MILLARD REFRIGERATED SERVICES, INC., Petitioner v. SECRETARY OF LABOR, Respondent, 405 U.S. App. D.C. 242

Opinion for the Court filed by Chief Judge GARLAND. GARLAND, Chief Judge: In August 2010, more than 30,000 pounds of anhydrous ammonia escaped from one of the petitioner’s refrigerated storage facilities. After an investigation, the Occupational Safety and Health Administration cited the petitioner for committing violations of emergency response, training, record-keeping, and other requirements. The Occupational Safety and Health Review Commission affirmed the citations, and the petitioner now seeks review in this court.

Concluding that the petitioner’s challenges are without merit, we deny the petition for review. I Anhydrous ammonia (NH3) is a corrosive chemical that can burn the eyes and skin and, when inhaled, can damage the nose, throat, and lungs. At sufficient levels of exposure, anhydrous ammonia can kill a person almost immediately. For these reasons, the Occupational Safety and Health Administration (OSHA) classifies anhydrous ammonia as a “toxic and reactive highly hazardous chemieal[].” 29 C.F.R. § 1910.119 app. A.

Employers that operate a process involving at least 10,000 pounds of anhydrous ammonia must conform to training, monitoring, and record-keeping requirements devised by OSHA— known as “process safety management” practices. See id. § 1910.119(a)(l)(i). Of particular relevance to this case, such employers must create and regularly update a report — called a “process hazard analysis” — that addresses risks involved in the process that uses anhydrous ammonia and identifies any “previous incident which had a likely potential for catastrophic consequences in the workplace.” Id. at (e)(1), (3).

Employers must also provide training to employees “involved in operating a process” that uses anhydrous ammonia and must keep a record showing that those employees “ha[ve] received and understood” that training. Id. at (g)(1), (3). Millard Refrigerated Services operates a refrigerated storage facility in Theodore, Alabama. The refrigeration system at the Theodore plant uses anhydrous ammonia in quantities that trigger the process safety management regulations found at 29 C.F.R. § 1910.119.

Although Millard’s refrigeration equipment is designed to prevent releases from occurring, cracks or other defects in the equipment can allow vaporized anhydrous ammonia to escape from the refrigeration system into the ambient air. On the evening of August 22, 2010, Allen White, the Theodore facility’s plant engineer, was notified at home that the plant had lost power. White went to the facility and, after the plant regained power, surveyed the refrigeration system. He was unable, however, to get one of its pumps running before he returned home.

The next morning, an employee working on a shipping dock approximately 200 feet from the plant smelled ammonia coming from the facility. Further investigation revealed a strong smell of ammonia in one of the plant’s freezers and a visible ammonia cloud rising from cracked piping on the plant’s roof. Two employees under White’s supervision went to the roof to close the valves that were allowing anhydrous ammonia to enter the leaking segments of piping. Neither employee wore a self-contained breathing apparatus, despite the fact that they came within 15 feet of the ammonia cloud.

Nor had either employee been trained in the use of a respirator or in emergency response procedures. The efforts of White and the other employees succeeded in containing the August 2010 leak, but only after more than 30,000 pounds of anhydrous ammonia escaped into the air. That release, the largest in company history, destroyed $4 million worth of products stored at the plant, required the plant’s evacuation, and sent approximately 150 people to the hospital— including White himself.

A month later, an internal investigation report prepared by Millard identified White’s failure to “achiev[e] a safe operation on all systems” following the power outage as a contributing cause of the ammonia leak. Braga Memorandum at 2 (Sept. 21, 2010) (J.A. 425). On August 24, 2010, after local fire authorities allowed the Theodore plant to reopen, OSHA commenced an inspection. Over the course of multiple visits, OSHA broadened its focus from the August 2010 release to a more comprehensive inspection of the entire plant.

At the end of the inspection, OSHA issued two citations for 18 separate regulatory violations. After a hearing, an administrative law judge (ALJ) affirmed as to 13 of those violations, including two regarding process safety management regulations: failure to keep an adequate record of past releases of anhydrous ammonia, in violation of 29 C.F.R. § 1910.119(e)(3)(ii); and failure to ensure that plant engineer White received adequate training, in violation of 29 C.F.R. § 1910.119(g)(3).

Among the other violations found by the ALJ was one for failing to install swinging gates on an open ladderway on the roof, in violation of 29 C.F.R. § 1910.23(a)(2). The ALJ assessed a total penalty of $15,250 against Millard. Millard filed an administrative petition for discretionary review. The Occupational Safety and Health Review Commission denied the petition, noting that the decision of the ALJ thereby became the final order of the Commission. Notice of Final Order at 1 (J.A. 1792). In this court, Millard seeks review of all 13 findings of violations as well as review of the total penalty.

