United States of America OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION SECRETARY OF LABOR, Complainant, v. CITGO PETROLEUM CORPORATION, Respondent. OSHRC Docket No. 14-0404 Appearances: Elizabeth K. Arumilli, Esq., U.S. Department of Labor, Office of the Solicitor, Chicago, Illinois, For Complainant Dennis Morikawa, Esq., Morgan, Lewis & Bockius LLP, Philadelphia, Pennsylvania Footnote For Respondent Before: Administrative Law Judge Peggy S. Ball DECISION AND ORDER I. Procedural History This proceeding is before the Occupational Safety and Health Review Commission (“the Commission”) under section 10(c) of the Occupational Safety and Health Act of 1970, 29 U.S.C. § 659(c) (“the Act”). In response to a fire in Respondent’s crude oil unit, the Occupational Safety and Health Administration (“OSHA”) conducted an inspection of Respondent’s Lemont Refinery in Lemont, Illinois on October 24, 2013. (Tr. 10). The fire broke out after hydrocarbons leaked into the air during the removal of a pump. (Tr. 60; Ex. C-1). OSHA issued a Citation and Notification of Penalty (“Citation”) to Respondent alleging two serious violations and a proposed penalty of $14,000.00. As noted in the parties’ Joint Stipulations, which are reproduced below, Respondent withdrew its Notice of Contest as to Item 1 of the Citation. Thus, the only item under consideration is Citation 1, Item 2, and its associated penalty of $7,000.00. Respondent timely contested the Citation. The trial took place on April 29–30, 2015, in Chicago, Illinois. Five witnesses testified at trial: (1) James Tancredi, Respondent’s manager of Health, Safety, Security, and Environment (HSSE); (2) Compliance Safety and Health Officer (“CSHO”) Mark Blackmore; (3) Walt Siegfried, Complainant’s expert; (4) Ray Hill, HSSE Manager for Respondent’s St. Charles, Louisiana refinery; and (5) Ray Boutte, Respondent’s Process Safety Management (“PSM”) Coordinator. Both parties timely submitted post-trial briefs. After reviewing the parties’ arguments and the record, the Court issues the following Decision and Order. II. Stipulations Footnote The parties stipulated to the following: 1. Jurisdiction of this proceeding is conferred upon this Occupational Safety and Health Review Commission by section 10(c) of the Occupational Safety and Health Act. 2. Respondent is, and at all relevant times was, a business, with an office and place of business at 135th & New Avenue in Lemont, Illinois, and at all relevant times, it was engaged in petroleum refining and other related activities. 3. Respondent at all relevant times had a worksite and was engaged in petroleum refining and other related activities at 135th & New Avenue, Lemont, Illinois. 4. Respondent, at all relevant times, was engaged in a business affecting interstate commerce in that Respondent was engaged in handling goods or materials which had been moved in interstate commerce. 5. Respondent at all relevant times was an employer employing employees in said business at the aforesaid worksite. 6. Respondent does not contest Item 1 of the Citation and Notification of Penalty. 7. Under 29 C.F.R. § 1910.147(a)(1) the regulations found in 29 C.F.R. § 1910.147 apply to the removal of the 11GT-9A Vacuum Tower Bottoms pump that was the subject of Citation 1, Item 2 of the citations. I. Jurisdiction As noted in the previous section, the parties have stipulated that the Commission has jurisdiction over this proceeding and that Respondent was an employer engaged in a business affecting commerce within the meaning of § 3(5) of the Act, 29 U.S.C. § 652(5). Slingluff v. OSHRC, 425 F.3d 861 (10th Cir. 2005). II. Factual Background The scope of the case at bar is rather narrow—whether Respondent’s LOTO procedures comply with the requirements of 29 C.F.R. § 1910.147(c)(4)(ii)(D). That standard requires that an employer’s LOTO program contain “[s]pecific requirements for testing a machine or equipment to determine and verify effectiveness of lockout devices, tagout devices and other energy control measures.” 29 C.F.R. § 1910.147(c)(4)(ii)(D). The cited standard governs just one step in what is otherwise a comprehensive regulatory scheme for the control of hazardous energy. Although the Court’s focus is narrow, it is important to understand the context in which the alleged violation occurred and the import of this particular step to the LOTO process. Based on the following facts and subsequent Discussion, the Court finds that Respondent violated the standard A. The Accident On October 23, 2013, employees at Respondent’s Lemont Refinery were in the process of removing the 11GT-9A Vacuum Tower Bottoms pump (“VTB pump”) from the crude oil unit in order to allow a contractor, Starcon, to perform maintenance. Footnote (Tr. 78). This process required Respondent’s employees to isolate the pump from all surrounding sources of stored, hazardous energy before custody of the equipment was handed over to Starcon. (Tr. 50, 236–37). After custody of the equipment was handed over to Starcon and work began on the pump, a leak was discovered. (Tr. 60). According to Respondent’s internal investigation, a ten-inch discharge valve had not been fully closed due to an internal obstruction. (Ex. C-1 at 19–21). This partially opened valve allowed flammable hydrocarbons to continue flowing into the system, which Respondent believed had been isolated. (Id.). Approximately 30 minutes later, the leaked material ignited, which caused a fire that resulted in approximately $320 million dollars in damage to the refinery. (Tr. 60). Fortunately, employees and contractors had been evacuated from the area before the fire began. On October 24, 2013, Complainant sent CSHO Blakemore to the refinery to conduct an inspection. During the course of his inspection, CSHO Blakemore conducted interviews of management and employees, reviewed Respondent’s policies and procedures, and performed a walk-around of the crude oil unit. (Tr. 75–76). Based on his review of Respondent’s lock-out/tag-out (LOTO) policy, as well as other interrelated policies, CSHO Blakemore determined Respondent did not have adequate procedures for verifying effective isolation while performing LOTO. As a result of his findings, Complainant determined that Respondent had