Earlier this week I struck a nerve with many of you; mostly positive comments and agreement and I appreciate all your support. I received some challenges and I appreciate those as well as they push me to become a better safety professional. Most of the challenges were of the position “it is not wrong/improper” to ask those type of questions in a PHA and “OSHA/EPA can not cite a facility who ask those questions”. I agree with BOTH of those positions, however; in use of the said “checklist” I referred to in Part I if that is the only questions your PHA is asking, then OSHA/EPA could find issues with your PHA – not to mention the team members and management not realizing the true value of a PHA. A PHA should be asking the questions that would lead to the need for a relief system – not if the relief system is in place! Let me explain…
As I stated in Part I, the questions about “vessels not having relief protection” should never have to be asked in a PHA. In fact, those type questions MUST be asked AND answered by the engineer(s) designing the process and developing the PSI.
1910.119(d)(2)(i) Information concerning the technology of the process shall include at least the following:
…
1910.119(d)(2)(i)(D) Safe upper and lower limits for such items as temperatures, pressures, flows or compositions; and,
1910.119(d)(2)(i)(E) An evaluation of the consequences of deviations, including those affecting the safety and health of employees
This is pretty basic in process safety when designing a process or even making changes to existing processes. We establish the safe upper and lower limits of ALL safety critical parameters for the process and then design to these parameters. As part of this exercise, the engineer(s) will evaluate the consequences of deviations to determine the level of safety that is necessary for the design. Using the relief system as our example, we can see how this is supposed to happen…
The engineer needs to replace a pressure vessel. He/She will consider the existing design or if the vessel is new, the first thing they will establish is the SAFE UPPER LIMIT for PRESSURE. Once this is established, he/she will begin to explore relief scenarios so that they can design the relief system ( a type of relief device, the size of relief, arrangement of relief, discharge location, control/collection system, etc.). They will use RAGAGEP(s) to design too, once they have established their relief scenario (fire, blocked in, runaway, etc.). Through all of this, the engineer is building SAFETY into the process – asking the questions:
- What if this vessel is over pressured?
- What are the mechanisms that could lead to an over pressure event?
- What will be in this pressure vessel and how will it behave under “out of control” process conditions? (too much heat, not enough cooling, fire in area, vessel overfilled, etc.)
This is the “evaluation of the consequences of deviations”. The engineer MUST design to these UNKNOWNS if they are possible to achieve, and we should ALWAYS ASSUME them to be achievable. If the process has INHERENT SAFE design, then maybe we can have a different discussion of using alternatives (e.g. SIS/SIL4) to Relief Valves to protect the pressure vessel(s).
So by the time we sit down to conduct our PHA on this new pressure vessel, the engineer(s) have already ESTABLISHED our Safe Upper and Lower limits for PRESSURE impacting the vessel, with consequences of deviating from these limits. The issue is they started at the back end of the scenario! They ASSUME the events leading to the over pressure event will occur and they design to that as our LAST LINE of defense. The PHA team starts at the front end of the scenario and asks “What could cause TOO MUCH PRESSURE”? Then they look at EACH CAUSE (cause-by-cause) of this overpressure scenario and look to “safeguards” that would PREVENT the event from even starting. They then look to safeguards to stop the event should it be initiated. Lastly, they look to the safeguard that would control the event should it reach the “end of the chain”. The latter is where we establish the RV as the safeguard in this scenario and we can verify this in the PSI that was developed and documented by the engineer(s).
Take note, we are well BEYOND the question “What if the vessel does not have an RV?”. But in essence, we are asking about relief valves, but the “What If” question is PROCESS BASED, such as
- “What if we lose cooling water?”
- “What if there is a fire in the process area”?
- “What if we overfill the vessel?”
We are actually analyzing “processing hazards”, hence it is called a Process Hazards Analysis.
Lastly, not having an RV on a pressure vessel that clearly is required to have one (e.g. some small vessels are actually exempt) should have been caught in the Pre-Start Up Safety Review (PSSR). Another PSM measure to ensure our pressure vessel was designed and installed per our pressure vessel RAGAGEP.
1910.119(i)(1) The employer shall perform a pre-startup safety review for new facilities and for modified facilities when the modification is significant enough to require a change in the process safety information.
1910.119(i)(2) The pre-startup safety review shall confirm that prior to the introduction of highly hazardous chemicals to a process:
1910.119(i)(2)(i) Construction and equipment are in accordance with design specifications;
So for those of you who have concerns that you may have a pressure vessel in service without a relief valve of the proper type/size/setting such that it needs to be asked to a PHA Team, you should consider conducting a serious management review of your PSM systems. But asking the question every five years in your PHA revalidation is NOT the answer to your problems!
Look at it this way, an air receiver in service without an RV in place is a “hazard”; although it is NOT a “process hazard”. Having a process vessel in service without an RV in place is also a “hazard”; although it is NOT a “process hazard” – hence a PHA is not intended to identify hazards NOT associated with the actual process. The PHA tool is designed to analyze the “hazards” associated with the process that would require us to have a relief system on the process. If this were the case, we should be asking the question “is the air receiver sitting next to our process vessel equipped with an RV of proper setting and size” as part of our PHA. And actually, a good PHA will consider the location of the air receiver next to the PSM/RMP covered process vessel in the facility siting analysis!
Lastly, if your process is being audited properly every three years, here is yet another layer the process safety management system that should catch pressure vessels in service without an RV. Yes, I am implying that a PSM/RMP MUST include a thorough review of the physical process conditions. Look at the paperwork for a couple of days is NOT a well-executed audit and we would be missing a BIG part of our management system if we shortcut our audit process. Out of a 5-day PSM/RMP audit, we spend at least 2 of those days in the process inspecting conditions against the PSI and SOPs, as well as interviewing personnel who are working in/on/adjacent to the process. And yes, we have found issues with relief systems and NOT once did we write up a finding that the “What-if” did not ask the question about the vessel not having an RV, or it was set wrong, etc. These types of failures are MUCH larger than a PHA issue!