II We consider Millard’s challenges under “[fjamiliar principles of administrative law.” A.J. McNulty & Co. v. Sec’y of Labor, 283 F.3d 328, 331 (D.C.Cir.2002). “A reviewing court must uphold the factual findings of the Commission if they are ‘supported by substantial evidence on the record considered as a whole,’ 29 U.S.C. § 660(a), and must uphold its other conclusions as long as they are not arbitrary, capricious, an abuse of discretion, or otherwise contrary to law, 5 U.S.C. § 706(2)(A).” A.E. Staley Mfg. Co. v. Sec’y of Labor, 295 F.3d 1341, 1345 (D.C.Cir.2002). “Moreover, ‘[w]e defer to [OSHA’s]

interpretation of the [Occupational Safety and Health] Act and regulations, upholding such

interpretations so long as they are consistent with the statutory language and otherwise reasonable.’ ” Id. (quoting Anthony Crane Rental, Inc. v. Reich, 70 F.3d 1298, 1302 (D.C.Cir.1995)). In the following sections, we address Millard’s challenges to the two process safety management violations, which Millard’s counsel describes as the company’s most important concerns. Oral Arg. Recording at 18:00-18:06. We also address Millard’s contention that OSHA was es-topped from asserting that the company violated agency regulations by failing to install swinging gates on an open ladder-way.

We find no merit in any of these challenges. Although we have carefully considered each of the remaining ten challenges, as well as Millard’s challenge to the $15,250 penalty, we have concluded that they merit neither reversal nor further discussion. A According to its counsel, Millard’s “number one issue” on appeal is its challenge to the finding that it violated 29 C.F.R. § 1910.119(e)(3)(ii) by failing to disclose a previous, smaller release of anhydrous ammonia in a mandatory report completed just months before the August 2010 release. Oral Arg. Recording at 18:07-18:39.

In the course of the 2010 inspection, OSHA examined Millard’s inventory of actual and potential hazards associated with processes that use anhydrous ammonia— the “process hazard analysis” report required by 29 C.F.R. § 1910.119(e). In May 2010, a little more than three months before the August 2010 release, Millard had completed a mandatory five-year review of its process hazard analysis reporting.

By regulation, Millard’s May 2010 report was required to include “[t]he identification of any previous incident” within the past five years that “had a likely potential for catastrophic consequences in the workplace.” 29 C.F.R. § 1910.119(e)(3)(ii); see id at (e)(6). OSHA investigators cited Millard for failing to mention in that report that 110 pounds of anhydrous ammonia gas had been released from the Theodore plant’s refrigeration system in 2007. According to Millard’s internal

summary of the 2007 incident, the earlier release, like the August 2010 release, was caused in part by hydraulic shock within the system. Incident Investigation (Apr. 25, 2007) (J.A. 426); see ALJ Decision at 4 (J.A. 1743). Before the ALJ, Millard contended that its May 2010 report was adequate because a sentence in the report mentioned a “PHA Addendum.” See PHA Review Certification Letter (May 5, 2010) (J.A. 492). According to Millard, that mention served to incorporate by reference a document labeled “PHA Addendum” that Millard had completed three years earlier, in May 2007, following the 2007 release.

PHA Study Team Session Documentation (May 4, 2007) (J.A. 434). The May 2010 report did not indicate that the “Addendum” it referred to was a 2007 document. And the 2007 document contained- no description or discussion of the April 2007 release of anhydrous ammonia. Instead, it contained — without explanation or description — a six-digit number, see id, that was also listed at the top of a different internal document describing the April 2007 release, see Incident Investigation (Apr. 25, 2007) (J.A. 426).

The ALJ found that there was “no dispute that the 2007 incident needed to be identified” in the 2010 report because the 2007 incident “had a ‘likely potential for catastrophic consequences’ based on the release of 110 pounds of ammonia caused by hydraulic shock under circumstances similar to [the] August 2010 ammonia release.” ALJ Decision at 9 (J.A. 1748). According to the ALJ, the May 2010 report failed to meet the identification requirement because it “containfed] no information about the 2007 incident,” and its alleged reference to the May 2007 document was unclear. Id at 9-10.

Millard concedes that it has waived any argument that the 2007 release was not a potentially catastrophic incident triggering 29 C.F.R. § 1910.119(e)(3)(ii), by failing to raise such an argument before the Commission. Oral Arg. Recording at 31:10-31:49; see 29 U.S.C. § 660(a) (“No objection that has not been urged before the Commission shall be considered by the court, unless the failure or neglect to urge such objection shall be excused because of extraordinary circumstances.”). Accordingly, the only issue before us is whether the May 2010 report “identified” the 2007 release as required by that regulation.

