On November 1 through November 4, 2016, representatives from the U.S. Environmental Protection Agency (“EPA”) Region IX conducted an inspection of the XXXXXXXX refinery. EPA’s inspection was conducted to determine compliance with the Risk Management Program (“RMP”) promulgated under Section 112(r)(7) of the Clean Air Act (“CAA”‘), and the General Duty Clause under Section 112(r)(l) of the CAA. The inspection primarily focused on three principal elements of the RMP:
- the Management System used by the facility to implement the RMP;
- the supporting documentation for Off-site Consequence Analyses (“OCA”); and
- the operation of the Hydrofluoric Acid (“HF”) Alkylation Unit including targeted Piping and Instrumentation Diagram (P&ID) field verifications of process and safety equipment within the unit.
A summary of the inspection findings is provided herein for your information and response. These findings describe conditions observed at the facility at the time of the inspection and subsequently provided in the the facility’s document submittals dated November 4 and November 23, 2016, for potential areas of noncompliance with CAA RMP regulations as set forth in 40 C.F.R. Part 68 and the General Duty Clause under Section 112(r)(l) of the CAA. Any omissions in the report shall not be construed as a determination of compliance with those portions of 40 C.F.R. Part 68 or any other applicable regulations.
With this letter and its enclosure (“Findings and Information Request”), EPA seeks additional information and documents concerning compliance with Section 112(r) of the CAA and the regulations thereunder at 40 C.F.R. Part 68. This information Request is authorized pursuant to Section 114 of the CAA, 42 U.S.C. § 7414.
Notice of Inspection Findings
This summary of inspection findings describes conditions observed at the Facility at the time of the inspection combined with reviews of documentation and identifies potential areas of noncompliance with CAA RMP regulations as set forth in 40 C.F.R. Part 68 and the General Duty Clause under Section 112(r)(l) of the CAA. Any omissions below shall not be construed as a determination of compliance with those portions of 40 C.F.R. Part 68 or any other applicable regulations.
Chemical Accident Prevention Provisions. 40 C.F.R. Part 68, Subpart A – General
1. Management – 40 CFR § 68.lS(a): The owner or operator of a stationary source with processes subject to Program 2 or Program 3 shall develop a management system to oversee the implementation of the risk management program elements.
Based on interviews and the review of related documents, the facility’s RMP management system does not appear to be sufficiently defined or cohesively structured to fulfill adequate oversight and implementation of the Risk Management Program.
At the time of the inspection, the facility’s overall management structure was different from that of its prior owner. New positions, such as the addition of a Reliability Department Manager, are substantively different than the management system as it appears in the RMP, and therefore does not reflect the facility’s implementation of the RMP elements. Furthermore, a Management of Organizational Change or similar analysis was not conducted to ensure that Risk Management and process safety responsibilities for changing positions was not lost during the transition, or are accurately reflected in the RMP.
According to the Facility Manager, at the time of the inspection, the facility had several different RMP management system document sources including: pre-existing [prior owner] RMP and process safety information; RMP related documents purchased from another refiner; and the facility’s own specific policies and procedures. The facility offered no schedule or plan for the consolidation, transition, harmonization or implementation of these various components of its RMP. The result is a stated management system that appears superficial and does not sufficiently describe the facility’s actual management system structure.
2. Management – 40 CFR § 68.15(c): When responsibility for implementing individual requirements of this part is assigned to persons other than the person identified under paragraph (b) of this section, the names or positions of these people shall be documented and the lines of authority defined through an organization chart or similar document.
Based on the inspection team’s review, the facility did not document each individual responsible for implementing the elements of the RMP. For example, the facility’s August 1, 2016 RMP update identified XXXXXXXXX XXXXXXXXXXX, Safety Engineer, as the person responsible for Part 68 implementation. However, during the inspection, several different facility representatives were identified as having the responsibility for implementing RMP elements. The facility did not offer an organizational chart that correctly identified this matrix of responsibilities as required by this subpart.
Chemical Accident Prevention Provisions, 40 C.F.R. Part 68. Subpart B – Hazard Assessment
3. Worst Case Release Scenario Analysis- 40 C.F.R. § 68.25(b)(1): For substances in a vessel, [The worst-case release quantity shall be the …] greatest amount held in a single vessel, talking into account administrative controls that limit the maximum quantity.
