Ultramar Golden Eagle Refinery - Executive Summary

| Accident History | Chemicals | Emergency Response | Registration | Source | Executive Summary |

ULTRAMAR GOLDEN EAGLE REFINERY 
 
EXECUTIVE SUMMARY 
 
 
Description of Stationary Source and Regulated Substances Handled 
 
Stationary Source Description: 
 
The Ultramar Golden Eagle Refinery processes approximately 160,000 barrels (1 barrel equals 42 gallons) of crude oil per day into transportation fuels.  The principal fuels produced are gasoline and diesel.  The refinery produces propane and butane for commercial purposes.  In addition, the refinery produces anhydrous Ammonia and elemental Sulfur for the agricultural market, as well as petroleum coke used for fuel in cogeneration plants.  The refinery accomplishes the production of these products from crude oil through the use of many complex processing units.  The refinery principally processes San Joaquin Valley Crudes and Alaskan North Slope Crude.  Oil must be converted to lighter hydrocarbons in order for it to be useable as motor fuels.  In addition, the sulfur and nitrogen must be removed from the oil distillates during  
processing to produce motor fuels that produce less smog upon combustion by cars and trucks.   
 
Crude oil begins its journey through the refinery at the Crude Units.  Desalters dehydrate the oil and electrically remove salts to reduce the corrosivity.  It is then sent to the distillation tower where the hydrocarbons are heated and separated into fractions by molecular weight.  Lighter hydrocarbons have lower boiling points than heavier hydrocarbons.  The distillation tower produces six fractions:  wet gas/butanes, gasoline, naphtha, kerosene, gas oil and resid.  The heaviest component, resid, is sent to the Feed Prep units for further distillation under vacuum.  After vacuum distillation, the Feed Prep bottom product, which is made up of very heavy hydrocarbons and is a solid at ambient temperature, is sent to the Coker.  The Coker thermally cracks large molecules into smaller ones.  These smaller molecules can then be further processed into motor fuels.  The Coker also produces petr 
oleum coke, which is a fine black carbon powder. 
 
The gas oil fractions from the Crude Units, Feed Prep Units, and the Coker are still too heavy for use as motor fuels.  These fractions are catalytically cracked in the Fluid Catalytic Cracking Unit (FCCU) and/or the Hydrocracker Unit.  Both of these units crack the hydrocarbon molecules into smaller molecules in the presence of a catalyst.  Catalytic cracking is more selective than thermal cracking.  The FCCU cracking breaks long chain hydrocarbons into short chains and multi-ring compounds into smaller ring compounds.  In addition, olefin compounds (unsaturated hydrocarbons) are generated.  Olefins are undesirable in motor fuels because they contribute to the formation of smog during engine combustion.  The olefins are removed by other process units.  The cracking process in the Hydrocracker occurs in the presence of Hydrogen gas.  Any olefins and other unsaturated compounds are saturated during the hydrocracking process in addition 
to breaking larger chain or ringed hydrocarbons into smaller compounds.   
 
The Hydrodesulfurization (HDS) units remove sulfur and nitrogen from their feedstocks, creating Hydrogen Sulfide and Ammonia, which are separated and processed elsewhere.  These units also saturate olefins.  The HDS units are particularly important for ensuring cleaner burning gasoline, since the removal of these compounds is critical to preventing smog from engine combustion of gasoline and diesel.  The Hydrodearomatization (HDA) unit removes aromatic compounds from diesel fractions, a necessary step in production of cleaner burning fuels.  The Butadiene plant saturates the Butadiene (another olefin) generated by the Coker.  The Reformer Units rearrange hydrocarbons from straight chains into branched chains, rings and aromatics; these are desirable compounds because they raise the octane number of the motor fuels.  Aromatic compounds created by the Reforming units are saturated in the Benzene Saturation Unit 
, ensuring their removal from clean fuel production.  The Alkylation Unit combines two small molecules, a branched hydrocarbon and an olefin, to make a larger branched hydrocarbon.  This process generates alkylate, a high octane blending component for gasoline.  The Alkylation Unit uses Sulfuric Acid as a catalyst.  The MTBE plant produces MTBE from an olefin and Methanol; MTBE is used as an oxygenate in fuel.   
 
The cracking processes produce very small hydrocarbons as well as the larger fractions discussed above.  The Gas Plants and the Light Hydrocarbon Processor (LHP) purify these compounds.  The smallest molecules (one and two carbons) are used in the refinery for fuel.  The propanes and butanes are used as feedstocks for the Alkylation process and for commercial sale.   
 
The refinery has several boilers that produce high pressure, high temperature steam, which is used for both heating and cooling various processes.  The Water Treatment Plants (WTP) produce high quality water  
for use in the boilers and process cooling systems.  The API Separator and the Waste Water Treatment (WWT) plant are part of the refinery's waste water treatment system.  The water that is removed from crude oil prior to processing and water from other process stages is treated by separation and biological conversion systems prior to its permitted discharge.   
 
The sulfur and nitrogen removed from processing streams is converted into anhydrous Ammonia and elemental Sulfur at the Chemical Plant.  The Chemical Plant actually consists of five units, the Ammonia Recovery Unit (ARU), Acid Plant, Diethanolamine (DEA) Stripping Unit, Sulfur Recovery Unit (SRU) and a Shell Claus Offgas Treating (SCOT) Unit.  The ARU removes Ammonia and Hydrogen Sulfide from refinery sour water streams.  The Ammonia is then purified for agricultural purposes, while the Hydrogen Sulfide is sent to the SRU.  The Acid Plant recycles the spent Sulfuric Acid from the Alkylation Unit for its reuse.  The DEA strippi 
ng unit removes Hydrogen Sulfide from refinery DEA streams as part of the sulfur recovery process.  The SRU converts collected Hydrogen Sulfide into saleable elemental sulfur.  The SCOT plant receives and treats sulfur-containing tailgas from the SRU, converts the sulfur containing compounds to Hydrogen Sulfide and returns the stream to the SRU for reprocessing. 
 
 
 
Description of Regulated Substances: 
 
Most of the regulated substances handled at the refinery regulated by the EPA's Risk Management Program (RMP) are flammables.  These materials range in flammability from Pentane (with a flash point greater than -40( F) to Hydrogen (with a flash point of -100( F).  Larger flash points indicate less flammability.  Materials with low flash points must be handled carefully and isolated from ignition sources to prevent fires or explosions involving these compounds.  For comparison, gasoline has a flash point of -45( F and diesel fuel has a flash point of 125( F.  Propane and Butane are  
flammable gasses with flash points lower than gasoline.  
 
As part of refining crude oil to motor fuels, other regulated substances are generated in addition to the flammables.  The four materials discussed here are hazardous principally through inhalation.  Hydrogen Sulfide, with its characteristic rotten egg odor, is created in the processing units that remove sulfur and nitrogen from the refining streams.  Hydrogen Sulfide is a colorless, corrosive, toxic gas; its odor can be readily detected at concentrations below concern.  Hydrogen Sulfide is not stored at the refinery.  As soon as it is generated, it is immediately sent to the Chemical Plant for processing into elemental Sulfur or Sulfuric Acid.  Ammonia is also created by the same processing units.  Ammonia is a colorless, corrosive, toxic gas with a sharp irritating odor.  Its odor is also readily detectable at concentrations below concern.  Ammonia is sent to the Chemical Plant where it is purified into Anhydrous Ammonia, st 
ored in tanks and shipped to agricultural suppliers.  Sulfur Dioxide is a colorless, corrosive, toxic gas with an irritating pungent odor that can be perceived as "burnt matches".  Sulfur Dioxide's odor also allows it to be detected at low concentrations.  Sulfur Dioxide is not stored at the Chemical Plant; it is an intermediate in the Sulfuric Acid recycling process.  Oleum is concentrated Sulfuric Acid with Sulfur Trioxide dissolved in it, hence its nickname "Fuming Sulfuric Acid".  Oleum has potential to liberate Sulfur Trioxide, which is a toxic gas with a sharp penetrating odor.  Oleum is a product of the Sulfuric Acid recycling process. 
 
 
Worst-Case Release Scenarios and Alternative Release Scenarios 
 
The refinery has both Program Level 1 and Program Level 3 Covered Processes as defined by EPA's RMP regulation.  A Program Level 1 process is a process that contains at least the threshold quantity of a regulated substance and the Worst Case Scenario (WCS) does not go offsite.  
A Program Level 3 process is a process that contains at least the threshold quantity of a regulated substance and the WCS reaches an offsite receptor.  A Worst Case Scenario (WCS) is a hypothetical event and the parameters for calculating the WCS is defined in the regulations.  For calculation purposes, it is assumed that the entire contents of the regulated substance in the largest container is released.  For Flammable scenarios, it is assumed all the material explodes.  For Toxic scenarios, it is assumed that the whole container is released within a ten minute period.  Based on these mathematical assumptions, a distance can be calculated for the WCS.   
 
Program Level 1 Processes: 
 
The refinery has 15 Covered Processes classified as Program Level 1 processes.  Each process contains a mixture of flammables as the regulated substance.  The WCS for each Program Level 1 process was calculated using RMPComp to determine the distance the explosion force could travel.  The WCS endpoint  
for explosions is defined as 1 psi.  To use RMPComp to calculate the WCS endpoint, any of the following flammable substances, Methane, Ethane, Propane, Butane, or Pentane, can be used to model a flammable mixture.  Since their heats of combustion are relatively close, they all provide the same distance to the endpoint.  As required, no passive mitigation measures are considered.  
 
