Citgo Petroleum Corporation

Read the official release (oshrc.gov)

Plain-English summary

Citgo employees isolated a refinery pump for contractor maintenance, but an obstructed valve remained partly open and hydrocarbons escaped before a fire caused extensive property damage. OSHA cited Citgo because its written lockout/tagout procedures did not specify how employees should test and verify each energy-control point. The judge found that broad instructions and extensive employee training were insufficient for a complex process involving multiple energy sources and eleven isolation points. Citgo had withdrawn its contest to the other citation item, and the judge affirmed the litigated item as serious. Both items were affirmed with penalties totaling $14,000.

Decision snapshot

• Cited standard(s): 29 C.F.R. § 1910.147(c)(4)(ii)(D)
• Outcome: Both serious citation items affirmed; $14,000 total penalty assessed.
• Key point: Complex lockout work requires written, job-specific verification steps; training and general procedures do not replace that documentation.

Full text (OSHRC public release)

                       United States of America
       OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION

SECRETARY OF LABOR,

                     Complainant,                                OSHRC Docket No. 14-0404

                             v.

CITGO PETROLEUM CORPORATION,

                     Respondent.

Appearances:

    Elizabeth K. Arumilli, Esq., U.S. Department of Labor, Office of the Solicitor, Chicago, Illinois,
         For Complainant

    Dennis Morikawa, Esq., Morgan, Lewis & Bockius LLP, Philadelphia, Pennsylvania 1
        For Respondent

Before: Administrative Law Judge Peggy S. Ball

                                    DECISION AND ORDER


I. Procedural History

    This proceeding is before the Occupational Safety and Health Review Commission (“the

Commission”) under section 10(c) of the Occupational Safety and Health Act of 1970, 29 U.S.C.

§ 659(c) (“the Act”). In response to a fire in Respondent’s crude oil unit, the Occupational

Safety and Health Administration (“OSHA”) conducted an inspection of Respondent’s Lemont

Refinery in Lemont, Illinois on October 24, 2013. (Tr. 10). The fire broke out after

hydrocarbons leaked into the air during the removal of a pump. (Tr. 60; Ex. C-1). OSHA issued

1. At trial Respondent was represented by Nina G. Stillman, with the firm of Scharf Banks Marmor, LLC in
   Chicago, Illinois. On September 30, 2015, the Court received notice that Ms. Stillman withdrew as counsel and that
   Dennis Morikawa would serve as counsel for Respondent.
   a Citation and Notification of Penalty (“Citation”) to Respondent alleging two serious violations

and a proposed penalty of $14,000.00. As noted in the parties’ Joint Stipulations, which are

reproduced below, Respondent withdrew its Notice of Contest as to Item 1 of the Citation. Thus,

the only item under consideration is Citation 1, Item 2, and its associated penalty of $7,000.00.

Respondent timely contested the Citation.

      The trial took place on April 29–30, 2015, in Chicago, Illinois. Five witnesses testified at

trial: (1) James Tancredi, Respondent’s manager of Health, Safety, Security, and Environment

(HSSE); (2) Compliance Safety and Health Officer (“CSHO”) Mark Blackmore; (3) Walt

Siegfried, Complainant’s expert; (4) Ray Hill, HSSE Manager for Respondent’s St. Charles,

Louisiana refinery; and (5) Ray Boutte, Respondent’s Process Safety Management (“PSM”)

Coordinator. Both parties timely submitted post-trial briefs. After reviewing the parties’

arguments and the record, the Court issues the following Decision and Order.

II.      Stipulations 2

      The parties stipulated to the following:

1. Jurisdiction of this proceeding is conferred upon this Occupational Safety and Health

Review Commission by section 10(c) of the Occupational Safety and Health Act.

2. Respondent is, and at all relevant times was, a business, with an office and place of

business at 135th & New Avenue in Lemont, Illinois, and at all relevant times, it was engaged in

petroleum refining and other related activities.

3. Respondent at all relevant times had a worksite and was engaged in petroleum refining

and other related activities at 135th & New Avenue, Lemont, Illinois.

2. The parties’ stipulations can be found in the parties’ Joint Stipulation Statement, which was filed with the Court
   on May 15, 2015. These stipulations were read in open court and can be found on page 10–11 of the transcript.

                                                    2
   

   4. Respondent, at all relevant times, was engaged in a business affecting interstate

commerce in that Respondent was engaged in handling goods or materials which had been

moved in interstate commerce.

5. Respondent at all relevant times was an employer employing employees in said business

at the aforesaid worksite.

6. Respondent does not contest Item 1 of the Citation and Notification of Penalty.

7. Under 29 C.F.R. § 1910.147(a)(1) the regulations found in 29 C.F.R. § 1910.147 apply to

the removal of the 11GT-9A Vacuum Tower Bottoms pump that was the subject of Citation 1,

Item 2 of the citations.

III. Jurisdiction

      As noted in the previous section, the parties have stipulated that the Commission has

jurisdiction over this proceeding and that Respondent was an employer engaged in a business

affecting commerce within the meaning of § 3(5) of the Act, 29 U.S.C. § 652(5). Slingluff v.

OSHRC, 425 F.3d 861 (10th Cir. 2005).