There is no dispute that the May 2010 report did not itself mention the 2007 release. Nonetheless, Millard contends that the May 2010 report satisfied § 1910.119(e)(3)(ii) because it incorporated by reference the May 2007 addendum, which in turn identified the April 2007 release. This contention has problems at two levels. First, the claim that the 2010 report incorporated the May 2007 addendum rests on a single sentence in the former stating that “all changes” to an earlier process hazard analysis report “have been addressed in the PHA Addendum.” PHA Review Certification Letter (May 5, 2010) (J.A. 492).

It would be charitable to call that statement opaque. As the ALJ noted, there is no way to know that the sentence referred to the May 2007 document; it mentioned nothing more than an undated “Addendum.” ALJ Decision at 10 (J.A. 1749). Moreover, even if it were crystal clear that the statement referred to the May 2007 document, that document’s reference to the April 2007 ammonia release was itself opaque.

The May 2007 document contained no mention of the April 2007 ammonia release; all it contained was an unexplained, six-digit number that was the same as the number on Millard’s internal report of the April 2007 release. PHA Study Team Session Documentation (May 4, 2007) (J.A. 434); see Incident Investigation (Apr. 25, 2007) (J.A. 426). Given these missing links, the ALJ was hardly unreasonable in concluding that Millard’s May 2010 process hazard analysis report failed to satisfy the identification requirement of 29 C.F.R. § 1910.119(e)(3)(ii).

B Millard’s “number two” issue on appeal is its challenge to the finding that it violated 29 C.F.R. § 1910.119(g)(3) by failing to ensure that Allen White, Millard’s plant engineer, was adequately trained in the safe operation of an anhydrous ammonia refrigeration system. Oral Arg. Recording at 18:40-18:54. Following the August 2010 ammonia leak, OSHA inspectors interviewed White. According to one inspector, they “question[ed] [White] about basic concepts of process safety management.” Hr’g Tr. at 128 (Aug. 29, 2011) (J.A. 105).

Finding that White could not articulate basic concepts and procedures relevant to safely operating an anhydrous ammonia refrigeration system, they issued Millard a citation for violating § 1910.119(g)(3). Before the ALJ, Millard argued that White’s inability to recite technical terms on command — without an opportunity to refer to manuals or consult other employees — did not prove he was unfamiliar with safe system operation.

Millard also maintained that, at the time of the August 2010 release, the recently-promoted White was still in'training, and was under the supervision of a regional engineer who oversaw operations at nine other plants across the southern states. Drawing on “the OSHA interviews ... and [White’s] testimony at hearing,” the ALJ found that White was not merely unable to recall technical details, but was “unable to express or show any understanding of [process safety management]^ basic principles.” ALJ Decision at 15 (J.A. 1758).

Moreover, he “was unable to describe his training or demonstrate an understanding of the topics on which he allegedly was trained.” Id. The ALJ further found that the regional manager’s oversight of White did not excuse the violation because the training requirements are “not restricted to personnel who have ‘overall control’ such as the regional engineer,” and because “[t]he regional engineer was not expected to supervise the plant’s daily activities.” Id. at 14.

The ALJ acknowledged that White had recently been promoted, but held that “[t]he issue is the lack of understanding of the training already received.” Id. at 15. “Even a plant engineer in training who has responsibility for [Millard’s] processes should know basic [process safety management] principles.” Id. at 14. Finally, the ALJ noted that the paperwork regarding White’s training provided no “documentation explaining how the employer determined the trainee understood the training,” as required by the regulations. Id. at 15.

For these reasons, the ALJ found that OSHA had established a violation of 29 C.F.R. § 1910.119(g)(3). On review, Millard urges many of the same arguments it raised before the agency. Although we, like the ALJ, take Millard’s point that White was still in training in August 2010, we note that he had been an operator since 2008 and, by 2010, had been in training for several years. ALJ Decision at 14-15 (J.A. 1753-54). We conclude that there was substantial evidence to support the ALJ’s findings — in particular, that White did not understand the training he had already received.

Finally, we reject Millard’s claim that it should be held faultless because it did not know that White did not understand his training. The regulation places the burden to “ascertain that each employee involved in operating a process has received and understood the training required” on the employer. 29 C.F.R. § 1910.119(g)(3). Substantial evidence supports the ALJ’s conclusion that Millard did not meet that burden. C We briefly address one final challenge.

During a December 2010 inspection of the Theodore facility, OSHA inspectors noticed 15-foot ladders leading from the roof of the plant to several raised platforms. While the raised platforms were mostly surrounded by guardrails, the openings in the platforms through which the ladders rose were completely open, exposing employees to a 15-foot fall if they stepped through.