Program Level 3 Processes, Worst Case Scenarios: 
 
The refinery has 5 Covered Processes classified as Program Level 3 processes.  Two WCS are required to be reported for Program Level 3 processes, one flammable and one toxic.  The largest WCS was selected according to regulatory requirements for the flammable and toxic scenarios.  The toxic WCS for the refinery involves anhydrous Ammonia.  The scenario is a complete failure of the storage tank releasing its entire contents of Ammonia.  The scenario was modeled using RMP Comp.  The concentration of Ammonia at the endpoint is 200 parts per million, which is  
the Emergency Response Planning Guideline-2 (ERPG-2) level for this compound.  The flammable WCS for the Refinery involves Butane.  The scenario is a complete failure of a Butane storage tank.  The WCS endpoint used for an explosion is 1 psi overpressure.  RMP Comp was used to perform the calculations. As required, no passive mitigation measures were included in either set of calculations. 
 
Program Level 3 Processes, Alternative Release Scenarios: 
 
EPA's RMP regulation requires the calculation of Alternative Release Scenarios (ARS).  Unlike the WCS, the ARS calculations allow consideration of active safety measures in addition to passive safety measures.  One ARS is determined for each regulated substance at the refinery.  There is an ARS for flammables, anhydrous Ammonia, and Oleum (Sulfur Trioxide).  Each of the scenarios was developed based upon a review of PHA reports, review of previous incidents, review of process operating condition and process equipment installation. 
 
The 
ARS selected for flammables involves the release of the entire contents of the refrigerated Butane storage tank followed by a pool fire in the secondary containment area.  The effects generated by the scenario were considered in its development, such as the effects of blast overpressure, fire and/or flammable vapor clouds.  The modeling program used was EPA's OCA Guidance Reference Tables or Equations.  The passive mitigation measure used in modeling this scenario was a dike. 
 
The ARS selected for anhydrous Ammonia involves a complete break of a 1 inch loading hose from a delivery truck.  The time period selected was an estimate of the time it could take for an Operator to isolate and control the leak.  The ERPG-2 concentration of 200 ppm Ammonia was used as an endpoint.  The modeling program used was Areal Locations of Hazardous Atmospheres (ALOHA).  Active mitigation measures used in modeling this scenario included a water spray and manual isolation valves. 
 
The ARS selected for 
Oleum (Sulfur Trioxide, SO3) involves a 2 inch hole. The time period selected was an estimate of the time it could take for an Operator to isolate and control the leak.  The ERPG-2 concentration of 2.5 ppm Sulfur Dioxide was used as the endpoint.  The modeling program used was Safer System's TRACE.  No passive or active mitigation measures were used in modeling this scenario. 
 
 
Program 3 Prevention Program Elements 
 
Employee Participation 
 
The refinery has a written Employee Participation Plan that addresses all of the Risk Management Program elements.  It is the policy to actively involve employees in all aspects of safety whenever possible and practical.  Involvement of employees in the development and implementation of the Risk Management Program elements enhances the effectiveness of these programs.  All employees, hourly and salaried, are included in the Employee Participation Program.  Employee representatives are included in the Employee Participation Program via the Joi 
nt Health and Safety Committee.  This Committee is composed of an equal number of Management and Union Representatives and meets monthly.   
 
The Employee Participation Program accomplishes employee consultation through a variety of avenues.  Consultation has been defined as a two-way dialogue between the employer and the employees and their representatives, where the employer seeks advice, criticism and suggestions.  Management receives direct input from employees through the Joint Health and Safety Committee monthly meetings and by soliciting employee suggestions at the quarterly Management/Employee Safety meetings.  The Annual Employee Computer Based Training (CBT) module includes a section on the Risk Management Program Elements to raise employee awareness and encourage participation.  Employee feedback forms are available for providing feedback on Process Safety Information and other Risk Management elements.   
 
Some examples of active employee participation are listed in this  
section; however, this is not a list of all of the activities that fall under Employee Participation.  Employees regularly participate in two types of Safety Audits; one focuses on facilities, equipment and work practices (the Planned General Inspection), the other focuses on behavior and actions (the Layered Safety Survey).  Both hourly and salaried employees participate on PHA teams.  Operators review and provide input on the adequacy of Operating Procedures.  The current maintenance craft training program was developed by a team of union represented maintenance mechanics and supervisors.  Incident Investigations of more serious incidents are conducted by teams of employees.  Employees participate in Compliance Audits through interviews by audit team members.  Operators are responsible for controlling access of contractors to their process area.  Operators permit all hot work and other safe work practices in their process area.  Specially trained employees comprise the Emergency Resp 
onse teams.   
 
The Employee Participation Program accomplishes employee access to Risk Management Program information through a variety of avenues.  Written programs for the Risk Management Program elements are available from the refinery intranet system.  The Joint Health and Safety Committee meeting minutes are posted on bulletin boards throughout the refinery.  PHA and Incident Investigation findings are discussed in the weekly/monthly safety meetings.  Process Safety Information and Safe Work Procedures are available on any personal computer connected to the refinery computer intranet and in hard copy at strategically selected locations.  Permit Compliance Audits are posted monthly by unit on Bulletin Boards throughout the refinery.  Safety Bulletins are also distributed refinery-wide through the email system.  In addition, any employee can request information regarding the Risk Management Program elements from the Health and Safety Department.   
 
Employee Participation is docu 
mented as part of the implementation of each Risk Management Program element.  Some examples include the following:  The PHA team members are listed in the final report document.  The minutes from the Joint Health and Safety Committee list the members present at the meeting.  The incident investigation forms list the employees involved in the investigation.  Training records for CBT and other methods of training document the information received by employees.  In addition, employee attendance is tracked at weekly/monthly safety meetings and the quarterly Management/Employee Safety Meetings.   
 
 
Process Safety Information 
 
The refinery has written Process Safety Information (PSI) for all Covered Processes.  The purpose of the PSI Program is to develop and maintain accurate information regarding the processes.  This information is available to employees for use in safely evaluating, designing, operating and maintaining the processes.  The PSI program is beneficial to preventing acci 
dental releases because it is used to ensure that safe process decisions are made accounting for potential process hazards.  Personnel use PSI during a process hazard analysis (PHA), writing operating procedures, training operators, planning maintenance jobs and in engineering project design.  PSI that was used in the PHA is retained with the PHA documentation, which is kept for the life of the process.   
 
Process Safety Information has three categories of information:  chemical hazards, process technology and process equipment.  The PSI program addresses the written requirements for chemical hazards by using Material Safety Data Sheets (MSDSs).  The MSDSs contain the required information regarding chemical toxicity, Permissible Exposure Limits (PEL), physical data, corrosivity data, thermal and chemical stability data, reactivity data and the hazardous effects of incompatible mixtures.  In addition to the MSDSs, the refinery has Hazardous Material Warning Sheets (HMWS) prepared for  
each vessel in the refinery.  The HMWS is a one-page summary of the potental chemical hazards from the materials contained within the vessel.  The HMWS highlights the NFPA ratings, warning statements, immediate hazards, first aid treatment, symptoms of exposure and proper Personal Protective Equipment required.  In addition, the HMWS references the full MSDS.   
 
The chemical hazard data was originally compiled by the Industrial Hygienist (IH), who compiled the appropriate MSDSs and entered them into a database.  The IH is responsible for managing the currency and accuracy of the MSDSs.  New chemicals are added to the system through a review process where several departments review the MSDS prior to its addition to the database and prior to the chemical's addition to the process area.  MSDSs are available to employees through the refinery intranet and from the IH.  Back-up copies are available in the Shift Superintendent's office and the IH storage area; this is in addition to the nor 
mal access to electronic copies on the refinery intranet. 
 
The process technology requirements for PSI are addressed by process flow diagrams, written process chemistry, determination of the maximum intended inventory and safe upper and lower limits and an evaluation of the consequences of deviation.  The process flow diagrams are initially developed for each process as part of the process design and installation.  Process flow diagrams are controlled by the Design Group in the Engineering Department.  Any updates to the process flow diagrams are managed through the Management of Change (MOC) process.  Process flow diagrams are available to employees electronically on the refinery intranet or in hard copy form from central locations, including Engineering.  Process chemistry was initially developed by the Subject Matter Coordinators discussed in Operating Procedures.  Safe upper and lower limits for processes and the consequences of deviation were initially established by the Technic 
al Services Engineers.  This information was incorporated into the Operating Procedures.  The process chemistry, upper and lower limits and consequences are reviewed as part of the Operating Procedures.  The Operating Procedures/Manuals are available in all the control rooms.  In addition, Operators can access a database on the upper and lower operating limits of their unit, which contains information regarding consequences of deviation and how to remedy a deviation.  The maximum intended inventory was originally compiled by the Technical Services Engineers and is maintained as part of the Hazardous Materials Business Plan filing that is updated annually. 
 
The process equipment portion of PSI includes information on materials of construction, piping and instrument diagrams (P&IDs), electrical area classification, relief system design and design basis, ventilation system design, design codes and standards, material and energy balances and safety systems.  Information on the materials  
used for a covered process can be found on P&IDs, the original vessel drawings and the original project files.  P&IDs are diagrams that contain all the information required to understand the purpose and operation of the process and strictly represent the process as it exists in the field.  This diagram has information about the process flow, line sizes, specifications, valves, instrumentation, sizes of equipment, pumps, pump flow rates, design pressure and temperature, safety systems, and relief valve size and set pressure.  The electrical area classification can be found on process area maps with boundaries defining the electrical equipment code classifications required in that area.  These classifications are based on the National Electric Code, which details what type of electrical equipment can be used in areas where flammable materials may be present.  A Professional Electrical Engineer determined the electrical classification areas at the refinery.  This information is maintained 
by the Design Group in Engineering; any changes to this information is managed through the MOC process.   
 