IV. Factual Background

      The scope of the case at bar is rather narrow—whether Respondent’s LOTO procedures

comply with the requirements of 29 C.F.R. § 1910.147(c)(4)(ii)(D). That standard requires that

an employer’s LOTO program contain “[s]pecific requirements for testing a machine or

equipment to determine and verify effectiveness of lockout devices, tagout devices and other

energy control measures.” 29 C.F.R. § 1910.147(c)(4)(ii)(D). The cited standard governs just

one step in what is otherwise a comprehensive regulatory scheme for the control of hazardous

energy. Although the Court’s focus is narrow, it is important to understand the context in which

the alleged violation occurred and the import of this particular step to the LOTO process. Based

                                            3

on the following facts and subsequent Discussion, the Court finds that Respondent violated the

standard

         A. The Accident

     On October 23, 2013, employees at Respondent’s Lemont Refinery were in the process

of removing the 11GT-9A Vacuum Tower Bottoms pump (“VTB pump”) from the crude oil unit

in order to allow a contractor, Starcon, to perform maintenance. 3 (Tr. 78). This process required

Respondent’s employees to isolate the pump from all surrounding sources of stored, hazardous

energy before custody of the equipment was handed over to Starcon. (Tr. 50, 236–37). After

custody of the equipment was handed over to Starcon and work began on the pump, a leak was

discovered. (Tr. 60). According to Respondent’s internal investigation, a ten-inch discharge

valve had not been fully closed due to an internal obstruction. (Ex. C-1 at 19–21). This partially

opened valve allowed flammable hydrocarbons to continue flowing into the system, which

Respondent believed had been isolated. (Id.). Approximately 30 minutes later, the leaked

material ignited, which caused a fire that resulted in approximately $320 million dollars in

damage to the refinery. (Tr. 60). Fortunately, employees and contractors had been evacuated

from the area before the fire began.

     On October 24, 2013, Complainant sent CSHO Blakemore to the refinery to conduct an

inspection. During the course of his inspection, CSHO Blakemore conducted interviews of

management and employees, reviewed Respondent’s policies and procedures, and performed a

walk-around of the crude oil unit. (Tr. 75–76). Based on his review of Respondent’s lock-

out/tag-out (LOTO) policy, as well as other interrelated policies, CSHO Blakemore determined

Respondent did not have adequate procedures for verifying effective isolation while performing

3. Vacuum Tower Bottoms is a fuel product that is created in the crude oil unit. (Tr. 65).

                                                     4
   

   LOTO. As a result of his findings, Complainant determined that Respondent had violated 29

C.F.R. § 1910.147(c)(4)(ii)(D).

       B. Respondent’s LOTO Program

   As testified to by Tancredi and Boutte, a LOTO program governing process equipment,

such as that found in a refinery, will necessarily look different from a LOTO program for fixed

pieces of equipment such as those found in a manufacturing warehouse. (Tr. 272–74, 365–66).

Just as the name implies, the procedures applicable to lock-out of a particular fixed piece of

equipment will not vary to any significant degree. With respect to a refinery such as

Respondent’s, however, the procedures for LOTO will vary depending upon the scope of the

work, the equipment, and the sources and types of energy involved. Due to this variability,

Respondent’s LOTO program relies upon extensive training, generally applicable procedures,

and safe work permits, which allow for the customization of LOTO procedures to a particular

job. (Exs. J-1 to J-7, C-1, R-1, R-2).

   The primary document governing Respondent’s LOTO program is called Safe Practice

Standard (SPS) No. 2, “Control of Hazardous Energy Standard”. (Ex. J-1; Tr. 282–83). This

SPS sets forth the requirements for conducting LOTO such that the equipment operator can

transfer custody/control of the equipment to a craftsman or maintenance person to perform

upkeep or replacement of a component (Ex. J-1). According to Respondent, the first step in this

process is to identify the scope of the work, which, in this instance, was removing the VTB

pump. (Tr. 275–76). Once that was delineated, the equipment operator prepared what is known

as an “isolation list”, which set out the description and location of each isolation point, the size

of the equipment to be isolated, lockset designations, lockbox numbers, and remarks applicable

to specific isolation points. (Tr. 276; Ex. J-6). During the preparation of this list, employees

                                             5

“walked the line” of equipment within the scope of the isolation and ensured that all necessary

isolation points were on the list. (Tr. 48, 276–77). Tancredi testified that the isolation list at

issue in this case was reviewed by a unit supervisor, who added more isolation points to the list

and gave it his approval. (Tr. 232, 277; Ex. J-6). Once this occurred, the isolation list became the

master isolation list for the project. (Tr. 277).

     After the master isolation list was prepared, the equipment operators closed all associated

valves, locked, and tagged them. (Tr. 277–78). Once a valve was closed, the equipment operator

signed next to that isolation point on the isolation list to indicate that lock out had been

implemented at that location. (Tr. 278). This part of the process also included the installation of

blinds, which are metal plates that are inserted between flanges to prevent the flow of energy

through the system. 4 (Tr. 278). The areas between the isolation points were then drained and/or

flushed. (Tr. 278). After isolation was implemented, the equipment operator and Starcon

walked the line again to verify that isolation had occurred. (Tr. 278–80). Prior to Respondent

issuing a safe work permit and transferring custody of the equipment, Starcon requested a union

break, or separation of bolted pipe, to further verify that no hydrocarbons remained in the

isolated system. (Tr. 280). After 15 minutes, Starcon and Respondent were satisfied that the

system had no residual energy and proceeded to issue the Safe Work Permit. (Tr. 280; Ex. C-1).

     The issuance of a safe work permit is governed by Respondent’s Safe Practice Standard

No. 22. As noted in SPS No. 2, the safe work permit works in conjunction with the procedures

for LOTO. (Ex. J-1). At its most basic, the safe work permit is “an authorization to perform

work and provides a checklist to help workers identify job hazards and necessary safety

precautions.” (Ex. J-2 at 1). With respect to LOTO and equipment custody transfer, “the

4. The installation of a blind requires the issuance of an additional safe work permit, in addition to the permit that
   authorizes work to be performed on the equipment to be isolated.

                                                     6
   

   Equipment Owner must review with the Lead Worker the Master Blind/isolation list, the job site,

the equipment, isolated energy sources, and practices applied to dissipate, drain or de-pressure

the energy sources.” (Id. at 11). Only after LOTO has been implemented and the requisite

portions of the safe work permit have been completed and attested to can the permit be issued.

(Tr. 299–300).

    In addition to the foregoing, Respondent’s employees testified regarding the extensive

training regimen that is in place at the refinery. Respondent’s employees undergo a tiered

training program, which includes eight weeks of initial, classroom-based instruction and six

months of field training before they are allowed to participate in a LOTO procedure. (Tr. 267–

69, 304–307). Even after the training period has concluded, employees are subject to spot audits,

testing, and refresher training on an annual basis. (Tr. 306–307). According to Tancredi, the

training includes extensive instruction on the various methods to verify the effectiveness of

isolation.

