Process safety management and emergency planning rules

Hannah Kowal's office at Grand Valley had a whole shelf of binders and a large wall calendar marked in three colours. "Everything we did in the last three lessons," she told Theo, "the procedures, the relief valve schedule, the near-miss report from the packing nut, the change review for the relief outlet, it all hangs together in one program. We run it to CSA Z767, the Canadian process safety management standard, because our parent company requires it, and because the Environmental Emergency Regulations require us to plan, practise and report." This lesson explains what process safety management is, which rules apply to ammonia plants in Canada, and what they mean for the technicians who work in those plants.

Process safety and personal safety

Most workplace safety is about personal safety: slips, falls, cuts, lifting, electrical shock. Process safety is about preventing the rare but severe events in which a hazardous material escapes from its containment or energy is released uncontrollably: fires, explosions and toxic releases. They need different tools. A plant can have an excellent record of personal safety, with no lost-time injuries for years, and still be heading toward a major release because a relief valve is overdue, a vessel is corroding under its insulation or a change was made without anyone checking its effects. Process safety management, PSM, is a structured set of practices for managing those hazards over the life of a plant.

The elements of a process safety program are broadly the same in every framework:

• Process safety information: up-to-date knowledge of the hazards of the materials, the design of the equipment, its limits and its relief systems.
• Process hazard analysis: a systematic team study of what could go wrong, using methods such as what-if checklists or hazard and operability studies, with recommendations that are tracked to completion and revalidated periodically.
• Operating procedures for each phase of operation, including normal, temporary and emergency operations, startup and shutdown.
• Training of operators and maintenance workers in the hazards and procedures, with refresher training.
• Contractor safety: selecting contractors who can work safely and informing them of the hazards.
• Pre-startup safety reviews before new or modified equipment is put into service.
• Mechanical integrity: inspection, testing and maintenance of equipment to recognized practice, with records, and correction of deficiencies.
• Hot work permits for welding, cutting and other ignition sources near the process.
• Management of change: a review of the hazards of any change in equipment, materials, procedures or staffing before it is made.
• Incident investigation of releases and near misses, with findings shared and acted on.
• Emergency planning and response.
• Compliance audits of the program itself, and employee participation in all of it.

The rules that apply

In Canada there is no single federal process safety regulation for refrigeration plants like OSHA's. The duties come from several places. Provincial occupational health and safety law, in Ontario the Occupational Health and Safety Act and its regulations, makes employers responsible for protecting workers from hazards, including hazardous substances and confined spaces. TSSA, under the Technical Standards and Safety Act, enforces CSA B52, the boiler and pressure vessel rules and the operating engineers regulation, O. Reg. 219/01, which governs the registration of refrigeration plants and the certificates their operators must hold. The federal Environmental Emergency Regulations, 2019, under the Canadian Environmental Protection Act, apply to facilities holding listed substances at or above threshold quantities, which for anhydrous ammonia is 4,500 kg. Those facilities must notify Environment and Climate Change Canada, prepare an environmental emergency plan, exercise it every year and in a full-scale exercise at least every five years, and report releases. CSA Z767, Process safety management, is a voluntary national standard that many companies, including Grand Valley's parent, adopt as the framework for their programs.

Whatever the rules, recognized and generally accepted good engineering practice is the standard against which the design and maintenance of an ammonia plant are judged, and for ammonia refrigeration that largely means the IIAR standards: IIAR 2 for design, IIAR 4 for installation, IIAR 5 for start-up, IIAR 6 for inspection, testing and maintenance, IIAR 7 for operating procedures, IIAR 8 for decommissioning and IIAR 9 for minimum safety requirements for existing systems, alongside CSA B52 where it applies. IIAR 9 is particularly important for older plants like Grand Valley's: it sets out the minimum safety features existing systems must have and the timelines for bringing them up to that level.

Mechanical integrity and the calendar

Much of process safety comes down to doing scheduled things on time and recording them: inspections, tests, replacements, reviews, audits, training and exercises. Hannah's wall calendar was the visible part of a database that listed every task, its basis, its interval and its last completion date. The script reproduces part of it and flags what was overdue or coming due.