violated 29 C.F.R. § 1910.147(c)(4)(ii)(D). B. Respondent’s LOTO Program As testified to by Tancredi and Boutte, a LOTO program governing process equipment, such as that found in a refinery, will necessarily look different from a LOTO program for fixed pieces of equipment such as those found in a manufacturing warehouse. (Tr. 272–74, 365–66). Just as the name implies, the procedures applicable to lock-out of a particular fixed piece of equipment will not vary to any significant degree. With respect to a refinery such as Respondent’s, however, the procedures for LOTO will vary depending upon the scope of the work, the equipment, and the sources and types of energy involved. Due to this variability, Respondent’s LOTO program relies upon extensive training, generally applicable procedures, and safe work permits, which allow for the customization of LOTO procedures to a particular job. (Exs. J-1 to J-7, C-1, R-1, R-2). The primary document governing Respondent’s LOTO program is called Safe Practice Standard (SPS) No. 2, “Control of Hazardous Energy Standard”. (Ex. J-1; Tr. 282–83). This SPS sets forth the requirements for conducting LOTO such that the equipment operator can transfer custody/control of the equipment to a craftsman or maintenance person to perform upkeep or replacement of a component (Ex. J-1). According to Respondent, the first step in this process is to identify the scope of the work, which, in this instance, was removing the VTB pump. (Tr. 275–76). Once that was delineated, the equipment operator prepared what is known as an “isolation list”, which set out the description and location of each isolation point, the size of the equipment to be isolated, lockset designations, lockbox numbers, and remarks applicable to specific isolation points. (Tr. 276; Ex. J-6). During the preparation of this list, employees “walked the line” of equipment within the scope of the isolation and ensured that all necessary isolation points were on the list. (Tr. 48, 276–77). Tancredi testified that the isolation list at issue in this case was reviewed by a unit supervisor, who added more isolation points to the list and gave it his approval. (Tr. 232, 277; Ex. J-6). Once this occurred, the isolation list became the master isolation list for the project. (Tr. 277). After the master isolation list was prepared, the equipment operators closed all associated valves, locked, and tagged them. (Tr. 277–78). Once a valve was closed, the equipment operator signed next to that isolation point on the isolation list to indicate that lock out had been implemented at that location. (Tr. 278). This part of the process also included the installation of blinds, which are metal plates that are inserted between flanges to prevent the flow of energy through the system. Footnote (Tr. 278). The areas between the isolation points were then drained and/or flushed. (Tr. 278). After isolation was implemented, the equipment operator and Starcon walked the line again to verify that isolation had occurred. (Tr. 278–80). Prior to Respondent issuing a safe work permit and transferring custody of the equipment, Starcon requested a union break, or separation of bolted pipe, to further verify that no hydrocarbons remained in the isolated system. (Tr. 280). After 15 minutes, Starcon and Respondent were satisfied that the system had no residual energy and proceeded to issue the Safe Work Permit. (Tr. 280; Ex. C-1). The issuance of a safe work permit is governed by Respondent’s Safe Practice Standard No. 22. As noted in SPS No. 2, the safe work permit works in conjunction with the procedures for LOTO. (Ex. J-1). At its most basic, the safe work permit is “an authorization to perform work and provides a checklist to help workers identify job hazards and necessary safety precautions.” (Ex. J-2 at 1). With respect to LOTO and equipment custody transfer, “the Equipment Owner must review with the Lead Worker the Master Blind/isolation list, the job site, the equipment, isolated energy sources, and practices applied to dissipate, drain or de-pressure the energy sources.” (Id. at 11). Only after LOTO has been implemented and the requisite portions of the safe work permit have been completed and attested to can the permit be issued. (Tr. 299–300). In addition to the foregoing, Respondent’s employees testified regarding the extensive training regimen that is in place at the refinery. Respondent’s employees undergo a tiered training program, which includes eight weeks of initial, classroom-based instruction and six months of field training before they are allowed to participate in a LOTO procedure. (Tr. 267–69, 304–307). Even after the training period has concluded, employees are subject to spot audits, testing, and refresher training on an annual basis. (Tr. 306–307). According to Tancredi, the training includes extensive instruction on the various methods to verify the effectiveness of isolation. C. Respondent’s Incident Investigation In response to the fire, Respondent formed an incident investigation team to determine the cause. (Tr. 345; Ex. C-1). The investigation team found that the ten-inch discharge isolation gate valve of the VTB pump, which was one of the isolation points, was in a partially open position. (Ex. C-1 at 1 and 5). As a result of such opening, material leaked through the valve and through a flange that had been opened to the atmosphere, causing a fire. (Id.). Closer inspection of the valve after the fire disclosed that seven full threads of the valve stem extended out from the hand wheel, which, according to Tancredi, Boutte and the Incident Report, indicated that “Operations failed to recognize the potential for energy to still be in the system and were not able to verify zero energy and that the system was clear.” (Tr. 324–25, 382; Ex. C-1 at 12–13, 25). It was later determined that foreign material may have prevented the valve from completely closing. (Ex. C-1 at 19–21). Footnote As a result of its investigation, Respondent concluded that the root and contributing causes of the accident primarily involved operator error—the failure of Respondent’s employees to verify “zero energy” and Starcon’s failure to abide by its own procedures. While many of the proposed corrective actions involved