Information about the process relief system design and design basis is organized into relief valve folders.  This information was compiled by the Process Engineering Department and is maintained by the Inspection Department.  Each folder contains all the information needed to determine the adequacy of the pressure relief valve for the service it is in.  Ventilation system design refers to ventilation of buildings that have potential for flammable vapor accumulation, such as control rooms, switch houses, etc.  Adequate ventilation is necessary to avoid any vapor build-up.  The design information is included in the original design and construction files on the building.  The design codes and standards used to design and build a process are contained in the original project information.  Material and energy balances are calculated when the process is built and the information is c 
ontained on process flow diagrams.  Safety system information is found on P&IDs and  more detailed instrument loop diagrams.  All this information is managed and maintained by the Design Group or the Inspection Department.  Any necessary changes are managed strictly though the MOC process.  Hard copies of this information are available from several central locations in the refinery.  In addition, the Shift Superintendent has access to all PSI at all times. 
 
The refinery has an Engineering Standards Manual for ensuring that all processes are designed in compliance with applicable codes and standards.  This manual has standard design specifics pertaining to civil and structural, structural steel, concrete, mechanical, piping, electrical, instrumentation, process controls, insulation and coatings, and welding.  Information for designing processes in accordance with good engineering practices is contained within this manual.  All processes must be designed according to the Engineering St 
andards Manual.   
 
Process Hazard Analysis 
 
The purpose of the Process Hazard Analysis (PHA) program is to examine safeguards of known hazards for adequacy and to uncover any previously unidentified hazards.  All Covered Processes have had an initial PHA performed.  All PHAs are performed by teams consisting of personnel with the appropriate knowledge to perform the PHA.  The PHA facilitator is the person knowledgeable in the PHA methodology being used.  The most knowledgeable Operators are used on the PHA teams.  Unit and/or Process Engineers participate as the engineering expertise.  The PHA may require personnel resources from any of the following specialties:  Inspection, Mechanical Engineering, Instrumentation Engineering and Rotating Equipment Engineering.  A scribe takes notes for the team during the PHA.   
 
The primary PHA methodology currently in use is the Hazard and Operability Study (HAZOP) methodology.  The What-If and Checklist methodologies are used to supplement t 
he HAZOP methodology when appropriate.  Complex processing units require the use of more detailed PHA methodology like HAZOP.  A HAZOP is a detailed review of the process in a systematic fashion to determine whether process deviations can lead to undesirable consequences.  Detailed PSI is required to perform a HAZOP, since the review process proceeds line-by-line through the processing unit.  The team lists potential causes and consequences of deviation as well as existing safeguards protecting against the deviation.  When the team finds that an inadequate protection exists for a credible deviation, then recommendations are developed to enhance safeguards.  The What-If methodology is a brainstorming approach about possible undesired events.  It is not as structured as the HAZOP, but allows for process safety concerns to be brought forward in a less rigid approach.  The Checklist methodology consists of a written list of items or procedural steps to verify the status of a system.  Devel 
opment of generic hazard checklists allows this method to be used in combination with other PHA methods.  The use of these three methodologies together increases the probability of discovering hazards.   
 
Each PHA performed systematically examines potential deviations and their consequences.  Examples of some of the deviations examined include:  no flow, less flow, more flow, reverse flow, wrong concentrations, contamination of flow, misdirected flow, low temperature, high temperature, low pressure, high pressure, low levels, high levels, start-up and shutdown, leaks/rupture, mechanical seal damage, exchanger tube leaks, corrosion/erosion, mixing concerns, human factors and instrumentation.  The PHA also reviews other issues such as:  safety/fire protection, emergency response, procedures, loss of utilities, previous incidents, facility siting, human factors, testing and inspection, maintenance and external events (such as earthquakes). During each PHA, a human factors checklist is u 
sed to identify any human factor issues.  The objective of this checklist is to identify and make recommendations to correct any deficiencies in the human/process interface.  This checklist addresses human factors both in the field and the control room.  Examples of some of the items covered include:  the labeling and positioning of valves and other instruments, layout of process controls, clarity of procedures, and emergency equipment locations.  Human errors and equipment malfunction are included as potential sources of deviation considered during the PHA.  A facility siting checklist is used during each PHA to identify any facility siting issues.  This checklist covers a large number of issues including:  equipment spacing, access for maintenance equipment, secondary containment, drainage, emergency egress routes, emergency vehicle access, aircraft warning lights on tall structures, routing of electrical power supply lines, location of redundant supplies for instrument and power, an 
d equipment and instrumentation compliance with electrical area classification.  
 
PHA recommendations are ranked by the PHA team as they develop the findings.  The priority ranking matrix evaluates the severity of the event coupled with its likelihood of occurrence.  For example, a finding ranked as a one would be very severe in worker/public impacts and have a high probability of occurrence.  PHA recommendations are entered into and tracked by a database (the same system as compliance audits and incident investigations).  All PHA recommendations are assigned to a responsible person along with a date of completion.  As part of addressing PHA recommendations, the responsible person must develop a corrective action plan.  This plan is documented on PHA recommendation closure forms.  The forms specify the actions to resolve the PHA finding and the basis for that resolution.  PHAs must be revalidated every five years; the revalidation cycle began in 1997.  Revalidations are performed by  
repeating the entire PHA, including the HAZOP method, on the process.   
 
 
Operating Procedures 
 
The refinery has written Operating Procedures for all Covered Processes.  The purpose of the Operating Procedures Program is to develop, implement and maintain operating procedures that provide clear instructions for safely conducting activities involved with refinery processes.  Operating Procedures are organized into Operating Manuals for each process unit.  Every Operating Manual contains all the process information, engineering data, and reference sources that is required to operate the unit in a safe, efficient, reliable and environmentally sound manner.  The Operating Procedures program is beneficial to preventing accidental releases because the operating procedures are used as a basis for operating units safely and reliably. 
 
The written Operating Manuals were developed from a standard template.  All Operating Manuals follow a consistent format that is divided into six sections 
.  There is an introduction section, a process safety and environmental section, an equipment description section, a process control variable section, a troubleshooting section and a failure prevention section.  In addition, each manual contains information so that the Operator can take appropriate action to safely perform any of the following:  an initial unit start-up, normal operation of the unit, shutdown of the unit during an emergency, operation of the unit during an emergency, a normal shutdown of the unit, a startup after a turn around and a startup after an emergency shutdown.  The Operating Procedures also contain information regarding the consequences of deviating from normal operating parameters and the steps to correct deviations and avoid deviations.  In addition, the Operating Procedures contain information about the process safety systems and how they function.   
 
The initial development of the Operating Procedures involved Operators, Unit Supervisors, Shift Superviso 
rs, and outside Contractors, all of whom are collectively referred to as Subject Matter Coordinators (SMCs).  The SMCs wrote the initial versions of the Operating Procedures.  Review and certification of the Operating Procedures occurs every year.  The Area Supervisor is responsible for the review and certification of their completeness and accuracy.  Operators are typically consulted during this review.  During the Annual Review process, revisions to the Operating Procedures may be warranted.  Any revisions to the Operating Procedures are managed through Management Of Change and operators are trained on the revisions.  Hard copies of Operating Procedures are kept in each control room and at the training center.  In addition, electronic copies are available on the refinery intranet. 
 
The refinery has a permitting program to address the safe work practices involving lockout/tagout, confined space entry, opening process equipment/piping and access of personnel other than operators to t 
he process area.  Hot Work is also addressed by permit, which will be discussed under the Hot Work section.  The permit template was used to address safe work practices so that maintenance work would be planned and performed in a consistently safe manner.  The content of the permit forms is in compliance with Cal-OSHA regulations specific to each of the areas previously mentioned.  The safe work practices and policies are available on the refinery intranet for all employees.  In addition, hard copies of the policies and permits are available in unit control rooms and at the Shift Superintendent's office.  Safe work practices permitting is continuously audited by the Health and Safety Department and the results are posted monthly on bulletin boards refinery-wide for employees to read.  The Field Safety Supervisor manages all changes to the safe work practices and permits.  Employee involvement on development and maintenance of the safe work practices occurs through the Joint Health and  
Safety Committee.  Employees are informed of changes through the weekly/monthly safety meetings, bulletin board postings, email distribution and other appropriate methods. 
 
 
Training 
 
The objective of the Operator training program is to ensure that employees involved in the operation of processes are trained in the tasks and information necessary to safely and effectively perform their work.  The training program is beneficial to preventing accidental releases because it prepares employees to understand the hazards of the process.  
 
Initial Operator Training:   
 
New Operators begin with six weeks of classroom training.  The classroom training covers safety training, reviewing safe work practices, respiratory protection, Personal Protective Equipment (PPE), hearing conservation and the hazard communication program (this program covers how to find and use MSDSs and other portions of PSI).  The new operators are also trained to the First Responder Operations Level as required by  
the HAZWOPER regulations.  This training covers defensive actions in the event of an accidental release.  In addition to the HAZWOPER training, the new Operators also receive Incipient Fire Training.  The curriculum also covers a general introduction to refinery processing, followed by training modules on refinery equipment, including pumps, compressors, heat exchangers, distillation towers, valves, instrumentation, furnaces, boilers, cooling towers and electrical systems.   
 
