Recently I was asked if a PSM/RMP program can be managed 100% electronically on a company intranet site or company internal server. The short and simple answer is NO it may not. In further discussion, it was asked if this would be permissible if the company kept a back up CD/Disk that operators could use if the intranet/server system crashed. Again my answer is NO – at least one up-to-date HARD COPY is needed and here is why…
There are many failure modes that come into play with using electronic management systems. The most common one is “loss of power” where the computers and network go down. But there are other failure modes that can occur even when there is power available. I have seen first hand a loss of intranet and Internet when a fiber optic cable outside of the plant was damaged. I have recently seen a facility loose Internet and intranet because of flooding on the plant site because of all the local heavy rains. A severe/software crash would also be a failure mode that needs to be considered.
A little compliance history
The question of “electronic systems” first came about when companies began going hi-tech with their MSDS management programs in the 1990’s and began relying on fax machines and Internet access to obtain their MSDS sheets, rather than keeping all those binders of MSDSs. Here is what OSHA states about using electronic methods to manage MSDSs…
MSDSs must be readily accessible and there must be no barriers to employee access during the work shift. The Agency interprets the term “readily accessible” to mean immediate access to MSDSs. The employer has flexibility to determine how this will be accomplished. The use of electronic means such as computers with printers, microfiche machines, the Internet, CD-ROMS, fax machines, etc., is acceptable. Employers using electronic means to supply MSDSs to their employees must ensure that reliable devices are readily accessible in the workplace at all times; that workers are trained in the use of these devices, including specific software; that there is an adequate back-up system for rapid access to MSDSs in the event of an emergency, including power outages, equipment, and on-line access delays; and that the system is part of the overall hazard communication program of the workplace. Additionally, employees must be able to access hard copies of the MSDSs, and in the event of medical emergencies, employers must be able to immediately provide copies of MSDSs to medical personnel. Mere transmission of the requested information orally via telephone is not acceptable. (Source: OSHA CPL for HAZCOM)
The same rational should be applied to all electronic safety management systems. Electronic management makes things much easier and actually is more reliable (in my opinion) in ensuring that workers are using the most up-to-date and accurate safety information. BUT it can NOT fully replace the old fashion document control paper system. There are a lot of issues that need to be considered and addressed when one considers using an electronic management system.
The other side of using an electronic management system that has back-up power is how that back-up power system comes into play within our PSM/RMP management systems. When we have these emergency power systems, here are some things to consider in how they will fit into our overall PSM/RMP management systems. It is NOT as simple as “plugging it in”!
PSI – the specifications of the device(s) must be listed. If they are “Uninterruptible Power Supply” battery units (UPS) how long a life does each one have? Are all UPS units the same or has the PHA identified some UPS unit that need to have extended battery life? 1 hour, 2 hours, 12 hours, etc. It should also be listed as a “safety system” under your PSI (as well as in your SOPs). Generator fuel systems need to have a “minimum fuel level” identified so as to ensure they have adequate fuel for the emergency. Frequent running of the generator under your MI program will deplete fuel from the tank and at some point this fuel needs to be replaced. Personnel need to know what this minimum fuel level is.
PHA – We will most likely list this system as a “safe guard” for scenarios involving loss of power; but if we have a generator, we will want to include the generators location in our facility siting analysis for the process. Consider the modes of failure for your “loss of power” scenario and make sure your emergency power supply will not be taken out with these same failure modes. We have seen generators sited smack in the middle of an flammable process that would have been disabled in their scenarios (we could have an entirely seperate discussion about your RMP submital and your emergency power supplies!). I know OSHA is learning a lot about Vapor Cloud Explosion (VCE) blast wave studies from their Refinery PSM inspections and they now know to look to see if your emegency generator is within your VCE blast wave as indicated by your own study!!! If it is and this system is a critical utility it better have some form of engineered system to be able to survive the blast wave (goes back to PSI for this engineered system to protect it from a blast).
Operating Procedures – You’re going to want to list the back-up power as a “safety system” in your SOP(s). Also, if the operators have to do anything involving this back-up power supply, these actions need to be covered in an SOP. Most systems are automatic these days, but we have come across some systems that required an operator to activate the system manual by throwing a switch or pushing a button on the wall. These buttons and switches need to be labeled and an SOP needs to be available as to when, how and who will activate the system. Another aspect to consider is “emergency operations” procedures. If your practice is to continue operating the process using the “emergency power supply” this should be considered as an “emergency operations” procedure. This practice should be THOROUGHLY reviewed before being allowed, but it will be considered an “emergency operation”. If your emergency power supply is just meant to provide power long enough to use the emergency shutdown procedure, then the emergency power supply just needs to be listed in your ESD procedure as a “safety system”.
