP argues its “actions were not untimely given the context of its long-term, complex, resource-intensive facility siting program and thus were not in violation of the” cited standard (BPP’s brief, p. 107). John Arendt is vice president for North American Process Industries sector for ABSG Consulting (Tr. 3877). He has a bachelor’s degree in nuclear engineering and a master’s degree in engineering (Tr. 3878). He has assisted 60 to 70 oil refineries with risk studies and facility-siting studies (Tr. 3878-3890). Arendt is responsible for the acronym RAGAGEP, used so much in this proceeding: “[W]hen I was testifying, both on behalf of [the CMA and API] and other associations, as well as myself, I got tired of saying [recognized and generally accepted good engineering practices] so many times so I coined the acronym RAGAGEP during that rulemaking” (Tr. 3897). Arendt was qualified as an expert in process hazard analysis and risk assessments, as well as auditing and evaluating facility siting in compliance with the PSM Standard (Tr. 3898-3899).

Arendt testified BPP’s facility siting program is reasonable. “Industry and probably the government considers high risk first and then lower risk to be a best practice” (Tr. 3908). Arendt stated that usually a refinery will have many buildings or processes that require some remediation. It is, therefore, customary for companies to rank the risks associated with occupied buildings and to address the higher risk buildings first (Tr. 3900). Arendt conducted a risk-based assessment of the nine buildings cited in Items 32 through 40. He used industry practice to look at the likelihood of risk and the consequence to determine whether an employee could be impacted in each of the buildings (Tr. 3925-3926). Arendt concluded that seven of the nine buildings were at such low risk that industry practice would not have required any mitigation at all (Tr. 3929). The companies described the steps taken or planned under the facility siting program for each of the cited buildings:

Item 32: WGI Insulators Building (PR-532430)

At the time of the inspection, approximately six employees worked in the WGI Insulators Building (Tr. 894). The start-of-shift safety meetings and breaks are located in this building. For the remainder of their shifts, the employees work in the plant (T. 4070).

BPP plans to relocate the function of this building to a warehouse after modifications are completed in 2013 (Tr. 4071, 4129). BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 33: Blender control room (PR-532354)

In 2010, the refinery relocated the blender operator to the Central Control Room. The refinery leased space outside the facility for storage of material from its existing warehouse (Tr. 4055, 4057). It also reassigned some field duties so employees could move to a location farther away from the process units (Tr. 1499-1500). The Blender Control Room was completely depopulated when its remaining workers were relocated to PODs (advanced-designed, hardened, blast-resistant buildings that can be built in or near the process units) in 2011 (Tr. 3713-3714, 4056). Prior to the depopulation, BPP implemented interim mitigation measures (Exh. RBPP-274).

Item 34: Boiler Shop (Pr-532473)

BPP has depopulated the Boiler Shop in stages. In 2006, approximately 99 employees worked there. At the time of the hearing approximately 30 employees remained in the Boiler Shop (Tr. 4071). BPP initially planned to move these employees to a new building located across Cedar Point Road. BPP later determined that course of action was less feasible than strengthening new buildings within the refinery or building a new building within the refinery (Tr. 1413, 1419-1420). The 2011 Baker Risk structural analysis demonstrated that it would not be feasible to strengthen the Boiler Shop (Tr. 4071-4072). BPP is currently reformulating its facility siting plan for this building and has decided to build a new building (Tr. 4072). BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 35: E&I Shop (PR-532419)

BPP implemented interim measures, such as the installation of film on the windows, in the E&I Shop prior to 2008 (Exh. RBPP-274). In early 2012, the Shop was completely depopulated. The employees that formerly worked in this building were all relocated to a new addition built onto and existing warehouse (Tr. 4120)

Item 36: HSEQ Building (PR-532380)

The HSEQ Building, now referred to as the HSSE Building, is on the refinery’s fence line at the parking lot. The building has been fully mitigated, the walls hardened, and the windows and doors strengthened during a major remodel (Exh. RBPP-274; Tr. 1508-1510, 4059). BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 37: Laboratory (PR-532490)

BPP was in the process of constructing a new Laboratory at the time of the inspection. The old Laboratory at issue here was depopulated in conjunction with the new Laboratory that was completed in 2010 (Tr. 1512).

Item 38: Main Office Building (PR-532399/532400)

BPP has depopulated the single-story portion of the main office building down to approximately 15 employees. Approximately 60 employees work in a two-story extension of the building that has been strengthened. The completion of the Refinery Operating Center has opened up additional space. BPP is in the process of relocating additional employees from the single-story portion of this building to the strengthened extension (Tr. 4074-4075).

Item 39: WGI Administrative Offices (PR-532480)

BPP had initially planned to transfer employees from the administrative offices to the building it planned to construct across Cedar Point Road. BPP later determined this option would take too much time and has since developed plans to relocate the remaining employees from the WGI Administrative Offices building to space BPP has created in an existing building (Tr. 1413, 1419-1420, 1426). BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 40: WGI Electricians Building (PR-532416)

This building was depopulated in conjunction with the E&I Shop. BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Compliance with the Terms of the Standard

The Secretary cites BPP and BP-Husky’s failure to document efforts to resolve recommendations with respect to the cited buildings. Although the citation is couched in terms of failure to document the resolution of recommendations, the Secretary’s primary issue with BPP and BP-Husky’s facility siting PHA recommendations is that they were not resolved on the Secretary’s timetable. CSHO Positano testified BPP and BP-Husky did not document the PHAs or see them “through to action” (Tr. 864). He stated, “There was no indication that a final decision had been made for the majority of the buildings that we cited as far as what action the company was planning to take to protect their employees” (Tr. 945).

Section 1910.119(e)(5) does not mandate any specific form of documentation or provide a schedule for completion. CSHO Positano conceded “there is no set schedule or time frame within our standard that says how long a company has to correct the findings themselves” (Tr. 942-94), and agreed the PSM Standard “is a performance-based standard. So the regulations allow employers to determine how to document its plan” (Tr. 981). OSHA provides no guidance for what constitutes documentation in compliance with the standard. Employers use a variety of documents to satisfy the standard’s requirements (Tr. 3933). BPP established it did have documentation of its efforts to resolve recommendations for the cited buildings (Exhs. RBBP-12, RBBP-274, RBBP-283, RBBP-284).

In his post-hearing brief, the Secretary asserts, “Timely means in this context, at most one to two years depending on the scope and complexity of the issue analyze, and the risk posed by the hazard. . . . In light of the context and the standard’s purpose to prevent catastrophes, resolution of the PHA recommendations and hazard control must be completed within the five-year PHA-revalidation cycle. . . . Regardless, BP’s failures to resolve the facility siting recommendations at issue in this case go far beyond any reasonable construction of the term ‘timely’” (Secretary’s brief, p. 132-133).

Arendt testified BPP’s facility siting program necessarily could not be completed on a tightly fixed schedule:

BP dealt with the highest risk buildings first and they fixed those, dealt with those. And then proceeded to deal with the next tier of building risks, which they used interim mitigations for until they could get a permanent solution. The permanent solutions that they put in place, some of them took time. And it takes time to be able to construct and to build a capital project, to be able to implement solutions like that. So I was okay with the strategy and I was okay with the things they were doing with those buildings.

(Tr. 3922).

Arendt stated that if an employer determines a project will take an extended time to complete, the employer should take effective interim measures to ensure the safety of its employees:

[Employers] will look at the highest risk situations first and then they will determine what needs to be done to be able to mitigate that risk. If that mitigation is something that requires capital expenditure or requires a unit to be shut down or a refinery to be shut down for other things, then they will look at what the general time frame is in order for that final mitigation to take place. If that amount of time is on the order of years for whatever the reason, then a company will look to implement interim risk mitigation measures because it’s prudent to be able to try to keep the risk as low as they can until they get to a final mitigation. The higher risk mitigation is something that is sort of embedded throughout the PSM Standard.

(Tr. 3901-3902),

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with § 1910.119(e)(5). The companies had documentation of the refinery’s facility siting program and the progress being made on it. The Secretary failed to show that the refinery’s extensive project for building, moving, and remodeling its facility, using the inside-out strategy for risk assessment, was not done in a timely manner.

Items 32 through 40 are vacated.