After the classroom training is complete, new operators begin practical training in the field.  They study the Operating Manual and Operating Procedures specific to the unit on which they are assigned.  They become skilled at the details of their job, including how to perform procedures.  They also learn more about their specific process unit, including its process chemistry.  The new operators learn the operational details covered in the six sections of the unit's Operations Manual, with particular emphasis on  
process control and safety systems.  The process control emphasis is on critical operating limits (COL), the consequences of operating outside the COL and how to bring the unit back under control if it has deviated outside of the COL.  The safety system emphasis focuses on the importance and function of the unit safety systems. 
 
The refinery has several units with state-of-the-art computer controls.  The Operators assigned to computer-controlled units receive additional training on computer simulators.  The simulators allow the operators to practice controlling the process units under a variety of events.  The simulators are a dynamic training tool, they can mimic the entire process unit and show the Operator the consequences of changing variables during process operations.  Some of the unit simulators also perform scenario training.  The scenarios can mimic process upset conditions that would require the operator to safely shut-down the unit and safely restart it.   
 
Upon completi 
on of the initial training, operators are given a written exam and a practical exam.  The written exam covers information specific to the Operations Manual in their unit.  The practical exam addresses the procedures they perform and specific details of their unit.  Finally, the new operator must pass the qualification process, which is similar to an oral exam, where they demonstrate the skills they have learned to be a qualified operator.  This completes the operator's certification of training.   
 
Refresher Operator Training:   
 
Operator refresher training is conducted every three years.  It covers the procedures and operations manual of the specific unit on which the operator is assigned.  As part of their refresher training, operators must pass a written exam and a practical exam in addition to the qualification process.  In addition, each year all employees, including operators, complete CBT modules on many of the topics covered in the initial operator training course.  Under s 
pecial circumstances in 1999, all operators at the refinery repeated the initial operator training and were re-certified in the same manner as described previously under initial operator training.   
 
Training documentation: 
 
The Training Department maintains records on all employee training.  Initial Operator training and refresher training is tracked through a database.  The database is programmed with the required training curriculum for each employee.  Employee training and testing is entered into the database upon its completion; this includes training on CBTs, classroom, as well as any written or verbal test results.  Training records for certain courses or safety meeting attendance are kept in hard copy in a central filing system.   
 
 
Mechanical Integrity 
 
The Mechanical Integrity Program addresses the integrity of process equipment and instrumentation for safe and reliable operations.  The refinery maintenance program covers three types of maintenance:  1) preventative  
and predictive maintenance, 2) routine maintenance (repair), and 3) turnarounds.  Preventative maintenance is performance of equipment inspection and repair based on time and historical knowledge of the equipment.  Predictive maintenance involves utilizing technological methods of inspection to determine equipment condition.  Preventative and predictive maintenance used in combination determine the inspection and repair frequency of equipment at the refinery.  Routine maintenance is the repair of equipment as dictated by predictive maintenance, preventative maintenance and equipment condition.  A turnaround is maintenance of a process unit on a large scale.  A turnaround is the periodic shutdown of a processing unit for cleaning, internal inspection and renewal.  The process unit is opened up and its critical components are inspected and repaired during a turnaround.  The goal of the Mechanical Integrity Program is to eliminate or minimize process chemical releases by maintaining the e 
quipment.   
 
Predictive and Preventative Maintenance 
 
Fixed Equipment: 
 
The Inspection Department has trained inspectors for performing inspections on fixed equipment at the refinery.  Fixed equipment includes, but is not limited to, equipment such as pressure relief systems, fractionators, reactors, separators, drums, strippers, tanks, exchangers, condensers, piping, etc.  The Inspection Department maintains a current list of all fixed equipment, categorized by process, which includes information on the last inspection, next planned inspection and inspection frequency.  Records of all equipment inspection are retained for the life of the equipment.  The Inspection Department also has a written procedures manual, which contains up-to-date written details on how to perform certain inspection techniques used to determine equipment serviceability.  Examples of techniques used by Inspectors include:  visual weld inspection, dry magnetic particle testing, wet fluorescent magnetic part 
icle testing, liquid penetrant examination, Eddy current tube examination, IRIS tube inspection, ultrasonic testing, and radiographic viewing.  The Inspection Manual also details procedures regarding how to perform an inspection for certain pieces of equipment.  Examples include instructions on how to inspect piping, boilers, air receivers, pressure vessels, furnaces, and exchanger tube bundles.  Inspection frequency and methods of inspection are performed according to Industry Codes and Standards and the California State Safety Orders.  The Inspection Procedures are reviewed regularly for accuracy.  Any changes to Inspection Procedures are managed through a revision process for tracking changes.  The Inspection Procedures Manual is available to employees both electronically through a computer shared-drive and in hard copy at their office.   
 
 
 
Rotating Equipment: 
 
The Rotating Equipment Department performs all inspections and repairs on rotating equipment at the refinery.  Rotat 
ing equipment includes pumps, compressors, fans, blowers, turbines, engines, gear boxes, motors, etc.  The rotating equipment group consists of Machinists, Machinery Field Specialists, Vibration Specialists, and Rotating Equipment Engineers.  The Rotating Equipment Department maintains a current list of all rotating equipment that is categorized by type of equipment.  Rotating equipment is inspected and tested using lubrication checks, oil analysis, visual inspections, vibration monitoring and testing mechanical safety devices.  The frequency of these tests and inspections is based upon industry codes and standards as well as type of service.  Inspection records are maintained on file as hard copies.  Vibration records are entered into computer database for tracking.  The Rotating Equipment Department also has a written procedures manual, which contains up-to-date written details on how to perform rotating equipment inspection and tests.  The procedures are reviewed annually and change 
s are tracked through a revision process. 
 
Instrumentation and Electrical Equipment: 
 
The Instrument and Electrical Department (I&E) performs all inspections and repairs on instrumentation and electrical equipment at the refinery.  This type of equipment includes, but is not limited to, transmitters, controllers, control valves, Distributed Control Systems, analyzers, interlocks, relief valves, power distribution systems, motors, alarms, programmable logic controllers.  The I&E group consists of Electricians, Instrument Mechanics, Analyzer Mechanics and Distributed Control System Technicians.  I&E maintains a current list of all electrical equipment and instrumentation.  I&E has 13 programs dedicated to predictive and preventative maintenance of instrumentation and electrical equipment.  The thermographic survey program is an annual performance of the survey to identify any hot spots in the power distribution system in need of repair.  The motor management program addresses motor r 
eliability.  The transformer program includes inspection and testing of transformers.  The UPS/battery program requires quarterly testing of these power sources.  The substation and switching station program addresses inspection and testing of electrical power distribution stations to ensure reliability.  The insulator washing program covers the cleaning of high voltage insulators.  The pole inspection program covers annual inspection of all power poles in the refinery.  The analyzer program covers calibration and testing of analyzers; the results of the tests are tracked by computer to predict maintenance requirements.  The vibration program is performed on motors with the Rotating Equipment Group.  The cathodic protection system is checked through a monthly inspection program.  Control valves are serviced through a control valve management plan, where a flow-scanning system is used to quantify and record the control valve performance.  The relief valve servicing program covers refine 
ry pressure relief systems.  The essential instrument program addresses inspection and repair of critical instrumentation.  In addition, the distributed control system technicians inspect and test the computer systems that control refinery processes.  The test frequencies are specified by instrumentation type and manufacturer specifications.  Inspection and test records are maintained on file and tracked by database.  I&E has written procedures for performing inspections and tests.  These procedures are reviewed regularly; changes are tracked through a revision process.  Due to the rapid technological expansion occurring in instrumentation and digital control systems, I&E personnel review procedures and train more frequently than other Mechanical Integrity areas.   
 
Repair 
 
Routine maintenance of equipment is performed by experienced Craftspeople.  Craft specialties include Boilermakers, Welders, Pipefitters, Exchanger Shop Mechanics, Mechanics, Machinists, Riggers, Carpenters/Buil 
ders, Compressor Mechanics, Valve Mechanics, Instrument Mechanics and Electricians.  Repair is performed on equipment as dictated by predictive maintenance, preventative maintenance and equipment condition.  Operator surveillance during their routine inspections of the units is also used for determining the need for repair on equipment.  Documentation of repairs is developed and maintained in the applicable equipment folders.  The repairs may be performed in maintenance shops or in the field.  The refinery has specialized repair shops for carpenter work, welding, machine work, instrument and electrical repair, and exchanger repair.  Inspectors perform inspections and tests on fixed equipment and maintenance craft personnel perform the repairs.  These repairs are typically performed in the field.  The Maintenance Department has written procedures for repair of equipment.  These procedures are available on the refinery intranet as well as in hard copy.  Rotating equipment is both inspect 
ed and repaired by Rotating Equipment Department personnel.  These repairs may be performed in a shop or in the field by Machinists or Machinery Field Specialists.  The Rotating Equipment Department has written procedures for repair of the equipment.  These procedures are reviewed annually and tracked through a revision process.  I&E repairs electrical equipment, instrumentation and relief valves.  These repairs may be performed in the shop or in the field by the appropriate Craftspeople.  I&E has written procedures for repair of their equipment.  These procedures are regularly reviewed and changes are tracked through a revision process.   
 
Repair work is planned by maintenance planners.  They develop detailed plans for conducting repairs in a safe manner.  Depending upon the scope of work, the proper information and materials are assembled for the repair work to proceed.  In addition, the appropriate safe work permit requirements are identified for the job.  Upon completion, repair  
records for equipment specific repairs are retained in hard copy or tracked by computer database. 
 
