Elements of process safetymanagement: Part 2

By Eileen Mason

In a previous article, I discussedthe historical origins of the Pro-cess Safety Management, the need

for employee involvement, and thecollection and analysis of processsafety information. These three ele-ments address the means of compilingnecessary process information. I willnow discuss the remaining eleven ele-ments, which address the applicationof this information and the implemen-tation of a systems safety program toassure process safety.

OPERATING PROCEDURESStandard procedures document theemployer’s policy for correct and safeoperation. Written operating proce-dures are necessary to ensure that ac-tivities are conducted in a safe mannerand in accordance with the safety pre-cautions developed during the PHA.With written operating procedures,the correct methods can be communi-cated to employees effectively, andeven a new or inexperienced em-ployee can respond to an event in theproper manner.

Procedures must be developed toaddress not only normal operatingconditions, but also initial startup,temporary, and emergency opera-tions; normal and emergency shut-down and startup following turn-around and emergency shutdown. For

each operating phase, proceduresshould detail operation limits, theconsequences of deviation and meansof avoiding or correcting deviations.Safety and health considerationsshould include a review of the hazardsand methods of preventing exposure,as well as control measures should ex-posure occur.

Operating procedures should be up-to-date and accurate. They should bemaintained in the operating areawhere they are readily available forreference. Employer desire for confi-dentiality of trade secrets cannot beused to avoid inclusion of necessaryinformation in the operatingprocedures.

TRAINING REQUIREMENTSTraining must be provided to all em-ployees involved with operation of theregulated process and should providean overview of the process and oper-ating procedures with emphasis onspecific safe practices. This trainingrequirement is not limited to equip-ment operators, but applies to all di-rect-hire employees not involved inmaintenance. Training for mainte-nance and contract personnel is ad-dressed in separate paragraphs of thestandard.

Training must be provided on initialassignment and refresher trainingmust be provided at least every threeyears. Process modifications that af-fect the process safety informationdata base will necessitate additionalrefresher training. Training for pro-cesses in operation before May 1992was grandfathered, but has by nowbeen supplemented by refreshertraining.

Unlike the HAZWOPER standard,which specifies a certain number ofhours of training, PSM allows the em-ployer to determine the amount anddepth of training needed both initiallyand on a refresher basis. The level oftraining depends on the complexity ofthe job, the skill level of the employee,and what skills are required to per-form the job safely.

Training documentation must in-clude some verification that the em-ployee understood the training. Work-ers should be able to demonstrate thatthey are able to perform their job taskssafely.

CONTRACTORSCommunication between plant orga-nization and contractors is essentialfor workplace safety. Unlike manyother OSHA standards, which applyto direct hire and contract employeesalike, the PSM standard has separatetraining requirements depending onjob tasks. This paragraph of 1910.119applies specifically to contractors per-forming maintenance or repair, turn-around, major renovation, or specialtywork. It does not apply to contractorsproviding services which do not affectthe process, such as food service,laundry, or supply services. Contractemployees hired to run a process mustbe trained to the level specified in theprevious section.

Eileen Mason, Ph.D., CIH, CSP isaffiliated with the EnvironmentalHealth Department of OldDominion University, Room 212D,William Spong Hall, Norfolk, VA23529-0286 (e-mail:emason@odu.edu).

Training must beprovided on initial

assignment andrefresher training

must be provided atleast every three

years.

FEATURE

231074-9098/01/$20.00 © Division of Chemical Health and Safety of the American Chemical SocietyPII S1074-9098(01)00239-8 Published by Elsevier Science Inc.

The owner of the facility must pro-vide a contractor with sufficient infor-mation to enable the training of con-tract employees about specific hazardsand protective measures. Employersmust explain to contractors theknown potential for fire, explosion ortoxic release related to the process andthe contractor’s work. In addition, theemployer must develop safe workpractices to control the entrance, pres-ence, and exit of contract employersand employees in the covered processareas. The contractor must also be in-formed of the applicable provisions ofthe emergency action plan required byPSM.

Training of contract employeesmust be provided and documented bythe contract employer, who must alsodemonstrate that the training has beenunderstood. The contract employer isresponsible for ensuring that his em-ployees are trained in known potentialhazards of the process and the specificjob, and in necessary safe work prac-tices, and for assuring that the facilitysafety rules are obeyed.

