Loss Prevention in Chemical Plants

FM Global Property Loss Prevention Data Sheets

7-43 17-2

May 1999 Revised January 2001 Page 1 of 51

LOSS PREVENTION IN CHEMICAL PLANTS

Table of Contents Page 1.0 SCOPE SCOPE ............... ............... ............... ............... ............... ............... ................ ............... ............... ........... 4 1.1 Changes Changes .................... .............................. .................... .................... .................... .................... .................... .................... .................... .................... ................... ................... ................... ......... 4 2.0 LOSS PREVENTION RECOMMENDAT RECOMMENDATIONS IONS ....................................................................................... 4 2.1 Human Human Element Element ................... ............................. .................... .................... .................... .................... .................... ................... ................... .................... .................... ................... ......... 4 2.1.1 Process Process Safety Management Management (PSM) System ................... ............................. .................... .................... .................... .................... ............. ... 4 2.1.1.1 General General .................... .............................. ................... ................... .................... .................... .................... .................... .................... .................... ................... ......... 4 2.1.1.2 Accountabil Accountability ity and Responsibi Responsibility lity .................... .............................. .................... .................... .................... .................... .................. ........ 5 2.1.1.3 Process Process Safety Knowledge Knowledge and Documentati Documentation on .................... .............................. .................... .................... ............... ..... 5 2.1.1.4 Process Process Safety Review (Process Hazard Analysis) Analysis) .................... .............................. .................... .................... .......... 5 2.1.1.5 Managemen Managementt of Change Change .................... .............................. .................... .................... ................... ................... .................... .................... ............. ... 6 2.1.1.6 Process Process and Equipment (Mechanical) (Mechanical) Integrity Integrity ................... ............................. .................... .................... .................. ........ 6 2.1.1.7 Incident Incident Investigation Investigation .................... .............................. .................... .................... .................... .................... ................... ................... .................. ........ 6 2.1.1.8 Training Training and Performance Performance .................... .............................. .................... .................... .................... .................... .................... ................... ......... 7 2.1.1.9 Human Factors ................... ............................. .................... .................... .................... .................... .................... .................... .................... ................. ....... 7 2.1.1.9.1 2.1.1.9.1 Organizatio Organization n ................... ............................. .................... .................... .................... .................... .................... .................... ................ ...... 7 2.1.1.9.2 2.1.1.9.2 Alarms Alarms ................... ............................. .................... .................... .................... .................... .................... .................... .................... ................ ...... 8 2.1.1.9.3 2.1.1.9.3 Environmen Environmental tal ................... ............................. .................... .................... .................... .................... .................... .................... .............. .... 8 2.1.1.9.4 2.1.1.9.4 Maintenanc Maintenance e Operations Operations .................... .............................. .................... .................... .................... .................... ................ ...... 8 2.1.1.10 2.1.1.10 Standards, Standards, Codes and Laws .................... .............................. .................... .................... .................... .................... .................... ............. ... 8 2.1.2 Highly Highly Protected Protected Risk (HPR) .................... .............................. .................... .................... .................... .................... .................... .................... ................. ....... 8 2.1.3 Principles Principles of Inherent Inherent Safety .................... .............................. .................... .................... .................... .................... .................... .................... ................. ....... 9 3.0 SUPPORT FOR RECOMMENDATIONS RECOMMENDATIONS ............... ............... ............... ............... ............... ............... ..... 9 3.1 Background Background Information Information ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... ............... ..... 9 3.1.1 Process Process Risk Management Management Strategies Strategies ................... ............................. .................... .................... .................... .................... .................... ............. ... 9 3.1.1.1 Tier Tier 1 - Inherent Safety ................... ............................. .................... .................... .................... .................... .................... .................... ............ .. 10 3.1.1.2 Tier Tier 2 - Passive Passive .................... .............................. .................... ................... ................... .................... .................... .................... .................... .............. .... 10 3.1.1.3 Tier Tier 3 - Active .................... .............................. .................... .................... .................... .................... .................... .................... .................... ................. ....... 11 3.1.1.4 Tier Tier 4 - Procedural Procedural ................... ............................. .................... .................... .................... .................... ................... ................... .................... ............ 11 3.1.1.5 Summary Summary .................... .............................. .................... .................... .................... .................... ................... ................... .................... .................... .............. .... 12 3.1.2 Process Process Safety Management Management ................... ............................. .................... .................... .................... .................... ................... ................... ................ ...... 12 3.1.2.1 Accountabil Accountability ity and Responsibi Responsibility lity .................... .............................. .................... .................... .................... .................... ................ ...... 12 3.1.2.1.1 3.1.2.1.1 Example: Example: Liquefied Liquefied Petroleum Gas (LPG), Mexico City, City, Mexico ............. ............. 13 3.1.2.1.2 3.1.2.1.2 References References .................... .............................. ................... ................... .................... .................... .................... .................... ................ ...... 13 3.1.2.2 Process Process Safety Knowledge Knowledge and Documentati Documentation on .................... .............................. .................... .................... ............. ... 13 3.1.2.3 Process Safety Review Review (Process (Process Hazard Analysis) Analysis) ................... ............................. .................... .................... .......... 15 3.1.2.3.1 3.1.2.3.1 Examples Examples ................... ............................. .................... .................... .................... .................... .................... .................... ................... ......... 16 3.1.2.4 Process Process Risk Management Management ................... ............................. .................... .................... .................... .................... .................... ................ ...... 17 3.1.2.4.1 3.1.2.4.1 Case Study .................... .............................. ................... ................... .................... .................... .................... .................... ................ ...... 17 3.1.2.4.2 3.1.2.4.2 HPR Requireme Requirements nts ................... ............................. .................... .................... .................... .................... .................... .............. .... 20 3.1.2.5 Managemen Managementt of Change Change .................... .............................. .................... .................... ................... ................... .................... .................... ............ 20 3.1.2.5.1 3.1.2.5.1 Change Change in Technology echnology ................... ............................. .................... .................... .................... .................... ................... ......... 20 3.1.2.5.2 3.1.2.5.2 Changes Changes in Facilities ................... ............................. .................... .................... .................... .................... .................... ............ 21 3.1.2.5.3 3.1.2.5.3 Changes Changes in Personnel ................... ............................. .................... .................... .................... .................... ................... ......... 21 3.1.2.5.4 3.1.2.5.4 Examples Examples ................... ............................. .................... .................... .................... .................... .................... .................... ................... ......... 21 3.1.2.5.5 3.1.2.5.5 References References .................... .............................. ................... ................... .................... .................... .................... .................... ................ ...... 23

©2000 F actory Mutual Insurance Company. Company. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, or transmitted, in whole or in part, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission of Factory Mutual Insurance Company.