Item 41: Alleged Willful Violation of § 1910.119(j)(4)(ii)

Pipe Inspections

The Secretary alleges BPP and BP-Husky failed to follow RAGAGEP by not testing specific test points on the thickness measurement locations (TMLs) and/or the condition monitoring locations (CMLs), and by not increasing the number of inspections in the ALKY 1 Unit where there was a history of thinning and leaks from exposure to sulfuric acid.

Background

A piping circuit is a length of pipe that is identified on isometric drawings for inspection purposes (Tr. 3433-3434). An employer periodically takes measurements of the pipe’s thickness to monitor for corrosion “to make sure that any fluid stays inside the pipe” (Tr. 3440).

Dennis Layman is BPP’s inspection superintendent. He is certified by API as a pressure vessel and piping inspector (Tr. 3430). Layman testified that BPP uses either ultrasonic or radiographic testing devices to measure the thickness of the pipe at various points within a TML. The test point that is lowest (thinnest) is recorded as the pipe’s thickness at that TML. That measure is then compared to prior readings from the TML in order to estimate the remaining life for the pipe and to establish the next inspection date (Tr. 3440-3444).

Item 41

Item 41 alleges:

b. BP-Husky Refining, LLC – Oregon, Ohio: In the FCC and Alky units, the employer does not follow RAGAGEP (recognized and generally accepted good engineering principles) when they do not conduct thorough piping inspections by failing to take thickness readings at a specific designated test point within a TML (thickness measurement location)/CML (condition monitoring location).

c. BP-Husky Refining, LLC – Oregon, Ohio: The employer does not conduct additional piping inspections on the Alky flare header/subheader when historical inspections indicate flare header thinning and leaks.

Section 1910.119(j)(4)(ii) provides:

Inspection and testing procedures shall follow recognized and generally accepted good engineering principles.

Compliance with the Terms of the Standard

Instance (b)

CSHO Anthony Lowe recommended issuing the citation for this item. CSHO Lowe was of the opinion that RAGAGEP requires an employer to physically mark TMLs on pipes, rather than on isometric drawings, as BPP does. He believed BPP and BP-Husky were in violation of the cited standard because there were “no markings in particular on those vessels or piping. All they had was on their inspection drawings. So for accuracy sake, they really probably weren’t going to get the exact same spot each time, because there was no marking, et cetera, on the vessel or piping” (Tr. 747-748).

The Secretary cited BPP because it failed to take the thickness readings at the exact same test point (or “examination point”) within each TML, as indicated by physically marking the pipes. The Secretary’s case is based on the belief that TMLs are the same thing as test points or examination points.

The publication both the Secretary and BPP look to for guidance is API 570, Piping Inspection Code (Exhs. JX-13 (June 2006 version) and JX-14 (November 2009 version). Section 3.46 of the 2006 version of API 570 defines “test point” as:

An area defined by a circle having a diameter not greater than 2 inches (50 mm) for a line diameter not exceeding 10 inches (250 mm), or greater than 3 inches (75 mm) for larger lines. Thickness reading may be averaged within this area. A test point shall be within a thickness measurement location.

Section 3.46 of the 2006 version of API 570 defines “thickness measurement locations (TMLs) as:

Designated areas on piping systems where periodic inspections and thickness measurements are conducted.

By definition, a TML is not one point, but an area where “thickness measurements” (plural) are taken. API 570 establishes CSHO Lowe’s belief that test points and TMLs are the same thing is mistaken. The Secretary acknowledges this in his brief, conceding, “[T]he citation alleged the failure to test the same test points, which the Secretary agrees is not RAGAGEP” (Secretary’s brief, p. 140). Despite this concession that the AVD for Instance (b) mischaracterizes RAGAGEP, the Secretary believes he still somehow has a viable case:

Although the citation alleged the failure to test the same test points, which the Secretary agrees is not RAGAGEP, this instance addresses the concern that there was no assurance that corrosion readings would be taken sufficiently close to tests made five or ten years previously to assure an accurate picture of the piping’s corrosion rate because the TMLs were not marked on uninsulated piping. Tr. at 160, 706-32, 764, 3433-34, 3440. A preponderance of the evidence establishes this violation.

(Secretary’s brief, p. 140).

The Secretary’s belief is mistaken. The AVD for Instance (b) imposed a requirement not found in the standard. Taking thickness readings at the exact same test point is not required by API 570, or any other publications purported to be RAGAGEP.

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the cited standard.

Instance (c)

CSHO Lowe testified there had been a leak in one circuit in the Alky flare header/subheader on August 30, 2009 (Tr. 778). BPP conducted an extended survey of the circuit the following day and took interim measures to contain the leak (Tr. 779). BPP replaced the piping in October 2009, during OSHA’s inspection (Tr. 788).

The Secretary adduced no evidence showing BPP’s procedures did not follow RAGAGEP. He has failed to establish BPP and BP-Husky were in noncompliance with the cited standard.

Item 41 is vacated.

Willful Classification

The Secretary classified all the items at issue in Citation No. 2 as willful.

A willful violation is one “committed with intentional, knowing or voluntary disregard for the requirements of the Act, or with plain indifference to employee safety.” Falcon Steel Co., 16 BNA OSHC 1179, 1181, 1993-95 CCH OSHA ¶30,059, p. 41, 330 (No. 89-2883, 1993) (consolidated); A.P. O’Horo Co., 14 BNA OSHC 2004, 2012, 1991-93 C.H. OSHA ¶ 29,223, p. 39,133 (No. 85-0369, 1991). A showing of evil or malicious intent is not necessary to establish willfulness. Anderson Excavating and Wrecking Co., 17 BNA OSHC 1890, 1891, n.3, 1995-97 C.H. OSHA ¶ 31,228, p. 43,788, n.3 (No. 92-3684, 1997), aff’d 131 F.3d 1254 (8th Cir. 1997). A willful violation is differentiated from a nonwillful violation by an employer’s heightened awareness of the illegality of the conduct or conditions and by a state of mind, i.e., conscious disregard or plain indifference for the safety and health of employees. General Motors Corp., Electro-Motive Div., 14 BNA OSHC 2064, 2068, 1991-93 C.H. OSHA ¶ 29,240, p. 39,168 (No. 82-630, 1991)(consolidated).

A.E. Staley Manufacturing Co., 19 BNA OSHC 1199, 1202 (Nos. 91-0637 & 91-0638, 2000).

OSHA’s Final Policy on self-audits policy includes a “safe harbor” provision, which states:

Consistent with the prevailing law on willfulness, if an employer is responding in good faith to a violative condition discovered through a voluntary self-audit and OSHA detects the condition during an inspection, OSHA will not use the voluntary self-audit report as evidence that the violation is willful.

This policy is intended to apply when, through a voluntary self-audit, the employer learns that a violative condition exists and promptly takes diligent steps to correct the violative condition and brings itself into compliance, while providing effective interim employee protection, as necessary.

65 Fed. Reg. 46503.

The Secretary discovered all the affirmed violations in the instant case by reviewing BPP’s Middough draft reports. At the time of the inspection, BPP and BP-Husky were taking steps to correct the violative conditions and were providing effective interim protection to the refinery employees.

Items 13a and 14a: BPP commissioned two separate safety audits in the 1990s, neither of which identified the cited relief valves as deficient. The Middough draft report issued in July 2009 served as the first notice BPP and BP-Husky had that the valves were deficient. Upon learning of the deficiencies, BPP immediately implemented interim measures to ensure the safe operation of the equipment. Indeed, in his post-hearing brief the Secretary notes the steps taken by BPP once it became aware of the undersized valves: “Upon receipt of Middough's calculations, Toledo implemented interim measures, sealing open piping leading to and from the serviced pressure vessel, and corrected the deficiencies at the next regularly scheduled equipment shutdown (or ‘turnaround’) in late 2011 or early 2012” (Secretary’s brief, p.110). Nothing in the record indicates an intentional, knowing or voluntary disregard for the requirements of the Act or plain indifference to employee safety. BPP self-identified the valve deficiencies and then took steps to ensure safe operation of the equipment until it could replace the valves. There is no illegality of either BPP’s conduct or the cited conditions, and thus no heightened awareness of illegality.