In addition, in order to ensure thatsafety information is complete, thecontract employer must advise theemployer of any unique hazards pre-sented or disclosed during the con-tractor’s work.

The employer must maintain injuryand illness logs related to the contrac-tor’s work and periodically reviewthe contract employer’s safetyperformance.

PRE-STARTUP SAFETY REVIEWSPSM requires pre-startup reviews fornew processes and for processes thathave been modified sufficiently to re-quire a change in the process safetyinformation. These reviews ensurethat certain critical safety issues havebeen addressed before any highly haz-ardous chemical is introduced into theprocess.

The specific questions that must beanswered in a pre-startup review are:

● Are the construction and equipmentin accordance with design spec-ifications?

● The PHA has assured only that de-sign specifications are appropriate,

not that they have actually beenfollowed.

● Are safety, operating, maintenance,and emergency procedures in placeand are they adequate?

● Has a process hazard analysis beenperformed and the recommenda-tions resolved and implemented be-fore startup? Modified facilitiesmust meet the Management ofChange requirements of the PSMstandard.

● Is operator training complete?

The pre-startup review is a final checkon the PHA process.

MECHANICAL INTEGRITYMechanical integrity ensures thatspecified critical process equipment isdesigned, installed, and maintainedfor proper operation. Failure or im-proper functioning of any of thisequipment could significantly impactthe safety of a process. The impor-tance of continuing mechanical integ-rity justifies the inclusion of Mainte-nance on the Process Hazardsanalysis team.

These regulations do not apply toequipment used for processes that donot involve highly hazardous chemi-cals in threshold quantities or toequipment that is not regarded as“critical.” Critical equipment includespressure vessels and storage tanks,piping systems, valves, relief and ventsystems, emergency shutdown sys-tems, controls such as monitoring de-vices and sensors, alarms and inter-locks, and pumps. Additionalequipment considered “critical” to theprocess by the facility owner is alsosubject to requirements for maintain-ing mechanical integrity.

Mechanical integrity is a sub-systemof the entire process system, and manyof the same elements, such as writtenprocedures and training, are required.Written procedures must be devel-oped to assure that process equipmentis maintained on a regular basis andmanufacturers’ preventative mainte-nance schedules should be followed.Software programs exist for schedul-ing, tracking and documenting theperformance of preventative main-tenance.

Employees engaged in maintainingprocess equipment are to be trained inan overview of the process itself andthe hazards associated with the pro-cess, as well as in the proper proce-dures for the employee’s job tasks.These training requirements are dis-cussed in a separate paragraph, ratherthan being combined with overalltraining requirements, in order to em-phasize the importance of job-specifictraining. Maintenance employeesneed to know the hazards of the pro-cess, but do not require the same op-erations training provided to employ-ees actually engaged in running theprocess.

Inspections and testing are also re-quired to verify mechanical integrity.Such inspections and testing must beperformed at least as often as recom-mended by the equipment manufac-turer, or in accordance with generallyaccepted good engineering practice.OSHA has deliberately avoided incor-porating specific codes and standardsby reference so that employers wouldnot be prevented from following inter-nal standards which may be evenmore stringent than prevailing codes.

Documentation is required for allinspections and tests performed onprocess equipment. This documenta-tion shall include not only when thetest was performed, and on whatequipment, but who performed thetest, and the results of such testing.

Equipment deficiencies that are out-side the acceptable limits defined bythe process safety information data-base must be corrected before furtheruse of the equipment. However, oper-ations may be continued in caseswhere other means are used to ensuresafe operations until the deficienciesare corrected. Such continued opera-tions should be regarded as an interimmeasure and correction must be made“in a timely manner.” Operations areallowed to continue under these cir-cumstances because shutdown andsubsequent startup are recognized tobe inherently more hazardous thannormal operations. Enforced shut-down of the process may be more haz-ardous than continued operation.