pipe configuration and equipment updates, the Incident Investigation Team also recommended that Respondent “[d]evelop an operating procedure that details the requirements for preparing the . . . pumps for maintenance and inspection” and “[r]eview the existing Operations Vacuum Tower Bypass Procedure to assure it distinguishes when it can be utilized; identify prerequisite unimpeded access to required ATB and VTB valves.” (Ex. C-1 at 26–27). III. Discussion A. Applicable Law To establish a violation of an OSHA standard, Complainant must establish: (1) the standard applies to the facts; (2) the employer failed to comply with the terms of the standard; (3) employees were exposed to the hazard covered by the standard, and (4) the employer had actual or constructive knowledge of the violation (i.e., the employer knew, or with the exercise of reasonable diligence could have known, of the violative condition). Atlantic Battery Co., 16 BNA OSHC 2131, 2138 (No. 90-1747, 1994). B. Citation 1, Item 1 Complainant alleged a serious violation of the Act in Citation 1, Item 1a as follows: 29 CFR 1910.147(c)(4)(ii)(D): The procedures shall clearly and specifically outline the scope purpose, authorization, rules, and techniques to be utilized for the control of hazardous energy, and including, but not limited to, the following: Specific requirements for testing a machine or equipment to determine and verify effectiveness of lockout devices, tagout devices and other energy control measures. Crude unit (Vacuum Tower area) – On or about October 23, 2013, employees were required to lockout for the removal of the 11GT-9A VTB Vacuum Tower Bottoms pump. The written energy control procedure (Isolation List – 11GT-9A VTB pump) did not clearly and specifically outline the requirements for testing a machine or equipment to determine and verify the effectiveness of lockout devices, tagout devices, and other energy control measures. Employees were thereby exposed to the hazards associated with releases of petroleum hydrocarbons (Vacuum Tower Bottoms). i.The Standard Applies The parties stipulated that the cited standard applies to the removal of the 11GT-9A Vacuum Tower Bottoms pump. ii. The Terms of the Standard were Violated As previously noted, the focus of this case is quite narrow—whether Respondent had adequately specific procedures for testing equipment to verify the effectiveness of its energy control measures. See 29 C.F.R. § 1910.147(c)(4)(ii)(D). Prior to determining whether Respondent violated the standard, however, the Court must determine what the standard requires. The cited standard is a performance standard. See Control of Hazardous Energy Sources (Lockout/Tagout), 54 Fed. Reg. 36644, 36671 (September 1, 1989) (indicating that standard is written in performance language and “addresses situations in which there is a need for entirely unique lockout/tagout procedures”). Performance standards “require an employer to identify the hazards peculiar to its own workplace and determine the steps necessary to abate them.” Thomas Indus. Coatings, Inc., 21 BNA OSHC 2283, 2287 (No. 97-1073, 2007). Because performance standards do not identify specific obligations, they are interpreted in light of what is reasonable. Id. “A reasonably prudent employer is a reasonable person familiar with the situation, including any facts unique to the particular industry.” W.G. Fairfield Co., 19 BNA OSHC at 1235 (No. 09-0344, 2000). That said, while industry practice is relevant to the analysis, it is not dispositive. See id.; see also Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992). Complainant contends that Respondent failed to have specific, written procedures for verifying the effectiveness of energy control measures. In particular, Complainant argues that SPS No. 2, which governs LOTO at the refinery, falls short of providing the requisite specificity and that the supplemental documents, such as the Isolation/Blind list and the Safe Work Permit, do not provide additional clarity sufficient to comply with the standard’s requirements. In order to comply, Complainant argues that at least one of the foregoing documents should address verification techniques and locations, and provide guidance on specific testing to be used to confirm that isolation has been effective and zero energy status has been achieved. Respondent proffers multiple arguments in support of its position that Complainant failed to prove a violation of the standard. First, Respondent contends that the plain language of the standard does not require that the specific steps for verification of energy control be in writing. Relying on the performance-oriented language of the standard, Respondent argues that it exercised its discretion to implement the Act’s LOTO requirements in a reasonable manner and did so consistently with industry practice. Second, Respondent contends that Complainant’s interpretation of the standard is at odds with the preamble to the LOTO standard, Commission case law, and Complainant’s own, prior interpretations of the standard. a. The Writing Requirement In response to Complainant’s claim that it should have written procedures for verification of hazardous energy isolation, Respondent contends that the standard does not require those procedures to be in writing. Respondent suggests such a requirement is unprecedented in light of the fact that the standard is couched in performance-oriented language, which provides employers flexibility in its implementation. The Court disagrees. The cited standard is a subsection of 29 C.F.R. § 1910.147(c)(4), which governs hazardous energy control procedures generally. It states, “Procedures shall be developed, documented and utilized for the control of potentially hazardous energy when employees are engaged in the activities covered by this section.” 