UPDATE: Many thanks to my friends who must remain nameless on my website for sharing their article on this topic. They are MUCH more elegant than me and quite a bit more technical, but all in all we agree… not all safeguards should be counted! For those doubting my position, you need to pay close attention to what these safety engineers have to say as what they say COUNTS! CLICK HERE (pdf) to download their article from Process Safety Progress.
Over the past 20 years I have facilitated hundreds of Process Hazards Analyzes (PHA) and participated in hundreds more and there is one thing that I still find troubling… too many are doing these revalidation exercises so they can “check the box” they were done in the name of “compliance”. When revalidating a PHA, we MUST challenge the facility’s “risk assumptions” and their “safeguards” all the way down to their very core in order to establish their true effectiveness. This is what I mean…
The vast majority of PHA’s that I facilitate or participate in are “revalidation’s” of previous studies; some are on their 4th or 5th revalidation. And yet it is all too common for us to find seriously flawed “assumptions” and too much credit given to certain safeguards. I believe it is the facilitator’s role to challenge the assumptions the team(s) makes regarding the frequencies, consequences, and safeguards associated with each process deviation. We even find PHA’s where some critical process deviations have not yet been studied. But most common are the assumptions and confidence a facility places in their “safeguards”. For the most part, it is VERY DIFFICULT for a facility to convince me that “SOPs and Training” are reliable safeguards that should be used to lower the risks of a particular scenario. If they insist they are different and so much more disciplined, I will take the time during breaks and at night to analyze a facility’s SOPs and Training to determine if they are at least meeting the OSHA/EPA minimums for SOP content and training. What I usually find is there are significant gaps in BOTH. Using their “previous incidents” and 3-year audit findings, I can make my case as to why “SOPs and Training” should not be used. When a facility has “previous incidents” where personnel was found to have not followed SOPs, or where an audit discovered personnel were not being trained at the correct frequencies, we should NOT be using these administrative controls in order to reduce our risks “on paper”! So I am more about engineering controls for layered protection and even then I challenge the design, functions, and maintenance of these engineering controls. For the most part, facilities have identified most of their deviations by now; what is missing is the discussions around the safeguards and their actual ability to function as they “hoped they would”. For example, how is the hi-hi level interlock on that bulk storage tank designed and maintained? Did the facility design this “safety system” to a Recognized and Generally Accepted Good Engineering Practice (RAGAGEP, such as API 2350)? Does the facility have the interlock logic defined (e.g. set points and what actions occur at set point(s))? Was the operator participating in the PHA aware of this safeguard and how it functions? Yes, we still find safeguards that engineers mention, that operators and maintenance personnel had no idea they even existed – HUGE FLAWS when this is happening!
Here are some basic guidelines that can help “challenge” the acceptance of a safeguard in your next PHA.
1) If the engineered safeguard is not listed and defined in the Process Safety Information as a “safety system” it can not be counted
2) If the engineered safeguard is not included in the facility’s Mechanical Integrity inspection/testing program it can not be counted (includes having a maintenance procedure for testing the safeguard)
3) If the engineered safeguard is not included in the SOPs and Operator training (i.e. operators were not aware of its present and/or function) it can not be counted
Of course, any of these issues NEED to be addressed with PHA recommendations to correct these errors. Often times these errors result in scenarios having a MUCH LOW risk level than is actually present within the process and this can cause quite a bit of concern and possibly require some FAST ACTION by the facility.
As for using “SOPs/Training” as a safeguard… I HIGHLY recommend this NOT be done. This would especially hold true if your “previous incidents” reviewed in the revalidation involved operator error or some type of deviation from established practices. Now I am not saying that all process-related incidents involve unsafe acts by workers; what I am saying is that when we provide credit to these administrative safeguards it can “blind us” to the actual level of risk associated with the deviation. Case in point… while doing a process walk-through in preparation for the PHA revalidation we came across a truck unloading its flammable liquid. This truck was NOT parked in the unloading bay spill basin as rain water had flooded the basin and the facility was running short on “Unloaders” for the week (due to vacations) so it had not been sampled and pumped out. Since the truck was not in the basin, the “permissive grounding” system cable could not reach the truck so the driver arranged for another “ground” to be used (which was tested and found to be over 100 ohms!). Also, the unloading activity was designed to be padded off using nitrogen gas; however, with the placement of the truck, N2 was not available so the driver used his truck pump to offload the flammable liquid. By using the truck’s pump, this BYPASSED the last line of defense (hi-hi level interlock) as the system was designed to shut down the N2 flow valve in order to stop the transfer; with using the truck pump, the transfer would continue! The SOP also called for the “operator” to inspect the facility hose (singular) before attaching to the truck and process. Since there was no available operator, the driver chose to use two (2) of his UN-INSPECTED hoses to reach the process connection (Please note these hoses were connected in a very INAPPROPRIATE manner involving duct tape!). SOP called for some very specific PPE to be used by the operator while making this transfer, most notably Flame Retardant Clothing; however, the driver was not donned in FRC as he never intended to the “HAZMAT attendant”. The driver, left by himself, had begun the transfer when we came upon the scene. This is an untrained driver in all respects; he knew nothing of the SOP requirements, PPE requirements, safety systems involved, emergency action plan (what to do in the event of a spill, where to go to be accounted for, emergency phone number for the plant, etc.). Sound bad? These deviations had been in place for seven (7) years! No MOC was done on the staffing change that allowed drivers to unload their content without any supervision. The previous PHA(s) just glossed over the fact that drivers were now unloading the HHC(s) across the site and without any official training.
We begin the PHA revalidation and the first node was “unloading”. All the scenarios regarding process deviations were controlled via all of the safeguards stated above (i.e. SOP/Training, Permissive Grounding System, Trailer spill containment, annually certified hoses, hi-hi level interlock, Area is an HAZLOC (truck engine off during unloading), Personnel in the area wear FRC, Emergency Response Plan). As you can imagine when we remove all these safeguards based on our observations from that walk-through, the risk(s) associated with these deviations went from very LOW to very HIGH! I will never forget the debate the engineer and operator and her supervisor had… engineer tried desperately to lay claim that what we saw was a rare instance and the facility should not be judged by one err’ed truck driver. Facility personnel quickly informed this engineer that what we witnessed was occurring several times a day across the plant site. The engineer quickly stated he had never signed a MOC to allow this practice and to his knowledge trained operators were performing the unloading activities. Needless to say, I was forced to don my stripped shirt and end the discussion as it was going to the gutter very quickly, with both sides mad and disappointed they were in this predicament. The point is that the original PHA had indeed identified the need for many of these safeguards and over the years the facility had implemented nearly all of them. But over time, and without proper management of change, many of these safeguards had been defeated in some fashion for varying reasons. None of the previous PHA revalidations had identified these changes to how the process is operated.
In closing… a GREAT guide as to answer the question “do I need to do a MOC on this change” is to refer back to the PHA and understand the state of the process and all the safeguards involved in those deviations. Had the facility performed a MOC on the differences in how the truck was being unloaded in comparison as to how it was intended to be unloaded then they would have been on the right track; however, I would question the thoroughness of the MOC had it actually allowed the truck to be unloaded with all the issues noted!