Items 16a, 17a, and 18a: Upon receipt of Middough’s draft report in July of 2009, BPP implemented its Relief Systems Guidelines by verifying the accuracy of the calculations, conducting a new risk analysis, and implementing interim actions to ensure safe continued operation of the valves until permanent modifications could be completed (Tr. 2991-2992, 3002-3004). BPP added a riser to the water tanks that can feed the FCC Feed Drum to prevent and overflow of water into it. BPP also increased the management review and approval required for continued operation of the valves and the FCC Feed Drum. It also installed a full sized relief valve in an interim location that could be installed without incurring the risks associated with a shutdown of the equipment (Tr. 2987, 2992, 3053). There is no evidence of BPP or BP-Husky having a heightened awareness of illegality regarding the relief valves.

The undersigned determines the Secretary’s classification of willfulness is not appropriate for BPP and BP-Husky’s violations of § 1910.119(d)(3)(ii) and reclassifies the violations as serious.

Penalty Determination

The Commission is the final arbiter of penalties in all contested cases. “In assessing penalties, section 17(j) of the OSH Act, 29 U. S. C. § 666(j), requires the Commission to give due consideration to the gravity of the violation and the employer’s size, history of violation, and good faith.” Burkes Mechanical Inc., 21 BNA OSHC 2136, 2142 (No. 04-0475, 2007). “Gravity is a principal factor in a penalty determination and is based on the number of employees exposed, duration of exposure, likelihood of injury, and precautions taken against injury.” Siemens Energy and Automation, Inc., 20 BNA OSHC 2196, 2201 (No. 00-1052, 2005).

BPP employed approximately 600 employees at the Ohio refinery (Tr. 1339, 1812, 1830-1832). OSHA had previously cited BPP for violations at the Ohio refinery. BPP and BP-Husky demonstrated good faith during this proceeding.

Items 13a and 14a of Citation No.2, § 1910.119(d)(3)(ii): The gravity of the violation is high. BPP installed PSV-115 (Item 13a) in 1995 and PSV-124 (Item 14a) in 1999 (Exhs. RBPP-84 and RBPP-88). Refinery employees were exposed to the hazards of inadequate pressure relief for 14 years and 10 years, respectively, while working in proximity to the undersized valves. The undersigned determines a penalty of $7,000.00 for each item is appropriate.

Items 16a, 17a, and 18a of Citation No. 2, § 1910.119(d)(3)(ii): The gravity of the violation is high. The in-service date of PSV-1280 and PSV-1281 (Items 16a and 17a) was 1973 (Tr. 355, 361). The in-service date of PSV-1301 (Item 18a) was 1958 (Tr. 335). Refinery employees were exposed for decades to the hazards of working in proximity to relief valves with excessive built-up back pressure. The undersigned determines a penalty of $7,000.00 for each item is appropriate.

FINDINGS OF FACT AND CONCLUSIONS OF LAW

The foregoing decision constitutes the findings of fact and conclusions of law in accordance with Rule 52(a) of the Federal Rules of Civil Procedure.

ORDER

Prior to the hearing, the Secretary and BPP settled the items cited in Citation No. 1 and Citation No. 3. The parties filed a written partial settlement agreement on December 7, 2012, incorporating these dispositions. The undersigned hereby approves the December 7, 2012, partial settlement agreement, the terms of which are set out below in the sections addressing Citation No. 1 and Citation No. 3.

Citation No. 1

Citation No. 1 contained Items 1 through 20 alleging serious violations, issued to BPP and to BP-Husky. Prior to the hearing, the Secretary and BPP entered into a settlement agreement. The Secretary agrees to withdraw all items of Citation No. 1 against BP-Husky. BPP agrees to accept as serious Items 1, 2, 3, 8, 12, 17, 18, 19, and 20 of Citation No. 1 and to pay $5,000.00 for each item. The Secretary agrees to withdraw Items 4, 13, and 16, with remedial action to be agreed upon. The Secretary withdraws Items 5, 7, 10, and 11. Items 6, 9, 14, and 15 are classified as other than serious with abatement agreed on by the Secretary and BPP. No penalties are assessed for the items classified as other than serious (Exh. JX-54; Partial Settlement Agreement).

Citation No. 2

1. Item 1 of Citation No. 2, alleging a willful violation of 29 C.F R. §1910.119(d)(3)(i), is vacated and no penalty is assessed;

2. Items 2a through 12a of Citation No. 2, alleging willful violations of 29 C.F.R § 1910.119(d)(3)(ii), are vacated and no penalties are assessed;

3. Items 2b and 3b of Citation No. 2, alleging willful violations of 29 C.F.R. § 1910.119(j)(5), are withdrawn by the Secretary and no penalties are assessed;

3. Items 4b through 12b of Citation No. 2, alleging willful violations of 29 C. F. R. § 1910.119(j)(5), are vacated and no penalties are assessed;

4. Items 13a and 14a of Citation No. 2, alleging willful violations of 29 C.F.R. § 1910.119(d)(3)(ii), are affirmed as serious and a penalty of $7000.00 each for Item 13a and Item 14a is assessed;

5. Items 13b and 14b of Citation No. 2, alleging willful violations of 29 C.F.R. § 1910.119(j)(5), are vacated and no penalties are assessed;

6. Items 15a and Item 15b of Citation No. 2, alleging willful violations of 29 C.F.R. §§ 1910.119(d)(3)(ii) and (j)(5), respectively, are vacated and no penalties are assessed;

7. Items 16a, 17a, and 18a of Citation No. 2, alleging willful violations of 29 C.F.R § 1910.119(d)(3)(ii) are affirmed as serious and a penalty of $7000.00 each for the items is assessed;

8. Items 16b, 17b, and 18b of Citation No. 2, alleging willful violations of § 1910.119(j)(5), are vacated and no penalties are assessed;

9. Items 19a through 27a of Citation No. 2, alleging willful violations of § 1910.119(d)(3)(ii), are vacated and no penalties are assessed;

10. Items 19b through 27b of Citation No. 2, alleging willful violations of § 1910.119(j)(5), are vacated and no penalties are assessed;

11. Items 28, 29, and 30 of Citation No. 2, alleging willful violations of § 1910.119(d)(3)(ii), are vacated and no penalties are assessed;

12. Items 31a and 31b of Citation No. 2, alleging willful violations of §§ 1910.119(d)(3)(iii) and (e)(3)(i), respectively, are vacated and no penalties are assessed;

13. Items 32 through 40 of Citation No. 2, alleging willful violations of § 1910.119(e)(5), are vacated and no penalties are assessed;

14. Item 41 of Citation No. 2, alleging a willful violation of § 1910.119(j)(4)(ii), is vacated and no penalty is assessed; and

15. Item 42 of Citation No. 2, alleging a willful violation of § 1910.119(j)(4)(iii), is withdrawn by the Secretary and no penalty is assessed.

Citation No. 3

Citation No. 3 contained Items 1, 2, and 3 alleging other than serious violations, issued to BPP and BP Husky. Prior to the hearing, the Secretary and BPP entered into a settlement agreement. The Secretary agrees to withdraw all items of Citation No. 3 against BP-Husky. The Secretary agrees to withdraw Item 1 against BPP. BPP agrees to accept as other than serious Items 2 and 3, with abatement agreed on by the Secretary and BPP. No penalties are assessed for Items 2 and 3 (Exh. JX-54).

SO ORDERED.

/s/ Sharon D. Calhoun

SHARON D. CALHOUN

Judge

Dated: August 12, 2013

Atlanta, Georgia

---

[1] Before the judge, the Secretary withdrew Items 2b, 3b, and 42 of Willful Citation 2.

[2] Nine of the items vacated by the judge—Items 13, 14b, 16b, 17b, 18b, 28, 29, 30, and 41—are not challenged by the Secretary on review.

[3] To establish a violation of an OSHA standard, the Secretary must prove that: (1) the cited standard applies; (2) its terms were violated; (3) employees were exposed to the violative condition; and (4) the employer knew or could have known of the violative condition with the exercise of reasonable diligence. See Briones Util. Co., 26 BNA OSHC 1218, 1219 (No. 10-1372, 2016).

