OSHA’s most recent PSM Letter of Interpretation (LOI) confirms their position on covered process battery limits. I struggle with this, as their position states, and I quote, “Neither the application paragraph nor the definition of “process,” states or implies that controls can limit the extent or boundaries of a PSM-covered process.”
With this position, OSHA does not appear to consider “process reactions” where the HHC is reacted within a process vessel, and after the reaction is completed, the product remaining in the vessel is no longer hazardous. Based on this OSHA position, all the interconnect downstream equipment/process would still be within the process battery limits of the PSM-covered process.
This is a concern, as many larger facilities have reviewed their battery limits within their Process Hazard Analysis (and engineering reviews) and determined that after “some point within the interconnected process,” the HHC could NOT reach and/or escape from the process beyond this specific point. Some of the facilities are huge, and stating that a piece of equipment is covered merely because it is “interconnected” is saying that a plastics extruder at a plastics manufacturing plant is a piece of “PSM-covered equipment”. It is “interconnected” (albeit very remotely) to the chlorine and phosgene processes, but there is no way that chlorine or phosgene could physically be released from this extruder.
We even see if an operator could “sabotage” the process and get an HHC outside of their process and into other areas and equipment.
Another example is a flammable liquids resin process, where the flammable liquids are reacted in a vessel and, once fully reacted, become a non-hazardous water-based emulsion. Once these materials are reacted, the entire molecular structure changes, and thus, plastic resins or water-based emulsions are created. Saying that all the downstream process/equipment is covered because it is merely “interconnected” is quite a stretch for these two examples.
However, KEEP IN MIND OSHA is trying to draw a line in the sand with this position, and if we want to redraw this line, we BETTER HAVE OUR DUCKS IN A ROW and STANDING AT ATTENTION. OSHA will ask some straightforward questions if we have redrawn the battery limit lines and the equipment is “interconnected.” Simply put… they will pick some point outside our battery limit that is “interconnected” and ask what is preventing the HHC from reaching this point. After all, it is “interconnected,” so getting the HHC to that point may be physically possible. We have to DEMONSTRATE through engineering methods (PASSIVE Engineering Controls) that there are ample LAYERS of PROTECTION (e.g., engineering and administrative controls) that will prevent this from occurring.
A perfect example that they have challenged is the flammable resin process mentioned above. They will ask, “What prevents the operator from accidentally transferring the flammable liquid out of the reactor BEFORE it is reacted or only partially reacted?” One human error can quickly put HHC beyond the reaction vessel and thus include the downstream equipment. We have to DEMONSTRATE that there are ample controls to prevent this and that these controls are correctly engineered and MAINTAINED PROPERLY. Something like an LEL indicator set to activate an emergency shutdown at 5% of the LEL in downstream equipment would fall into this category. We would still have to include some downstream equipment and determine how far downstream the flammable liquid/vapor could get before the system is shut down and isolated by valves.
PLEASE TAKE HEED… a flammable liquid that happens to be BELOW its FLASHPOINT will pass right by an LEL detector! We have to consider this is happening, and it reaches its FP later in the process, flashes off, and reaches its LEL somewhere we do not want! So simply adding an LEL detector downstream is NOT sufficient in this example!!!
The flip side to this is when a company does not cover “interconnected” equipment WHEN THE HHC can reach or be released from the equipment! It is our experience that facilities usually have established battery limits that are too narrow without proper documentation. Let me be clear… if a facility can not DEOMONSTRATE (and document) that a failure in the “interconnected” equipment/process will NOT result in a release of the HHC, then this equipment MUST be within the battery limits. To exclude “interconnected equipment,” which OSHA says can not be done, a facility must undergo an extensive hazard and engineering review. This review MUST CONSIDER events EXTERNAL to the process, such as:
- a fire OUTSIDE the battery limits directly impacting the process or even impacting a critical utility for the process
- an IMPROPER UTILITY HOOK-UP made OUTSIDE the battery limits that introduces an incompatible material or could cause reverse flow of the HHC into areas not expected
- human errors that allow personnel to transfer HHC to downstream equipment or interconnect equipment.
I also do NOT allow a SINGLE LAYER of protection or SINGLE LAYER of active mitigation to be counted in trying to narrow the battery limits. Check valves FAIL people, so a check valve in a line is NOT a stopping point for establishing your battery limit with interconnected equipment!
Setting your process “battery limits” is often difficult, but it is as fundamental as developing our Process Safety Information. In fact, we have to set our process battery limits before we know what pieces of equipment will be included in our PSM/RMP programs, what procedures need to be written, what has to be covered in the PHA, etc. This exercise MUST consider CRITICAL UTILITIES (see OSHA LOI on utilities). What is a “critical utility”? I define it as a utility that, if lost, would cause a release of the HHC or take the process outside the safe operating envelope. Nitrogen used to blanket flammable liquid tanks and purge flammable liquid lines would be an example of a “critical utility” for a flammable liquid process. Something as common as electricity would also be considered a “critical utility” if the PHA determines that loss of electricity would lead to a release of the HHC or the emergency shutdown systems rely on electricity. And don’t forget about the compressed air system; if the loss of compressed air, or even the air dryer, could cause a process upset, then compressed air would be a “critical utility.” I will also mention that some processes have emergency shutdown systems that rely on compressed air to activate valves. If this is the case and the valves are NOT fail-safe valves, meaning they are NOT spring-loaded to go to their SAFE position, and they actually require air pressure to go to their SAFE position, then the compressed air system is WITHOUT A DOUBT a covered utility. Even though the failure of this emergency system would not directly cause a release of the HHC, the failure of the system would cause a failure of an emergency shutdown system on the process.
So, setting your battery limits is critical in your process safety and compliance efforts. Doing so too narrowly will eventually cause serious issues, but doing so too broadly will drain resources from low-risk equipment rather than perfecting PSM on the equipment where it is needed.
Lastly, a recent investigation that SAFTENG was asked to participate in is a perfect example of how a facility can establish incorrect battery limits that can have a DIRECT IMPACT on process safety. A flammable liquids process failed to consider their wastewater handling facility as part of the covered process. A spill containment system in the process area was designed to drain to the treatment plant containment basin per 1910.106(e)(3)(iv). However, this containment basis was not rated as a Class I Div 2 HAZLOC and was using ordinary electrical equipment. The basin (e.g., a 20′ deep covered pit) was not treated as a Permit-Required Confined Space, and the basin was not in the MI inspection/testing program. The process had a major overflow event, sending a flammable liquid to the wastewater treatment plant. The vapors within this covered basin reached their LEL and although we could not definitively say what the ignition source was, it was very apparent there was an ignition source within the basin. The lesson to be learned is that your containment system(s) can be a means to “interconnect” equipment and areas that should be covered under your PSM/RMP program.