In February 2011, at the conclusion of their inspection, the inspectors cited Millard for violating 29 C.F.R. § 1910.23(a)(2), which requires that “[e]very ladderway floor opening or platform shall be guarded by a standard railing ... with the passage through the railing either provided with a swinging gate or so offset that a person cannot walk directly into the opening.” The ALJ and Commission upheld the citation.

Millard raises a host of challenges to the citation, none of which are availing and only one of which warrants further discussion: Millard’s contention that OSHA was estopped from issuing the citation. We first note the Supreme Court’s repeated admonition, “from [its] earliest cases,” that “equitable estoppel will not lie against the Government as it lies against private litigants.” OPM v. Richmond, 496 U.S. 414, 419, 110 S.Ct. 2465, 110 L.Ed.2d 387 (1990) (citing cases).

And although the Court has declined to hold that there are no circumstances in which estoppel may run against the government, id. at 423, 110 S.Ct. 2465, it has made clear that the bar for succeeding on such a claim is high, see id. at 421-22, 110 S.Ct. 2465 (noting that the Court’s opinions have “mention[ed] the possibility, in the course of rejecting estoppel arguments, that some type of ‘affirmative misconduct’ might give rise to estoppel against the Government.”). See Morris Commc’ns, Inc. v. FCC, 566 F.3d 184, 191-92 (D.C.Cir.2009). Millard’s argument does not come close to reaching that bar.

Millard argues that OSHA was es-topped from finding violations in December 2010 because its inspectors had failed to cite Millard for the absence of gates during previous inspections in 2007 and August 2010. But the mere failure to cite Millard previously can hardly be enough to estop later government enforcement. “[Ujnless Congress has indicated otherwise,” agencies charged with enforcing the law retain discretion not to prosecute every violation that comes to their attention. Heckler v. Chaney, 470 U.S. 821, 838, 105 S.Ct. 1649, 84 L.Ed.2d 714 (1985).

This broad discretion would be considerably constrained if declining to prosecute an offender in one instance by itself prevented an agency from ever demanding that the offender come into compliance. Indeed, if that were the law, an agency like OSHA could preserve its future enforcement authority only by requiring its inspectors to cite every regulated party for every violation discovered during every inspection.

In any event, as the ALJ found, “there is no evidence that the caged ladders or platforms were the subject of prior OSHA inspections or even observed by the OSHA inspectors prior to December 2010.” ALJ Decision at 7 (J.A. 1746). There is certainly “no showing of detrimental reliance by [Millard] or that OSHA misled it regarding the swing gates.” Id. And detrimental reliance is an essential element of any conceivable estoppel defense. See Keating v. FERC, 569 F.3d 427, 434 (D.C.Cir.2009). Millard maintains that there is more here than merely a failure to previously cite it for a violation.

The company contends that, during the December 2010 inspection, an inspector noted that the ladder openings lacked swinging gates but stated that OSHA would not cite Millard for their absence. Millard Br. 26. Even if the inspector had made such a remark (which is contested), it would not suffice to establish an estoppel defense. In the first place, by drawing Millard’s attention to the fact that the company was in violation of the regulation, the remark could hardly have lulled Millard into believing that it was in compliance with the law.

More important, the citation at issue expressly charged Millard with having failed to provide protection “prior” to the date the inspector allegedly made the remark, including during the period before the December inspection even began. Citation and Notification of Penalty at 6 (J.A. 11). Hence, because Millard could not have relied on the inspector’s remark in deciding not to provide fall protection, it cannot make out even a traditional defense of estoppel. Ill For the foregoing reasons, the petition for review is Denied. .

The remaining regulatory violations upheld by the ALJ included: failure of employees to wear self-contained breathing apparatuses while working on the roof to contain the anhydrous ammonia leak, in violation of 29 C.F.R. § 1910.120(q)(3)(iv); failure to have provided those employees training in the use of respirators, in violation of 29 C.F.R. § 1910.134(k)(3), and training in emergency response operations, in violation of 29 C.F.R. § 1910.120(q)(6)(iii); and numerous record-keeping violations, including two violations of 29 C.F.R. § 1904.7(b)(1), two violations of 29 C.F.R. § 1904.29(b)(1), and one violation each of 29 C.F.R. § 1904.29(b)(3), § 1904.32(b)(3), and § 1910.147(c)(6)(i). .

These principles of review apply equally in cases where the Commission makes independent findings and where it declines review and thereby adopts the ALJ’s findings as its own. See Fabi Constr. Co. v. Sec’y of Labor, 508 F.3d 1077, 1080-81 (D.C.Cir.2007).