I continue to see facilities struggle with the emergency shutdown SOP requirements and how it is all suppose to flow and fit into the daily operations. In this post I will try and lay out a flow to help make sense of these PSM/RMP requirements. I am hopeful you can learn from my mistakes, as I have learned this the hard way from many OSHA inspections and accident investigations.
In our Process Safety Information (PSI) we have set our Safe Operating Envelop (SOE) which is the safe upper and lower limits for all of our safety critical process parameters such as flow, level, temperature, pressure, pH, viscosity, etc. The idea is that we MUST operate within this SOE. When we “deviate” from the SOE, there will be a consequence to that deviation if it is not corrected, or even better – AVOIDED altogether.
Our SOPs have to list these deviations, their consequences and MOST IMPORTANTLY the “steps to correct or avoid the deviations”. A lot of folks call this “trouble shooting” and that is a good term because if we do nothing there will be some serious trouble! But in the realm of chemical process safety we cannot let personnel “freelance” and we have to address the deviation so we include in our SOPs these “steps to correct or avoid the deviations”.
This is where the emergency shutdown procedure comes into the picture. The operator has exhausted all the actions the SOP and their training directs them to take and the process is still outside the SOE. Their very next step is to begin emergency shutdown procedures or in some cases maybe even activating an emergency shutdown system.
Basically, once the operator has exhausted all their procedural guidance (i.e. documented in the SOP that has been annually certified and they have been trained on the SOP) and the process is still outside the SOE their next step is to begin shutting it down.
We always get the question/comment that the process has a high level interlock that will shutdown the system before something bad happens. My response to them is…
Your interlock is GREAT and it is needed, but it is the LAST LINE of defense and if it ever does actually shutdown your system because of a deviation we have had a MAJOR FAILURE/BREAKDOWN of our management system. PSM/RMP is ALL about keeping the tiger in the cage and if we let that tiger all the way of the cage and just grab him by the tip of his tail, it is a world of hurt to get him back in the cage. It is much easier, and cheaper, to just keep him inside the cage. We cannot rely on our last line of defense as a primary shutdown. It is truly there in the event that something crazy happens and operator(s) are not available to respond (e.g. they are dead already! – yes it has to be that bad before we rely on the last line of defense).
It should be getting clear no, that how we go about setting our SOE is critical. We do not want to set our SOE too close to the maximum process capabilities. For example, I have a pressure vessel that is rated for 300 psi (called the Maximum Allowed Working Pressure or MAWP) and we have a relief valve on the vessel with a set point of 300 psi. If we set the upper end of the SOE for pressure at 300 psi, this leaves NO room for error and more importantly we leave no room or time for the operator to begin his “trouble shooting” before the relief valve lifts and “lets the tiger out of the cage”. If your process normally operates at 275-285 psi, you need to go back to the design table and figure why in the heck we installed a vessel rated so close to our normal process pressures (e.g. NO safety factor!). The correct way would be to set your upper SOE at 250 psi. At 250 psi, the operator gets an audible (and may even a visual) alarm. He/she then turns to the SOP and their training in how they respond to this hi pressure alarm. Remember this is a DEVIATION and we must respond to it per the SOP steps to correct or avoid the deviation. They take the prescribed actions and still the process is outside the SOE…it is time to hit the Emergency Shutdown (ESD) button or begin the emergency shutdown procedures. If all works out well, they will be able to get the process down to a safe state BEFORE the relief valve lifts and releases the HHC to the atmosphere.
I hope this helps make sense of “emergency shutdown” and the conditions under which emergency shutdown has to be activated. Bottom line…we do NOT start shooting from the hip and experimenting during the time we are “trouble shooting”! The time to do your “what if we do this” is in the actual Process Hazard Analysis using the “What-if” methodology that is done in a controlled environment with many qualified personnel involved and NOT at 3 a.m. with alarms going off, an upset chemical process, and just one or two operators present. ALL of our actions have to be calculated, studied, and approved when dealing with these Highly Hazardous Chemicals (HHC). If your SOPs and training follow the methodology I have discussed here, things will turnout MUCH BETTER than you could have imagined.
Bryan