There is a method to OSHA’s madness in PSM (as well as EPA’s with regards to RMP) when it comes to conducting a Process Hazard Analysis (PHA). Unfortunately too many facilities have been duped into believing that the effort they put forward into what they called a PHA was quite frankly a waste of time. Maybe not a total waste of time, but way too many of these PHA’s fall well short of even resembling some recognizable methodology. For example, a trade group has published a “What-If Checklist” for the type of process their member companies operate. This checklist was supposedly taken from a HAZOP study that was conducted by a team of experts and the scenarios converted over to “what-if” questions for the ease of use by their members. But these “What-Ifs” are NOT “what-if” scenarios! If your “What-if” questions are asking if pressure vessels have relief valves, this is a sign that you may not be ready for a PHA.
The OSHA (and EPA) process safety management REQUIRE us to have our Process Safety Information FULLY IN PLACE BEFORE attempting a PHA.
1910.119(d) Process safety information. In accordance with the schedule set forth in paragraph (e)(1) of this section, the employer shall complete a compilation of written process safety information before conducting any process hazard analysis required by the standard.
§68.65 Process safety information. (a) In accordance with the schedule set forth in §68.67, the owner or operator shall complete a compilation of written process safety information before conducting any process hazard analysis required by the rule.
But that is not all…
BOTH OSHA and EPA also REQUIRE us to document that equipment complies with recognized and generally accepted good engineering practices as part of our PSI requirements.
1910.119(d)(3)(ii) The employer shall document that equipment complies with recognized and generally accepted good engineering practices.
§68.65(d)(2) The owner or operator shall document that equipment complies with recognized and generally accepted good engineering practices.
What does this actually mean? It means that we should NOT be asking questions about RV’s on pressure vessels, their set points, or their size as What-If Scenarios in a PHA! This type of question was supposed to have already been answered as part of putting together our Process Safety Information (PSI). This does not mean relief valves are not discussed in PHA’s – they are, but as an ESTABLISHED SAFEGUARD for identified “over pressure” scenarios. Asking a what-if question like “are the pressure vessels equipped with relief valves” is NOT a question that should even need to be asked during a PHA!
Now it is not unreasonable to challenge a facility’s assumption that their RV design basis is correct if we come across a weird “over pressure” scenario such as a runaway reaction. Asking to see their design basis in the PSI is OK, but the PHA is NOT the place to be “designing” or developing PSI.
Here are some examples from the “What-If-Checklist” that just leave me wondering if sometimes we just miss the boat altogether! Remember, we have a team of highly paid professionals in a room for several days to analyze the hazards of the process and these are the questions we are asking them… and we wonder why so many do not see the value in a PHA!
Shell and Tube Condenser
- What if there is no RV on this equipment?
- What if the set pressure of the equipment SRV is more than the design pressure of the equipment?
- What if the SRV capacity is too low?
- What if there is a closed stop valve before/after an SRV?
- What if an SRV discharges into piping/system that is not vented to the atmosphere?
These are ALL questions that MUST BE ASKED, but these are NOT PHA questions! Let me explain further…
What if there is no RV on the shell and tube condenser?
The short answer is “it should not be in service BECAUSE it does not meet RAGAGEP!” We failed in our design, construction, and development of PSI to identify this when we documented that equipment complies with RAGAGEP! We have THREE (3) PSI requirements that should have captured a missing RV on a pressure vessel WELL BEFORE we sit down for the PHA:
1) Development of the P&IDs
2) RV Listing with Design Basis (set points, sizing, scenario(s)
3) Management’s documentation that equipment complies with RAGAGEP
If these three (3) distinct requirements failed to ensure the shell and tube heat exchanger was not equipped with RVs of proper set point and size, then we need to take several steps BACK and regroup, as we are nowhere near ready for an effective PHA – regardless of what methodology we are using!
What if the equipment’s PM Program for RVs is insufficient or non-existent?
Again, another question that needs to be asked of the RV, but it is NOT a PHA scenario question. As I have written before, EVERY SAFEGUARD that is listed in a scenario MUST be in some type of PM/Inspection/Testing program to gain credit for the safeguard. So yes, I ask for evidence that the facility has a functioning RV replacement/testing program before I allow the team to claim the RV as a safeguard; but this is an entirely different discussion than asking the questions as a “what-if” question.
PHA’s are meant to analyze process deviations, such as
- over filling a vessel
- over pressurizing a vessel
- loss of flow, etc.
We establish all the CRITICAL PROCESS PARAMETERS and then determine how they can be deviated from and what the consequences of these deviations can be. We then look to our SAFEGUARDS to prevent, protect and mitigate the scenarios. I would argue that an RV failing to lift at its set point is NOT a PHA problem and therefore is never intended to be analyzed as a PHA failure. So many things have had to have gone wrong for us to be in the situation that we are relying on our FINAL LINE of DEFENSE to bring our process back to a safe state.
PHA’s need to be focused on credible scenarios. Asking engineering design questions that should have already been clearly established and documented is just a waste of time and gives PHAs a bad name.
And before I close this posting, I want to make it clear that I am in no way advocating short-cuts in a PHA. The one argument I get when training folks on how to conduct a PHA is how to reconcile the following requirement…
1910.119(e)(3)(iv) Consequences of failure of engineering and administrative controls
Yes, we have to consider the consequences of the failure of engineering and administrative controls to prevent our scenario(s). What this means is that we can NEVER ASSUME that a scenario will not take place merely because we have some engineering and/or administrative controls in place. Humans have shown we can defeat ALMOST ANY engineering control and administrative control known to man-kind and to assume other wise is just being foolish. We MUST ALWAYS assume the event can occur and ALWAYS ASSUME the consequences to be severe! We then reduce our RISK (probability of the event and severity of the event) with our ESTABLISHED safeguards which have been well documented in our PSI. But no matter how many independent layers of protection we have and regardless of our reliability of our safety systems, we ALWAYS ASSUME consequences of the failure of engineering and administrative controls will result in some consequence.