29 C.F.R. § 1910.147(c)(4)(i) (emphasis added). Further, those procedures “shall clearly and specifically outline the scope, purpose, rules, and techniques to be utilized for the control of hazardous energy, and the means to enforce compliance including but not limited to . . specific requirements for testing a machine or equipment to verify the effectiveness of . . . energy control measures.” Id. § 1910.147(c)(4)(ii)(D) (emphasis added). Contrary to Respondent’s assertion, there is a clear requirement that energy control procedures shall be documented. The fact that subsection 1910.147(c)(4)(ii)(D) does not reiterate that the specific procedures referenced must be in writing does not undermine the clear mandate of 1910.147(c)(4). Indeed, it would make little sense for the Act to require documentation of energy control procedures as a general proposition only to then say that the specific elements of that program, i.e., steps for isolation, verification, etc., need not be in writing. The requirement for procedures to “clearly and specifically” outline requirements for verification of energy control methods would be rendered null if compliance could be achieved without including such verification in the documentation. Footnote See Solis v. Summit Contractors, Inc., 558 F.3d 815, 823 (8th Cir. 2009) (“We also should ‘avoid a [regulatory] construction that would render another part of the same [regulation] superfluous.’” (quoting United States v. Stanko, 491 F.3d 408, 413 (8th Cir. 2007))). Further, though the standard at issue is a performance standard, that does not mean that Respondent is free to ignore the documentation requirement. The performance language of the standard gives Respondent flexibility on what to include in its documented energy control procedures and how to document them (e.g., work authorization permits), not whether to document them in the first place. In support of this proposition, and to counter any suggestion that the standard does not require written procedures, the Court notes that the LOTO standard provides an exception to the documentation requirement. That the standard, as a whole, provides only one exception to the general requirement of documentation is a clear indication that Respondent’s argument is mistaken. In order to qualify for the exception, the process/equipment at issue must meet eight separate requirements. In general, the exception applies to a single piece of equipment, powered by a single energy source, which can be locked out with a single lockout device. See 29 C.F.R. § 1910.147(c)(4), Note. In contrast, here Respondent had to use multiple lockout devices to control multiple potential energy sources. Accordingly, Respondent was required to have written procedures for verification of energy control measures. b. Preamble to 29 C.F.R. § 1910.147 There is no question that Respondent had a robust LOTO program in place at the time of the fire, nor is there a suggestion that Respondent’s employees failed to perform testing or visual inspection in an attempt to verify a zero energy state. Footnote The issue in this case is one of content—did the procedures that Respondent had in place comply with the specificity requirements of 29 C.F.R. § 1910.147(c)(4)(ii)(D), not only as to the points for isolation but also as to verification that isolation has been effective? Having addressed the question of whether such procedures need to be in writing, the next question is what is required to be in writing. Complainant argues that Respondent’s LOTO procedures must include: techniques for particular verification methods, identification of which techniques to use, and identification of proper locations on or around the equipment to perform verification. Compl’t Br. At 12. Respondent contends that such a requirement would not only be onerous but is unsupported by the plain language of the standard, the preamble, and relevant case law. Not only does Respondent contend that Complainant’s interpretation is unsupported by the preamble, but it also suggests that the preamble supports its belief that the particulars of its energy control verification procedures do not need to be documented. First, Respondent re-emphasizes that LOTO is a performance standard, and, as such, employers have flexibility in terms of how they comply. See 54 Fed. Reg. at 36659 (“The advantage of writing this OSHA standard in performance language is to allow flexibility of compliance for all systems in which hazardous energy is or may be present.”). According to Respondent, this flexibility means that it is “entitled to model its LOTO program after what other reasonable refinery operators are doing . . . .” Resp’t Br. At 18. That is not entirely true—while industry practice is relevant to the determination of what a reasonable person would do, it is not dispositive. See Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992) (“[T]o consider industry practice as determinative would permit an entire industry to avoid liability by maintaining inadequate safety.”). Respondent confuses the issue of how to document verification procedures with whether to document them in the first place. As noted above, the plain language of the standard requires written LOTO procedures for each element listed in 1910.147(c)(4)(ii). Thus, the issue is not whether Respondent should document anything at all but, instead, what level of detail is required to comply. The evidence of industry practice was relatively scant—Respondent’s employees testified they had not seen a refinery that documented its verification procedures and techniques. Complainant’s expert, Siegfried, had limited refinery-specific experience. That said, Siegfried testified to his extensive experience in the arena of Process Safety Management, which included inspecting chemical plants and refineries, drafting interpretive documents, and participating in speaking engagements sponsored by the refinery industry. (Tr. 141–59). Based on his experience, the Court qualified Siegfried as an expert with respect to hazardous energy control in the context of chemical processing. Footnote (Tr. 200). Siegfried testified about the similarities regarding the equipment and machinery used at chemical processing plants and refineries, the methods of verification that are typically employed by those industries, and how they document procedures for the implementation of those verification methods. (Tr. 212–13). He testified that, in some instances, such companies rely on a standardized procedure, whereas others may utilize a work authorization permit (also known as a safe work permit), to lay out specific steps for verification. (Tr. 213). Regarding the specificity required for isolation verification procedures, an employer’s flexibility is more circumscribed than Respondent proposes. In its discussion on the standard’s use of the term “specific”, the preamble notes: OSHA has retained the word “specific” when detailing the elements of the procedure. This was done to emphasize the need to have a detailed procedure, one which clearly and specifically outlines the steps to be followed. Overgeneralization can result in a document which has little or no utility to the employee who must follow the procedure. 