Process safety management for facility workers

Personal safety and process safety are different. Personal safety is about the hazards that hurt one person at a time: slips, cuts, falls, pinch points and strains. Process safety is about the hazards that can kill many people at once and destroy a facility: fires, explosions and toxic releases from loss of containment. A facility can go years without a recordable injury and still be one bypassed shutdown away from disaster. Process safety management (PSM) is the set of management system elements that companies use to prevent major accidents in hazardous processes. HSE-311 teaches PSM in depth, from hazard analysis methods to safety instrumented systems. This lesson focuses on what PSM means for the people who operate and maintain oil and gas facilities day to day, and on the elements where a field worker's actions matter most.

The elements of PSM

In the US, OSHA's PSM standard, 29 CFR 1910.119, and EPA's Risk Management Program list the elements that covered processes must have, and many companies apply the same elements to facilities that fall below the thresholds. In Canada, CSA Z767 sets out a similar framework. Whatever the source, the core elements are the same. They are summarized in the table below, with the part that facility workers play in each.

Safe operating limits

Every process has an operating envelope: the range of pressure, temperature, level, flow and composition within which equipment is designed to run safely. Process safety information documents these limits, and procedures say what to do when a variable approaches or crosses them. Typically there is a normal operating range, an alarm limit where the operator must act, and a safe operating limit or trip point beyond which the system shuts down or equipment may be damaged. Running outside the envelope, even when nothing goes wrong, uses up the safety margins that engineers built in. Operators should treat an excursion as a near miss, record it and ask why it happened.

Normalization of deviance is the process by which repeated small excursions come to feel normal. An alarm that sounds every shift is ignored; a level that runs above the high alarm becomes the new normal; a shutdown that trips often is bypassed to keep production going. Many major accidents, from refinery explosions to space shuttle losses, show this pattern. The antidote is to treat every recurring alarm, excursion and bypass as a problem to be solved rather than a nuisance to be lived with.

Management of change

Management of change (MOC) is the element field workers most often trigger, sometimes without realizing it. A change is anything other than a replacement in kind: a different valve, a new tie-in, a changed set point, a different chemical, a modified procedure, a temporary hose, a bypass, a new staffing arrangement or an extended run between inspections. Each change can introduce hazards that the original design and hazard analysis did not consider. The MOC process requires the change to be described, reviewed by people with the right expertise, approved, documented and communicated before it is made, and then checked before start-up.

A replacement in kind meets the original specification exactly: same material, rating, design and function. Anything else is a change. The table shows examples from oil and gas facilities.

Temporary changes need the same review as permanent ones, plus a firm end date. Temporary hoses, clamps, bypasses and jumpers have a way of becoming permanent. Many companies track them in a register and audit it regularly.

Bypasses, overrides and alarms

Shutdowns and alarms are among the most important safeguards in a facility, and they are also the easiest to defeat. A forced input in the control system, a jumper on a switch, a closed valve on an instrument line or a muted alarm can disable a safeguard in seconds. Bypasses are sometimes necessary, for example during start-up or while an instrument is repaired, but they must be controlled: authorized by the right person, recorded, time-limited, communicated at shift handover and backed by compensating measures such as continuous monitoring by an operator.

Alarm floods are another problem. During an upset, a poorly designed alarm system can present hundreds of alarms in minutes, burying the critical ones. Alarm management programs reduce nuisance alarms and prioritize important ones so that operators can respond. Operators help by reporting nuisance and standing alarms rather than learning to ignore them.

Measuring process safety

Injury rates do not measure process safety well, because major accidents are rare and injuries are dominated by personal safety events. The industry uses process safety event indicators instead. API RP 754, widely used in both countries, classifies loss of primary containment events by severity: Tier 1 for the most serious releases, Tier 2 for lesser releases, Tier 3 for challenges to safeguards such as relief valve lifts and safe operating limit excursions, and Tier 4 for measures of system performance such as overdue inspections. Tiers 3 and 4 are leading indicators that show weaknesses before a major event. The program below classifies a year of invented events at Spruce Ridge using simplified, illustrative thresholds, not the actual tables in the standard.

# Simplified process safety event classification for an invented year at a gas plant.
# Thresholds are illustrative only; the real API RP 754 tables depend on material category.
events = [
    ("Sour gas release from flange", "release", 640, False, False),
    ("Condensate leak at pump seal", "release", 70, False, False),
    ("Small amine leak at sample point", "release", 4, False, False),
    ("Relief valve lift to flare", "safeguard", 0, False, False),
    ("High-level excursion past SOL", "safeguard", 0, False, False),
    ("Fire at compressor lube oil skid", "release", 30, True, False),
    ("Worker hospitalized after H2S exposure", "release", 15, False, True),
]
TIER1_KG, TIER2_KG = 500, 50
hours = 410_000                      # employee and contractor hours, invented

counts = {1: 0, 2: 0, 3: 0}
for name, kind, kg, fire, injury in events:
    if kind == "safeguard":
        tier = 3
    elif kg >= TIER1_KG or injury:
        tier = 1
    elif kg >= TIER2_KG or fire:
        tier = 2
    else:
        tier = 3
    counts[tier] += 1
    print(f"Tier {tier}: {name}")
for t in (1, 2):
    print(f"Tier {t} rate: {counts[t] * 200_000 / hours:.2f} per 200,000 hours")
print(f"Tier 3 events (leading signs): {counts[3]}")

Tier 1: Sour gas release from flange
Tier 2: Condensate leak at pump seal
Tier 3: Small amine leak at sample point
Tier 3: Relief valve lift to flare
Tier 3: High-level excursion past SOL
Tier 2: Fire at compressor lube oil skid
Tier 1: Worker hospitalized after H2S exposure
Tier 1 rate: 0.98 per 200,000 hours
Tier 2 rate: 0.98 per 200,000 hours
Tier 3 events (leading signs): 3

The plant's two Tier 1 events, one large release and one release that hospitalized a worker, would be the headline, but the Tier 3 events tell the more useful story: a relief valve lift, an excursion past a safe operating limit and a small leak are all warnings that safeguards are being challenged. Organizations that collect and act on these leading signs, through near-miss reporting and Tier 3 and 4 tracking, can fix weaknesses before they line up into a major accident.

Field workers and PSM

PSM can sound like paperwork done by engineers in offices, but most of it depends on the people in the field. Procedures only work if they match the plant and operators follow them. Hazard analyses are only as good as the field knowledge brought to them. Mechanical integrity depends on technicians who test shutdowns and relief valves properly and record what they find. Management of change depends on someone noticing that a proposed fix is a change. And incident investigation depends on people reporting near misses honestly, without fear of blame. Organizations with strong process safety cultures encourage workers to speak up, stop work and question unusual conditions, and they treat bad news as useful information.

The 2005 Texas City refinery explosion, which killed 15 workers, led to major changes in US process safety practice, including API RP 754's indicators. The 1998 Esso Longford gas plant explosion in Australia, which killed two workers and cut gas supply to the state of Victoria for about two weeks, is especially relevant to gas plants: a loss of warm oil flow let a heat exchanger chill to about −48 °C, and when operators restarted warm flow, the brittle steel failed. Both events show how weak procedures, training, alarm management and management of change can combine, and both are taught in process safety programs across the industry.