         C. Respondent’s Incident Investigation

    In response to the fire, Respondent formed an incident investigation team to determine

the cause. (Tr. 345; Ex. C-1). The investigation team found that the ten-inch discharge isolation

gate valve of the VTB pump, which was one of the isolation points, was in a partially open

position. (Ex. C-1 at 1 and 5). As a result of such opening, material leaked through the valve and

through a flange that had been opened to the atmosphere, causing a fire. (Id.). Closer inspection

of the valve after the fire disclosed that seven full threads of the valve stem extended out from

the hand wheel, which, according to Tancredi, Boutte and the Incident Report, indicated that

“Operations failed to recognize the potential for energy to still be in the system and were not able

to verify zero energy and that the system was clear.” (Tr. 324–25, 382; Ex. C-1 at 12–13, 25). It

                                             7

was later determined that foreign material may have prevented the valve from completely

closing. (Ex. C-1 at 19–21). 5

     As a result of its investigation, Respondent concluded that the root and contributing

causes of the accident primarily involved operator error—the failure of Respondent’s employees

to verify “zero energy” and Starcon’s failure to abide by its own procedures. While many of the

proposed corrective actions involved pipe configuration and equipment updates, the Incident

Investigation Team also recommended that Respondent “[d]evelop an operating procedure that

details the requirements for preparing the . . . pumps for maintenance and inspection” and

“[r]eview the existing Operations Vacuum Tower Bypass Procedure to assure it distinguishes

when it can be utilized; identify prerequisite unimpeded access to required ATB and VTB

valves.” (Ex. C-1 at 26–27).

V.     Discussion

         A. Applicable Law

      To establish a violation of an OSHA standard, Complainant must establish: (1) the

standard applies to the facts; (2) the employer failed to comply with the terms of the standard;

(3) employees were exposed to the hazard covered by the standard, and (4) the employer had

actual or constructive knowledge of the violation (i.e., the employer knew, or with the exercise

of reasonable diligence could have known, of the violative condition). Atlantic Battery Co., 16

BNA OSHC 2131, 2138 (No. 90-1747, 1994).

5. In addition, the report noted, “The check valve (installed new in August 2013) held, holding pressure in the upper
   spool. This condition as well as the IR temperature gun readings gave a false indication that the 10” discharge block
   valve was holding. Given the configuration of the discharge piping and the closed position of the 2” pump out and
   6” recirculation valves on the upper spool, the no leak condition at the open union on the check valve bypass was
   insufficient verification of zero energy in the system.” (Ex. C-1 at 15).

                                                    8
   

   B. Citation 1, Item 1

   Complainant alleged a serious violation of the Act in Citation 1, Item 1a as follows:

   29 CFR 1910.147(c)(4)(ii)(D): The procedures shall clearly and specifically
   outline the scope purpose, authorization, rules, and techniques to be utilized for
   the control of hazardous energy, and including, but not limited to, the following:

   Specific requirements for testing a machine or equipment to determine and verify
   effectiveness of lockout devices, tagout devices and other energy control
   measures.

   Crude unit (Vacuum Tower area) – On or about October 23, 2013, employees
   were required to lockout for the removal of the 11GT-9A VTB Vacuum Tower
   Bottoms pump. The written energy control procedure (Isolation List – 11GT-9A
   VTB pump) did not clearly and specifically outline the requirements for testing a
   machine or equipment to determine and verify the effectiveness of lockout
   devices, tagout devices, and other energy control measures. Employees were
   thereby exposed to the hazards associated with releases of petroleum
   hydrocarbons (Vacuum Tower Bottoms).

             i. The Standard Applies
   

   The parties stipulated that the cited standard applies to the removal of the 11GT-9A

Vacuum Tower Bottoms pump.

              ii. The Terms of the Standard were Violated

   As previously noted, the focus of this case is quite narrow—whether Respondent had

adequately specific procedures for testing equipment to verify the effectiveness of its energy

control measures. See 29 C.F.R. § 1910.147(c)(4)(ii)(D). Prior to determining whether

Respondent violated the standard, however, the Court must determine what the standard requires.

   The cited standard is a performance standard. See Control of Hazardous Energy Sources

(Lockout/Tagout), 54 Fed. Reg. 36644, 36671 (September 1, 1989) (indicating that standard is

written in performance language and “addresses situations in which there is a need for entirely

unique lockout/tagout procedures”). Performance standards “require an employer to identify the

hazards peculiar to its own workplace and determine the steps necessary to abate them.” Thomas

                                            9

Indus. Coatings, Inc., 21 BNA OSHC 2283, 2287 (No. 97-1073, 2007). Because performance

standards do not identify specific obligations, they are interpreted in light of what is reasonable.

Id. “A reasonably prudent employer is a reasonable person familiar with the situation, including

any facts unique to the particular industry.” W.G. Fairfield Co., 19 BNA OSHC at 1235 (No. 09-

0344, 2000). That said, while industry practice is relevant to the analysis, it is not dispositive.

See id.; see also Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992).

   Complainant contends that Respondent failed to have specific, written procedures for

verifying the effectiveness of energy control measures. In particular, Complainant argues that

SPS No. 2, which governs LOTO at the refinery, falls short of providing the requisite specificity

and that the supplemental documents, such as the Isolation/Blind list and the Safe Work Permit,

do not provide additional clarity sufficient to comply with the standard’s requirements. In order

to comply, Complainant argues that at least one of the foregoing documents should address

verification techniques and locations, and provide guidance on specific testing to be used to

confirm that isolation has been effective and zero energy status has been achieved.

   Respondent proffers multiple arguments in support of its position that Complainant failed

to prove a violation of the standard. First, Respondent contends that the plain language of the

standard does not require that the specific steps for verification of energy control be in writing.

Relying on the performance-oriented language of the standard, Respondent argues that it

exercised its discretion to implement the Act’s LOTO requirements in a reasonable manner and

did so consistently with industry practice. Second, Respondent contends that Complainant’s

interpretation of the standard is at odds with the preamble to the LOTO standard, Commission

case law, and Complainant’s own, prior interpretations of the standard.

