Earlier this year, the US EPA cited a company for not having trained staff on-site at all times the Extremely Hazardous Substance (EHS) or Highly Hazardous Chemical (HHC) is on-site in quantities that exceed the Risk Management Plan threshold. The case (Click Here for my summary of the case) involved an ammonia distributor. The only time trained personnel were on site was when a truck was loaded or unloaded. This is clearly a staffing issue; but, there is so much more to “process staffing” than just having operators on site.
Of course, it is always a good idea to have trained personnel on-site at all times the EHS/HHC is on site and being processed (remember, “storage” is part of a “process”). This does not mean that a fully trained operator/technician is required, although having trained operators/technicians on-site 24/7 would be best. But in some situations, training a supervisor to take necessary actions should a safe upper/lower limit be exceeded, or worse yet, there is a release of the HHC/EHS may be enough to meet our staffing needs.
Bottom line… when the process contains the EHS/HHC, someone that knows how to respond to process alarms, intervene in the process, bring the process to a safe state when needed, and how to organize a safe response to a release of the HHC/EHS is required.
But as I said, safe staffing of a PSM/RMP-covered process goes MUCH FARTHER than just ensuring that a trained operator/technician is on site. We also have to look at this operator’s ability to safely (and timely) respond to and conduct the necessary actions to maintain the process in a safe state or to safely execute emergency shutdown procedures.
In almost all of the PSM/RMP-covered processes, there is some interaction between the operator and the process controls, and this is where “staffing” really comes into play. In a traditional chemical process, personnel will monitor a computer readout of the process parameters and communicate with a field operator, who will take physical actions to control the process based on computer feedback. In some smaller (or simpler) processes, this may all be done by a single individual and a PLC located right at the process. But there is almost always this interaction between the process and the operator.
Most of the time, the presence of a trained operator within the process boundaries will be adequate for a safe and timely response. But over the years, some process layouts have been found to be more “resource intensive” merely because of how they have been designed. There is not much we can do through engineering to manage this concern, so it all comes down to staffing and the staff’s ability to safely and timely respond to any process deviations.
If your process is “operated and controlled” from a single location and operators are not present 100% of the time at these controls, we have two options:
1) implement a Safety Instrumented System (SIS) to bring the process to a safe state when a safe upper or lower limit is exceeded when an operator is not present, or
2) install emergency shutdown (ESD) controls at the remote locations where the operator(s) are required to travel/work on a regular basis.
Imagine an operator (working independently) receiving notification of a process deviation (e.g., an alarm) while he/she is minutes away from the control panel. How much of a safety factor has been engineered into the SIS so that the operator can travel back to the control panel to take steps to correct the deviation before the process releases its EHS/HHC?
Here are more details on our scenario…
We have a pressure vessel with an MAWP of 300 psi and a relief valve with a set point of 300 psi. The hi-pressure alarm is set at 295 psi. Sound like a problem? It should! Even if the operator is within 50’ of the control panel, we will be lifting relief valves, and this is UNACCEPTABLE!
But how long will the operator travel from the most remote location back to the control panel? 5 minutes? 10 minutes? 15 minutes? Has this travel time been factored into the design of the process controls and safety systems? Usually, the safety factors used to establish set points of alarms and interlocks are based on the assumption that a trained operator is present and can take immediate action (or within a reasonable time frame). But if our process is staffed in such a way and designed so that this is not true, then we may be setting ourselves up for a terrible day!
Case in point…
A facility has a process that is individually staffed on 2 of 3 shifts. The process’s design is such that about 35 remote locations require the individual operator to visit several times per shift. Some of these remote locations are even on the facility’s roof, accessible only by a single fixed ladder. The square footage of the facility is approximately 400,000. The most remote location is the roof, and under the best conditions (dry and warm), the travel time from the roof to the control panel is 15 minutes. The operator is on the roof when he is contacted via 2-way radio that an alarm is sounding at the control panel. Would our operator have 15 minutes to respond before a release occurs?
So staffing needs of a covered process go deeper than some may believe. Staffing can impact where safe upper and lower limits are established. Staffing can impact how an emergency shutdown is executed and the trigger by which an emergency shutdown is activated. Too often, we have assumed that an operator will be available to respond to process deviations; yet, often we leave the process staffed with a single operator, and this operator is routinely put into situations that would hamper their ability to control the process or worse yet, shut down the process in the event of a release of the HHC/EHS! Lastly, please do not forget that when the sole operator is away from the process controls, he/she will need some remote capability to receive alarms, which may even delay response times even more. But without this remote capability to receive alarms, our whole process safety management system fails us! So like I said, staffing is so much more than just having an operator present; it involves operator interaction with the process as well.