54 Fed. Reg. at 36670 (emphasis added). The preamble goes on to state that “the procedure is required to be written in detail.” Id. However, because the standard is intended to be applicable across the field of “general industry”, the level of detail required should be commensurate with the complexity of the process. Id. Regardless of the level of detail, “OSHA believes that because of the need to follow the steps in the energy control procedure carefully and specifically, and the number of variables involved in controlling hazardous energy, a documented procedure is necessary for most energy control situations.” Id. (emphasis added). As noted above, Respondent does not qualify for the exception to the documentation requirement. Thus, irrespective of whether there are refineries that do not document their verification procedures, the Court finds that under any reasonable reading of the LOTO standard, Respondent’s verification procedures should be documented. Footnote Second, Respondent appears to suggest that its extensive training program is an acceptable substitute for specific procedures. Respondent notes a passage wherein the preamble states that a tagout system would be just as acceptable as a lockout system when combined with “extensive training programs to teach their employees about their energy control procedures.” 54 Fed. Reg. at 36655. Respondent then lays out the particulars of its LOTO training program and concludes that it is “consistent with the preamble’s emphasis on training as an ingredient to a successful LOTO program.” Resp’t Br. at 19. The Court does not take issue with Respondent’s training program, nor does it disagree that training is an essential component of any comprehensive LOTO program; however, there is no indication in the preamble to suggest that a comprehensive training program is an acceptable substitute for specific procedures. In fact, the passage quoted by Respondent had a very limited application—the appropriateness of lockout versus tagout. 54 Fed. Reg. at 36655. In that passage, the importance of documented procedures was highlighted: In order to provide adequate protection to employees, the Final Rule, as did the proposal, requires employers to develop and utilize a comprehensive energy control program consisting of the development and utilization or [sic] procedures and training of employees. The procedures must consist of steps for deenergization of equipment, isolation of the equipment from energy sources, and verification of deenergization before servicing and maintenance is performed on equipment, and the employees who either perform the servicing or maintenance or are affected by those operations must be properly trained in the energy control procedures which apply to their work. Id. The preamble clearly states that a comprehensive energy control program consists of both the development and utilization of procedures and the training of employees. The conjunction “and” mandates both components. Nowhere in the preamble does it suggest that training, in and of itself, is a sufficient replacement for specific procedures. Footnote Third, Respondent argues that using a safe work permit, in conjunction with the isolation list and SPS Nos. 2 and 22, complies with the preamble’s statement “that a work permit checklist system or work authorization system could serve as the required written procedure . . . .” See Resp’t Br. at 19 (quoting 54 Fed. Reg. at 36658). This is the sort of flexibility that was discussed above—LOTO procedures that can vary on a case-by-case basis cannot be captured by static, general procedures. Thus, the preamble recognizes that alternative methods of documenting procedures are acceptable. However, merely having a safe work permit or work authorization system is not sufficient in and of itself. To complete the passage quoted by Respondent: “[A] work permit checklist system . . . could serve as the required written procedure as long as it meets the criteria for a procedure spelled out in this Final Rule.” 54 Fed. Reg. at 36658 (emphasis added). While individual passages, divorced of context, appear to support Respondent’s position, the general thrust of the standard is clear: (1) Respondent is required to “develop, document, and utilize” a procedure for control of hazardous energy; and (2) those documented procedures shall have specific information regarding use of the procedure, steps for isolation, steps for placement of energy isolating devices, and requirements for testing and verifying the effectiveness of those energy isolating devices. See 29 C.F.R. §§ 1910.147(c)(4)(i), (ii). The passage cited by Respondent merely indicates where an employer may document the procedures, not that any checklist or work authorization will suffice as a “procedure”. In that regard, neither the isolation list nor the safe work permit at issue here contains procedures related to the verification of isolation. Finally, Respondent references the preamble’s discussion of the “different means to isolate the energy in piping and process systems” and the importance of “verification of the success of prior steps of a piping system isolation”. 