                                            10

a. The Writing Requirement

   In response to Complainant’s claim that it should have written procedures for verification

of hazardous energy isolation, Respondent contends that the standard does not require those

procedures to be in writing. Respondent suggests such a requirement is unprecedented in light of

the fact that the standard is couched in performance-oriented language, which provides

employers flexibility in its implementation. The Court disagrees. The cited standard is a

subsection of 29 C.F.R. § 1910.147(c)(4), which governs hazardous energy control procedures

generally. It states, “Procedures shall be developed, documented and utilized for the control of

potentially hazardous energy when employees are engaged in the activities covered by this

section.” 29 C.F.R. § 1910.147(c)(4)(i) (emphasis added). Further, those procedures “shall

clearly and specifically outline the scope, purpose, rules, and techniques to be utilized for the

control of hazardous energy, and the means to enforce compliance including but not limited to . .

specific requirements for testing a machine or equipment to verify the effectiveness of . . . energy

control measures.” Id. § 1910.147(c)(4)(ii)(D) (emphasis added).

   Contrary to Respondent’s assertion, there is a clear requirement that energy control

procedures shall be documented. The fact that subsection 1910.147(c)(4)(ii)(D) does not

reiterate that the specific procedures referenced must be in writing does not undermine the clear

mandate of 1910.147(c)(4). Indeed, it would make little sense for the Act to require

documentation of energy control procedures as a general proposition only to then say that the

specific elements of that program, i.e., steps for isolation, verification, etc., need not be in

writing. The requirement for procedures to “clearly and specifically” outline requirements for

verification of energy control methods would be rendered null if compliance could be achieved

                                            11

without including such verification in the documentation. 6 See Solis v. Summit Contractors, Inc.,

558 F.3d 815, 823 (8th Cir. 2009) (“We also should ‘avoid a [regulatory] construction that would

render another part of the same [regulation] superfluous.’” (quoting United States v. Stanko, 491

F.3d 408, 413 (8th Cir. 2007))). Further, though the standard at issue is a performance standard,

that does not mean that Respondent is free to ignore the documentation requirement. The

performance language of the standard gives Respondent flexibility on what to include in its

documented energy control procedures and how to document them (e.g., work authorization

permits), not whether to document them in the first place.

    In support of this proposition, and to counter any suggestion that the standard does not

require written procedures, the Court notes that the LOTO standard provides an exception to the

documentation requirement. That the standard, as a whole, provides only one exception to the

general requirement of documentation is a clear indication that Respondent’s argument is

mistaken. In order to qualify for the exception, the process/equipment at issue must meet eight

separate requirements. In general, the exception applies to a single piece of equipment, powered

by a single energy source, which can be locked out with a single lockout device. See 29 C.F.R. §

1910.147(c)(4), NOTE. In contrast, here Respondent had to use multiple lockout devices to

control multiple potential energy sources. Accordingly, Respondent was required to have written

procedures for verification of energy control measures.

                      b. Preamble to 29 C.F.R. § 1910.147

    There is no question that Respondent had a robust LOTO program in place at the time of

the fire, nor is there a suggestion that Respondent’s employees failed to perform testing or visual

6. Not to mention that it would be exceedingly difficult to have clear and specific instructions that were
   communicated orally.

                                              12
   

   inspection in an attempt to verify a zero energy state. 7 The issue in this case is one of content—

did the procedures that Respondent had in place comply with the specificity requirements of 29

C.F.R. § 1910.147(c)(4)(ii)(D), not only as to the points for isolation but also as to verification

that isolation has been effective? Having addressed the question of whether such procedures

need to be in writing, the next question is what is required to be in writing. Complainant argues

that Respondent’s LOTO procedures must include: techniques for particular verification

methods, identification of which techniques to use, and identification of proper locations on or

around the equipment to perform verification. Compl’t Br. At 12. Respondent contends that such

a requirement would not only be onerous but is unsupported by the plain language of the

standard, the preamble, and relevant case law. Not only does Respondent contend that

Complainant’s interpretation is unsupported by the preamble, but it also suggests that the

preamble supports its belief that the particulars of its energy control verification procedures do

not need to be documented.

    First, Respondent re-emphasizes that LOTO is a performance standard, and, as such,

employers have flexibility in terms of how they comply. See 54 Fed. Reg. at 36659 (“The

advantage of writing this OSHA standard in performance language is to allow flexibility of

compliance for all systems in which hazardous energy is or may be present.”). According to

Respondent, this flexibility means that it is “entitled to model its LOTO program after what other

reasonable refinery operators are doing . . . .” Resp’t Br. At 18. That is not entirely true—while

industry practice is relevant to the determination of what a reasonable person would do, it is not

dispositive. See Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992) (“[T]o

consider industry practice as determinative would permit an entire industry to avoid liability by

7. This does not mean that the verification process was effective. Tancredi testified that the individuals charged
   with this responsibility “didn’t do a good job”. (Tr. 320).

                                                  13
   

   maintaining inadequate safety.”). Respondent confuses the issue of how to document

verification procedures with whether to document them in the first place. As noted above, the

plain language of the standard requires written LOTO procedures for each element listed in

1910.147(c)(4)(ii). Thus, the issue is not whether Respondent should document anything at all

but, instead, what level of detail is required to comply.

     The evidence of industry practice was relatively scant—Respondent’s employees testified

they had not seen a refinery that documented its verification procedures and techniques.

Complainant’s expert, Siegfried, had limited refinery-specific experience. That said, Siegfried

testified to his extensive experience in the arena of Process Safety Management, which included

inspecting chemical plants and refineries, drafting interpretive documents, and participating in

speaking engagements sponsored by the refinery industry. (Tr. 141–59). Based on his

experience, the Court qualified Siegfried as an expert with respect to hazardous energy control in

the context of chemical processing. 8 (Tr. 200). Siegfried testified about the similarities regarding

the equipment and machinery used at chemical processing plants and refineries, the methods of

verification that are typically employed by those industries, and how they document procedures

for the implementation of those verification methods. (Tr. 212–13). He testified that, in some

instances, such companies rely on a standardized procedure, whereas others may utilize a work

authorization permit (also known as a safe work permit), to lay out specific steps for verification.