[4] It was not until 2013 (and thus after the inspection and issuance of the instant citation) that OSHA offered a definition of the phrase RAGAGEP when it published a request for information (“RFI”) pursuant to an Executive Order. Process Safety Management and Prevention of Major Chemical Accidents, 78 Fed. Reg. 73,756 (Dec. 9, 2013) (RFI issued in response to Improving Chemical Facility Safety and Security, Exec. Order No. 13,650, 78 Fed. Reg. 48,029 (Aug. 1, 2013)). OSHA’s RFI requested comments on ways to modernize its PSM standard, and it cited to a source definition for RAGAGEP from the Center for Chemical Process Safety (“CCPS”), which OSHA recognized as “an example of a safety organization that recommends additional management-system elements”:

Recognized And Generally Accepted Good Engineering Practices . . . are the basis for engineering, operation, or maintenance activities and are themselves based on established codes, standards, published technical reports or recommended practices (RP) or similar documents. RAGAGEPs detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a vessel, inspecting a storage tank, or servicing a relief valve.

Id. at 73,761. OSHA noted that while CCPS’s definition of RAGAGEP “is not an official OSHA definition, it is consistent with OSHA’s intent when it promulgated the [PSM] standard.” Id.

[5] Chairman MacDougall and Commissioner Sullivan note that if these reports were voluntary self-audits, the Secretary’s reliance on them to prove a violation of the OSH Act would be troubling because, if an employer risks OSHA’s use of them to establish allegations of violative conduct, such use would discourage self-audits. The purpose of OSHA’s policy regarding such audits is “to provide appropriate, positive treatment that is in accord with the value voluntary self-audits have for employers’ safety and health compliance efforts . . . .” Final Policy Concerning the Occupational Safety and Health Administration’s Treatment of Voluntary Employer Safety and Health Self-Audits, 65 Fed. Reg. 46,498, 46,502 (July 28, 2000). “OSHA will not routinely request voluntary self-audit reports when initiating an inspection, and . . . the Agency will not use voluntary self-audit reports as a means of identifying hazards upon which to focus during an inspection.” Id. at 46,501. Additionally, “OSHA will refrain from issuing a citation for a violative condition that an employer has discovered through a voluntary self-audit and has corrected prior to the initiation of an inspection . . . .” Id. In other words, employers should not be penalized for conducting self-audits that are not specifically required by OSHA’s standards as “part of a planned effort to prevent, identify, and correct workplace safety and health hazards.” Id. Rather, voluntary self-audits should be viewed “as strong evidence of the employer’s good faith with respect to the matters addressed.” Id.; see Solis v. Grede Wis. Subsidiaries, LLC, 24 BNA OSHC 1061, 1063, No. 13-cv-017-wmc, 2013 WL 3899768, at *2 (W.D. Wis. 2013) (“[I]t is irrelevant whether one calls this guidance a ‘rule’ or merely a ‘final policy,’ or even whether it is legally binding on the agency for purposes outside of the exercise of its agency subpoena power. What is important is that it creates a reasonable expectation of privacy that businesses rely on in conducting internal safety audits; in turn, this expectation serves OSHA’s paramount goal of promoting safety in the workplace.”).

[6] For the types of pressure relief valves at issue here, it was presumed at the time of the alleged violative conduct that the valve manufacturer preset the reseat pressure to allow for a blowdown that was 7% below the set pressure.

[7] The IPd measurements set forth in Items 2a and 3a were subsequently recalculated by Middough at less than 3%. In addition, unlike the valves at issue in the other IPd items, the one referenced in Item 2a, originally misidentified as a conventional valve, was later found to be a pilot valve, which is subject to different IPd requirements under both BP’s policy and pertinent consensus standards.

[8] Our dissenting colleague argues that BP implicitly tried the issue of IPd limits above 3% being RAGAGEP-compliant. This, however, ignores the Secretary’s repeated assertions that a 3% IPd limit was the only RAGAGEP available to BP under the circumstances. The Secretary’s argument throughout this litigation has been laser-focused on—and has never strayed from—this proposition. (See, e.g., Sec’y Post-Hr’g Br. at 91 (heading that states, “The 3% IP[d] Rule Is the Only RAGAGEP”); Sec’y Br. at 43 (“The ALJ . . . erred in rejecting the 3% limit as the applicable RAGAGEP for valve IPd.”), 52 (“[T]he ALJ’s holding on this point ignores the fact [that] at this time industry consensus is that the 3% limit is the only relevant RAGAGEP.”); Sec’y Reply Br. at 1 (heading that states, “The 3% Limit is the Only Applicable RAGAGEP”).) Indeed, at the hearing, counsel for the Secretary concluded his opening statement with the following assertion: “[T]he evidence will show that . . . BP was put on notice that the Secretary considered that 3% was RAGAGEP. And so we believe that the evidence will show that there were very clearly violations and RAGAGEP has clearly been 3%.”

This view of the Secretary’s argument is consistent with how he alleges the violations in the citation. Specifically, the “a” items state:

The employer does not document that [an identified relief valve] providing protection to [an identified pressure vessel] complies with recognized and generally accepted good engineering practices, in that, it has an inlet pressure drop greater than 3%. [The identified relief valve] was determined to have an inlet pressure drop of [a calculated value exceeding 3%].

And the “b” items state:

The employer does not ensure [that the relief valve identified in the corresponding “a” item], located in [an identified unit of the refinery], has an inlet pressure drop of not more than 3%. [The identified relief valve] was determined to have an inlet pressure drop of [a calculated value exceeding 3%].

Our colleague asserts that “the language of the citation itself apprised BP that what constitutes RAGAGEP” is “in controversy.” But the citation items each say—very explicitly—that an IPd greater than 3% is not RAGAGEP. If anything, this language deprived BP of notice that an IPd limit, other than 3%, could be at issue.

[9] In the PSM standard’s final rule preamble, OSHA revised the proposed rule to include the phrase, “recognized and generally accepted good engineering practices,” to assure that the mechanical integrity requirements were truly performance-oriented:

Several rulemaking participants . . . suggested that if this provision is to be truly performance-oriented, employers should have the flexibility to follow internal standards and manufacturers’ recommendations as well as applicable codes and standards.

OSHA agrees with these rulemaking participants. Since the phrase “recognized and generally accepted good engineering practices” would include both appropriate internal standards and applicable codes and standards, the Agency has decided to use this phrase in this provision of the final rule.

Process Safety Management of Highly Hazardous Chemicals, 57 Fed. Reg. at 6390-91. The preamble, thus, makes clear that RAGAGEP may “include appropriate internal standards of a facility.” As discussed below, however, while certain parts of BP’s internal IPd policy could be characterized as internal, the aspect of that policy at issue here is expressly based on API’s consensus standard.

[10] This version of the consensus standard had been in place since 2003 and was reaffirmed in 2011. Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries Part II – Installation, API Recommended Practice 520 (5th ed. Aug. 2003, reaffirmed Feb. 2011). We note that after the submission of briefs in this case, API 520 was revised and the sixth edition of the standard was published in March 2015. Therefore, what API’s standard indicated was RAGAGEP in 2009 is not necessarily RAGAGEP today, at least to the extent that API’s consensus standard is used by an employer to establish compliance with RAGAGEP.

[11] Before OSHA’s inspection commenced, BP had engineering guidelines in place for its relief systems. BP’s expert witness, Dr. Georges Melhem, testified that those guidelines addressed the broad range of factors that impact relief system stability, including (but not limited to) IPd. According to BP, internal guidelines are necessary because most consensus standards, including API 520, expressly state that they do not replace operators’ engineering judgment and experience. In this regard, the “Special Notes” to the version of API 520 in place at the time of the alleged violations stated as follows:

API standards are published to facilitate the broad availability of proven, sound engineering and operating practices. These standards are not intended to obviate the need for applying sound engineering judgment regarding when and where these standards should be utilized. The formulation and publication of API standards is not intended in any way to inhibit anyone from using any other practices.

[12] In contrast to API 520, BP’s policy requires an even lower IPd if the blowdown is less than 7% (or 5%, after the IPd limit for existing relief installations was revised). The blowdown setting for each of the valves at issue, however, was presumed at the time of OSHA’s inspection to be 7%. This part of BP’s policy, therefore, is not relevant to the circumstances of this case.