7-43 17-2 Page 2

Loss Prevention in Chemical Plants FM Global Property Loss Prevention Data Sheets

3.1.2.6 Process Process and Equipment Equipment (Mechanical (Mechanical)) Integrity .................... ............................. ................... .................... ............... ..... 23 3.1.2.6.1 3.1.2.6.1 Reliabilit Reliability y Engineerin Engineering g ................... ............................. .................... .................... .................... .................... ................... ......... 23 3.1.2.6.2 3.1.2.6.2 Materials Materials of Constructio Construction n and Fabrication Fabrication .................... .............................. .................... .................. ........ 24 3.1.2.6.3 3.1.2.6.3 Installatio Installation n Procedures Procedures .................... ............................. ................... .................... .................... .................... .................. ........ 24 3.1.2.6.4 3.1.2.6.4 Preventive Preventive Maintenanc Maintenance e ................... ............................. .................... .................... .................... .................... ................ ...... 24 3.1.2.6.5 3.1.2.6.5 Demolition Demolition Procedures Procedures ................... ............................. .................... .................... .................... .................... .................. ........ 25 3.1.2.7 Incident Incident Investigation Investigation .................... .............................. ................... ................... .................... .................... .................... .................... ................ ...... 25 3.1.2.7.1 3.1.2.7.1 Basic Elements Elements .................... .............................. .................... .................... .................... .................... .................... ................... ......... 25 3.1.2.7.2 3.1.2.7.2 Incident Incident Investigation Investigation Concepts .................... .............................. .................... .................... .................... ............. ... 26 3.1.2.7.3 Investigative Techniques ............... ............... ............... ............... ............... 26 3.1.2.7.4 3.1.2.7.4 Example Example .................... ............................. ................... .................... .................... .................... .................... .................... .................... ............ 27 3.1.2.8 Training Training and Performance Performance .................... .............................. .................... .................... .................... .................... .................... ................. ....... 28 3.1.2.8.1 3.1.2.8.1 Example: Example: Three Mile Island ................... ............................. .................... .................... .................... .................... ............ 29 3.1.2.8.2 3.1.2.8.2 References References ................... ............................. .................... .................... .................... .................... .................... .................... ................ ...... 29 3.1.2.9 Human Factors ................... ............................. .................... .................... .................... .................... .................... .................... ................... ............... ...... 29 3.1.2.9.1 3.1.2.9.1 Human Human Behavior Behavior .................... .............................. .................... .................... ................... ................... .................... .................. ........ 30 3.1.2.9.2 3.1.2.9.2 Human/Mach Human/Machine ine Interface ................... ............................. .................... .................... .................... .................... ............. ... 31 3.1.2.9.3 3.1.2.9.3 Work Environment Environment .................... .............................. .................... .................... .................... .................... .................... .............. .... 32 3.1.2.9.4 3.1.2.9.4 Human Human Factor in Maintenance Maintenance Operations Operations .................... .............................. ................... ................ ....... 32 3.1.2.9.5 References .............. ............... ............... ............... ............... ................ ....... 32 3.1.2.10 3.1.2.10 Standards, Standards, Codes, and Laws ................... ............................. .................... .................... .................... .................... .................... ............ 33 3.1.2.11 3.1.2.11 Audits and Corrective Corrective Actions ................... ............................. .................... .................... .................... .................... .................... ............ 33 3.1.2.1 3.1.2.11.1 PSM Audit Preparation Preparation ................... ............................. .................... .................... .................... .................... ................ ...... 34 3.1.2.1 3.1.2.11.2 PSM Audit Techniques echniques .................... .............................. .................... .................... .................... .................... ................ ...... 35 3.1.2.12 3.1.2.12 Emergency Emergency Response Planning .................... .............................. .................... .................... .................... .................... ................ ...... 36 3.1.3 Concepts Concepts of Highly Protected Risk .................... ............................. ................... .................... .................... .................... .................... ................ ...... 37 3.1.3.1 Requiremen Requirements ts to Achieve HPR Status .................... .............................. .................... .................... .................... .................. ........ 37 3.1.3.1.1 3.1.3.1.1 Integrated Integrated PSM System ................... ............................. .................... .................... .................... .................... ................ ...... 37 3.1.3.1.2 3.1.3.1.2 Managemen Managementt Commitment Commitment and Oversight Oversight ................... ............................. .................... .................. ........ 38 3.1.3.1.3 3.1.3.1.3 Instrumenta Instrumentation tion and Process Process Control Control .................... .............................. .................... .................... ............... ..... 38 3.1.3.1.4 3.1.3.1.4 Operator Operator Training Training and Empowerme Empowerment nt ................... ............................. .................... .................... ............... ..... 38 3.1.3.1.5 3.1.3.1.5 Vessel, Vessel, Piping Piping and Reaction Reaction Overpressure Overpressure Protection Protection ................... ............................ ......... 38 3.1.3.1.6 3.1.3.1.6 Maintenanc Maintenance, e, Inspection, Inspection, and Testing esting programs programs .................... .............................. .................. ........ 39 3.1.3.1.7 3.1.3.1.7 Adequate Adequate and Reliable Water Water Supply and Delivery Delivery System .................... .................... 39 39 3.1.3.1.8 3.1.3.1.8 Ignition Ignition Source Control .................... ............................. ................... .................... .................... .................... .................. ........ 39 3.1.3.1.9 3.1.3.1.9 Adequate Adequate Spacing of Buildings, Buildings, Process Units and Tanks Tanks .................... ...................... .. 39 3.1.3.1.10 3.1.3.1.10 Emergency Emergency Response Response and Post-loss Post-loss Contingency Contingency Plans .................... ...................... .. 40 3.1.3.1.1 3.1.3.1.11 1 Testing and Understanding Understanding of Process Chemistry Chemistry .................... ............................. ............. .... 40 3.1.3.1.12 3.1.3.1.12 Adequate Adequate and Reliable Fixed Fixed Suppression Suppression Systems .................... ............................. ......... 40 3.1.3.1.13 3.1.3.1.13 Drainage Drainage and Containment Containment Systems .................... .............................. .................... .................... ............. ... 41 3.1.3.1.14 3.1.3.1.14 Equipment Equipment and Structural Steel Fire Protection Protection ................... ............................. .................. ........ 41 3.1.3.1.15 3.1.3.1.15 Damage Damage Limiting and Noncombustibl Noncombustible e Construction Construction ................... ............................. .......... 42 3.1.3.1.16 3.1.3.1.16 Combustibl Combustible e Gas Detection .................... .............................. .................... .................... .................... .................. ........ 42 3.1.3.1.17 3.1.3.1.17 Inerting Inerting and Purging Purging Systems .................... .............................. ................... ................... .................... ............... ..... 42 3.1.3.1.18 3.1.3.1.18 Barriers Barriers and Barricades Barricades .................... .............................. .................... .................... .................... ................... .............. ..... 42 3.1.3.1.19 3.1.3.1.19 Protection Protection Against Against Natural Natural Perils Perils ................... ............................. .................... .................... .................... ............ 43 3.1.4 Concepts Concepts of Inherent Inherent Safety .................... .............................. .................... .................... .................... ................... ................... .................... ................ ...... 43 3.1.4.1 Intensificat Intensification ion .................... .............................. .................... .................... .................... .................... .................... .................... .................... ................. ....... 43 3.1.4.2 Substitution Substitution .................... .............................. .................... .................... .................... .................... ................... ................... .................... .................... ............ 43 3.1.4.3 Attenuation Attenuation ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... ............ .. 44 3.1.4.4 Limitation Limitation of Effects Effects .................... .............................. .................... .................... .................... .................... .................... .................... ................. ....... 44 3.1.4.5 Simplification/Error Tolerance .............. ............... ............... ................ ............... ....... 45 4.0 REFERE REFERENCES NCES .............. ............... ............... ............... ............... ............... ............... ................ ............. 45 4.1 FM Global Global ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... .................... .................... ............... ..... 45 APPENDIX APPEND IX A GLOSS GLOSSARY ARY OF TERMS ..................................................................................................... 45 APPENDIX APPEND IX B DOCUM DOCUMENT ENT REVISION HISTORY HISTORY ..................................................................................... 45

©2000 Factory Mutual Insurance Company. All rights reserved.