The final requirements under “Me-chanical integrity” is that equipment,as fabricated, shall be suitable for the

24 Chemical Health & Safety, September/October 2001

intended use, that appropriate checksand inspections shall be performed toassure that the equipment is properlyinstalled in a manner consistent withdesign specifications, and that suitablemaintenance materials and spare partsare used. Selection of spare parts isalso addressed under the “Manage-ment of Change” paragraph.

HOT WORK PERMITSHot work, while closely related to me-chanical integrity, was considered im-portant enough to warrant a separateparagraph in the regulation. The pur-pose of a hot work permit system is toensure that the employer is aware ofany hot work (cutting, welding, braz-ing) being performed, and that appro-priate safety precautions have beentaken prior to beginning the work. Al-though hot work permits are also re-quired under 1910.252(a) (the Gen-eral Requirements paragraph ofSubpart Q, Welding, Cutting andBrazing), this precaution was consid-ered so important that a specific re-quirement for hot work permits wasalso included in 1910.119. Both em-ployers and labor organizations op-posed an OSHA proposal that wouldhave allowed certain exceptions to therequirement for hot work permits.

Through the hot work permit sys-tem, the employer documents that therequired fire prevention and protec-tion requirements of 1910.252 are inplace. Hot work is authorized only fora specific day, and is to be performedonly on identified equipment or facil-ities. The permit must be kept on fileuntil completion of the hot work.

MANAGEMENT OF CHANGEMany incidents have been ascribed tounsuitable modifications, includingthe 1974 Flixborough explosion, con-sidered England’s greatest post-wardisaster. This incident involved aplant where cyclohexane was air-oxi-dized to a mixture of cyclohexanoneand cyclohexanol. When one of thereactors developed a leak, it was tem-porarily replaced with a large-diame-ter pipe. This pipe was unable to with-stand the high temperature andpressure of the process. Following the

release of a massive amount of cyclo-hexane, a vapor explosion destroyedthe plant and caused 28 fatalities.4

Changes to a process may be delib-erate or may occur inadvertentlythrough the result of process optimi-zation activities or during repair. Al-though a process and its associatedequipment may have undergone a rig-orous hazard analysis, inappropriatechanges have historically resulted inconditions which are less safe than theoriginal configuration.

For this reason, 1910.119 requires aprocedure for “management ofchange” to assess the potential impactof any contemplated changes on thesafety and health of workers. Employ-ers must establish and implementwritten procedures to manage changesinvolving process chemicals, technol-ogy, equipment, procedures, and facil-ities associated with covered pro-cesses. Exceptions apply to“replacement in kind,” where the re-placement meets the original designspecifications, and changes to the fa-cility that do not affect a coveredprocess.

When a change is made, the follow-ing topics must be addressed beforethe change is implemented:

● What is the technical basis for theprocess change?

● What is the anticipated impact ofthe change on safety and health?

● Have the operating procedures beenmodified?

● What is the necessary time periodfor the change?

The proposed change must be re-viewed and authorized by qualifiedindividuals, as specified in the em-ployer’s Management of Change pro-cedures. Once the change has beenproperly authorized, any employeesinvolved in the process, including pro-cess and contract employees, must beinformed of and trained in the changebefore the process is restarted. If theimplemented change affects the pro-cess safety information basis or thestandard operating procedures, thenthat information must be updatedaccordingly.

INCIDENT INVESTIGATION

Effective safety programs use incidentinvestigations to uncover the rootcauses of accidents, both those caus-ing injury or property damage, andthose which have not caused actualinjury or loss but have the potential todo so. Only if the root cause of theincident is identified and correctedcan appropriate measures be devel-oped and implemented to prevent fu-ture recurrence of similar incidents.Under 1910.119, OSHA requires thatemployers investigate all incidentswhich resulted in, or could reasonablyhave resulted in, a catastrophic releaseof highly hazardous chemical. A re-view of these investigations is requiredas part of the Process HazardAnalysis.

Incident investigations should becarried out promptly, while the factsare fresh in the minds of those in-volved, events can be recalled and re-counted clearly, and the scene is un-likely to have been disturbed. Incidentinvestigations carried out under PSMmust be initiated as soon as possible,but no later than 48 hours after theincident occurred.