Turnaround 
 
A turnaround is maintenance of a process unit on a large scale.  A turnaround is the periodic shutdown of a processing unit for the cleaning, internal inspection and renewal of equipment.  The process unit is opened up and its critical components are inspected and repaired during a turnaround.  Due to the size of the project, turnarounds take 6-24 months of planning.  Three criteria determine the frequency of unit turnarounds; they are the type of unit, the history of the unit and specific government regulations.  Typically, units undergo turnaround every two to five years.  
 
Training 
 
Maintenance Craftsperson Training: 
 
Experienced Journey-level Craftspeople are employed in a number of disciplines to perform maintenance at the refinery.  Craft disciplines include Boilermakers, Welders, Transportation (drivers), Pipefitters, Exchanger Shop Mechanics, Mechanics, Machi 
nists, Vibration Specialists, Riggers, Carpenters/Builders, Compressor Mechanics, Valve Mechanics, Instrument Mechanics and Electricians.  All Craftspeople must pass a written and practical exam to demonstrate their skills prior to hire.  All Craftspeople are trained on the overview of the refinery processes.  On a regular basis, refresher training is performed and conducted in modules.  These training modules may include, but are not limited to:  forklift operations, respirator fit testing, fresh air, blinding, torqueing, hose use/selection, gasket selection, fall protection, lead abatement, asbestos, lock-out/tag-out, hazardous energy, confined space, hot work, repacking valves, rebuilding site glasses, bleeder reamer use, turbine repair, laser alignment of equipment, staging/scaffolding, rigging/crane, highlift, and leak repair.  During the lock-out/tag-out training module, there is an emphasis on understanding the hazardous energy sources.  All Craftspeople must complete an exam at 
the conclusion of each training module.  Vibration Specialists responsible for performing predictive and preventative maintenance on rotating equipment have been certified in their craft by attending in-depth training courses from the Vibration Institute and/or manufacturers' training courses.  Machinists who perform vibration analysis on rotating equipment have received 12 hours of classroom training in addition to field training.  The instrument mechanics and electricians have skills training annually, including a specialized CBT for their craft.  Under special circumstances in 1999, all Maintenance Craftspeople repeated all training modules described above (with the exception of vibration training).   
 
Inspector Training: 
 
Inspectors perform inspections of structures and fixed equipment to insure the safety of personnel and property.  The inspection personnel receive specialized training to assure that they are able to successfully perform their job.  All Inspectors must have f 
ive years experience in operations, welding and/or boilermaker craft.  They must pass a written exam as well as a vision test.  The Inspector initially is trained in a company developed training program involving in-house and off-site training.  The course curriculum is focused on non-destructive testing and equipment visual inspection.  Specific courses may include:  Introduction to non-destructive testing, visual weld inspection, radiation safety and radiographic examination, math and physics for industrial technology, ASME pressure vessel and boiler codes, magnetic particle examination, ultrasonic examination-thickness gauging, color contact penetrant examination, API 510 on pressure vessels, API 570 on piping and API 653 on tanks.  Certification of course completion is performed by written exam.  The Inspector training is compliant with ASNT SNT-TC-1A and API guidelines.  Recertification, as specified in ASNT SNT-TC-1A and API guidelines, occurs every 3 to 5 years depending on the  
method and/or certification.  Inspector training is tracked by the Inspection Department by database, including when training has been completed and refresher training is due.  In addition, hard copies of all Inspector certification are kept on file. 
 
General Safety Refresher Training: 
 
In addition, all Maintenance Craftspeople and Inspectors must complete an annual CBT and classroom training that addresses chemical hazards, the emergency action plan, electrical safety awareness, safe work permitting, PPE, and respiratory protection.  The training records of all maintenance personnel except Inspection, are kept by the Training department.   
 
Quality Assurance: 
 
The quality of maintenance repair work on fixed equipment is verified by Inspectors.  The Inspectors perform or oversee specific tests after the repair is complete to assure that the repair has been performed properly and with appropriate materials.  The nature of the tests used for qualify assurance depends upon the typ 
e of work performed and is typically specified by an Inspector.  To assure the proper material has been used in building or repairing a process, the refinery has a Positive Materials Identification Procedure.  This procedure involves the use of an analyzer capable of identifying metal alloys.  Rotating equipment quality assurance is performed by Supervisors.  They perform visual inspections, pressure testing (where and when applicable) and start-up checks.  In addition, spare parts original manufacturer's number is tracked along with the manufacturer provided documentation (material certification papers) to ensure the right parts have been installed into the proper service.  Instrument and Electrical repair quality is assured by strict use of original equipment manufacturer spare parts.  Repair of relief valves are performed by VR qualified shops, these specialized shops have been certified by a national board to perform work on relief valves.   
 
 
Management of Change 
 
The purpose 
of the Management of Change (MOC) program is to ensure that modifications to processes are properly evaluated and documented with the same degree of scrutiny as the original process design.  Changes to process chemicals, technology, equipment or procedures are managed through the MOC process.  Replacements in kind, which are changes to components that are within current design specifications, are not subject to the MOC program.  Procedure changes are managed through a revision process; the other types of changes listed above proceed through the process described below.  This program is beneficial for release prevention because it provides a process for review of changes and their potential effects prior to their implementation in the process. 
 
Any change that alters the design specification of the process must have a MOC performed.  To assist personnel in recognizing changes that require a MOC, a matrix has been developed that describes the tasks that fall under MOC jurisdiction.  T 
he matrix specifies the level of scrutiny the change should receive; more complex changes receive greater scrutiny for both MOC and Pre Start-up Safety Review (PSSR).  To initiate the process, a MOC form is completed.  This form describes the change, the justification for the change, the level of scrutiny required for the MOC process and PSSR, PHA requirements, and training requirements of personnel.  The design basis for the change must be attached to the form.  The MOC may then be reviewed by any or all of the following disciplines:  Health and Safety, Environmental, or Engineering in the areas of process, mechanical, electrical, instrument control, civil, metallurgy, rotating equipment or design engineering.  The MOC form has sections for personnel in the reviewing disciplines to identify necessary actions to allow this change to occur.  The actions can fall into any of seven areas:  process technology (PSI is included here), equipment/inspection, rotating equipment, instrumentation 
/controls, electrical, unit records and procedures/training.   
 
The Health and Safety Review of the MOC form consists of a checklist that addresses areas of industrial hygiene, emergency response, field safety and regulatory compliance.  The industrial hygiene checklist covers adequacy of PPE and any personnel monitoring, while the emergency response checklist examines the adequacy of the fire protection equipment and emergency response procedures as they pertain to the change.  Field safety covers adequacy of safety showers, eyewash stations and chemical containment.  Regulatory compliance covers the need for any changes to RMP or Hazardous Materials Business Plan due to the MOC.  A PHA is performed on changes of greater complexity because more scrutiny is required on more complex changes.  The Environmental Department also reviews MOCs with a checklist.  Their checklist examines if the change will increase odors, change air emissions or fugitive emissions, impact effluent water qua 
lity, impact groundwater quality, impact any ecological areas, increase hazardous waste generation or require permits. 
 
The MOC is deemed complete when all necessary analysis, work completion, training and document updating has been completed.  Upon completion of the MOC, the Area Supervisor authorizes the completion of the MOC along with the approval of the PHA Coordinator. 
 
Temporary changes are those changes that are expected to exist for a limited period or a change that is being evaluated on a trial basis.  If temporary changes are required, a temporary end date is noted on the MOC form.  At the time of the end of that time, the technical evaluator must confirm that the change has been returned to original conditions, extend the temporary end date, or go through the process to make the change permanent.   
 
Employee training on the change typically takes place at safety meetings or one-on-one meetings with the supervisor.  In addition, control rooms have MOC binders/log for o 
perators to read as part of the shift change routine.  If changes involve procedures, supervisors are responsible for ensuring that their employees are trained and understand the new procedure.  This may involve one-on-one discussions or practical demonstration.  If PSI updates are required, the marked up PSI is given to the Design Group in Engineering.  The Design personnel then verifies the change prior to changing the PSI.  MOC records are retained for at least 5 years for their use in the revalidation of process PHAs. 
 
 
Pre Start-up Safety Reviews 
 
The purpose of the Pre Start-up Safety Review (PSSR) program is for Operations to confirm that elements required for the operation of new processes or changes to processes have been addressed prior to start-up.  The PSSR examines if the facilities have been engineered and constructed in accordance with the design, operating procedures are complete, personnel responsible for operating and maintaining the process have been appropriate 
ly notified or trained and that all applicable documentation is up-to-date and accessible.  The PSSR program is beneficial for accident release prevention because it provides a process for operations to confirm that a new process of modified process is safe to start. 
 
All new processes and changes to a process (MOC) go through the PSSR process.  The complexity of the PSSR review process for MOC items depends on the complexity of the change.  The PSSR process includes:  confirmation that the facilities have been engineered and reviewed per MOC requirements, performance of inspections and tests to verify that construction and installation have been performed according to design specification, confirmation that changes have been communicated to appropriate personnel, confirmation that procedures and other documentation have been prepared and reviewed, confirmation that applicable training has been performed and a confirmation that necessary support and emergency response systems are in  
place.  All new processes and changes to processes must follow the the Engineering Standards Manual; inspections and tests are performed for verification.  Redlined copies of P&IDs are placed in the control room prior to start-up.  All operating, maintenance and emergency response procedures changes must be addressed prior to unit start-up.  Employee training on the change typically takes place at safety meetings or one-on-one meetings with the supervisor.  In addition, control rooms have MOC binders for operators to read as part of the shift change routine.  If changes involve procedures, supervisors are responsible for ensuring that their employees are trained and understand the new procedure.  This may involve one-on-one discussions or practical demonstration.  PSSR records are retained with MOC records.  Any recommendations from the PSSR are tracked through a database.  The Operations Supervisor verifies the completeness of the PSSR and authorizes the start-up.   
 