7-43 17-2 Page 3

APPENDIX C: INTERNATIONAL INTERNATIONAL ORGANIZATIONS ORGANIZATIONS AND REGULATORY REGULATORY CODES OVERSEEING CHEMICAL PLANT PROCESS SAFETY ................. ............... ............... . 45 C.1 Mandatory Mandatory Regulations Regulations Covering Covering PSM and Related Chemical Chemical Industry Safety Oversight Oversight .......... 45 C.1.1 Europe .................... .............................. .................... .................... .................... .................... .................... .................... .................... .................... .................... .................. ........ 46 C.1.2 United States .................... .............................. .................... .................... .................... .................... ................... ................... .................... .................... ................... ......... 46 C.1.2.1 Occupationa Occupationall Safety and Health Administrat Administration ion .................... .............................. .................... .................... ............. ... 46 C.1.2.2 Environmen Environmental tal Protection Protection Agency ................... ............................. .................... .................... .................... .................... ................ ...... 47 C.2 Vo Volunta luntary ry Chem Chemical ical Industry Programs Programs ............... ............... ............... ............... ............... ............. 48 C.2.1 Respo Responsible nsible Care Care ® ............. ................ ............... ............... ............... ............... ............... ... 48 C.2.2 Intern Internationa ationall Safety Rating System (ISRS) (ISRS) ......................................................................... 48 C.3 C.3 Other Sources for Chemical Chemical Process Safety Guidelines Guidelines ................... ............................. .................... .................... .................... ............. ... 49 C.3 C.3.1 Australia Australia .................... .............................. .................... .................... ................... ................... .................... .................... .................... .................... .................... ................. ....... 49 C.3 C.3.2 Canada Canada ................... ............................. .................... .................... .................... .................... .................... .................... .................... ................... ................... ................... ......... 49 C.3 C.3.3 India ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... .................... ................... ............. .... 49 C.3 C.3.4 Far East .................... .............................. .................... .................... ................... ................... .................... .................... .................... .................... .................... ................. ....... 49 C.3 C.3.5 South America ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... ................. ....... 49 C.3 C.3.6 United Kingdom ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... ............... ..... 49 C.3 C.3.7 United States .................... .............................. .................... .................... .................... .................... ................... ................... .................... .................... ................... ......... 49 APPENDIX APPEND IX D BIBLIO BIBLIOGRAPH GRAPHY Y .............. ............... ................ ............... ............... ............... ............... ........ 50 D.1 Process Process Safety and Risk Managemen Managementt ................... ............................. .................... .................... .................... .................... .................... ................... ......... 50 D.2 Highly Highly Protected Protected Risk Guideline Guidelines s for Chemical Industry ................... ............................. .................... .................... .................... ............. ... 50 D.3 Concepts Concepts of Inherent Inherent Safety .................... .............................. .................... .................... .................... .................... .................... .................... .................... ............... ..... 50 D.4 Preventive Preventive Maintenanc Maintenance e ................... ............................. .................... .................... .................... .................... .................... .................... .................... .................... ............ .. 51 D.5 Chemical Chemical Hazard Information Information .................... .............................. ................... ................... .................... .................... .................... .................... .................... .............. .... 51

List of Tables Table 1. Comp Comparison arison of OSHA and EPA Threshol Thresholds ds of the More Comm Common on Hazardous Chemicals Chemicals .......... .......... 47


7-43 17-2

Loss Prevention in Chemical Plants

Page 4


1.0 SCO SCOPE PE

This data sheet describes general principles and concepts of chemical risk loss prevention and the minimum requirements for a chemical operation to qualify as a Highly Protected Risk (HPR). Other FM Global data sheets, listed in Appendix D.2, provide specific guidance on protection concepts and design requirements within this HPR framework. An HPR chemical facility is one that meets the highest standards of property loss prevention including management agement commitment, commitment, process process control, control, fixed active and passive passive protection protection where needed, needed, and employee training and awareness. Process Safety Management (PSM) as a way of conducting business has been developed over many years to guide the chemical process industry toward safer facilities before being adopted by various regulatory agencies. It can and should be considered the foundation of all loss prevention activities in this industry as well as related industries with hazardous chemical processes. Process safety management is a necessary component of an HPR facility to minimize or prevent episodic releases or events that can cause property damage and business interruption. A number of U.S. national and state regulations, as well as those of the European Union and other international regulators, have adopted PSM in one form or another. (Highlights of some of these regulations are in the Appendix.) This data sheet is not meant to address issues associated with regulatory compliance but also does not introduce any conflicts with these regulations. As a fundamental subset of PSM and HPR concepts, principles of inherent safety, as they apply to the chemical industry, are also discussed. Practicing the concept of inherent safety can significantly reduce the overall risk of a hazardous plant or process. The concepts of Highly Protected Risk, process safety management, and inherent safety are all interrelated and apply to chemical chemical facilities as well as non-chemic non-chemical al facilities facilities with chemical chemical processes. The level of detail to which PSM principles are implemented is in proportion to the level of hazard of the operation. PSM principles are not a cookbook to be followed but a philosophy to be applied according to need. 1.1 Changes Changes

September 2000. This revision of the document has been reorganized to provide a consistent format. 2.0 LOSS PREVENTION RECOMMENDAT RECOMMENDATIONS IONS 2.1 Human Elemen Elementt 2.1.1 2.1. 1 Process Process Safety Management Management (PSM) System

2.1.1.1 2.1.1.1 General General 2.1.1.1.1 2.1.1.1.1 Chemical Chemical plants and hazardous chemical chemical operations operations in other plants should have a process process safety management system in place to ensure that the following (or equivalent) elements* of process safety are integrated into plant operations: a) Accountabil Accountability ity and Responsibi Responsibility lity b) Process Process Safety Knowledge Knowledge and Documentation Documentation c) Process Process Safety Review (Process Hazard Analysis) Analysis) d) Process Process Risk Management Management e) Managemen Managementt of Change f) Process Process and Equipment Equipment (Mechanical) (Mechanical) Integrity Integrity g) Incident Incident Investigation Investigation h) Training Training and Performance Performance i) Human Factors Factors j) Standards, Codes, and Laws