54 Fed. Reg. at 36658. Respondent argues that this passage is notable for what it does not say: that an employer needs to document verification techniques in its energy control procedures. The preamble does not mention documentation in that paragraph, because the import of that passage is to illustrate that the LOTO standard’s requirements are “appropriate for the control of all hazardous energy sources, including those discussed by [American Petroleum Institute].” Id. In that respect, when the preamble discusses “verification of the success of prior steps of a piping system isolation”, it did so only to point out that such a procedural step is no different than “verification of proper implementation of the energy control program.” Id. Overall, this passage does no more to support Respondent’s case than the previously cited passages. Rather, it supports the proposition that OSHA’s purpose in utilizing performance-based language to define the general industry’s obligations under the LOTO standard was to make it broadly applicable to fit multiple energy control scenarios. That it is so written does not alleviate Respondent’s obligation under the standard to “develop[], document[], and utilize[]” energy control procedures, which “clearly and specifically outline the scope, purpose, authorization, rules, and techniques to be utilized for the control of hazardous energy . . . including . . . [s]pecific requirements for testing a machine or equipment to determine and verify the effectiveness of . . . energy control measures.” 29 C.F.R. § 1910.147(c)(4). c. Case Law Similar to its arguments with respect to the preamble, Respondent attempts to find support for its position in isolated passages of applicable Commission precedent. Unfortunately for Respondent, nothing in the case law supports the proposition that an employer can choose whether to document its verification procedures. Rather, as the preamble suggests, whether an energy control procedure is adequate depends on the complexity of the process or equipment. See Gen. Motors Corp., 22 BNA OSHC 1019 (No. 91-2834 et. al, 2007) (“As GM acknowledges the amount of detail required would depend on ‘the complexity of the equipment and the control measures to be utilized.’” (quoting 54 Fed. Reg. at 36670)). Respondent places significant emphasis on Interstate Brands Corp., 2001 CCH OSHD ¶ 32394 (No. 00-1077, 2001) (ALJ Rooney). Respondent’s reliance on this case is misplaced for two reasons. First, Interstate Brands was subsequently appealed to the Commission. See Interstate Brands Corp., 20 BNA OSHC 1102 (No. 00-1077, 2003). On appeal, the Commission affirmed the judge’s decision to vacate the citation items; however, it came to that conclusion on different grounds than had been relied upon by the judge. Id. Thus, the rationale for vacating the citations has no precedential value. Second, even if it did, the Interstate Brands decision does not stand for the proposition that lockout verification procedures do not need to be in writing. Judge Rooney carefully analyzed the facts of that case and determined that the machine at issue was covered by the exception to the documentation requirement. 2001 CCH OSHD ¶ 32394 at *8. Respondent, as discussed previously, does not qualify for the exception provided in 29 C.F.R. § 1910.147(c)(4)(i). Respondent was persuaded by the judge’s finding that “the intent was not to require employers to identify each piece of equipment and to specify for each piece of equipment, the manner of verifying deenergization.” Id. However, the very next sentence clarifies the import of that statement: “Rather, where machines have similar controls, they may be covered under the same procedure.” Id. In Interstate, the complainant argued that the employer’s LOTO procedures were insufficient as to all of the machines under its control. Id. However, the court found the complainant failed to put forth evidence proving the LOTO procedures were insufficient for those machines. Id.; see also 20 BNA OSHC 1102 (noting that Secretary’s evidence failed to establish how procedures were inadequate as to the “other” machines, the nature of the energy involved, the function of the other machines, their operations, or the circumstances under which they would require lockout/tagout). The Interstate cases provide contour to the question of the quantum of proof necessary to establish the need for more specific procedures, but they in no way absolve an employer of its obligation to document its energy control procedures. The manifest reason the judge in Interstate Brands was comfortable with the lack of documentation was because it was fairly simple to implement and verify LOTO on the piece of equipment under discussion. Footnote The process for implementing LOTO to perform maintenance on the VTB pump was not a simple task. (Tr. 276–81). There were no fewer than eleven isolation points and multiple energy sources identified in the safe work permit for the VTB pump versus only a single energy source and isolation point for the equipment in Interstate. (Ex. J-6). At the very least, it is safe to say that the equipment at issue here is far more complex than the equipment at issue in Interstate. The Court finds the holding and facts of the Interstate cases do not support Respondent’s position. Conversely, the Court finds that the cases cited by Complainant are instructive. In Drexel Chem. Co., 17 BNA OSHC 1760 (No. 94-1460, 1997), the employer co-opted the LOTO procedure contained in Appendix A to 29 C.F.R. § 1910.147. Footnote The problem, however, was that the employer did not fill in any of the provided blanks, which are intended to allow an employer to include facility- or equipment-specific information, including “the names of affected employees, the types and magnitudes of energy, the hazards, the methods to control the energy, the types and locations of machine or equipment operating controls, the types and locations of energy isolating devices, the types of stored energy and methods to dissipate or restrain energy, and the method of verifying the isolation of the equipment.” Drexel, 17 BNA OSHC 1760 at *5 (emphasis added). The Commission noted, “Because the purpose of the lockout procedure is to guide an employee through the lockout process, these general procedures are not acceptable.” Id. While Respondent’s LOTO program was more comprehensive than that of the employer in Drexel, it nonetheless relied upon generalized procedures with respect to verification of isolation. With respect to verification, Respondent’s Control of Hazardous Energy procedure, SPS No. 2, simply states, “Before starting the work the Equipment Owner and Lead Worker shall review the job and perform a survey to ensure all energy sources are isolated. The equipment Owner will