(Tr. 213).

8. Although Siegfried’s experience is based, in large part, on his work in the chemical processing industry, the
   Court was convinced by his testimony that the equipment used in chemical processing plants and refineries is similar
   in type, if not in orientation, due to the different chemicals that are being manufactured. (Tr. 149–50). Further, to the
   extent that he has performed multiple inspections of process equipment in those industries, reviewed LOTO policies
   and procedures of other companies, and been engaged by those industries to speak at events, the Court finds that he
   is qualified to opine on industry practice.

                                                      14
   

   Regarding the specificity required for isolation verification procedures, an employer’s

flexibility is more circumscribed than Respondent proposes. In its discussion on the standard’s

use of the term “specific”, the preamble notes:

    OSHA has retained the word “specific” when detailing the elements of the
    procedure. This was done to emphasize the need to have a detailed procedure, one
    which clearly and specifically outlines the steps to be followed.
    Overgeneralization can result in a document which has little or no utility to the
    employee who must follow the procedure.

54 Fed. Reg. at 36670 (emphasis added). The preamble goes on to state that “the procedure is

required to be written in detail.” Id. However, because the standard is intended to be applicable

across the field of “general industry”, the level of detail required should be commensurate with

the complexity of the process. Id. Regardless of the level of detail, “OSHA believes that because

of the need to follow the steps in the energy control procedure carefully and specifically, and the

number of variables involved in controlling hazardous energy, a documented procedure is

necessary for most energy control situations.” Id. (emphasis added). As noted above,

Respondent does not qualify for the exception to the documentation requirement. Thus,

irrespective of whether there are refineries that do not document their verification procedures, the

Court finds that under any reasonable reading of the LOTO standard, Respondent’s verification

procedures should be documented. 9

    Second, Respondent appears to suggest that its extensive training program is an

acceptable substitute for specific procedures. Respondent notes a passage wherein the preamble

states that a tagout system would be just as acceptable as a lockout system when combined with

“extensive training programs to teach their employees about their energy control procedures.” 54

Fed. Reg. at 36655. Respondent then lays out the particulars of its LOTO training program and

9. If, as Respondent suggests, employers in the refinery industry do not document their verification procedures, that
   says more about the state of the industry than it does about the reasonableness of Complainant’s interpretation.

                                                    15
   

   concludes that it is “consistent with the preamble’s emphasis on training as an ingredient to a

successful LOTO program.” Resp’t Br. at 19. The Court does not take issue with Respondent’s

training program, nor does it disagree that training is an essential component of any

comprehensive LOTO program; however, there is no indication in the preamble to suggest that a

comprehensive training program is an acceptable substitute for specific procedures. In fact, the

passage quoted by Respondent had a very limited application—the appropriateness of lockout

versus tagout. 54 Fed. Reg. at 36655. In that passage, the importance of documented procedures

was highlighted:

     In order to provide adequate protection to employees, the Final Rule, as did the
     proposal, requires employers to develop and utilize a comprehensive energy
     control program consisting of the development and utilization or [sic] procedures
     and training of employees. The procedures must consist of steps for
     deenergization of equipment, isolation of the equipment from energy sources, and
     verification of deenergization before servicing and maintenance is performed on
     equipment, and the employees who either perform the servicing or maintenance or
     are affected by those operations must be properly trained in the energy control
     procedures which apply to their work.

Id. The preamble clearly states that a comprehensive energy control program consists of both the

development and utilization of procedures and the training of employees. The conjunction “and”

mandates both components. Nowhere in the preamble does it suggest that training, in and of

itself, is a sufficient replacement for specific procedures. 10

     Third, Respondent argues that using a safe work permit, in conjunction with the isolation

list and SPS Nos. 2 and 22, complies with the preamble’s statement “that a work permit checklist

system or work authorization system could serve as the required written procedure . . . .” See

10. In support of its argument, Respondent cites Unifirst Corp., 24 BNA OSHC 2261 (No. 13-1703, 2014) (ALJ
    Gatto). Respondent argues that the ALJ vacated the citation, in part, based on the safety training that was provided
    to its employees. This is incorrect. Judge Gatto vacated the citation because the Secretary failed to proffer evidence
    to establish that the respondent’s procedure for handling soiled hospital scrubs deviated from what a reasonably
    prudent employer would do under similar circumstances. While Judge Gatto mentioned that the respondent’s
    employees had been trained, there was no finding that such training was a sufficient substitute for adequate
    procedures.

                                                     16
    

    Resp’t Br. at 19 (quoting 54 Fed. Reg. at 36658). This is the sort of flexibility that was discussed

above—LOTO procedures that can vary on a case-by-case basis cannot be captured by static,

general procedures. Thus, the preamble recognizes that alternative methods of documenting

procedures are acceptable. However, merely having a safe work permit or work authorization

system is not sufficient in and of itself. To complete the passage quoted by Respondent: “[A]

work permit checklist system . . . could serve as the required written procedure as long as it

meets the criteria for a procedure spelled out in this Final Rule.” 54 Fed. Reg. at 36658

(emphasis added). While individual passages, divorced of context, appear to support

Respondent’s position, the general thrust of the standard is clear: (1) Respondent is required to

“develop, document, and utilize” a procedure for control of hazardous energy; and (2) those

documented procedures shall have specific information regarding use of the procedure, steps for

isolation, steps for placement of energy isolating devices, and requirements for testing and

verifying the effectiveness of those energy isolating devices. See 29 C.F.R. §§ 1910.147(c)(4)(i),

(ii). The passage cited by Respondent merely indicates where an employer may document the

procedures, not that any checklist or work authorization will suffice as a “procedure”. In that

regard, neither the isolation list nor the safe work permit at issue here contains procedures related

to the verification of isolation.