 
Compliance Au 
dits 
 
The purpose of the Compliance Audit Program is to determine the status and effectiveness of the Risk Management Programs established to meet the regulatory requirements of the Process Safety and Risk Management Regulations.  The Compliance Audit program is beneficial to accidental release prevention because the objective of the program is to assess existing Risk Management Programs and to find ways to improve the programs.   
 
Three Compliance Audits have been conducted since the implementation of OSHA's Process Safety Management Standard.  The audits were conducted in 1995, 1997 and 2000 respectively.  Each audit lasted approximately two to four weeks and reviewed all of the Risk Management Programs.  The Compliance Audit methodology utilized was the Federal OSHA's Program Quality Verification (PQV).  PQV consists of evaluating the program, comparing the quality of the program with others in the industry and finally, verifying the implementation of each program.  PQV is accom 
plished by conducting reviews of records, interviewing employees and conducting field observations.   
 
Compliance Audit team members are chosen based upon their knowledge and experience.  The final team will have members with knowledge and experience in refinery processing, regulatory requirements, and compliance auditing.  Findings from the Compliance Audits are written as a final report.  Corrections of the findings are assigned to personnel in pertinent areas; a date for completion of the action is also assigned.  The findings and their corrective actions are tracked in databases maintained by the Health and Safety department.  (This database system also tracks findings from other types of audits, incident investigations and PHAs.)  Minimally, the last two compliance audits are retained in the filing system. 
 
 
Incident Investigation 
 
The refinery has an Incident Investigation program that establishes uniform procedures for reporting and investigating incidents and near misses 
.  The program focuses on determining the facts surrounding the incident and formulating corrective actions to prevent similar incidents from recurring.  The Incident Investigation program is beneficial to accidental release prevention because corrective actions are generated during investigations to prevent the incident from occurring again. 
 
The Incident Investigation program classifies incidents into three categories, minor, serious and major.  Minor level incidents are investigated by an Area Supervisor using a causal factor approach to determine the cause of the incident.  Serious and major incidents are investigated by multi-disciplinary teams using Root Cause Analysis (RCA) methodology.   
 
All employees have some level of responsibility for the Incident Investigation program.  All employees are required to immediately report incidents and contribute all knowledge of the incident and offer suggestions for use in developing corrective actions.  When an incident or near miss oc 
curs, it is logged into the refinery incident investigation tracking system and is assigned an incident number.  Each event is promptly categorized to ensure the correct level of investigation is initiated in a timely manner.  All incident investigations must be commenced within 48 hours of the incident.  An investigation form is then completed that includes the following information:  a classification of the incident or near miss, date and time of incident, date and time investigation began, CWS level, incident checklist (e.g. type of injury or release), the location of the incident, facts about the incident, information about involved personnel, any immediate actions taken to mitigate hazards, list of corrective actions, and a witness interview form.  For minor investigations, a causal factor checklist is completed to assist in the development of proper corrective actions.   
 
Serious and major level incidents are investigated using RCA methodology.  RCA is an in-depth investigation 
method that determines the underlying causes of an incident.  The investigation involves gathering data by performing site inspections, conducting interviews of involved personnel and emergency responders and reviewing relevant documentation, such as regulations, standards, engineering data and refinery procedures.  This data is then analyzed by converting data to statements of fact vs. supposition, bridging gaps in the data and determining the root causes by using the root cause flow chart.  The root cause flow chart assists in identifying which management systems were causal factors.  The final report from a RCA includes the same incident investigation form as described above as well as a more comprehensive report about the findings from the incident.  The report will describe:  the location of the incident and equipment involved, date and time of incident, date and time investigation began, description of events leading to incident, description of conditions existing at the site pr 
ior to incident, description of how and why incident occurred based on findings, description of emergency response, causal factors and root causes identified, description of the nature and severity of losses suffered and a statement about specificity of incident to this or other processes. 
 
Serious and major level incident investigations are conducted by teams.  Every team must have a member knowledgeable in RCA methodology and an employee knowledgeable in the process involved.  The team leader is appointed by the Incident Steward.  Incident Stewards are the Area Superintendent for minor and serious level investigations and Division Managers for  major investigations.  The team leader is responsible for the overall investigation, including recommendations, and signing the final report.  The Investigation Steward is responsible for authorizing and tracking closure of corrective actions. Serious level incidents require a minimum team size of two members, but must be larger if the natur 
e of the incident requires more expertise on the team.  Team members may be selected from First and Second Line Supervision, Maintenance, Engineering or other technical experts, and the Health and Safety Department.  Major level incidents require a minimum team size of five members, but must be larger if the nature of the incident requires more expertise on the team.  Two of the team members must be hourly employees; one representing the Joint Health and Safety Committee, the other an employee knowledgeable in the process or work involved.  Team members may be selected from Department Superintendents, First and Second Line Supervision, Maintenance, Engineering or other technical experts, and the Health and Safety Department. 
 
Once an incident investigation is completed, the incident investigation form and corrective actions are entered into the incident investigation tracking system.  This database is the same system used for tracking PHA action items and compliance audit findings.   
Each corrective action is assigned to a responsible employee along with a completion date.  Incident Investigations are required to be retained minimally for five years.  Upon completion of the incident investigation, the findings are shared with employees through weekly/monthly safety meetings.   
 
 
Hot Work 
 
The refinery has a written permitting program to address Hot Work.  The purpose of the Hot Work program is to develop and implement consistent hot work practices and precautions to control tasks that may create sources of ignition.  The program also provides consistent planning and authorization of those tasks.  The Hot Work program is beneficial to accidental release prevention because it provides a consistent methodology to address prevention of fires that could potentially result from ignition producing work.   
 
The Hot Work Permitting Program applies to all equipment or tasks capable of generating energy sufficient to ignite flammable/combustible materials, vapors or ga 
sses.  The equipment and tasks are divided into two categories, high energy and low energy. Some of the activities qualifying as low energy include the use of battery operated tools, grinding, chipping concrete and flash photography.  Some of the high energy tasks are gas or electric welding, pre or post weld heat treating, and abrasive blasting on storage tanks.  Whenever possible, employees and contractors are to move the job requiring Hot Work to the shop or weld bay to avoid performing this work in the process area. 
 
Prior to each Hot Work job, a permit must be completed.  The permit requires the following information to be filled out:  the date and time of job start, equipment identification, the type of work to be performed, classification of the hot work as low or high energy, a checklist for site preparation, a checklist for any PPE requirements, a checklist for emergency provisions, and atmospheric testing results.  All permits require the performance of atmospheric tests fo 
r percent oxygen and percent hydrocarbon; the time of the test performance must be clearly documented.  Other types of atmospheric tests may also be required depending upon the nature of the work and process area.  High energy Hot Work also requires the completion of a pre-plan by an Operations Supervisor and Maintenance Supervisor prior to completing the Hot Work permit.  Authorizing signatures for a low energy Hot Work permit include the responsible operator, the head operator, the craftsperson and a fire watch.  For a high energy permit, the responsible operator, the head operator, the craftsperson, the fire watch and the shift supervisor authorize the permit.  These signatures mean that the permit has been reviewed, the proper tests have been performed and that the job site is safe to allow work to proceed.  If additional personnel are required for the job, each of them must also review and sign the permit.  Upon completion of the job, the responsible operator and the craftsperson  
review the site to ensure that it has been left clean and in a safe condition.  Once the Hot Work is complete, copies of the permits are retained for two years. 
 
Hot Work permits are good from the start time listed on the permit until 7 AM.  All permits terminate at 7 AM every morning.  A new permit must be issued if more hot work is needed.  At evening shift change, the permit is suspended until the operator coming on shift has reviewed the permit, reviewed the work site, conducted atmospheric testing and documented their findings on the permit.  If conditions, precautions, work scope, or work procedures change, the Hot Work permit is terminated and a new permit must be issued.  One of the ways to monitor the conditions is with the atmospheric testing required in the Hot Work permit.  In addition, if there is an emergency anywhere in the refinery, all Hot Work must be terminated.   
 
The fire watch is responsible for monitoring the condition of the job site during the performance o 
f Hot Work.  The fire watch wears an identifying vest, has a fire extinguisher, a radio for communication purposes and an air horn to alert personnel to stop work.  The fire watch must be trained in the use of the type of fire extinguisher required for the job.  Fire watches remain at the job site for 30 minutes after the Hot Work is completed. 
 
The Hot Work policies are available on the refinery intranet for all employees.  In addition, hard copies of the policies and permits are available in unit control rooms and from the Shift Superintendent's office.  Hot Work Permits are continuously audited by the Health and Safety Department as part of the safe work practices audit.  The results of this Permit Compliance Audit are posted monthly on bulletin boards refinery-wide for employees to read.  The Field Safety Supervisor manages all changes to the Hot Work policies and permits.  Employee involvement on development and maintenance of the Hot Work policies and permits occurs through the 
Joint Health and Safety Committee.  Employees are informed of changes through the weekly/monthly safety meetings, bulletin board postings and email distribution. 
 