verify equipment is de-energized by testing all start/stop controls, and/or visual inspection of energy isolating devices.” (Ex. J-1 at 6). This language is almost directly parroted from the sample “Typical Minimal Lockout Procedure” found in the Appendix to the standard. See 29 C.F.R. § 1910.147, Appendix A (“Ensure that the equipment is disconnected from the energy source(s) by first checking that no personnel are exposed, then verify the isolation of the equipment by operating the push button or other normal operating control(s) or by testing to make certain the equipment will not operate.”). Footnote In light of the general nature of Respondent’s written procedures, and considering the complexity associated with implementing LOTO in this context, the Court finds Respondent’s procedure for verification of isolation to be inadequate, because there is nothing to guide Respondent’s employees through the entire LOTO process, as dictated by 29 C.F.R. § 1910.147(c)(4)(ii). The Commission’s decision in Gen. Motors Corp., 22 BNA OSHC 1019, is also applicable to the present dispute. Similar to its holding in Drexel, the Commission emphasized the importance of having specific procedures commensurate with the complexity of the equipment and found that GM’s procedures were inadequate. Gen. Motors, 22 BNA OSHC 1019 at *7–8. As an example of the complexity of the equipment at the GM facility, the Court noted that the motor rail conveyor required “at least four safety locks . . . to lock it out.” Id. (internal citation omitted). By comparison, here Respondent needed to implement eleven different isolation points for the VTB pump. (Ex. J-6). Based on the case law, the preamble, and the plain language of the standard, the law is clear that if an energy control procedure requires multiple lockout devices to control multiple energy sources, then the procedures governing LOTO should be correspondingly detailed. No matter how well-trained employees may be, or how familiar they are with their equipment, there is always a potential for a lapse in attention. (Tr. 80). This is particularly so in the process industries—not only are there multiple steps and multiple sources of energy, but by Respondent’s own account, those steps and sources change with each separate maintenance project (sometimes with respect to work on the same piece of machinery or process). (Tr. 273–76). In such a dynamic environment, Complainant allows the use of work permits as a supplement to the primary LOTO procedure. See 54 Fed. Reg. at 36658. However, irrespective of what form the procedures take, Respondent is still obligated to specifically outline the steps an employee must follow to implement LOTO. Going beyond the question of whether specific procedures for verification of isolation need to be documented, Respondent also takes issue with the specificity of information Complainant asserts must be included in the procedures. Complainant contends the standard requires Respondent to identify the location where verification is to occur and to indicate the method which will be employed to verify. Based on the plain language of the standard, the preamble, and associated case law, the Court finds that Complainant’s interpretation is reasonable. The process for isolating a piece of equipment in a refinery is a paradigmatic example of the sort of complicated and dynamic process that requires specific instructions to ensure safe implementation of LOTO. To suggest, as Respondent has, that extensive training can take the place of a written procedure runs afoul of the very reason for the requirement in the first place—minimizing the element of human error. See id. at 36670 (“Overgeneralization can result in a document which has little or no utility to the employee who must follow the procedure.”). Respondent dedicates a lot of up-front work into preparing a piece of equipment for maintenance, including a fairly extensive isolation process; however, as this case illustrates, if a similar amount of detail is not employed on the back end to verify such isolation has been effective, there can be serious consequences. Footnote Subsequent review of the problematic valve showed that the valve stem was still visible after it had been hand-wrenched by one of the bigger employees in the unit. (Tr. 320). According to Hill, visual verification of this particular valve stem was difficult because it required scaffolding or a ladder to observe. (Tr. 358). A specific method for verifying the valve stem was fully engaged had not been documented. Tancredi testified that there are over 200 different techniques that can be employed to verify de-energization, which Respondent contends would be unduly burdensome to document. (Tr. 317). Based on the Court’s understanding of the case, Complainant is not suggesting that Respondent include each of the purported 200 different techniques in its procedures, isolation list, or safe work permit; rather, pursuant to the standard, Complainant argues that Respondent is required to identify which verification technique should be applied to each point where isolation is planned. Further, Respondent’s claim that there are over 200 different verification methods is somewhat specious. First, during the trial, Respondent’s employees were only able to testify as to a handful of methods, such as opening high point vents and low point bleed valves, using an infrared gun to test temperature, and visual verification. (Tr. 312–14, 320). Second, if there are over 200 methods, it is hard to conceive of an employee being able to remember all of them each time he is required to implement them. Finally, to the extent that 200 different methods exist, it is curious that Respondent has not documented these methods anywhere. Insofar as Respondent already creates job-specific procedures through its use of isolation lists and safe work permits for each project, the Court does not perceive the burden of including verification methods specific to each job to be an onerous addition. The process for isolating a piece of equipment in a refinery can be complicated and fraught with potential hazards. The level of complexity is exemplified by the fact that project-specific procedures have to be developed each time LOTO is