    Finally, Respondent references the preamble’s discussion of the “different means to

isolate the energy in piping and process systems” and the importance of “verification of the

success of prior steps of a piping system isolation”. 54 Fed. Reg. at 36658. Respondent argues

that this passage is notable for what it does not say: that an employer needs to document

verification techniques in its energy control procedures. The preamble does not mention

documentation in that paragraph, because the import of that passage is to illustrate that the

                                             17

LOTO standard’s requirements are “appropriate for the control of all hazardous energy sources,

including those discussed by [American Petroleum Institute].” Id. In that respect, when the

preamble discusses “verification of the success of prior steps of a piping system isolation”, it did

so only to point out that such a procedural step is no different than “verification of proper

implementation of the energy control program.” Id. Overall, this passage does no more to

support Respondent’s case than the previously cited passages. Rather, it supports the proposition

that OSHA’s purpose in utilizing performance-based language to define the general industry’s

obligations under the LOTO standard was to make it broadly applicable to fit multiple energy

control scenarios. That it is so written does not alleviate Respondent’s obligation under the

standard to “develop[], document[], and utilize[]” energy control procedures, which “clearly and

specifically outline the scope, purpose, authorization, rules, and techniques to be utilized for the

control of hazardous energy . . . including . . . [s]pecific requirements for testing a machine or

equipment to determine and verify the effectiveness of . . . energy control measures.” 29 C.F.R.

§ 1910.147(c)(4).

                    c. Case Law

   Similar to its arguments with respect to the preamble, Respondent attempts to find

support for its position in isolated passages of applicable Commission precedent. Unfortunately

for Respondent, nothing in the case law supports the proposition that an employer can choose

whether to document its verification procedures. Rather, as the preamble suggests, whether an

energy control procedure is adequate depends on the complexity of the process or equipment.

See Gen. Motors Corp., 22 BNA OSHC 1019 (No. 91-2834 et. al, 2007) (“As GM acknowledges

the amount of detail required would depend on ‘the complexity of the equipment and the control

measures to be utilized.’” (quoting 54 Fed. Reg. at 36670)).

                                            18

Respondent places significant emphasis on Interstate Brands Corp., 2001 CCH OSHD ¶

32394 (No. 00-1077, 2001) (ALJ Rooney). Respondent’s reliance on this case is misplaced for

two reasons. First, Interstate Brands was subsequently appealed to the Commission. See

Interstate Brands Corp., 20 BNA OSHC 1102 (No. 00-1077, 2003). On appeal, the Commission

affirmed the judge’s decision to vacate the citation items; however, it came to that conclusion on

different grounds than had been relied upon by the judge. Id. Thus, the rationale for vacating the

citations has no precedential value. Second, even if it did, the Interstate Brands decision does not

stand for the proposition that lockout verification procedures do not need to be in writing. Judge

Rooney carefully analyzed the facts of that case and determined that the machine at issue was

covered by the exception to the documentation requirement. 2001 CCH OSHD ¶ 32394 at *8.

Respondent, as discussed previously, does not qualify for the exception provided in 29 C.F.R. §

1910.147(c)(4)(i). Respondent was persuaded by the judge’s finding that “the intent was not to

require employers to identify each piece of equipment and to specify for each piece of

equipment, the manner of verifying deenergization.” Id. However, the very next sentence

clarifies the import of that statement: “Rather, where machines have similar controls, they may

be covered under the same procedure.” Id. In Interstate, the complainant argued that the

employer’s LOTO procedures were insufficient as to all of the machines under its control. Id.

However, the court found the complainant failed to put forth evidence proving the LOTO

procedures were insufficient for those machines. Id.; see also 20 BNA OSHC 1102 (noting that

Secretary’s evidence failed to establish how procedures were inadequate as to the “other”

machines, the nature of the energy involved, the function of the other machines, their operations,

or the circumstances under which they would require lockout/tagout). The Interstate cases

provide contour to the question of the quantum of proof necessary to establish the need for more

                                            19

specific procedures, but they in no way absolve an employer of its obligation to document its

energy control procedures. The manifest reason the judge in Interstate Brands was comfortable

with the lack of documentation was because it was fairly simple to implement and verify LOTO

on the piece of equipment under discussion. 11

    The process for implementing LOTO to perform maintenance on the VTB pump was not

a simple task. (Tr. 276–81). There were no fewer than eleven isolation points and multiple

energy sources identified in the safe work permit for the VTB pump versus only a single energy

source and isolation point for the equipment in Interstate. (Ex. J-6). At the very least, it is safe to

say that the equipment at issue here is far more complex than the equipment at issue in Interstate.

The Court finds the holding and facts of the Interstate cases do not support Respondent’s

position.

    Conversely, the Court finds that the cases cited by Complainant are instructive. In Drexel

Chem. Co., 17 BNA OSHC 1760 (No. 94-1460, 1997), the employer co-opted the LOTO

procedure contained in Appendix A to 29 C.F.R. § 1910.147. 12 The problem, however, was that

the employer did not fill in any of the provided blanks, which are intended to allow an employer

to include facility- or equipment-specific information, including “the names of affected

employees, the types and magnitudes of energy, the hazards, the methods to control the energy,

the types and locations of machine or equipment operating controls, the types and locations of

energy isolating devices, the types of stored energy and methods to dissipate or restrain energy,

and the method of verifying the isolation of the equipment.” Drexel, 17 BNA OSHC 1760 at *5

11. Interestingly enough, even though the LOTO procedures for the equipment at issue were fairly basic, the
    employee still managed to injure himself because he failed to properly verify effective lockout. 20 BNA OSHC
    1102.
12. Just as it did with respect to the Interstate Brands cases, Respondent cited ALJ Welsch’s decision in Drexel
    instead of the Commission’s decision, which takes precedence. See Resp’t Br. at 21 (citing Drexel Chem. Co.¸17
    BNA OSHC 1760 (ALJ Welsch, March 11, 1996)).

                                                  20
    

    (emphasis added). The Commission noted, “Because the purpose of the lockout procedure is to

guide an employee through the lockout process, these general procedures are not acceptable.” Id.