7-43 17-2 Page 5

k) Audits and Corrective Corrective Actions Actions l) Emergency Emergency Response Response Planning * Thes These e 12 elem elemen ents ts are are base based d on the Cent Center er for Chem Chemic ical al Proc Proces ess s Safet Safety y (CCP (CCPS) S) ‘‘Pl ‘‘Plan antt Guid Guidel elin ines es forTec forTechhnical Management Management of Chemical Chemical Process Safety’’. Safety’’. Other guidelines guidelines are equivalent equivalent and can be substituted. substituted. A list of CCPS and other references on PSM is provided in Appendix D, Bibliography. 2.1.1.2 Accountability and Responsibility Key components of this element are a policy statement; management commitment; procedural requirements; and a performance measurement. 2.1.1.2.1 2.1.1.2.1 Managemen Managementt should should develop develop a written written policy policy statement statement that clearly clearly defines process safety and loss prevention prevention as a priority priority that is shared by managemen managementt as well as plant operations operations personnel. personnel. The statement could include a Process Safety Management organization chart that clearly shows positions, lines of authority, authority, and process safety functional titles. The policy statement should receive broad broad distribution to all sectors of the organization, backed by genuine management interest in loss prevention. The statement and organizational chart should be reviewed regularly and updated as needed to reflect things such as management changes within the facility. 2.1.1.2.2 2.1.1.2.2 The facility’s facility’s PSM program should have procedures procedures to resolve resolve safety and loss prevention prevention concerns that arise from new design, HAZOP reviews, Management Management of Change Change (MOC) (MOC) issues, issues, etc., and should include input from operations employees, where appropriate. These procedures should designate a person or position that is responsibl responsible e for achieving resolution. resolution. 2.1.1.2.3 2.1.1.2.3 A program program should be in place to track how well safety and loss prevention prevention concerns concerns are resolved. resolved. Of particular interest are those concerns that were not easily resolved. This could be as simple as a monthly report of the status of unresolved issues sent to a designated responsible person as indicated by the organizational chart or plant procedures. 2.1.1.3 2.1.1.3 Process Process Safety Knowledge Knowledge and Documentati Documentation on 2.1.1.3.1 The organization should assign responsibility responsibility for maintaining key material and and process hazard information, design basis information, design standards, electrical area classifications, key design decisions, alternate process considerations, and basic operation and maintenance procedures for all chemical processes. Documents also would also include accident investigations, causes and corrections as well as records of process, equipment and maintenance changes. 2.1.1.3.2 2.1.1.3.2 All processes should have detailed detailed written procedures procedures that document normal operating operating procedures, as well as start-up, shutdown and abnormal situations. These procedures should be kept up-to-date and written in such manner as to be understood by all operating personnel. Should the facility be multilingual, procedures should be maintained in separate form for each language. Any changes to the documented procedures procedures should follow the Managemen Managementt of Change Change procedures procedures of the PSM program. program. Operator involvement in writing writing the procedures procedures will ensure comprehens comprehensive ive detail in the procedures. procedures. 2.1.1.3.3 2.1.1.3.3 A periodic periodic review or audit should be performed performed for all written procedures procedures to ensure ensure they remain remain current. 2.1.1.4 2.1.1.4 Process Process Safety Review (Process (Process Hazard Hazard Analysis) Analysis) 2.1.1.4.1 2.1.1.4.1 The following following are considered considered a minimum minimum to meet the Process Safety Review requirements requirements in an effective program based on PSM principles: a) Collaborati Collaboration on between process and loss prevention specialist specialists s at the concept concept stages of a project. b) Agreement Agreement on a protection philosophy philosophy with special consideratio consideration n given to inherently inherently safe design in site selection, construction and protection features. c) Conduct a detailed process safety review using a recognized methodology (HAZOP, (HAZOP, Checklist, FEMA, etc.) at an early stage in the project. The review should be updated whenever process changes are made and a complete re-evaluation made on a regular basis (about 5 yr. intervals).


7-43 17-2


Page 6


2.1.1.5 Management of Change 2.1.1.5.1 Management should establish and implement written procedures to manage change in technology, facilities and personnel. These procedures should be flexible enough to accommodate both major and minor changes and should be understood and used. These procedures should: a) Provide a method for identification of changes that should be subject to MOC procedures. b) Provide for documentation of the process and mechanical design basis for the proposed change. c) Provide an analysis of the loss prevention considerations involved in the proposed change, including a formal process hazards review, if appropriate. The effects of the proposed change on separate but interrelated upstream or downstream facilities also should be reviewed. d) Identify the need for modifications of the operating procedures, updating P&IDs, updating personnel training, etc. e) Provide for communication of the proposed change and the consequences of that change to appropriate personnel such as maintenance engineers, operators, safety, and emergency response staff. f) Establish administrative procedures needed (documentation, checklists that cover hazards, records of personnel skills, responsibilities and training.) g) Provide for tracking of and limiting the duration of any temporary change. h) Identify the required authorizations. 2.1.1.5.2 A qualified member of the plant loss prevention, safety, or engineering staff should be assigned to communicate changes to the FM Global specialist where appropriate. This individual should ensure that all plant personnel follow accepted methods for management of change, and that the FM Global specialist is notified at the earliest stages of significant changes, to allow for proper consideration of the loss prevention aspects. 2.1.1.6 Process and Equipment (Mechanical) Integrity 2.1.1.6.1 To implement this element of PSM, programs should be in place to address the following: a) Reliability Engineering — Tracking and evaluating of individual equipment and processes to prevent unexpected incidents throughout its lifetime. b) Materials of Construction and Fabrication — Ensuring that equipment is built according to appropriate standards with materials appropriate to the service conditions with appropriate supporting documentation. c) Installation Procedures — Planning quality control, inspection and pre-startup integrity testing to ensure installation in accordance with specifications and direction of the manufacturer. Poor installation can invalidate a good design. d) Preventive Maintenance — Documenting procedures to ensure that maintenance is completed on schedule, unscheduled work is properly authorized and completed without introducing additional hazards, and records are maintained and evaluated to identify future needs. This would include a comprehensive vessel and piping inspection program, as well as instrumentation inspection, testing and calibration. e) Demolition Procedures — Documenting methods to isolate, remove and dispose of obsolete or unneeded equipment without creating unnecessary hazards. 2.1.1.7 Incident Investigation 2.1.1.7.1 The corporation should have a system based on PSM principles that requires that incidents be recorded and investigated. The investigation methods should consist of the basic elements outlined above, and records should be kept detailing each incident, the level and results of the investigation and the status of any findings or recommendations developed.



7-43 17-2 Page 7

2.1.1.7.2 Management should make use of all incident investigations and near-misses to evaluate recurrences. Action should be taken to eliminate the source of error, either through system redesign or additional training. Important lessons learned in these investigations should receive wide distribution to interested and affected parties. 2.1.1.8 Training and Performance 2.1.1.8.1 Operators should be fully trained in the normal operation of the facility, as well as the appropriate action for each alarm condition. Since every process excursion cannot be detailed, the operators should be trained in diagnostic and troubleshooting skills to facilitate an orderly correction. For the most critical applications (i.e., nitrations, some polymerization and other highly reactive systems) use of a process simulator for training purposes is strongly suggested. If a simulator is to be used, the control panel and instrumentation should be designed to match the actual equipment that will be used in the operation. 2.1.1.8.2 When either temporary or permanent changes are made to a process, the process documentation and drawings should be updated prior to implementation of the changes. All employees whose responsibilities involve the affected area should be retrained in the new process parameters and safe working conditions. This will allow integration of the new procedures into the day-to-day functioning of the facility. 2.1.1.8.3 Special care must be taken when critical actions are infrequently completed in the normal course of operations. Actions such as responding to infrequent critical alarms may result in catastrophic events if the response is incorrect. In these cases, frequent retraining is needed. 2.1.1.8.4 Training should be mandatory for contract employees working in the area so they may perform in a safe and effective manner. Training for contract employees may need to be as stringent as for operators. 2.1.1.8.5 A comprehensive retraining program should be in place for all operating personnel. The time interval for retraining will vary depending on the criticality of the process and number of changes made. Management should have a formal method to determine retraining frequencies. 2.1.1.8.6 A formal method for evaluating the effectiveness of the training program should be developed. This may be a written test, hands-on demonstration, simulation or an extended period of on-the-job training. A feedback mechanism should be established to inform the operator of areas requiring further study and improvement. Records should be kept of these evaluations to facilitate improving the method of training employees. 2.1.1.9 Human Factors 2.1.1.9.1 Organization

2.1.1.9.1.1 The plant’s program should have written guidelines requiring that all new processes incorporate fundamental concepts of human factor engineering beginning with the design phase of the project. If human factor specialists are not available in-house, consideration should be given to retaining outside specialists to assist in this area. 2.1.1.9.1.2 Human factor elements should be incorporated into existing processes, if economically viable, whenever changes or improvements are being planned. 2.1.1.9.1.3 HAZOP reviews should specifically explore human factor issues to determine if appropriate design has been included. 2.1.1.9.1.4 Each of the above activities should include input from operating personnel to ensure that day-to-day operating knowledge is incorporated into the proposed improvements. 2.1.1.9.1.5 Management should create an environment where process safety is paramount above production demands. Operators should be empowered to invoke a controlled shutdown of a process if operating conditions indicate an imminent loss-of-control situation. A written statement to this effect, signed by senior plant management, should be posted in the control rooms. 2.1.1.9.1.6 If staff reductions are anticipated, management’s commitment to safety and loss prevention should remain paramount. Special attention is needed during these times to ensure that operating personnel remain motivated to perform their functions in a consistent and safe manner.