[13] This view persists in OSHA’s most recent enforcement policy concerning RAGAGEP:

There may be multiple RAGAGEP that apply to a specific process. For example, American Petroleum Institute (API), RP 520 Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries Part II - Installation, and International Standards Organization, Standard No. 4126-9, Application and installation of safety devices, are both RAGAGEP for relief valve installation and contain similar but not identical requirements. Both documents are protective and either is acceptable to OSHA.

RAGAGEP in Process Safety Management Enforcement, Director Thomas M. Galassi, Directorate of Enforcement Programs, to Regional Administrators (May 11, 2016).

[14] Given the Secretary’s claim that an engineering analysis could not be conducted pursuant to API’s consensus standard, BP’s attempt to establish that an engineering analysis could be conducted and, in fact, had been conducted by BP, was directly responsive to the Secretary’s specific allegation.

Our dissenting colleague argues that “[l]ike the Secretary, BP has litigated the broader issue of what constitutes RAGAGEP.” She bases this conclusion on the fact that BP relied on its engineering analysis to support IPd limits over 3% as being RAGAGEP-compliant. What she fails to acknowledge, however, is the Secretary’s steadfast position that, at the time of the citation, there was no methodology available for conducting such an engineering analysis under API 520 that would have allowed for an IPd limit above 3% and that BP’s engineering analysis, therefore, was incapable of producing an acceptable alternative. The sole allegation to which BP is responding in this litigation is, thus, whether a 3% IPd limit is the only acceptable RAGAGEP.

[15] Even after the judge expressly found that the Secretary’s theory was limited to whether any IPd in excess of 3% violated the cited PSM provisions, the Secretary made no attempt to amend the citation to include anything other than this very specific view of what constitutes RAGAGEP. See generally McWilliams Forge Co., 11 BNA OSHC 2128, 2129 (No. 80-5868, 1984) (stating that amendment under Federal Rule of Procedure 15(b)(2) “is proper only if two findings can be made—that the parties tried an unpleaded issue and that they consented to do so”); Envision Waste Servs., LLC, 27 BNA OSHC 1001, 1007 (No. 12-1600, 2018) (“Under Federal Rule of Civil Procedure 15(b)(2), ‘[w]hen issues not raised by the pleadings are tried by express or implied consent of the parties, they shall be treated in all respects as if they had been raised in the pleadings.’ Trial by consent exists ‘only when the parties knew, that is, squarely recognized, that they were trying an unpleaded issue.’ ” (cited case omitted)); compare Lancaster Enter., Inc., 19 BNA OSHC 1033, 1036 n.13 (No. 97-0771, 2000) (holding sua sponte amendment appropriate where parties tried different provision by consent).

Further, we find that BP would be prejudiced by any such amendment at this point. Our determination in this regard is relevant to whether BP had a fair opportunity to defend against the Secretary’s evidentiary case and whether it could have offered any additional evidence if the case had been tried under a different legal theory. See Yellow Freight Sys., Inc. v. Martin, 954 F.2d 353, 358 (6th Cir. 1992) (introduction of evidence relevant to issue already in case may not be used to show consent to trial of new issue absent clear indication that party who introduced evidence was attempting to raise new issue). Had BP known that the Secretary was claiming it had violated the cited provisions on the ground that it failed to comply with specific IPd levels in excess of 3% (such as BP’s internal standards of 7% and 5%), it would have understood the need to offer evidence addressing those particular IPd levels. Instead, given the Secretary’s steadfast insistence that 3% is the only IPd limit that constitutes RAGAGEP, BP’s defense could appropriately be limited to defending that one theory, which could include the positions that the Secretary was seeking to impose a prescriptive rule into a performance standard by pursuing a 3% IPd limit, or that a basis could exist for RAGAGEP exceeding this limit. Id. We therefore decline to reach whether the Secretary established a violation of the cited provisions on the basis that an IPd limit other than 3% was RAGAGEP and was breached.

[16] This is not to say that the IPds calculated by Middough for the relief installations at issue were, or were not, RAGAGEP. Our decision today is focused on what the Secretary has explicitly pleaded and argued—that a 3% IPd limit is the only possible RAGAGEP for the relief installations at issue. As such, other IPd limits need not be considered with respect to these citation items. Nonetheless, there is evidence in the record concerning BP’s engineering analysis under API 520 that tends to show that having a safety margin between the blowdown and IPd is necessary to promote valve stability. This evidence—including testimony from BP’s own expert witness, Dr. Melhem—suggests that where the blowdown is 7% (as was presumed, based on the manufacturers’ settings, for the valves at issue), an IPd of 5% or less provides an appropriate safety margin.

Any discussion in this decision concerning RAGAGEP, however, is specific to the circumstances of this case. RAGAGEP is a performance-oriented concept that changes based on, for example, advances in technology and revisions to methodologies. Although the evidence in this case may tend to show that, in 2009, an IPd limit above 5% could not have constituted a “good engineering practice,” and therefore was not RAGAGEP, what constitutes a good engineering practice in 2018, even for an identical process, may no longer be the same. Indeed, given the very nature of RAGAGEP, multiple RAGAGEPs could exist for a single matter, either through consensus standards that take diverging approaches, or through an internal standard that, although different from a consensus standard’s requirements, still constitutes RAGAGEP. Thus, our holding today, as noted above, does not set forth what constitutes RAGAGEP as we decline to find that issue is before us.

[17] Paragraph (e)(1) sets the initial assessment schedule and requires this initial assessment to be updated and revalidated in accordance with the every-five-years schedule in (e)(6).

[18] The Secretary’s interpretation of (d)(3)(ii) would give PSM-covered facilities, such as BP, two options: either immediately implement permanent corrective measures for all mechanical equipment deficiencies or shut down affected equipment. However, because permanent corrections at large, complex facilities often take significant time, and come with their own risk, these facilities would have only one choice—to shut down without conducting a risk assessment to determine how best to mitigate the associated risks.

In fact, in unrefuted testimony, BP technical manager Timothy Smith and BP’s expert, Dr. Melhem, both stated that it is less risky in some circumstances to continue to operate until the next scheduled shutdown or “turnaround,” and then make a permanent fix. The next scheduled shutdown at the refinery was to have taken place later in 2012.

[19] The citation in this case was issued on March 8, 2010, six months after OSHA began its inspection on September 10, 2009. Thus, the relevant time-period for any violation coincides with the start of the inspection. See 29 U.S.C. § 658(c) (“No citation may be issued under this section after the expiration of six months following the occurrence of any violation.”).

[20] Specifically, Hasselbach testified that the drum was drained, vented, and taken out of service during OSHA’s inspection, and that BP did an “MOC” (an apparent reference to a “management of change” procedure, see 29 C.F.R. § 1910.119(l)) to take the drum out of service. The judge never mentioned Hasselbach’s testimony and did not provide any reason for crediting Smith’s account over his. See, e.g., L.E. Myers Co., 16 BNA OSHC 1037, 1046-47 n.17 (No. 90-0945, 1993) (“Not only did the judge fail to give any reason for rejecting this evidence, but, in his decision, the judge appears to have totally ignored [contrary] testimony,” and so “the judge’s finding cannot be considered a credibility determination to which the Commission must defer.”); Caterpillar Logistics Servs., Inc. v. Solis, 674 F.3d 705, 709 (7th Cir. 2012) (“The
adjudicator . . . must take account of competing evidence and inferences . . . [in order to] show why the agency credited one witness rather than another.”).

[21] The Secretary contends that even if the June 1 log entries establish that the drum was completely drained, they do not establish “that BP had fully mitigated the hazard” by locking out the vessel. The Secretary, however, did not cite BP under the LOTO standard. See 29 C.F.R. § 1910.147(a)(1)(i) (“cover[ing] the servicing and maintenance of machines and equipment in which the unexpected energization or start up of the machines or equipment, or release of stored energy, could harm employees”).