Like a Process Hazard Analysis, anincident investigation should be per-formed by a team, which must includeat least one person knowledgeable inthe processes involved. A contractemployee should be included if theincident involved the work of the con-tractor. Once the investigation is com-pleted, a report must be written, andthe information shared with all em-ployees, direct hire and contract,“whose job tasks are relevant to theincident findings.”

The incident investigation reportmust include a description of the inci-dent and the factors that contributedto it. The report findings and recom-mendations must be addressedpromptly. OSHA has agreed withcommentators that situations may ex-ist in which it is neither necessary norappropriate to implement all of therecommendations. Therefore, “resolu-tion” of an incident investigation rec-ommendation does not necessarily en-tail implementation. Resolution, withor without implementation, must bedocumented, and the report retained

25Chemical Health & Safety, September/October 2001

for 5 years. Retention of the reportensures that it will be available forinclusion in the 5-year Process Hazardreview.

EMERGENCY PLANNING ANDRESPONSEEmergency planning and response arealready addressed under the require-ments of 29 CFR 1910.38. The PSMstandard reiterates the requirementsof this earlier standard and commentsthat the provisions of 29 CFR1910.120 (HAZWOPER) may also ap-ply. At a minimum, the emergencyplan must include emergency escapeprocedures and escape route assign-ments, procedures to account for allpersonnel, means of reporting firesand emergencies, an alarm system,and employee training. Names or titlesmust be provided for individuals ordepartments that can provide addi-tional information or explanation ofduties under the emergency plan. Al-though OSHA recommends that drillsbe held as part of employee trainingfor emergencies, drills are notmandated.

The only addition to previous stan-dards is the requirement that the em-ployer include procedures for han-dling small spills because it may notalways be clear whether a given re-lease is in fact an emergency.

COMPLIANCE AUDITSThe purpose of an audit should be

to identify problem areas and to directattention to weaknesses so they can becorrected. During the comment pe-riod, employers agreed their programs

should be evaluated, but felt it wasmore important to focus on effective-ness of the entire safety managementsystem rather than emphasizing com-pliance with the standard.

As written, 1910.119 requires em-ployers to certify they have evaluatedtheir program for compliance and theprocedures and practices developedunder the standard remain adequateand are being followed. This adminis-trative compliance audit must be per-formed at least once every three yearsand the findings documented in awritten report. Appropriate responsemust be made to any findings of theaudit and corrective action must alsobe documented.

Employers should retain on file thelast two compliance audit reports.

TRADE SECRETSOther OSHA regulations, specifically29 CFR 1903.7 and 1903.9, assure theprotection of trade secrets. Furtherprotection is provided under the pro-visions of the Hazard Communicationstandard, 1910.1200, which providescriteria for determining whether mate-rial meets the definition of a trade se-

cret. However, some commenterswere concerned about protection oftrade secrets involving processes aswell as chemicals. In the Preamble,OSHA indicated a belief that rela-tively few trade secrets would be in-cluded in the information required bythe PSM standard. However, the finalruling includes a provision for confi-dentiality agreements to ensure fur-ther protection of proprietary infor-mation. Employees and theirdesignated representatives cannot bedenied access to trade secret informa-tion relative to process safety withoutsound legal justification, althoughmore general information may be sub-stituted for specific information undercertain circumstances.

29 CFR 1910.119, Process SafetyManagement of Highly HazardousChemicals, codifies the application ofsystems safety to chemical processes.Originally developed in the aerospaceindustry, systems safety remains thesafety management tool of choice forsituations when failure is not anoption.

References1. OSHA Preambles: Process Safety Man-

agement (29 CFR 1910.119), III. Sum-mary and Explanation of the Final Rule,www.osha-slc.gov/Preamble/PSMan-age_data/PROCESS3.html29 CFR1910.119: Process Safety Managementof Highly Hazardous Chemicals.

2. 29 CFR 1910.252: Subpart Q, Welding,Cutting and Brazing, General Require-ments.

3. Kletz, Trevor, Flixborough—20 YearsAfter, Second Biennial Canadian Con-ference on Process Safety and Loss Pre-vention.

The purpose of anaudit should be toidentify problem

areas and to directattention to

weaknesses so theycan be corrected.

26 Chemical Health & Safety, September/October 2001