Based on the inspection team’s review of the OCA supporting documentation, the facility did not accurately determine and subsequently use the worst-case release quantity of hydrofluoric acid in the toxic Worst Case Scenario analysis (“WCS”). Errors in several independent elements have the potential to impact the actual maximum quantity that should be used in the OCA and subsequently the predicted offsite consequence. For example:
a. The facility identifies that the WCS toxic determination includes administrative control on the fill level for each acid settler. The facility represents that an administrative level corresponds to the RMP reported vessel amount. However, at the time of the inspection, Acid Settler #2 was observed to be at a height exceeding the stated administrative control level.
Additional review of on-site logs indicates that the Acid Settler level was regularly at a height exceeding the administrative control level and on at least one occasion significantly higher (October 9, 2016). If the acid settler operates at a higher level than the RMP OCA documentation identified administrative control level, the administrative control is not functioning to limit the maximum quantity in the vessel, and the release quantity used for calculation of the toxic WCS must be correspondingly higher. As such the reported settler quantity used in the modeling appears to be inaccurate.
b. Toxic WCS calculations identify the quantity of HF in each acid settler. The quantity of HF in the acid storage vessel is identified to be more than the quantity in each acid settler. For the purposes of the WCS OCA, the facility selected the volume in a single acid settler as the largest “single vessel” in the calculation. However, the quantity of HF reported in the facility’s most recent RMP, and used to determine the WCS, is only 5,200 pounds, and not the higher volume contained in either acid settler.
The RMP identifies “release barriers and modified HF catalyst” as passive mitigation considered. The facility subsequently used the described passive mitigation as justification for reducing the amount of HF in the WCS calculations to an HF equivalent. Such an approach is not consistent with the regulatory requirements found in 40 C.F.R. § 68.25(b) as described above.
Furthermore, the acid storage vessel quantity that the facility used is larger than the quantity in the settler.
c. According to the facility, to keep the modified HF catalyst at the appropriate percentage in the alkylation process, makeup or separated catalyst must be mechanically pumped into the process. The facility subsequently claims that the HF modification process serves as passive mitigation. However, based on inspection team review this does not appear to be the case. The definition of mitigation, from 40 C.F.R. § 68.3, is as follows:
Mitigation or mitigation system means specific activities, technologies, or equipment designed or deployed to capture or control substances upon loss of containment to minimize exposure of the public or the environment. Passive mitigation means equipment, devices, or technologies that function without human, mechanical, or other energy input. Active mitigation means equipment, devices, or technologies that need human, mechanical, or other energy input to function.
Based on this definition, mechanically pumping and monitoring modified HF catalyst quantities, levels, or percentages is not passive mitigation, as it requires human, mechanical or other energy input to function. EPA has previously addressed the issue of using an acid aerosol reducing additive as passive mitigation, which can be found at: https://emergencymanagement.zendesk.com/hc/en-us/articles/211413968-Acid-aerosol-reducingadditive-as-passive-mitigation
d. The inspection team observed that the facility used EPA’s RMP*Comp model to determine the WCS endpoint. In that determination, the facility appears to have erroneously selected a percentage of hydrofluoric acid as the modeling chemical instead of selecting anhydrous hydrofluoric acid. Such an error reduces the accuracy of the model and is an incorrect application. The issue is further confused by the facility’s selection of an endpoint of 3.2 miles for which they offer no clear basis.
4. Worst Case Release Scenario Analysis – 40 C.F.R. § 68.25(a)(2)(iii): Additional worst-case release scenarios for a hazard class if a worst-case release from another covered process at the stationary source potentially affects public receptors different from those potentially affected by the worst-case release scenario developed under paragraphs (a)(2)(i) or (a)(2)(ii) of this section.
Inspection team members evaluated documents and maps related to all of the facility’s RMP regulated processes. Based on those reviews the facility did not report a WCS for the railcars that are filled and staged at the northwest corner of the facility. The flammable WCS for a staged railcar affects different receptors than the reported flammable WCS. Following EPA’s review, it appears that the facility incorrectly determined that no additional offsite receptors are impacted by railcar OCA results.