[22] We also reject an alternative exposure theory advanced by the Secretary—that even if the drum was empty as of June 2009, employees were nonetheless exposed, based on testimony from Dr. Melhem about welders in the refining industry being injured when vessels they thought had been emptied of hydrocarbons exploded. Although welding an out-of-service vessel is addressed by the PSM standard if done “on or near a covered process,” in which case a “hot work permit” is required, the Secretary did not cite BP for a violation of this provision. See 29 C.F.R. § 1910.119(k). The issue here is whether the Secretary established exposure to the alleged failures regarding the deficient relief valves, not the hazard of combustion/explosion. He cannot circumvent that burden by showing that there was exposure to a different hazard. See RGM Constr. Co., 17 BNA OSHC 1229, 1234 (No. 91-2107, 1995) (“The zone of danger is determined by the hazard presented by the violative condition, and is normally that area surrounding the violative condition that presents the danger to employees which the standard is intended to prevent.”) (emphasis added).

[23] The Secretary notes that BP did not seek review of the judge’s ruling on the noncompliance element of the Secretary’s case, seemingly arguing that the company should be precluded from now arguing the issue before the Commission. BP prevailed on these items, however, so the company was not required to challenge the noncompliance element to preserve the issue. See Commission Rule 91(b), 29 C.F.R. § 2200.91(b) (“A party adversely affected or aggrieved by the decision of the Judge may seek review by the Commission . . . .”).  Additionally, BP argued before the judge that the company complied with RAGAGEP with respect to the heat exchangers cited in these items. Compare Commission Rule 92(c), 29 C.F.R. § 2200.92(c) (“The Commission will ordinarily not review issues that the Judge did not have the opportunity to pass upon.”).

[24] For example, the P&ID for the Stripper Reboiler Condensate Pot (Item 23) shows only that there was no PRD “on the heat exchanger itself,” and the testimony notes only that the “safety valve that’s on [that vessel] now wasn’t on there [then]” and “[t]here’s no device attached to it.” Similarly, regarding the Stripper Steam Reboiler (Item 24), the testimony states only that there was no PRD “on the tube side” or “on the shell side.”

[25] Notably, the record also does not show BP violated its own internal guidance, which states that “[p]ressure relief capacity shall be provided on heat exchangers for the external fire condition on both sides if they can be isolated without draining or in an area where a fire could be sustained.” Even assuming that “on heat exchangers” means a PRD is required to be located on the vessel, nothing in the record shows the cited heat exchangers “can be isolated without draining or in an area where a fire could be sustained.”

[26] Section 1910.119(e) requires an employer to have “a team with expertise in engineering and process operations” conduct “an initial [PHA] (hazard evaluation) on processes covered by this standard,” and then, “[a]t least every five (5) years after the completion of the initial [PHA],” update and revalidate it. 29 C.F.R. § 1910.119(e)(1), (4), (6).

[27] The judge qualified Wolf as an expert in the areas of “fire water systems in the refining industry,” “the design, operations and analysis of BP’s fire water system,” and “process hazards and risks associated with the refinery’s fire water systems.” We note that the judge’s qualification of Wolf as an expert on BP’s fire water system is quite unorthodox, given that experts are typically qualified as such in a particular field and then apply that expertise to the facts at issue. Nevertheless, given that Wolf was qualified as an expert in “fire water systems in the refining industry” and then opined on BP’s system, we do not consider the judge’s ruling reversible error.

[28] Initially, in opposition to the Secretary’s petition for discretionary review, BP disputed that the Secretary had made such a request. However, in response to the Secretary’s reference in his opening review brief to this discovery request, BP now argues only that “[t]he Secretary has not . . . presented any evidence that Respondent[] did not produce any documents in response to this request.”

[29] Compliance audits are governed by paragraph (o) of the PSM standard, which provides, among other things, that “[e]mployers shall certify that they have evaluated compliance with the provisions of this section at least every three years to verify that the procedures and practices developed under the standard are adequate and are being followed.” 29 C.F.R. § 1910.119(o)(1).

[30] Pursuant to the authority granted in Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, Pub. L. No. 114-74, § 701 (2015), OSHA has revised the penalty amounts for violations of its standards. See 29 C.F.R. § 1903.15(d). The violation here, however, occurred prior to the effective date of these revisions, so the statutory maximum applicable in this case is $7,000.

[31] We note that the 1995 Report contains what may be considered recommendations in its “Major Findings” section—these findings, as they pertain to population risk, may be viewed as inconsistent with what appears in the “Recommendations” section. For example, the “Major Findings” section states that “population risks should be further reduced where such reduction can be cost-effectively achieved” and that “risks can be cost-effectively reduced through building modifications or relocation for” the WGI Electricians Building, Laboratory, Blender control room, and WGI Administrative Building. (Emphasis added.) We conclude, however, that the only relevant part of the 1995 Report is the “Recommendations” section. The report’s separation of “Major Findings” from “Recommendations” tracks the language of the standard, which requires the employer to have “a system to promptly address the team’s findings and recommendations” and to “assure that the recommendations are resolved in a timely manner and that the resolution is documented . . . .” 29 C.F.R. § 1910.119(e)(5) (emphasis added). To the extent BP was obligated to consider statements in the Major Findings section as “recommendations,” its failure to do so could be considered a deficiency in its PHA, but these statements cannot be treated as a basis for finding a violation of the cited provision, which confines the Secretary to the substance of the PHA recommendations at issue.

[32] The Secretary seems to take issue with the substance of the recommendations in the 1994 and 1995 Reports, claiming they are insufficient to address the hazard involved. To the extent this is the Secretary’s actual concern, we note that several provisions of the PSM standard appear to address the substance of PHAs but were not cited here. See 29 C.F.R. § 1910.119(e)(1) (“The process hazard analysis shall be appropriate to the complexity of the process and shall identify, evaluate, and control the hazards involved in the process.”), (e)(3)(i) (“The process hazard analysis shall address . . . [t]he hazards of the process.”), (e)(3)(v) (“The process hazard analysis shall address . . .  [f]acility siting.”).

[33] Both before the judge and on review, BP has challenged as “overbroad” the Secretary’s proposed abatement for most of the items at issue on review (all but Items 31a and 31b) because these items specify, in part, abatement of conditions that the Secretary did not cite as violative of the PSM standard. Because we vacate each of the items pertinent to BP’s argument, we need not address this abatement issue.

[34] API’s standard provides, “[a]n engineering analysis of the valve performance at higher inlet losses may permit increasing the allowable pressure loss above 3 percent.”

[35] As discussed by my colleagues, the IPd levels for each of the relief installations at issue are from reports that Middough, Inc.—the safety consulting firm that conducted the revalidation study of the refinery’s valves—submitted to BP. For the reasons stated by my colleagues, I agree that these reports were not part of a voluntary self-audit and that, in any event, BP waived any admissibility arguments by submitting the underlying reports into evidence and failing to object to the December 2008 summary report offered by the Secretary.

Unlike my colleagues, however, I would not be troubled by the Secretary’s use of these reports in this case, even if they were the type of voluntary self-audits discussed in OSHA’s policy. Final Policy Concerning the Occupational Safety and Health Administration’s Treatment of Voluntary Employer Safety and Health Self-Audits, 65 Fed. Reg. 46,498 (July 28, 2000). OSHA explicitly notes in its policy that it does not prohibit the use of such audits in enforcement proceedings. Specifically, OSHA explains that it would be “imprudent” to completely prohibit the agency’s “use of voluntary self-audit documentation” because doing so “would hamper OSHA’s ability to enforce the Act effectively.” Id. at 46,500. OSHA also states that the policy is an “internal” one “intended only to provide OSHA inspectors with guidance regarding the circumstances under which [OSHA] considers it appropriate to review and consider documentation generated by employers as a result of voluntary self-audits.” Id. Finally, OSHA explains that it will not promulgate a formal rule concerning use of voluntary self-audits, because it “believes that a rule that creates legal rights for third parties would be more likely to produce unproductive litigation than will a policy that only provides guidance to OSHA inspectors.” Id. at 46,501; see Dayton Tire, 23 BNA OSHC 1247, 1257 n.8 (No. 94-1374, 2010) (“The Commission has long held that while OSHA’s internal manuals may ‘provide[] guidance to OSHA professionals,’ they ‘[do] not have the force and effect of law, nor [do they] confer important procedural or substantive rights or duties on individuals.’ ” (citation omitted)), aff’d in part, 671 F.3d 1249 (D.C. Cir. 2012).