    While Respondent’s LOTO program was more comprehensive than that of the employer

in Drexel, it nonetheless relied upon generalized procedures with respect to verification of

isolation. With respect to verification, Respondent’s Control of Hazardous Energy procedure,

SPS No. 2, simply states, “Before starting the work the Equipment Owner and Lead Worker shall

review the job and perform a survey to ensure all energy sources are isolated. The equipment

Owner will verify equipment is de-energized by testing all start/stop controls, and/or visual

inspection of energy isolating devices.” (Ex. J-1 at 6). This language is almost directly parroted

from the sample “Typical Minimal Lockout Procedure” found in the Appendix to the standard.

See 29 C.F.R. § 1910.147, Appendix A (“Ensure that the equipment is disconnected from the

energy source(s) by first checking that no personnel are exposed, then verify the isolation of the

equipment by operating the push button or other normal operating control(s) or by testing to

make certain the equipment will not operate.”). 13 In light of the general nature of Respondent’s

written procedures, and considering the complexity associated with implementing LOTO in this

context, the Court finds Respondent’s procedure for verification of isolation to be inadequate,

because there is nothing to guide Respondent’s employees through the entire LOTO process, as

dictated by 29 C.F.R. § 1910.147(c)(4)(ii).

    The Commission’s decision in Gen. Motors Corp., 22 BNA OSHC 1019, is also

applicable to the present dispute. Similar to its holding in Drexel, the Commission emphasized

the importance of having specific procedures commensurate with the complexity of the

equipment and found that GM’s procedures were inadequate. Gen. Motors, 22 BNA OSHC 1019

13. It is interesting to note that the Commission, perhaps tongue in cheek, stated that this language was “the most
    detailed discussion in GM’s procedure.” 22 BNA OSHC 1019 at *8.

                                                    21
    

    at *7–8. As an example of the complexity of the equipment at the GM facility, the Court noted

that the motor rail conveyor required “at least four safety locks . . . to lock it out.” Id. (internal

citation omitted). By comparison, here Respondent needed to implement eleven different

isolation points for the VTB pump. (Ex. J-6).

    Based on the case law, the preamble, and the plain language of the standard, the law is

clear that if an energy control procedure requires multiple lockout devices to control multiple

energy sources, then the procedures governing LOTO should be correspondingly detailed. No

matter how well-trained employees may be, or how familiar they are with their equipment, there

is always a potential for a lapse in attention. (Tr. 80). This is particularly so in the process

industries—not only are there multiple steps and multiple sources of energy, but by

Respondent’s own account, those steps and sources change with each separate maintenance

project (sometimes with respect to work on the same piece of machinery or process). (Tr. 273–

76). In such a dynamic environment, Complainant allows the use of work permits as a

supplement to the primary LOTO procedure. See 54 Fed. Reg. at 36658. However, irrespective

of what form the procedures take, Respondent is still obligated to specifically outline the steps an

employee must follow to implement LOTO.

   Going beyond the question of whether specific procedures for verification of isolation

need to be documented, Respondent also takes issue with the specificity of information

Complainant asserts must be included in the procedures. Complainant contends the standard

requires Respondent to identify the location where verification is to occur and to indicate the

method which will be employed to verify. Based on the plain language of the standard, the

preamble, and associated case law, the Court finds that Complainant’s interpretation is

reasonable.

                                             22

The process for isolating a piece of equipment in a refinery is a paradigmatic example of

the sort of complicated and dynamic process that requires specific instructions to ensure safe

implementation of LOTO. To suggest, as Respondent has, that extensive training can take the

place of a written procedure runs afoul of the very reason for the requirement in the first place—

minimizing the element of human error. See id. at 36670 (“Overgeneralization can result in a

document which has little or no utility to the employee who must follow the procedure.”).

Respondent dedicates a lot of up-front work into preparing a piece of equipment for

maintenance, including a fairly extensive isolation process; however, as this case illustrates, if a

similar amount of detail is not employed on the back end to verify such isolation has been

effective, there can be serious consequences. 14 Subsequent review of the problematic valve

showed that the valve stem was still visible after it had been hand-wrenched by one of the bigger

employees in the unit. (Tr. 320). According to Hill, visual verification of this particular valve

stem was difficult because it required scaffolding or a ladder to observe. (Tr. 358). A specific

method for verifying the valve stem was fully engaged had not been documented.

    Tancredi testified that there are over 200 different techniques that can be employed to

verify de-energization, which Respondent contends would be unduly burdensome to document.

(Tr. 317). Based on the Court’s understanding of the case, Complainant is not suggesting that

Respondent include each of the purported 200 different techniques in its procedures, isolation

list, or safe work permit; rather, pursuant to the standard, Complainant argues that Respondent is

required to identify which verification technique should be applied to each point where isolation

14. By so holding, the Court is not expressing an opinion as to the cause of the fire. To that point, the Court would
    note that it is irrelevant whether or not the lack of documented procedures caused the fire. See Western
    Waterproofing Co., Inc., 7 BNA OSHC 1625 (No. 1087, 1979) (“[A]s a general rule, whether an employer is in
    violation of the Act does not depend on the cause of a particular accident.”); Propellex Corp., 18 BNA OSHC 1677
    (No. 96-0265, 1999) (finding judge mistakenly focused on cause of accident in determining whether a violation
    occurred).

                                                     23
    

    is planned. Further, Respondent’s claim that there are over 200 different verification methods is

somewhat specious. First, during the trial, Respondent’s employees were only able to testify as

to a handful of methods, such as opening high point vents and low point bleed valves, using an

infrared gun to test temperature, and visual verification. (Tr. 312–14, 320). Second, if there are

over 200 methods, it is hard to conceive of an employee being able to remember all of them each

time he is required to implement them. Finally, to the extent that 200 different methods exist, it

is curious that Respondent has not documented these methods anywhere.