7-43 17-2


Page 8


2.1.1.9.2 Alarms

2.1.1.9.2.1 All alarms should be ranked according to severity and displayed visually and audibly in this order to avoid alarm overload during an actual emergency. 2.1.1.9.2.2 Critical alarms should be grouped separately from ‘‘information only’’ alarms. Audible and visual alarms should be distinctly different for these type alarms so that priority can be given to critical alarms. 2.1.1.9.2.3 Critical process information should be easily accessible on the control panel so that an excessive number of screen changes will not be required to understand the information in an emergency situation. 2.1.1.9.2.4 Critical process information and alarms should be logged, by computer or manually as appropriate, and maintained for a reasonable period of time to aid in incident investigation or future process improvements. 2.1.1.9.2.5 The operator should have a proactive role in the monitoring and control of process variables, rather than simply waiting for alarm conditions to sound. This will encourage the operator to be familiar with the process data and facilitate an appropriate response in an emergency situation. 2.1.1.9.3 Environmental

2.1.1.9.3.1 Optimal performance occurs when environment factors are within specific boundaries. Proper clothing should be available for employees whose work is outside a climate-controlled environment. 2.1.1.9.3.2 For areas having excessive noise, proper hearing protection should be provided and a method of communications established when vocal communication is not feasible. 2.1.1.9.3.3 Proper lighting should be provided in all operations areas, and most importantly in control rooms, to ensure that controls and process equipment are visible. 2.1.1.9.4 Maintenance Operations

2.1.1.9.4.1 All maintenance operations that may adversely impact the safe operation of a process or production facility should require written authorization. Included in this authorization is notification to all areas of the facility that will be impacted by the work. In most cases, operations will need to be stopped or bypassed, to allow safe work in the area. All such process modifications should be thoroughly studied to determine the ramifications of the process change. 2.1.1.10 Standards, Codes and Laws 2.1.1.10.1 The organization should define the minimum codes, standards and laws that will be applied for maintaining an acceptable level of safety. 2.1.1.10.2 Responsibility should be assigned to ensure all codes, standards and regulations (internal or external) are maintained current and are available to those needing to use them. 2.1.1.10.3 A variance procedure should be developed that can be applied when an alternative to an existing code is to be used. 2.1.2 Highly Protected Risk (HPR)

A Highly Protected Risk (HPR) level of loss prevention based on FM Global data sheets and industry guidelines should be the goal at chemical risks. (See also Section 3.1.3) 2.1.2.1 An HPR chemical risk is one that meets all of the following minimum guidelines: a) A fully integrated system based on PSM principles at a level appropriate to the hazards. b) Management commitment and oversight including early involvement of FM Global specialists at an early stage of all projects. c) Adequate process control and safety instrumentation. d) Operator training and empowerment adequate for the process complexity. e) Piping and vessel overpressure protection for the hazards that exist. f) Maintenance, inspection, and testing programs covering all critical equipment and instrumentation.



7-43 17-2


Page 9

g) An adequate and reliable water supply and delivery system. h) Ignition source control. i) Adequate spacing of buildings, process units and tanks. j) Emergency response and post-loss contingency plans. k) Testing and understanding of process chemistry. Where needed based on hazard an HPR chemical risk also incorporates the following features: l) Adequate and reliable fixed suppression systems. m) Drainage and containment systems. n) Fire protection of structural steel. o) Damage limiting and noncombustible construction. p) Combustible gas detection. q) Inerting and purging systems. r) Barriers, barricades and/or distance separation. s) Protection against natural hazards. 2.1.3 Principles of Inherent Safety

2.1.3.1 Principles of Inherent Safety should be applied where possible when designing or improving chemical plant processes. Inherent safety (see also Section 3.1.4) includes the following general principles: a) Intensification — using smaller amounts of a hazardous substances. b) Substitution — replacing a hazardous chemical with a non-hazardous or less hazardous one. c) Attenuation — using less hazardous process conditions or a less hazardous form of a material. d) Limitation of effects — designing a facility to minimize the impact of a release of hazardous material or energy, for example by sufficient spacing or more resistant construction. e) Simplification/error tolerance — designing a facility so that operating errors are less likely or the process is more forgiving if errors are made. 3.0 SUPPORT FOR RECOMMENDATIONS 3.1 Background Information

In the following sections, concepts and strategies for risk reduction in the chemical industry are discussed. These include approaches to loss prevention using: a) CCPS four-tiered Process Risk Management Strategy. b) CCPS systematized Process Safety Management approach. c) FM Global concepts of a Highly Protected Risk. d) Concepts of Inherent Safety. 3.1.1 Process Risk Management Strategies

The CCPS four-tier safety strategy for reducing risk in a chemical facility includes inherent safety, passive safety, active safety, and procedural safety. These strategies are listed in preferred selection order as a loss prevention technique. By using this method when designing a plant, one would approach the safety aspects by applying these strategies starting with an inherent safety concept, followed by passive protection where still needed, followed by active systems, and then by procedural or administrative systems as needed. The techniques that are lower on the list are less effective in preventing losses.


7-43 17-2


Page 10


3.1.1.1 Tier 1 - Inherent Safety The first tier and most preferred approach to chemical plant loss prevention is Inherent Safety (IS). Inherent safety is defined as eliminating the hazard through intensification, substitution, attenuation, limitation of effects, or simplification/error tolerance. Refer to Section 3.1.4 for a full discussion on inherent safety concepts including definitions of these terms. The intent of applying inherent safety is to eliminate the need for add-on layers of passive, active, or procedural protection, which have to function as designed to limit the effects of a loss. Examples of implementing inherent safety would be: •

•

•

•

substitution of water for process cooling in place of a combustible thermal oil. substitution of a non-flammable solvent for a flammable solvent, for example using supercritical carbon dioxide in place of hexane for extraction. through chemical research, replacing a high pressure process using extremely reactive materials in a flammable solvent with an atmospheric pressure process using non-flammable solvents in a reaction that is incapable of generating any pressure in the event of a runaway reaction. storing flammable gases such as ethylene in low pressure refrigerated tanks rather than pressurized tanks.

In these examples, the revised cooling and extraction systems represent no fire hazard. They require no fixed fire protection with its installation, maintenance, and testing costs. With the new reaction system, there is no potential for overpressure because of the chemistry of the process, and the physical characteristics of the materials have no need for costly and failure-prone add on controls, emergency relief devices or reactor strengthening. Finally, with the refrigerated storage, the amount of vapor produced in the event of an unexpected release of the liquid will be minor compared to a similar event with pressurized storage. Note that there may be tradeoffs when applying IS techniques or any of the four strategies. The water cooling system is more susceptible to freezing and may need more cold weather protection than a thermal oil system to prevent a costly freeze damage loss. The CO2 extraction system requires extremely high pressures and process equipment will be susceptible to overpressurization, requiring add on passive or active protection or procedural controls. The reaction system might require use of a corrosive material that could cause long term building damage, requiring costly steel protection or maintenance. The economics and overall risk reduction for all approaches, all of which carry risks, need full evaluation. The potential for risk reduction through use of inherent safety is most feasible very early in the design process. To affect the chemistry of the process may require years of experimental work. Other more tolerant changes and safety improvements may be made during plant design. While opportunities to apply inherent safety concepts should always be explored, there will always be situations where other risk management strategies may need to be employed. 3.1.1.2 Tier 2 - Passive The next tier, and the next in safety selection preference is the passive approach. A passive approach is one that requires no mechanical device or system to actively function to limit or prevent the loss. A passive approach also can be one that stores or uses hazardous materials in a form or state that is as benign as possible. For example, after a process review it is determined that water cooling cannot be used and the process requires a reaction that is capable of generating 50 psig in the event of a runaway reaction. If a combustible thermal oil must be used for cooling, a passive approach would attempt to use an oil with the most benign properties and under the lowest temperature and pressure as possible. Further, this approach would limit the amount of potential oil released by eliminating bulk storage of material within the unit and sizing the coolant feed system to the minimum flow requirement. Finally, in the event of spill, the process area would be designed for rapid drainage and building steel fireproofing rather than placing reliance on (active) fixed fire suppression systems that may fail. In the case of the reactor system, instead of relying on an active system such as a safety relief valve to protect the reactor in the event of a runaway, a passive approach would be to design the reactor to contain the maximum expected overpressure.