[36] At the very least, BP has never argued, either before the judge or on review before the Commission, that what constitutes RAGAGEP is not an issue in controversy. Brabham-Parker Lumber Co., 11 BNA OSHC 1201, 1202 (No. 78-6060, 1983) (consolidated) (“The defense of lack of particularity is an affirmative defense that must be raised pre-hearing, in a pleading or by motion, or tried by the consent of the parties.”).

[37] The judge’s basis for vacating Items 2a through 12a, and 4b through 12b, is different than that of my colleagues. The judge concluded that by arguing that a 3% IPd limit is the only RAGAGEP, the Secretary impermissibly attempted to convert the cited PSM provisions from performance requirements to specification requirements. Although § 1910.119(d)(3)(ii) requires compliance with only one of any available RAGAGEPs, that does not mean there are necessarily multiple engineering practices for every specific aspect of all equipment that meet the standard’s performance criteria, i.e., engineering practices that are both recognized and generally accepted, and good.

By the terms of § 1910.119(d)(3)(ii), one way the Secretary can prove noncompliance is to establish that BP’s engineering practice for IPd does not meet the RAGAGEP criteria. If the Secretary proves, as he argues, that BP failed to comply with RAGAGEP by implementing an IPd limit for existing relief installations that was neither “recognized and generally accepted” nor a “good engineering practice” (or that the practice failed one of these two requirements), he has not “converted” a performance standard into a specification standard; he has simply established that in this instance, the facility’s practice was non-compliant. Cf. Brown & Root, Inc., 9 BNA OSHC 1833, 1834 n. 2, 1840 (No. 76-190, 1981) (concluding that frequency of testing—for carbon monoxide, conducted three times over a six- to eight-month period—was inadequate under standard requiring that “[i]f only a high-temperature alarm is used, the air from the compressor shall be frequently tested for carbon monoxide . . . .”); D. Fortunato, Inc., 7 BNA OSHC 1643, 1648 (No. 76-3103, 1979) (where garbage containers were found to be overflowing, employer’s daily removal of garbage was inadequate to meet standard’s requirement that removal occur “at frequent and regular intervals”). In this respect, I conclude that the judge erred in vacating the citation items on this basis.

[38] At the time of the alleged violative conduct, it was a common understanding throughout the refining industry (and even at OSHA) that the valve types at issue here were shipped by their manufacturers with a blowdown specification of 7%. Indeed, OSHA stated in an April 2010 letter to API that “[o]ur understanding is that most relief valves in compressible service,” which means vapor or gas service, “in the US are shipped with 7% blowdown.” In addition, Georges Melhem and Fisher both testified that in 2009 and 2010 (the period of BP’s alleged violative conduct), blowdown was understood in the refining industry to be 7%.

[39] BP asserts that it compared each valve’s IPd to either the “actual [blowdown] figure” or the manufacturer’s 7% specification, but the record shows that Middough did not measure the valves’ blowdown values, and there is no evidence in the record—or assertion by BP—that BP independently measured these values. Accordingly, the record shows that BP’s engineering analysis is based on a comparison between the IPd, actually calculated by Middough, and the manufacturer’s 7% blowdown setting.

[40] Melhem made it clear in his testimony that he did not consider the 7% IPd limit a “good engineering practice” absent a safety margin:

BP’s Counsel: So [the 7% IPd limit is] the same guideline as . . . the 5% rule and 3% rule, just without a safety margin?

Melhem: Yeah, you’ve got to have a little bit of a margin. So we came in and said, you can’t just have it with no margin, you've got to put in some margin.

BP’s Counsel: Okay, so what did you say -- what did you think about their 7% rule?

Melhem: I’m going to have to select my words very carefully because I remember writing that in that report that was served to OSHA and BP. I think I said . . . the 7% inlet pressure drop is not without merit.

BP’s Counsel: Well, what would you think would be a good engineering practice for the company to adopt?

Melhem: Five percent. Blowdown minus some margin.

BP’s Counsel: Okay. And they adopted that?

Melhem: And they did adopt that. But the 7% has some engineering basis. And we just wanted to see a little bit more of a margin.

Melhem subsequently repeated this view when he testified that “you can’t have a zero percent [safety] margin” because “nobody’s that good”; and “[f]or existing systems, to make sure that we don’t expose people to undue risk . . . go up to blowdown minus some margin.”

[41] Discussing shutdowns and startups, a BP general operator testified that these are the most unstable operations, because the temperature of the metals is changing “from ambient” to as much as 1400 degrees, and the pressure is changing from “0 to 1000 pounds”—this creates a “tendency” for equipment “to give.”

[42] Fisher claimed that dynamic factors—such as resonance and vibrations, which could affect the stability of a valve when it is opening or closing—must be considered but admitted that such factors are more prevalent in the nuclear industry. He also acknowledged that there is no mention of dynamic factors in API 520 and that as of 2003 in the refining and chemical industries (when this version of the API standard was first published, before being reaffirmed in 2011), dynamic factors were not recognized as “having to do with relief valve operation.” In fact, Fisher admitted that since the “engineering analysis” language was first added to API 520 in 1994, at the time that language could not have been intended to address dynamic factors.

[43] As my colleagues explain, there is no dispute that, at the time of the violations, API 520 was recognized and generally accepted (the “RAGA” part of RAGAGEP).

[44] The IPd calculations asserted by the Secretary in these citation items are derived from the December 2008 summary report from Middough. However, in evidence with respect to each referenced relief installation are several versions of the Middough reports that, in some cases, postdate the summary report. These reports include revised IPd levels, which resulted from new API recommendations on how to perform certain underlying calculations and issues noticed during field checks.

Items 5b, 7b, and 8b allege that the referenced relief installations had IPds of 5%, 3.2%, and 3.2%, respectively. The Middough reports in evidence show that these levels were never revised in excess of 5%. I note that based on the summary report, Item 4b alleges an IPd of 5.377% for the referenced relief installation. But in a report from June 2010, after the citation was issued, Middough revised this level to 4.17%. The Secretary, in his briefs, appears to concede that the IPd level for the relief installation identified in Items 4a and 4b was not in excess of 5%.

[45] The citation alleges that the relief installations identified in these items had IPds of 6.3%, 7.7%, 7.7%, 8.8%, and 6.8%, respectively. The Middough reports in evidence show that these levels, when revised, continued to be in excess of 5%.

BP argues that allowing the Secretary to use these results “to prove a deficiency would create a strong disincentive against the desirable practice of employers obtaining such data to quickly take (potentially) necessary interim safety measures.” As my colleagues point out, however, BP itself submitted the Middough reports into evidence and did not object when the Secretary submitted into evidence, and relied upon, Middough’s December 2008 summary report. BP, therefore, has no basis for challenging the Secretary’s use of this evidence. Fed. R. Evid. 103(a) (“A party may claim error in a ruling to admit . . . evidence only if the error affects a substantial right of the party and . . . a party, on the record: (A) timely objects or moves to strike; and (B) states the specific ground, unless it was apparent from the context[.]” (emphasis added)); see Commission Rule 71, 29 C.F.R. § 2200.71 (“The Federal Rules of Evidence are applicable.”).

[46] BP also cites to a portion of the technical manager’s testimony, in which he discusses measures taken to address certain issues that arose following installation of a “balance line.” However, these measures were completed in 2009, before Middough started revalidating the affected valves, and the manager admitted that when Middough conducted its review, BP had not anticipated that problems with IPd would be found. He did testify that as part of the risk assessment for back pressure, his team determined that BP should continue to use the measures that were in place before Middough started the revalidation process, but that these measures did not pertain to IPd.

[47] The Middough reports that serve as the basis for the IPd citation items documented that the IPd levels for the relief installations referenced in Items 2a and 3a were 3.8% and 4.6%, respectively. Middough subsequently revised these levels to 0.66% and 1.63%. The Secretary argues that even though Middough determined that the IPds for these relief installations “did not actually exceed 3%,” BP still violated § 1910.119(d)(3)(ii) because it failed “to document compliance with RAGAGEP.” The Secretary asserts that “BP has not offered any proof of the required documentation,” and that “from 2008 until Middough revised its calculations, BP believed that these [relief installations] did not comply with RAGAGEP.” Based on my view of the case, however, I find that the levels Middough originally reported to BP for the referenced relief installations were RAGAGEP-compliant. And since there is no dispute that the Middough reports can be used to document compliance with RAGAGEP, the Secretary has not established BP’s non-compliance with respect to Items 2a and 3a.