Mechanical Integrity – these emergency power systems MUST BE included in the MI program. This means they will be tested at some frequency to ensure their reliabilty. Batteries go bad and generators get over loaded and these tests/inspections are meant to ensure these systems will function as designed. Follow manufacturers recommendations for draining UPS charges and recharging to ensure the system will provide power for the prescribed time. Generators need to be run on some frequency as well (usually monthly). Another part of the generator inspection and testing should be a “load test” to ensure that the generator has NOT been overloaded. I can tell you first hand, that EVERYONE thinks their emergency needs are legitimate and will put a work order in to add their equipment to the generator. Without any formal review system (see MOC discussion below) the generator will be come overloaded and will not provide the needed power.
Management of Change – As should be very clear, these systems fall under our PSM/RMP systems (assuming your use of these systems are for PSM/RMP systems). The most common failure we find around these systems is that changes to them are not covered under the Management of Change systems. The most common problem we find are generators that have been overloaded as the facility just keeps adding equipment to the generator and eventually the load will be too much and the generator will trip on the overload, thus not having any back-up power. Any changes, including adding equipment to the emergency power supply, should require an MOC. Taking the emergency power system OFF LINE for any reason, including repairs, NEEDS to have an MOC done so as the proper review can be made to determine the level of risk of running without emergency back up power. I have seen some processes be brought down using normal shutdown because the emergency back up systems were going to be out of service for 1 day and the facility felt that was too long to run without back up power.
Pre-Start Up Safety Review – your emergency power systems should be on your PSSR checklist to ensure someone has verified they are on-line, functioning and ready for action. And don’t forget to REFUEL the generator or wait until the UPS units have fully charged after an incident that depeleted their charge/fuel!!!!
So as you can see, using back up power has it’s own requirements AND STILL with ALL OF THESE MEASURES IN PLACE, we can NOT rely solely on an electronic management system. At least one hard copy of your program(s) is needed. Granted you will not have to have your entire PSM/RMP program on paper, but those critical programs that will be needed in the event you loose a server, loose power, loose intranet/internet MUST BE AVAILABLE to those personnel who need them 100% of the time. Programs like your Employee Participation, last two audit reports, PSSR, may be able to be excluded, but a THOROUGH REVIEW needs to take place to understand this better. I can WITH CLEAR CERTAINTY state that the following will need to be available:
- Operating Procedures and Safe Work Practices
- Emergency Action Plan and Response Plan
- Management of Change forms in the event that an Emergency MOC may be needed
- PSI (e.g. MSDS)
Lastly I want to share with you an actual situation we found during a PSM/RMP audit: The facility maintained a back-up of their files on a daily basis. The IT group at the plant took care of this daily network back-up. The facility’s plan was that if there was an “interruption in the electronic system” that IT would provide this “back-up” to operations so that operators and maintenance personnel would have access to the most up to date information. During our audit we tested this system by asking the shift supervisor to get the back-up system up and running. There was no documented procedure for how this was to be done and the facility had never tested their “system”. The supervisor had no idea as how to do this, from who to contact to how he was to actually use the back-up. Another VERY INTERESTING discovery was that only the oldest computer in the control room had a CD-ROM reader. The IT group, in a cost saving effort and increased security, “changed” their specifications for new computers for open access areas. New computers that are going into “open access areas” did not have CD readers. Can you guess how IT provided the back-up to the supervisor…yep on a CD. It was only by error that the oldest computer was still in the control room, which means there was not suppose to be a CD reader in the room!!! After two hours of not being able to get the back up system up and running, the facility admitted their system was flawed. Lesson to be learned…THINK THROUGH your systems and WRITE an SOP or incorporate this into existing SOPs. Understand how your emergency back up systems, both power and electronic data, are designed to operate and conduct TESTS/DRILLS to ensure all aspects work as designed. Keep in mind that even the smallest change to the back up system WILL FALL under your MOC program, even when IT changes their specifications of the computers that may be used in these emergencies! Also, just like smoke detectors, UPS units can be “borrowed” for other applications and never returned to their primiary function. We have found UPS units moved to other equipment without MOCs and no one ever knew the battery back-up had been moved. The monthly checks did NOT include a check to ensure it was backing up the right equipment, only that it was fully charged. Maintenance did their monthly inspection, but they were never told what the UPS was suppose to be backing up!
I hope this helps you understand all that goes into “back-up systems” for your PSM/RMP covered processes. If you have questions about your PSM/RMP Management System feel free to contact me @ [email protected].