7-43 17-2


Page 11

Some additional examples of a passive approach are: diking and containment systems; fire barriers; blast resistant construction; using stainless steel in place of plastic in corrosive environments; proper spacing of buildings, vessels and process units; plant design to prevailing meteorological or geological hazard; enclosing plastic electric cables in metal conduit; processing potentially combustible dusts as a slurry, etc. The single most favorable aspect of a passive approach is its performance reliability. Because it is not an active system, it is not prone to failure unless process conditions or materials are changed without commensurate improvements to the passive system. 3.1.1.3 Tier 3 - Active The next tier, and the next in safety preference is the active approach. An active strategy is one that requires a mechanical device or protective system to actively detect and respond to limit or prevent the loss. An active system must be: •

reliably designed to work when intended

•

installed according to strict installation rules

•

maintained and tested over its entire life.

Because of this, an active system is more prone to failure than a passive system and may cost more over the life of the plant. Active systems are also known as engineered controls. In a previous example, if the thermal oil system is used under more hazardous operating conditions or the drainage and fire proofing systems are lacking, insufficient, or too costly to retrofit, then an active fixed water suppression system becomes the protection device of choice. This system must be properly designed and maintained and tested over its entire life to be considered reliable and effective. Once activated, more damage will occur than with a passive system because the fuel (thermal oil) is not removed by drainage, the building steel is not protected against radiant heat (and may structurally fail), and the water system itself may cause damage to sensitive instrumentation. Finally, if the suppression system should fail, always a possibility, reliance for protection becomes dependant on the fourth tier, procedural or administrative controls. If reliance on procedures (i.e., manual response) is needed, a significant increase in damage will usually occur due to delayed response. In the reactor example, an active (engineered) approach would be to design the reactor to 15 psig and acknowledge the potential for a 50 psig overpressure by depending on process and management controls to prevent the runaway reaction, and by providing properly designed emergency relief venting if it does runaway. The active system is complex and becomes even more complex as vent gas collection systems are installed, etc. This active approach is the traditional approach to reactor protection and most other loss prevention activities in a chemical plant. One primary reason is timing. Often protection is added after the plant is constructed. Inherent safety and passive approaches become less economical — if not completely impractical - after a plant has entered the equipment design phase. An active approach does not provide the same level of risk reduction that the inherently safe or passively safe systems do. In the case of the reactor, with an active approach the loss would be significant if the emergency relief system failed (reactor failure, building blast damage, ensuing fires, and production loss). In the case of the passive system the pressure would be contained with minor risk effects (perhaps time and cost to investigate, recertify the vessel, and retrain employees, etc). In the inherently safe system the event could not occur. Some additional examples of an active strategy are: large deluge systems with high capacity water systems; automatic sprinklers over grouped electrical cables; explosion suppression systems in dust collectors; flow, thermal and pressure controls and interlocks; emergency shutdown systems, etc. While not as effective and reliable as the inherently safe or passive approach, nevertheless, active systems are often required and necessary for adequate protection of a chemical plant. 3.1.1.4 Tier 4 - Procedural The next tier, and last in safety preference is the procedural or administrative control approach. A procedural response to safety is one using operating procedures, administrative checks, emergency response, and other management approaches to prevent or minimize the severity of an incident.


7-43 17-2


Page 12


An example would be to provide written procedures for operators to take corrective action for the runaway reactor, rather than providing active automatic controls or relief systems. In this scenario, emergency action such as leaving the control room, inspecting the reactor, and manually adding quench water might be the only loss prevention response. In the event of a thermal oil release and fire, the plant may have only the emergency response of the fire department to rely upon for damage control. 3.1.1.5 Summary The application of a tiered approach to risk management does not necessarily imply a singular strategy. A complex HPR facility will feature aspects of all four safety tiers — inherent, passive, active, and procedural — within the plant. Given a sufficiently hazardous process, all four tiers might be applied to the single process to provide assurance to risk managers that if one level fails, additional levels are available to limit the loss. Application of this tiered approach is fully consistent with HPR loss prevention concepts. 3.1.2 Process Safety Management

The CCPS defines process safety management as the application of management systems to the identification, understanding, and control of process hazards to prevent process related incidents. The CCPS defines process safety management systems as comprehensive sets of policies, procedures, and practices designed to ensure that barriers to episodic incidents are in place, in use, and effective. The CCPS guidelines focus on twelve elements of chemical process safety: — — — — — — — — — — — —

Accountability and Responsibility Process Safety Knowledge Project Review and Design (Process Hazard Analysis) Process Risk Management Management of Change Process and Equipment (Mechanical) Integrity Incident Investigation Training and Performance Human Factors Standards, Codes, and Laws Audits and Corrective Actions Emergency Response Planning

In addition to CCPS, other organizations have developed PSM guidelines that may have different elements and terminology but nonetheless are equivalent to the CCPS guidelines and may be fully substituted in application. Some are listed in the Appendix. There also are government regulations, both U.S. and international, which mandate application of PSM guidelines under specific conditions. Some information on these regulations is also in the Appendix. All 12 CCPS points are needed for a reliable system based on PSM principles but they need to be customized for the corporation (i.e., making baking soda does not need the same program used for making polyvinyl chloride). 3.1.2.1 Accountability and Responsibility Accountability and responsibility are at the heart of any facility’s program. These concepts must be ingrained into the philosophy of an organization to be successful. Key components of accountability are a policy statement; management commitment; procedural requirements; and performance measurement. The degree to which management demonstrates interest in implementing programs based on PSM principles at its facilities is of paramount concern to safe operation of the facility. Without solid management backing even the best written program will never achieve successful implementation. Management interest should be demonstrated with a written policy statement that is shared with and understood by each employee of the facility. Management’s interest in loss prevention should be obvious in the day-to-day activities of a facility. Simply having a paper document on file will be of no benefit. Routine safety meetings, communication of safety issues to employees and publishing lessons learned from incident investigations are just a few ways in which this interest will be demonstrated.