   Insofar as Respondent already creates job-specific procedures through its use of isolation

lists and safe work permits for each project, the Court does not perceive the burden of including

verification methods specific to each job to be an onerous addition. The process for isolating a

piece of equipment in a refinery can be complicated and fraught with potential hazards. The level

of complexity is exemplified by the fact that project-specific procedures have to be developed

each time LOTO is implemented. To suggest, as Respondent has, that documenting its

verification procedures is not required by the standard is contrary to the plain language of the

standard, the preamble, and Commission case law. Accordingly, the Court finds that the terms

of the standard were violated.

              iii. Respondent Had Knowledge of the Violative Condition

    The Court finds that Respondent knew or, with the exercise of reasonable diligence,

could have known that its energy control procedures were deficient. Tancredi testified that, as the

HSSE manager, he works with the energy control procedures and is considered the owner of

those procedures. (Tr. 32, 265). This means that Tancredi and his department ensure that the

procedures are complete, current, and properly executed. (Id.). But Tancredi testified multiple

times that the LOTO procedures do not contain a written description of verification. (Tr. 54, 317,

329, 335–38). Nevertheless, the refinery leadership team approved SPS No. 2, which governs

                                            24

the control of hazardous energy. Accordingly, the Court finds that Respondent knew that its

procedures were deficient. See Revoli Const. Co., 19 OSHC 1682 (No. 00-0315, 2001) (holding

that knowledge of supervisors is generally imputable to employer).

              iv. Respondent’s Employees were Exposed to the Hazard

     “To establish exposure, ‘the Secretary . . . must show that it is reasonably predictable

either by operational necessity or otherwise (including inadvertence), that employees have been,

are, or will be in the zone of danger.’” Delek Ref., Ltd., 25 BNA OSHC 1365 (08-1386, 2015)

(citing Fabricated Metal Prods., Inc., 18 BNA OSHC 1072, 1074 (No. 93-1853, 1997)). See also

Gilles & Cotting, Inc., 3 BNA OSHC 2002 (No. 504, 1976).

   The Court finds that Respondent’s employees were exposed to the hazard. According to

CSHO Blakemore, four of Respondent’s employees were working in the area of the VTB pump

during the LOTO process. (Tr. 78, 98). Tancredi confirmed that four employees were working

in the crude unit and that at least one of the employees was working in close proximity to the

location where Starcon employees were unbolting the flange to begin the maintenance project.

(Tr. 65). In light of the size of the resulting fire, the Court finds that Respondent’s employees

were exposed to the hazard resulting from inadequate procedures. (Ex. C-1 at 2).

               v. The Violation Was Serious

   A violation is “serious” if there was a substantial probability that death or serious

physical harm could have resulted from the violative condition. 29 U.S.C. § 666(k).

Complainant need not show that there was a substantial probability that an accident would

actually occur; he need only show that if an accident occurred, serious physical harm could

result. Phelps Dodge Corp. v. OSHRC, 725 F.2d 1237, 1240 (9th Cir. 1984). If the possible

injury addressed by a regulation is death or serious physical harm, a violation of the regulation is

                                            25

serious. Mosser Construction, 23 BNA OSHC 1044 (No. 08-0631, 2010); Dec-Tam Corp., 15

BNA OSHC 2072 (No. 88-0523, 1993).

     The fire that occurred at Respondent’s refinery illustrated the seriousness of this

violation. Respondent failed to adequately verify that the VTB pump had been isolated.

Notwithstanding Respondent’s investigation report findings, this failure can be attributed, in part,

to the fact that Respondent’s employees were not provided with specific and detailed instructions

to ensure that the system was de-energized. As a result of Respondent’s failure to adequately

verify zero energy status had been achieved, a fire broke out in the crude unit, which resulted in

approximately $320 million in damages. A fire of this (or any) magnitude has the potential to

cause serious injuries, such as burns or death. Accordingly, the Court finds the violation was

serious.

VI. Penalty

       In calculating appropriate penalties for affirmed violations, Section 17(j) of the Act

requires the Commission give due consideration to four criteria: (1) the size of the employer’s

business, (2) the gravity of the violation, (3) the good faith of the employer, and (4) the

employer’s prior history of violations. Gravity is the primary consideration and is determined by

the number of employees exposed, the duration of the exposure, the precautions taken against

injury, and the likelihood of an actual injury. J.A. Jones Construction Co., 15 BNA OSHC 2201

(No. 87-2059, 1993). It is well established that the Commission and its judges conduct de novo

penalty determinations and have full discretion to assess penalties based on the facts of each case

and the applicable statutory criteria. Valdak Corp., 17 BNA OSHC 1135 (No. 93-0239, 1995);

Allied Structural Steel, 2 BNA OSHC 1457 (No. 1681, 1975).

                                            26

Respondent is a large employer, with over 100 employees working at the Lemont

Refinery. (Tr. 84). When the fire broke out, four Citgo employees and three Starcon employees

were present in the crude unit. (Tr. 98). The fire resulted from Respondent’s failure to

adequately verify isolation at the ten-inch bypass valve, an isolation Respondent had not

sufficiently planned and documented. The fact that a fire occurred in this instance, coupled with

the presence of seven workers in the area of combustion (four of them Respondent’s employees),

is a strong indication that the likelihood of an actual injury was high. Further, to the extent that

Respondent contends that it does not need to document isolation verification procedures (and, in

fact, did not), its employees were exposed to a risk of serious injury each time the LOTO

procedures were implemented. The Court finds that although Respondent’s LOTO program in

general is quite thorough, the potential for injury under this set of facts was such that a penalty of

$7,000.00 is appropriate.

                                          ORDER

   The foregoing Decision constitutes the Findings of Fact and Conclusions of Law in

accordance with Rule 52(a) of the Federal Rules of Civil Procedure. Based upon the foregoing

Findings of Fact and Conclusions of Law, it is ORDERED that:

1. Citation 1, Item 1, and its associated penalty of $7,000.00, are AFFIRMED.

2. Citation 1, Item 2, and its associated penalty of $7,000.00, are AFFIRMED.

   SO ORDERED

                                                 /s/
                                                 ____________________________
                                                 Peggy S. Ball
                                                 Judge, OSHRC
   

   Date: March 9, 2016
   Denver, Colorado

                                            27