5. Worst Case Release Scenario Analysis – 40 C.F.R. § 68.30(a): The owner or operator shall estimate in the RMP the population within a circle with its center at the point of the release and a radius determined by the distance to the endpoint defined in §68.22(a).
Based on a review of documents, it appears that the facility did not correctly identify the center point location of the butane storage sphere, which is identified as the flammable WCS. As a result, the OCA does not accurately identify the off-site receptors and affected population.
Chemical Accident Prevention Provisions. 40 C.F.R. Part 68, Subpart D – Program 3 Prevention Program
6. Process Safety Information – 40 C.F.R. § 68.65(d)(1)(ii): Piping and instrument diagrams (P&ID’s)
The facility did not adequately identify instrumentation, piping, and valve configurations on P&IDs. During the inspection, it was observed that P&ID 05A0106D01, rev. 19 did not match the equipment in the field. For example, two pressure indicators and manual valves were not listed on the P&IDs.
7. Process Safety Information – 40 C.F.R. § 68.65(d)(1)(vi): Design codes and standards employed
During the field inspection of the HF Alkylation Unit, pressure vessel DSC-31 was inspected to determine if nameplates were present and if the information on the nameplates were accurate. Review of the nameplate information affixed to vessel DSC-31 found no National Board Inspection Code (NBIC) nameplate affixed to the vessel for the replacement of a leaking vessel nozzle in May 2016. Section 5.7.2(c) of the NBIC Part 3, Section 5.7.2 (Stamping Requirements for Repairs) requires the stamping or nameplate be applied adjacent to the original or manufacturers nameplate for repairs to pressure vessels and that the stamping or nameplate includes the date of the repair that corresponds with the date on associated Form R-1.
8. Operating Procedures – 40 C.F.R. § 68.69(a): The owner or operator shall develop and implement written operating procedures that provide clear instructions for safely conducting activities involved in each covered process consistent with the process safety information and shall address at least the following elements.
Based on a review of documents, the facility did not fully implement its operating procedures to safely conduct HF-related activities, including but not limited to the unloading of HF. For example, the facility did not produce completed and signed operating procedures for the four unloadings of HF from July 30, 2016 through September 2, 2016. In other instances, operating procedures were observed to not be completely signed off as required and did not include a justification or explanation for why certain steps were incomplete.
In some instances, safeguards such as fire water monitor systems, safety shower alarms and cameras were identified in handover logs as not working during HF unloading. The facility documentation did not identify any alternate safeguards or changes to the procedures on these occasions.
9. Operating Procedures – 40 C.F.R. § 68.69(a)(1)(iv): Emergency shutdown including the conditions under which emergency shutdown is required, and the assignment of shutdown responsibility to qualified operators to ensure that emergency shutdown is executed in a safe and timely manner.
At the time of the inspection, the emergency operating procedure OM-05-306, available in the control room, did not clearly indicate who is involved with completing the steps, specifically the assignment of shutdown responsibility to qualified operators to ensure that emergency shutdown is executed in a safe and timely manner.
10. Operating Procedures – 40 C.F.R. § 68.69(a)(2)(i) – (ii): Consequences of deviation; and steps required to correct or avoid deviation.
The facility did not include operating limits within operating procedure OM-05-005 for the unloading of HF to SC-31. Several steps in the operating procedure include specific direction, but there are no operating limits identifying what is otherwise acceptable, nor are there any steps required to correct or avoid deviation.
11. Mechanical Integrity – 40 CFR § 68.73(d)(3): The frequency of inspections and tests of process equipment shall be consistent with applicable manufacturers’ recommendations and good engineering practices, and more frequently if determined to be necessary by prior operating experience.
In a number of instances, the facility did not test critical safety systems, including pushbutton water deluge systems and critical electrical equipment within the HF Alkylation Unit, at the identified frequency documented on the list of critical safety systems for the Alkylation unit.
12. Mechanical Integrity – 40 CFR § 68.73(e): The owner or operator shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in §68.65) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.
The facility did not correct deficiencies in equipment that were identified as being outside of an acceptable operating range in a safe and timely manner. Safety systems and equipment within the Alkylation unit were identified as being non-operational on a recurring basis. Some were not fixed for multiple weeks,
even those identified as safeguards.
CLICK HERE for the “Letter”