7-43 17-2


Page 13

The policy statement should be site-specific, and should assign ownership of safe operations to management, as well as to every employee involved in the operation. Expectations of every member of the organization should be detailed and written in language understandable at every level of the organization. The policy statement should be reviewed on a periodic basis and changes made as needed. For example, when changes occur within an organization such as change in management structure, the policy statement should be updated to reflect these changes. The policy statement should clearly outline the objective of the PSM program. These principles should be routinely communicated to all employees so as to reinforce a safety-conscious work force. Generally, a review of the policy statement will be included in the orientation of new employees. Periodic review with all employees within the organization also is useful. Each employee should feel responsible for the safe operation of a facility. There should be no fear of reprimand should a safety concern be reported. Only when the channels of communication remain open and free can a program based on PSM principles become and remain effective. As safety issues arise in new facility design, HAZOP reviews, changes to the process, etc., there will be issues that are not easily resolved, or will involve interpretation of codes or standards. A method should be in place to handle such issues so that resolution at the lowest level of management is achieved. Once implemented, the success of a program based on PSM principles should be evaluated on a periodic basis to ensure the procedures achieve results. This can be in the form of random audits, routine reports to management or direct communication with those involved. Findings from this feedback mechanism should be incorporated into the policy statement to facilitate constant improvement of the PSM program. Issues that are difficult to resolve often lead to input on ways that the PSM program could be improved. 3.1.2.1.1 Example: Liquefied Petroleum Gas (LPG), Mexico City, Mexico

On November 19, 1984, an 8 in. (200 mm) pipe line at a government-owned LPG terminal ruptured. The supply was not shut off, and the vapor cloud was subsequently ignited 10 minutes later by a ground level burn pit. Additional LPG tanks and spheres BLEVE’d (Boiling Liquid Expanding Vapor Explosion) due to exposure to excessive heat. Management and organizational factors reportedly were the major factors in this incident. Reportedly, management at this facility had not taken action on recommendations from previous studies. The deluge systems that were designed to cool the LPG vessels were deemed grossly inadequate. Vessel design was inadequate and the vessels lacked proper insulation. There was also no gas detection system available at the facility. The loss estimate is in excess of $25 million property damage (current values)1,2 3.1.2.1.2 References

1. Gertman, D.I., and Blackman, H.S., Human Reliability and Safety Analysis Data Handbook, John Wiley & Sons, New York (1994). 2. Mahoney, D., Ed, Large Property Damage Losses in the Hydrocarbon-Chemical Industries, A Thirty-year Review, M&M Protection Consultants, Chicago (1995). 3.1.2.2 Process Safety Knowledge and Documentation Process safety knowledge and documentation, which includes process safety information, is the basis for understanding the hazards of the process. This is achieved by acquiring process information and using this knowledge while conducting process hazard analyses. The CCPS defines process safety information as the data describing the process and its chemistry. Process safety knowledge, in general terms, includes both process safety information and the ability to understand and interpret the information. It also includes the tracking and storing of key initial design bases, records of critical design decisions, design standards, site and equipment drawings, accident investigation information, etc. This data can be used as a baseline for future changes. Data on process hazards and material chemistry can be obtained from numerous sources including testing, manufacturer issued Material Safety Data Sheets (MSDS) (or equivalents), and literature sources. Some examples of needed process safety information, and the sources where the information is found, follow as an example of a new process under design.


7-43 17-2


Page 14


A chemical company is proposing a process using flammable solvents, reactants, and catalysts to produce a chemical intermediate for the pharmaceutical industry. The process will include a potentially exothermic reaction, mixing, distillation, and drying to produce a powdered product. Prior to conducting a process hazard analysis or determining levels of protection, information is needed on the various materials and the way they may interact normally or abnormally. The company may find information from the following sources: a) Material Safety Data Sheets. These, if available, will give information on flammability (i.e., flash points), explosibility (i.e., explosive limits), toxicity, corrosiveness, and potential reactivity with other materials. b) FM Global data sheets and National Fire Protection Association (NFPA) standards. Lists of hazardous materials are presented with fire and explosion information. c) Public domain literature such as the Kirk Othmer Encyclopedia of Chemical Technology, Sax Danger- ous Properties of Industrial Materials, CRC Handbook of Chemistry and Physics and numerous other similar sources. d) Proprietary industry or trade group research and testing reports. e) Expert opinion such as engineers from the corporation, FM Global or outside consultants. f) Intentional and systematic testing of the materials. In the example, the final product of the new process is a powder with a possible dust explosion hazard. The material is unique, and no known data on its properties can be found by conventional literature search. To determine hazardous properties such as minimum ignition energy, lower explosive limits, maximum rate of pressure rise and possible overpressures produced should it explode, tests are conducted in a 20-liter sphere in accordance with ASTME-1226, Standard Test Method for Pressure and Rate of Pressure Rise for Combustible Dust. Information on the mixture within a reactor or other vessels is needed to determine potential for exothermic runaway or other chemical instability. Laboratory-scale reactivity screening should be done before scaling up to pilot or full scale processing. This data can be obtained using a number of devices including the Accelerating Rate Calorimeter (ARC), the DIERS Vent Sizing Package (VSP) and others. Site information is also developed during this stage. This may include meteorological data (for later vapor dispersion modeling), geographic data for exposure to natural hazards, accident exposures from nearby industrial sites, and utility data such as reliability and adequacy of water, fuel, and power supplies. After basic chemistry, physical, and thermodynamic properties of materials are developed and site characteristics are found, conclusions on different release and impact scenarios are qualitatively determined. For example, if a solvent is flammable, it will be qualitatively concluded that a spill can result in fire. If boiled and held under pressure, an indoor or outdoor flammable vapor explosion potential may exist. The catalyst to be used might be known to overheat and produce equipment-damaging pressure if not refrigerated. These ‘‘generic’’ conclusions are all derived in the process safety information phase. However, the sequence of events by which the scenario and its consequences will be realized will not surface until a process hazard analysis is conducted on the system in which the materials are used. Finally, the action steps, such as fixed mitigation, taken to reduce the quantified hazard or consequences will not surface until the process risk management stage. Under this activity, in addition to developing and maintaining basic process and material hazard information, it is necessary to include accumulation of all the design details, alternative process considerations, key design decisions and basic operation and maintenance plans. Here, the corporation should develop rationale and responsibility for collecting and maintaining this data as well as data on operating experience, accident investigations, causes and corrections as well as changes developed and reviewed under the Management of Change processes (described later). This collection of data will preserve initial design records (to ensure that replacements comply with design intent), reasons for key design decisions (aid to future projects and modifications) and provide a basis for understanding how the process should be operated. It also serves as a baseline for evaluating future changes.



7-43 17-2


Page 15

The collection of this information provides the process safety knowledge needed in subsequent PSM steps (as well as a record of the original review process) so that the process can be started up and run throughout its intended life without an unanticipated incident or unprotected hazard. The information is documented and made part of the overall process safety management package, which will eventually also include data from the process hazard analysis and process risk management steps. This is then used for employee training, future process changes, etc. Enhancement of process safety knowledge is a subset of this element, and is sometimes added as a separate element of PSM. Over the life of the plant, new technology in process operation, inherent safety, or loss prevention techniques may be developed. While not known or cost effective during initial plant design, they may become so later in the life of the plant. It is important for an organization to stay fully abreast of new technology and apply it as appropriate. Use of a Management of Change procedure will ensure that latest technology and information will be available. 3.1.2.3 Process Safety Review (Process Hazard Analysis) This element of PSM is often identified as Process Hazards Analysis (PHA), and should include the project review for new facilities or modifications to existing facilities that have a significant process or capital impact. Where no major changes occur, the review should be revisited on a regular basis. A suggested frequency would be about every 5 years with longer intervals for less hazardous processes. The element also includes the necessary design and pre-startup review of such projects to ensure that recommendations were, in fact, implemented. The CCPS discusses staffing, hazard reviews, siting, plot plan, etc., in the context of phases of capital projects. As a supplement to the CCPS material, an HPR chemical plant should consider the following sections related to property and business interruption loss prevention. Principles of loss prevention and risk management should guide plant siting decisions. These principles are usually defined in the corporate guiding principles or business objectives. Most sites can be made acceptable if sufficient funding is allocated to overcome deficiencies presented by the site selection. Sites chosen should be selected to avoid or minimize exposures by perils of: a) Fire. b) Natural Hazards (flood, wind, lightning, snow, freezing, earthquake, volcano, etc.). c) Explosion. d) Transportation (aircraft, motor vehicle, rail, ship). e) Pipeline or tank farm exposures. Sites should feature: a) Access for safe disposal of waste. b) Access to fire fighting assistance (public or other). c) Access to an adequate source of water to meet present and future demands. d) Access to reliable security and emergency services. e) Access to the site during adverse conditions (riot, traffic, etc.). In addition to location of the plant site, equal consideration should be applied to the location of: a) Process units. b) Pipe racks. c) Storage facilities. d) Unloading facilities for rail cars, trucks and water craft e) Flare stacks. f) Utility plants. g) Waste water treatment facilities.