 
Contractors 
 
The refinery has a Contractor program with the objective of hiring competent and knowledgeable contractor employees to perform work safely on refinery processes.  This program applies to all Contractor employees working in process areas.  The Contractor program is beneficial to accidental release prevention because it ensures that contract employees are trained in and practice safe work practices. 
 
Contractors must pass a qualification process prior to hire.  First, the Contractor must complete a pre-qualification package that covers their Worker's Compensation Experience Modification Rate, OSHA 200 Log, compliance with Title 8 CCR Section 3202 (Injury and Illness Prevention Program), drug and alcohol testing program, employee training programs, and Process Safety Programs.  The Contractor then must prov 
ide documentation about these programs during an interview process.  After hire, the Contractor's compliance with Process Safety Management (PSM) and their safety performance at the refinery is periodically audited depending upon the length of the contract.  In addition, the Field Safety Supervisor maintains a safety record for the contractor employees during their employment at the refinery. 
 
Although it is the Contractor's responsibility to train their employees in the process hazards and emergency action plan and to document that training, all contract employees are required to annually attend a safety orientation specific to the refinery.  This class covers the safety policies and procedures, safe work practices, PPE, the permitting program, the meaning of the refinery alarms, the evacuation routes and evacuation gathering locations.  Written exams are administered at the conclusion of the orientation.  Minimally, the attendance records and exams are kept on file for one year. 
 
 
In addition, all contractor employees working in process areas must complete a Bay Area Training Corporation (BATC) class prior to entering the refinery.  The BATC course covers seven areas of worker safety.  In the first two sections, the contract employees learn about Cal-OSHA, Process Safety Management (PSM), refinery equipment, refinery processes and job hazard analyses.  The third course module consists of personal protection practices, including respiratory protection, hearing and eye protection, head, hand and foot protection and fall protection.  Hazard Communication is covered in the fourth module, including how to read a MSDS and material labeling.  Safe work permits are covered in the fifth session such as lock-out/tag-out, confined space entry, hole watch procedures for confined space, electrical hazards, and elevated work on ladders and scaffolds.  The sixth module covers Hot Work permitting including fire watch procedures, and proper use of a fire extinguisher.  Finally, 
the class covers alcohol and substance abuse and testing.  The contract employees must pass a test on these materials prior to completion of the BATC class.  In addition, contractor employees working in lead positions must have passed the refinery safety skills test.  This test was developed in 1998 by a coalition of refinery owners, labor representatives and Contractors to measure the craftsperson's knowledge of certain critical tasks that must be performed properly to ensure safe operation and maintenance of the refinery. 
 
The control of contractors' access to the facility is managed through Security.  Once a Contractor has been hired to work at the refinery, they must submit a list of active employees to Security.  Each contractor employee receives a vehicle placard, which allows them to drive to contractor parking lots.  Contractor employees then must sign-in with the guard at the gate prior to entering the refinery.  
 
The control of contractors to process areas is managed as  
part of the safe work practices as discussed under Operating Procedures.  Operators control all non-operator access to the process area.  All personnel, including contractor and employees, who are not operators, must report to the control room before entering the process area.  The operator reviews the task to be performed with the non-operator employee.  If the task is simple, such as a visual examination of some process equipment, the operator may issue a permit that simply requires the non-operator employee to sign-in and sign-out at the control room.  However, if the task is more involved, it requires pre-planning with the operators and preparation of the appropriate safe work permits (such as Hot Work, Confined Space, Safe Work, etc.)  There are no exceptions. 
 
As part of Federal, State and local regulations, Contractors are required to notify the refinery of any hazards presented by their work or found during their work.  Prior to performance of any tasks, contractor employees  
fill out a checklist (a job hazard analysis) from the Contractor employer that covers performance of the safe work practices covered by the permitting program.  This checklist is kept with the permitting package during the performance of the work.  In addition, accident prevention program cards for contractor employees are available to complete if contractors need to communicate information about hazards to the refinery.  The cards have a checklist that covers unsafe acts as well as unsafe conditions.  The cards also have space for the contractor employee to offer suggestions on how to correct the unsafe act or condition.   
 
 
Five-Year Accident History 
 
The regulation requires a five-year listing of accidents that meet specific criteria listed in the regulation.  This is the list for the refinery.  All corrective actions listed resulting from incident investigations have been fully implemented.  
 
1/21/97 7:41 PM    A pipe ruptured at the Hydrocracker, causing an explosion and fire. 
 The fire and smoke were visible offsite.  One worker fatality occurred and 25 workers were injured.  No offsite injuries occurred.  The wind was out of the South/Southwest at 6 mph.  Approximately four pounds of Hydrogen Sulfide, thirteen pounds of asbestos, nine pounds of hydrocarbon and 1.8 pounds of Sulfuric Acid were released.  The event lasted approximately 5 hours.  No offsite damage was reported; there was considerable equipment damage onsite.  Contra Costa Health Services, the Bay Area Air Quality Management District, the California Office of Emergency Services, the National Response Center, Fish and Game, EPA Region IX and Cal-OSHA were notified of the event as described under the Emergency Response section.  This accident was investigated by Cal-OSHA and Contra Costa Health Services in addition to the refinery's investigation.  A runaway reaction in the Hydrocracker's reactor was the initiating factor.  Failure to recognize that the runaway reaction was occurring was a cont 
ributing factor.  As a result of this accident, the refinery installed an automated shut-down system to prevent temperature excursions, new alarm and control systems were installed, operating procedures were modified related to temperature excursions, operating personnel were re-trained on the behavior of temperature excursions, and operators were trained on unit instrumentation. 
 
8/6/97 3:37PM    A flange failed at the Sulfuric Acid Plant and released Oleum.  An operator was chemically burned on the ear.  The event lasted a few minutes.  The weather conditions are unknown.  Equipment failure was the initiating factor.  The investigation from the incident resulted in several corrective actions including:  increased inspection of gaskets, upgrading flange guards and re-training of maintenance personnel on gasket use.   
 
2/23/99 12:18 PM    Naphtha fire at the 50 Crude Unit during maintenance work on a pipeline.  Four worker fatalities occurred and one worker was seriously injured.  An est 
imated 100 gallons of naphtha was released.  The wind was from the West/Northwest at 3 mph.  The smoke was visible offsite, classifying this as a CWS level 2.  The fire lasted approximately 15 minutes.  No offsite impacts were reported; equipment damage occurred onsite.  Notifications to Contra Costa Health Services, the Bay Area Air Quality Management District, Contra Costa Consolidated Fire District, Contra Costa Office of Emergency Services, Cal-OSHA and the State Lands Commission occurred as described under the Emergency Response section.  Contra Costa Consolidated Fire District participated in the rescue efforts.  In addition to the refinery's investigation, this accident has been investigated by Cal-OSHA, Contra Costa Health Services, and the Chemical Safety Hazard and Investigation Board.  Contra Costa County commissioned A. D. Little to perform a facility safety evaluation as a result of this accident.  The refinery has developed and implemented action plans to address all find 
ings.  Follow up reports have been submitted to Contra Costa Health Services. 
 
3/22/00 12:15 PM    A fire occurred at the Alkylation Unit.  The wind was out of the South/Southeast at four mph.  Two contractor employees were injured.  One received first aid for first degree burns, while the other had first and second degreee burns and a fractured wrist.  The source of the fire appears to be the presence of hydrocarbons in the firewater used to wet down the hot work area.  The hydrocarbon involved was Alkylation reactor effluent, which is a mixture of C3 to C8 olefinic and paraffinic compounds and is liquid under pressure.  The most likely ignition source was a welding spark.  Agencies notified include Contra Costa Health Services, Contra Costa Fire, BAAQMD, Contra Costa Office of Emergency Services and California Office of Emergency Services.  The Fire Brigade was able to immediately suppress the fire.  A RCA Investigation is still currently in progress on this event.   
 
 
Emergency Re 
sponse Program 
 
The emergency response program is described in a written Emergency Response Plan (ERP) and it consists of an emergency response organization, procedures for response and equipment for response.  This program addresses emergency response for fires, explosions, releases of hazardous materials and medical emergencies.  The ERP addresses coordination with local agencies and the public.  The ERP has been prepared in coordination with the local emergency response area plan (the Contra Costa County Hazardous Materials Area Plan) as required by CalARP, RMP and ISO and confirmed that the refinery has the equipment and personnel to support the area plan.  In addition, the ERP contains the refinery's Oil Spill Contingency Plan, Hazardous Waste Contingency Plan and the Spill Prevention Control and Countermeasures Plan as annexes.  The ERP was revised and reissued in August, 2000.  The plan is reviewed on a tri-annual basis to assure that the plan represents the most effective app 
roach for protecting workers, the public and the environment.  However, the ERP may be revised more frequently if any of following activities indicate the need for a change:  applicable federal, state or local regulatory changes, the ERP fails in an emergency, significant changes in facility operation occurs, the emergency contact list changes, changes occur in emergency response equipment or procedures, or a review reveals a deficiency in the ERP. 
 