[48] BP argues that a prior consultant reviewed these relief installations in 1998 and did not report any of them as having an IPd deficiency. However, this 1998 report was twelve years old when the citation here was issued. Given that PHA revalidation must be conducted every five years, 29 C.F.R. § 1910.119(e)(6), it would be inconsistent with that provision to allow BP to rely on twelve-year-old data to document the equipment’s compliance with RAGAGEP.

[49] As discussed in the part of the majority opinion that I join, when equipment is not RAGAGEP-compliant, but the employer is acting in accordance with the requirements of § 1910.119(j)(5), documentation of RAGAGEP-compliance under § 1910.119(d)(3)(ii) is not required. As to Items 6 and 9 through 12, however, BP continued to use the relief installations despite its failure to take interim measures to “assure safe operation” under paragraph (j)(5). BP, therefore, was not exempt from the requirement to document that these relief installations were compliant with RAGAGEP.

[50] For the relief installations identified in Items 6a, 6b, 12a, and 12b, which alleged IPd levels above 5% but less than 7%, BP would have performed no risk assessment by the time OSHA commenced its inspection in September 2009, because the IPds for these relief installations complied with BP’s internal IPd standard until it was lowered to 5% in late October 2009 (though risk assessments were performed at some point after the IPd limit was revised). Additionally, Middough had to revise some of its reports, even though BP had previously approved them and conducted risk assessments, due to the revision to BP’s internal IPd standard and changes to API’s recommendations on how to perform certain calculations. Following each revision, once the calculations were approved by BP, a new risk assessment would be conducted unless the revision was a “minor adjustment.”

[51] The Secretary’s only expert witness to testify on when to fix deficiencies in relief installations admitted that while he “can speak to chemical plants,” as to relief installation deficiencies identified in refineries, he did not “know standard practice” for prioritizing and correcting those deficiencies—i.e., “when you fix it or when the turnarounds occur.”

[52] Once the calculations for a particular unit were approved through a preestablished process, BP personnel would discuss deficiencies found by Middough and determine each deficiency’s “severity level” and “probability” of occurrence, as designated on a “risk matrix.” Based on this assessment, BP would then determine into which color-coded box on the risk matrix a particular deficiency should be assigned. The color of the box dictated BP’s subsequent action: as to the relief installations identified in Items 6a, 6b, 9a through 12a, and 9b through 12b, BP assessed their deficiencies—all had IPds exceeding 5%—as falling within the second lowest color-coded risk category. According to this risk category, for the referenced relief installations to continue operating with the deficiencies uncorrected until a future scheduled turnaround, the pertinent operations superintendent had to (and did) “sign off.” Nothing in the record establishes why the superintendents determined that interim mitigations were unnecessary for these particular relief installations, or what basis the superintendents had for determining that it was “[s]afe to operate until [a future scheduled] turnaround.” E.R. Zeiler Excavating, Inc., 24 BNA OSHC 2050, 2053 (No. 10-0610, 2014) (declining to characterize violation as willful where record is poorly developed on key evidentiary issues); George Campbell Painting Corp., 17 BNA OSHC 1979, 1983 (No. 93- 0984, 1997) (same); Access Equip. Sys., Inc., 18 BNA OSHC 1718, 1727-28 (No. 95-1449, 1999) (same).

[53] The Secretary also argues that BP exhibited “utter indifference to employee safety” in “tolerat[ing]” the relief installation identified in Items 6a and 6b that had an IPd (as calculated by Middough) exceeding BP’s own original 7% IPd limit. In this regard, the Secretary is relying on a revised IPd calculation of over 7% made by Middough on March 4, 2011, almost two years after the citation was issued—as to these items, the allegations included in the citation stated that the IPd for the referenced relief installation was 6.26%. The Secretary cannot rely on the revised calculation to show that BP was aware, during the six-month period before the citation was issued, that this relief installation’s IPd exceeded BP’s original internal standard of 7%. See OSH Act § 9(c), 29 U.S.C. § 658(c) (“No citation may be issued under this section after the expiration of six months following the occurrence of any violation.”). Although BP was aware that Middough’s calculations could change based on the revalidation process, the Secretary fails to point to any evidence that would show BP had reason to expect that the IPd level at issue in Items 6a and 6b would be revised upward, in excess of 7%. The Secretary does not appear to be relying on the IPd levels set forth in Items 9a through 11a, and 9b through 11b—the only items that alleged IPds in excess of 7%—to support this particular argument. For the relief installations identified in these items, revisions to the Middough reports that post-dated the citation show the IPds were recalculated at less than 7%.

In any event, these relief installations, like the other ones at issue, were subject to BP’s risk assessment process. As discussed above, the Secretary, in my view, failed to establish the BP’s reliance on this process constituted plain indifference to employee safety.

[54] I see no reason, at this juncture, to address what penalty I would assess for these violations.

[55] For the first time in a Commission proceeding, all pleadings, motions, orders, exhibits, and other documents that make up the record were filed electronically.

[56] At the hearing, BP-Husky moved to seal certain exhibits and certain portions of the testimony of two witnesses. The Secretary did not object to the motion, nor did BPP or the Union. The undersigned granted BP-Husky’s motion. The sealed portions of the record relate to the joint venture agreement that created BP-Husky, as well as the operating services agreement between BPP and BP-Husky (Tr. 1339-1342). The Secretary and BP-Husky also redacted the sections of their briefs addressing the issue of whether BP-Husky is an employer. The parties filed unredacted copies of the briefs with the undersigned.

For purposes of review, the undersigned has attached a Sealed Appendix to this Decision and Order, discussing the analysis and rationale for concluding BP-Husky is an employer.

[57] BPP and BP-Husky are both cited for violations in all the remaining items at issue. BPP operated the refinery for years before BP-Husky was formed and continued afterwards to oversee its daily operation. For simplicity’s sake, the undersigned will at times use “BPP” interchangeably with “BPP and BP-Husky.”

[58] In his post-hearing brief, the Secretary asserts that Rowe stated that gathering the required information for the pressure vessel “could take ‘days’” (Secretary’s brief, pp. 16, 83). This is a mischaracterization of Rowe’s testimony. Rowe was referring to conducting a “fitness for service evaluation” which is performed “because components degrade over time and you need to make sure that they remain fit for service. It’s a common practice. . . [T]o do a fitness for service evaluation, depending on the nature of the damage, it can take days to do the evaluation” (Tr. 2419) (emphasis added). Rowe was referring to performing an evaluation, not merely locating the information.

[59] IPD refers to “Inlet Pressure Drop.”

[60] BPP and BP-Husky objected to the testimony of James Lay before, during, and after the hearing (Tr. 238, 295-296, 470; BPP’s brief, pp. 152-160). In its post-hearing brief, BPP moves to strike Lay’s testimony on the grounds Lay provided expert testimony but was a lay witness. BPP’s motion is denied.

[61] In this sentence the Preamble is addressing § 1910.119(j)(3)(ii), the inspecting and testing subsection, not the subsection at issue here § 1910.119(d)(3)(ii). In its discussion of § 1910.119(d)(3)(ii), the Preamble explicitly directs the reader to the section addressing § 1910.119(j) for an explanation of the RAGAGEP language. (“OSHA has modified this paragraph by eliminating the list of codes and standards producing organizations. The discussion in paragraph (j), mechanical integrity, discusses the reasons for this change.” 57 Fed. Reg. 6375 (1992)).

[62] To “car-seal” means to lock open a valve, ensuring that there will be an open pathway for the product to relieve through in the event of overpressure (Tr. 3050-3051).

[63] BPP subsequently replaced the undersized valves during turnarounds in 2011 and 2012 (Tr. 3007-3009).

[64] Item 20a of Citation No. 2 contains a typo, identifying the cited heat exchanger as “PR543757.” CSHO Sternes testified as to the correct identification number at the hearing (Tr. 817).

[65] RP 556 uses “heaters” and “furnaces” interchangeably (Tr. 1184).