# A process safety calendar for Grand Valley (dates illustrative; check the rules and the company's own program)
from datetime import date
def add_years(d, n):
    return d.replace(year=d.year + n)
today = date(2026, 11, 2)
items = [  # (activity, last done, interval in years, basis)
    ("tabletop exercise of the E2 plan", date(2025, 11, 20), 1, "E2 Regulations"),
    ("full-scale exercise with responders", date(2022, 5, 12), 5, "E2 Regulations"),
    ("process hazard analysis revalidation", date(2021, 9, 30), 5, "CSA Z767 program"),
    ("program audit", date(2024, 2, 15), 3, "CSA Z767 program"),
    ("relief valve replacement, receiver", date(2021, 6, 1), 5, "IIAR 6 practice"),
    ("operator refresher training", date(2024, 1, 10), 3, "company program")]
for name, last, years, basis in items:
    due = add_years(last, years)
    days = (due - today).days
    status = "OVERDUE" if days < 0 else ("due within 90 days" if days <= 90 else "ok")
    print(f"{name:38s} due {due}  {status:18s} ({basis})")

tabletop exercise of the E2 plan       due 2026-11-20  due within 90 days (E2 Regulations)
full-scale exercise with responders    due 2027-05-12  ok                 (E2 Regulations)
process hazard analysis revalidation   due 2026-09-30  OVERDUE            (CSA Z767 program)
program audit                          due 2027-02-15  ok                 (CSA Z767 program)
relief valve replacement, receiver     due 2026-06-01  OVERDUE            (IIAR 6 practice)
operator refresher training            due 2027-01-10  due within 90 days (company program)

The relief valve replacement on the receiver was overdue when Theo arrived, which is why it was done in lesson 5, and so was the five-year revalidation of the process hazard analysis, which had slipped when the plant manager changed. The annual tabletop exercise of the environmental emergency plan was due within weeks, and the full-scale exercise with the fire department the following spring. Hannah used the list to plan the year and to report to the company's management, which had to approve the resources for the overdue items. Overdue process safety tasks are not paperwork failures; each one is a layer of protection that may not be there when it is needed. Inspectors and auditors look first at whether a plant does what its own program says it does.

Management of change

Management of change is the element technicians meet most directly. Any change other than a replacement in kind, such as a different valve type, a new pipe route, a different relief setting, a new control sequence, a different oil, a change to a procedure or even a change in staffing, must be reviewed before it is made, to understand its effects on safety and to update the information, procedures and training. A replacement in kind, an identical part, does not need a review, but technicians must be sure that it really is identical, including its pressure rating, materials and set points.

At Grand Valley, the relief outlet issue from lesson 5 went through management of change: an engineer reviewed the distance from the outlet to the office's air intake against the code, recommended extending the discharge pipe by 3 m (10 ft) and adding a rain cap of the correct type, and the change was planned, approved, made, inspected and recorded, with the drawings updated. Theo also learned that if a technician proposes using a different gasket material because the specified one is out of stock, that is a change too.

Process hazard analysis

The process hazard analysis is the team study at the heart of a program. For an ammonia plant, the team usually includes an engineer, the chief operator, an experienced maintenance person, often a contractor like Ingrid, and a facilitator. Working from the drawings, they go through each part of the plant and ask what could go wrong: what if this valve is closed, what if the level rises, what if the power fails during defrost, what if a truck hits this pipe? For each scenario they identify the consequences, the safeguards in place and whether more are needed. The recommendations are tracked until each is completed or formally resolved. The analysis is revalidated every five years, and also when major changes are made. Theo joined the revalidation team for two days as the maintenance representative's helper, and was surprised by how often the operators' knowledge of the plant's quirks changed the team's view of a risk.

What this means for a technician

Working in a plant with a process safety program means following its systems as carefully as following a wiring diagram. Before starting work, a contractor's technicians receive the site's safety orientation and sign in. Work on the ammonia system is done under a permit that lists the hazards, the isolation, the protective equipment and the emergency arrangements, and under the plant's written procedures. Hot work needs its own permit. Anything that is not a replacement in kind goes through management of change. Incidents and near misses are reported, not hidden. And records of what was done, inspected or replaced are completed before the job is closed, because they become part of the plant's mechanical integrity evidence.

Incident investigation and learning

Process safety programs require releases and near misses to be investigated, and the quality of investigation is one of the clearest signs of a plant's safety culture. A good investigation looks past the immediate cause, such as a packing nut left loose, to the reasons it was possible: was there a procedure step for it, was the step clear, was the operator trained, was he rushed? It produces recommendations that address those reasons, and it shares the findings with everyone who could learn from them, including contractors. At Grand Valley, Hannah's investigation of the April near miss in lesson 6 led to a change in the procedure for returning a compressor to service and a short training session for every operator, and its findings were sent to the company's other plants.

Investigations depend on people reporting. If workers expect to be blamed, small events go unreported until a large one happens. Plants with good process safety records make it easy and safe to report, and they treat near misses as free lessons. Ingrid told Theo that the plants she trusted most were the ones with the longest lists of reported near misses, not the shortest.

Employee participation and contractors

Process safety programs also require employees to take part: in hazard analyses, in developing procedures and in investigations, and to have access to the program's information. Contractors must be selected for their safety performance, informed of the hazards and the emergency plan, and trained in the parts of the program that affect their work. For Northfield's industrial group, that meant site orientations at each plant, keeping records of their technicians' training and qualifications, and following each owner's permit and procedure system rather than their own.