Notification: 
 
In the event of a serious fire, explosion, hazardous material release, or medical emergency, employees or contractors call 2222 and report the nature of the emergency to Security Control.  Security Control will then sound emergency alarms, activate emergency call-outs, and issue advisory pages and announcements over the refinery radios, in plant voice pagers and the refinery public address system.  The refinery-wide horn is sounded for emergencies that require a facility-wide response. Employees are alerted when this horn 
sounds four long blasts.  (The refinery-wide horn is actually five horns sounded simultaneously.)  Immediately following the horn, Security Control announces the nature of the emergency over the refinery-wide announcing system.  Security Control also pages the appropriate emergency response groups.  For emergencies isolated to a single process unit, the unit horn will sound six short blasts.  Two short blasts on the horn indicate an "All Clear".  The Chemical Plant has supplementary signals in addition to the refinery's signals.  The supplemental signals include one continuous blast indicating an emergency, a series of short blasts indicating the need for evacuation of the plant, a series of "wow-wow-wow" blasts indicating a Hydrogen Sulfide release and a long-short-long blast indicating an "All Clear".   
 
The emergency action plan requirements are included in the Emergency Response Plan.  It describes employee actions for the evacuation of process areas.  If any of the emergency al 
erts are sounded, workers have been instructed to immediately stop work, shut down any ignition sources, and proceed to a designated employee gathering area.  Emergencies requiring employee evacuation will have an evacuation announcement immediately following the alert.  Employees then proceed to designated evacuation areas where they are counted.  All employees receive initial training on emergency actions via a safety orientation when they are hired.  In addition, every year employees receive refresher training on this subject annually.  All Contractor employees receive initial training and annual refresher training in this area as well.  The emergency alarms for employees are regularly tested.  The refinery-wide horn is used, sounding one long blast, every day at 7:00 AM, 11:00 AM, 11:30 AM and 3:30 PM as part of clocking the workday.  The horn is formally tested with four blasts on the first Wednesday of the month at 11:00 AM, concurrently with the Community Warning System (CWS) si 
rens.  The Chemical Plant whistle is tested every Friday at noon.  In addition, testing of the paging system occurs every Monday at 7 PM. 
 
Depending upon the nature of the emergency, the Shift Superintendent (the Initial Incident Commander) will immediately activate the Community Warning System (CWS).  The activation of the CWS for a Level 3 event will sound sirens, activate the County's Community Alert Network (CAN) phone system, and send preprogrammed advisories to the news media and regulatory agencies.  The CWS Sirens are used to alert the public to an event at the refinery for which Shelter-In-Place is recommended; the public should listen to TV and radio broadcasts for further instructions.  The refinery has been assigned four CAN zones for calling local residences and businesses.  When activated, the CAN phone system will call residents and businesses in the specified CAN zone with a recorded message about the event and how to Shelter-In-Place.  
 
The Initial IC is responsibl 
e for immediately notifying the following agencies:  Contra Costa Health Services (CCHS), Bay Area Air Quality Management District (BAAQMD), Contra Costa County Office of Emergency Services (CCCOES), and the Contra Costa Fire District about the emergency.  As part of that notification, the Initial IC will inform the agencies about the CWS level established for the emergency.  Additional agency notifications by facility personnel may be made depending upon the nature of the emergency to the following agencies:  Cal-OSHA, California Department of Fish and Game, California Highway Patrol, Concord Police Department, Contra Costa County Sheriff, Department of Toxic Substances Control, Martinez Police Department, National Response Center, Regional Water Quality Control Board, State Fire Marshall, State Lands Commission, State Office of Emergency Services, U.S. Coast Guard, U.S. EPA, and U.S. Fish and Wildlife Service. 
 
If ambulance transport is required during the emergency, Security Contr 
ol will call American Medical Response (AMR) or an Air Ambulance Service, CalSTAR or REACH.  Security Control has the direct phone numbers for these organizations.  Upon arrival of the ambulance, the paramedics will be given an informational package, which includes a copy of the MSDS if the transported person was exposed to any chemicals.  An employee will accompany the transported person to the hospital.   
 
Organization and Response: 
 
The refinery has implemented an Incident Command System (ICS) to ensure effective, well-organized and adequately staffed emergency responses utilizing the emergency response teams and emergency response equipment.  Initially in an emergency, the Shift Superintendent assumes control as the initial Incident Commander (IC) and site control is established to limit access to the area involved in the emergency.  Depending upon the nature and extent of the emergency, Incident Command may be transferred to the Emergency Operation Center (EOC).  EOC is staffe 
d with supervisory personnel to fill the following positions as needed for the emergency:  Incident Commander, Safety Officer, Information Officer, Liaison Officer, Legal Affairs Officer, Industrial Hygienist, Operations Section, Planning Section, Logistics Section and Finance Section.  The role of these personnel is to command the response and provide support to the emergency response personnel in the field.  The emergency response personnel respond to and actively mitigate the emergency situation to bring it under control.   
 
The emergency responders are organized, trained, and capable of responding to fires, explosions, hazardous material releases, emergency medical situations and rescues.  There are two principal emergency response teams, the Fire Brigade and the Oil Spill Response Team.  Subteams of the Fire Brigade makeup the HazMat team, EMT team and Rescue team.  Every year, members of the Fire Brigade attend a week-long industrial fire-fighting course at the University of Ne 
vada, Reno-Fire Science Academy (UNR-FSA) in Elko.  This course covers basic fire-fighting principles, ICS, proper protective equipment including use of a Self Contained Breathing Apparatus (SCBA), safety, teamwork, communication, basic hose handling, rescue training, water management and use of effective streams, emergency response vehicles, industrial fire fighting, structure/building emergencies and fire/rescue in a flare area.  Course attendees also practice putting out industrial fires on training structures.  In addition, the fire brigade conducts three hours of refresher training every month at the refinery.  The training can be one of twenty training modules, including topics such as protective equipment, behavior of fire, fire system pumps, hose handling, SCBA, CPR, First Aid, Foam, Wildland Fire Fighting, HazMat and Rescue.  For the fire school class and the monthly training modules, Fire Brigade members demonstrate competency by both written and practical exams.  In addition 
to the Fire Brigade training, HazMat team members receive additional training, including a 40 hour HAZWOPER class and additional monthly training specific to their area.  The EMTs are certified through a State program and attend bi-monthly training as required by the State certification program.  In addition to the Fire Brigade training, the Rescue team members receive an eighty hour class on rescue training and have additional monthly training specific to their area.   
 
The emergency response teams have a variety of emergency response equipment to use in responding to an emergency.  Fixed fire protection systems are located throughout the refinery and consist of deliniated pumps and water supplies, water canons, and deluge/spray systems.  Some of the mobile fire fighting equipment available includes:  two fire engines capable of pumping water and foam, a truck with aerial pumping capability, a brush fire pumper, two "super-pumpers" capable of pumping larger volumes of foam and wate 
r, a "quick attack" vehicle, a trailer with additional SCBA units and a HazMat trailer with protective equipment including Level A suits.  In addition, all process areas have eye wash stations, safety showers, fire extinguishers, SCBAs, first aid kits and blankets.  Emergency response equipment is inspected and testing monthly by the Fire Marshals.  Fire truck pumps and stationary pumps are performance tested annually for flow rates.   
 
Permanent gas detectors for Hydrogen Sulfide and Ammonia are located in the relevant process areas.  In addition, there are Ground Level Monitors (GLMs), required by BAAQMD, for Hydrogen Sulfide and Sulfur Dioxide.  There are three monitors for each chemical in four different potential downwind locations. During an emergency, refinery personnel can be dispatched to perform real time monitoring of the community for any of the following:  Hydrogen Sulfide, Ammonia, Sulfuric Acid, Sulfur Dioxide, respirable size particulate matter, and total hydrocarbon  
concentration.  Summa canisters may be used to collect airborne samples if desired.  The refinery may also dispatch the Odor Science and Engineering Contractor to determine if any odors are occurring offsite. 
 
Coordination 
 
The refinery is an active member of CAER.  CAER is a nonprofit group comprised of industry, agency and community members that are dedicated to a safe and informed public.  CAER's core objectives are safe industrial facility operations, coordinated emergency response, providing an effective safety sharing forum and development of a trust-based relationship with the community.  CAER has several committees under its charter to accomplish these objectives.  The committees are:  personal safety, process safety, community outreach, emergency notification, emergency response preparedness and drill coordination, Petrochemical Mutual Aid Organization, and Industrial Hygiene.   
 
As part of CAER, the refinery participated in the development of the Community Warning Syste 
m, a system to alert and inform the public about accidental releases of hazardous material.  Refinery personnel participated in the initial CWS education of the public about the CWS and Shelter-in-Place.  The refinery continues to be an active partner in the use of the CWS in order to provide early notification to neighboring communities about incidents that have the potential for offsite impacts.   
 
The Ultramar Golden Eagle Refinery is a member of CAER's Petrochemical Mutual Aid Organization (PMAO) committee.  PMAO is an organization of industrial facilities and public agencies that focus on mutual aid response to emergencies.  The members of PMAO provide assistance (material and equipment) to any member requiring aid during an emergency situation.  The refinery may request assistance from PMAO during an emergency or may be part of a response at another facility as part of PMAO.  PMAO membership includes:  Ultramar, Tosco Rodeo, DOW Chemical, Chevron Refining, Huntway Refining, Mar 
tinez Refining Company-Equilon, Rhodia, Exxon, Kemwater, and Shore Terminals.  Agencies, including Contra Costa Health Services (CCHS), Rodeo/Hercules Fire Department, Contra Costa Emergency Medical Services (EMS), Contra Costa Fire Protection District, American Medical Response (AMR), U.S. Coast Guard, and the Richmond Fire Department also attend PMAO meetings.  PMAO is dispatched through the Chevron Refinery Fire Department or DOW Chemical.   
 
 
 
Page 30
Click to return to beginning