implemented. To suggest, as Respondent has, that documenting its verification procedures is not required by the standard is contrary to the plain language of the standard, the preamble, and Commission case law. Accordingly, the Court finds that the terms of the standard were violated. i. Respondent Had Knowledge of the Violative Condition The Court finds that Respondent knew or, with the exercise of reasonable diligence, could have known that its energy control procedures were deficient. Tancredi testified that, as the HSSE manager, he works with the energy control procedures and is considered the owner of those procedures. (Tr. 32, 265). This means that Tancredi and his department ensure that the procedures are complete, current, and properly executed. (Id.). But Tancredi testified multiple times that the LOTO procedures do not contain a written description of verification. (Tr. 54, 317, 329, 335–38). Nevertheless, the refinery leadership team approved SPS No. 2, which governs the control of hazardous energy. Accordingly, the Court finds that Respondent knew that its procedures were deficient. See Revoli Const. Co., 19 OSHC 1682 (No. 00-0315, 2001) (holding that knowledge of supervisors is generally imputable to employer). ii. Respondent’s Employees were Exposed to the Hazard “To establish exposure, ‘the Secretary . . . must show that it is reasonably predictable either by operational necessity or otherwise (including inadvertence), that employees have been, are, or will be in the zone of danger.’” Delek Ref., Ltd., 25 BNA OSHC 1365 (08-1386, 2015) (citing Fabricated Metal Prods., Inc., 18 BNA OSHC 1072, 1074 (No. 93-1853, 1997)). See also Gilles & Cotting, Inc., 3 BNA OSHC 2002 (No. 504, 1976). The Court finds that Respondent’s employees were exposed to the hazard. According to CSHO Blakemore, four of Respondent’s employees were working in the area of the VTB pump during the LOTO process. (Tr. 78, 98). Tancredi confirmed that four employees were working in the crude unit and that at least one of the employees was working in close proximity to the location where Starcon employees were unbolting the flange to begin the maintenance project. (Tr. 65). In light of the size of the resulting fire, the Court finds that Respondent’s employees were exposed to the hazard resulting from inadequate procedures. (Ex. C-1 at 2). iii. The Violation Was Serious A violation is “serious” if there was a substantial probability that death or serious physical harm could have resulted from the violative condition. 29 U.S.C. § 666(k). Complainant need not show that there was a substantial probability that an accident would actually occur; he need only show that if an accident occurred, serious physical harm could result. Phelps Dodge Corp. v. OSHRC, 725 F.2d 1237, 1240 (9th Cir. 1984). If the possible injury addressed by a regulation is death or serious physical harm, a violation of the regulation is serious. Mosser Construction, 23 BNA OSHC 1044 (No. 08-0631, 2010); Dec-Tam Corp., 15 BNA OSHC 2072 (No. 88-0523, 1993). The fire that occurred at Respondent’s refinery illustrated the seriousness of this violation. Respondent failed to adequately verify that the VTB pump had been isolated. Notwithstanding Respondent’s investigation report findings, this failure can be attributed, in part, to the fact that Respondent’s employees were not provided with specific and detailed instructions to ensure that the system was de-energized. As a result of Respondent’s failure to adequately verify zero energy status had been achieved, a fire broke out in the crude unit, which resulted in approximately $320 million in damages. A fire of this (or any) magnitude has the potential to cause serious injuries, such as burns or death. Accordingly, the Court finds the violation was serious. II. Penalty In calculating appropriate penalties for affirmed violations, Section 17(j) of the Act requires the Commission give due consideration to four criteria: (1) the size of the employer’s business, (2) the gravity of the violation, (3) the good faith of the employer, and (4) the employer’s prior history of violations. Gravity is the primary consideration and is determined by the number of employees exposed, the duration of the exposure, the precautions taken against injury, and the likelihood of an actual injury. J.A. Jones Construction Co., 15 BNA OSHC 2201 (No. 87-2059, 1993). It is well established that the Commission and its judges conduct de novo penalty determinations and have full discretion to assess penalties based on the facts of each case and the applicable statutory criteria. Valdak Corp., 17 BNA OSHC 1135 (No. 93-0239, 1995); Allied Structural Steel, 2 BNA OSHC 1457 (No. 1681, 1975). Respondent is a large employer, with over 100 employees working at the Lemont Refinery. (Tr. 84). When the fire broke out, four Citgo employees and three Starcon employees were present in the crude unit. (Tr. 98). The fire resulted from Respondent’s failure to adequately verify isolation at the ten-inch bypass valve, an isolation Respondent had not sufficiently planned and documented. The fact that a fire occurred in this instance, coupled with the presence of seven workers in the area of combustion (four of them Respondent’s employees), is a strong indication that the likelihood of an actual injury was high. Further, to the extent that Respondent contends that it does not need to document isolation verification procedures (and, in fact, did not), its employees were exposed to a risk of serious injury each time the LOTO procedures were implemented. The Court finds that although Respondent’s LOTO program in general is quite thorough, the potential for injury under this set of facts was such that a penalty of $7,000.00 is appropriate. ORDER The foregoing Decision constitutes the Findings of Fact and Conclusions of Law in accordance with Rule 52(a) of the Federal Rules of Civil Procedure. Based upon the foregoing Findings of Fact and Conclusions of Law, it is ORDERED that: 1. Citation 1, Item 1, and its associated penalty of $7,000.00, are AFFIRMED. 2. Citation 1, Item 2, and its associated penalty of $7,000.00, are AFFIRMED. SO ORDERED /s/ ____________________________ Peggy S. Ball Judge, OSHRC Date: March 9, 2016 Denver, Colorado