7-43 17-2


Page 16


h) Electrical power lines. i) Process control rooms. Once site selection is complete, the project should have sufficient funding to implement FM Global and/or corporate loss prevention guidelines. In addition to basic project design and construction costs, finances should: a) Allow time for a thorough review of loss prevention aspects of the design and construction using accepted hazard analysis methods. Designs should use inherent safety and risk mitigation concepts. b) Permit installation of proper loss prevention features affecting construction, protection, drainage, electrical equipment, freeze protection, etc. 3.1.2.3.1 Examples

3.1.2.3.1.1 The ABC chemical company proposes building a new polymerization plant at the site of an existing chemical plant in the Gulf Coast area. It could be located in any of three different areas near the existing plant. The raw material (ethylene) is supplied to the main ABC plant, but the facilities will need to be enlarged to accommodate more ethylene. New facilities will need to be developed for storage of propane, butylene, and other future monomer feedstocks. The ABC company has a license to use a new process to make the finished copolymers, but sizes and layout of major equipment have yet to be finalized. At this point, a team was created including specialists from FM Global, ABC, and several design and construction engineering companies. Early meetings developed a time line for the construction, plan reviews, site visits, and pre-startup reviews, as well as a plan to conduct a thorough hazard analysis. Full HAZOP and What-if analyses were performed. FM Global specialists participated in the hazard analysis meetings, and provided an important perspective on damageability, available protection and mitigation methods, and analysis of business interruption potentials. A full site survey was conducted at all three sites with a team made up of various specialists including the FM Global engineer. Through this process, a site was chosen to minimize flood exposures, and the potential for fire and explosion exposures presented by nearby plants, pipe racks and railways. Plans were modified to include relocation of pipe racks, along with rerouting of rail sidings. Through early team meetings, objectives from corporate guiding principles were interpreted to define objectives for limiting the maximum foreseeable loss, and normal loss expectancies. Through collaboration, specifications were developed for the plant construction, particularly control room construction, fire protection water supply piping sizes and locations, pipe rack locations, drainage patterns, sprinkler valve house locations, and feedstock and product delivery contingencies. These methods resulted in mitigation of Vapor Cloud Explosion (VCE) potentials (see Data Sheet 7-42, Guidelines for Evaluating the Effect of Vapor Cloud Explosions Using a TNT Equivalency Method for additional information on VCE hazards). Note: The level of FM Global participation can vary from project to project depending on the needs of all the parties involved, contractor, insured, insurance company, etc.

3.1.2.3.1.2 XY Chemical Company planned and constructed a polymer manufacturing plant along the Texas Gulf Coast. Design work was conducted at the home offices in the northeastern US using highly experienced personnel. Project designs did not consider incident history and advice for this area relative to freeze protection. As a result, the plant was built with numerous outdoor sprinkler systems as well as elements of the process and instrumentation system with insufficient freeze protection. As a result, the plant suffered a $2 million loss related to broken pipe, instrument lines, and loss of production in the 1983 and 1989 freezes. This pointed to a normal frequency of freezing weather in this area, worthy of protection. A cost estimate of $75,000 for correction of the deficiencies was developed in consultation with the local FM Global specialist. Economic conditions dictated that these improvements be extended over a period of three years resulting in a need to prioritize the modifications.



7-43 17-2


Page 17

If the concepts and guidelines of this data sheet had been used in siting of this plant, the freeze potential and its frequency would have been identified. A loss potential of $2 million with an average 10-year recurrence interval would have been mitigated. The cost at the time this plant was designed could have been much lower. 3.1.2.4 Process Risk Management Process risk management involves the identification, evaluation, control, or risk transfer of potential hazards that may be associated with existing operations, new projects, acquisitions, and customer supplier activities. Process risk management is the system whereby conscious risk improvement decisions are made based on results and information obtained during the process knowledge and process hazard analysis stages. If hazard information data is available at very early stages of a plant design, inherent safety features can be incorporated into the design. Later in the design, passive, active, and procedural improvements and protection are usually added. The need and level of fixed suppression systems such as sprinklers and deluge systems, building steel fireproofing, damage limiting construction, barriers, process controls, etc., are decided in the process risk management phase of PSM. Fire safety professionals in partnership with the chemical plant determine the level of protection needed to meet HPR status and loss exposure goals. Ultimately the exposure is improved through fixed protection and management systems, is transferred through insurance, or is completely avoided by eliminating the hazardous activity. Data and information from process knowledge gathering and hazard analysis activities must be evaluated as to economics and potential for risk reduction. Not all risk in a facility can be eliminated or reduced through engineering. Process risk management ensures that a balance of inherent or engineered safety and risk transfer (i.e., insurance) is maintained and that all mandatory regulations, corporate standards, and industry and insurance guidelines are met. Process risk management requires screening, ranking, and engineered assessment tools. A high level assessment, such as Quantitative Risk Analysis (QRA) may be needed to make final decisions. The four tier safety strategy is still followed. Regardless of methods, documentation of the basis for risk decisions is important. 3.1.2.4.1 Case Study

ABC Chemical company is planning a facility to produce polyvinyl chloride (PVC) plastic using a licensed process. Production of this material will include use of vinyl chloride monomer (VCM), a liquefied gas, flammable solvents, and reactive peroxide-based catalysts in a moderately high pressure, high temperature, continuous autoclave (single reaction vessel) system. The process will be located in a single process unit supported by raw materials delivery and storage, in-process storage, combustible heat transfer media, heat, steam, power, and fuel utility systems, and final product handling, storage and transfer to market. The final products will be solid extruded pellets, some of which will be custom made with plasticizers. The benzoyl peroxide (BP) catalyst is to be manufactured on site. The process will be constructed at a new site not previously developed. In the process safety knowledge step the following technical information may be obtained based on a literature search or documented testing: — — — — — —

flammability and explosivity characteristics of gases and liquids flammability and explosivity characteristics of heat transfer media reactivity data on catalysts combustibility and explosivity data on solid powder product reactivity of the PVC reaction at given process conditions reactivity and hazard of catalyst manufacture

The following site information might be obtained based on a site study and documented: — — — — — — —

meteorological data (prevailing winds/speeds/atmospheric stability) freeze and snowfall/rainfall data flood data earthquake data windstorm data data on adequacy and reliability of utility services information on nearby hazardous exposures


7-43 17-2


Page 18


General conclusions might be derived based on the above chemical and site information and qualitative analysis. At this stage, these conclusions are based on generic knowledge obtained from experts or from the literature, and are used for establishing more definitive scenarios during a process hazard analysis. Detailed consequence studies such as vapor cloud dispersion, explosion overpressure, or pool fire radiant heat effects are conducted as part of the hazard analysis. The following general conclusions are not meant to be all-inclusive but only to demonstrate types of information and scenarios that could be developed during this step. a) Flammable liquid spill fire potentials exist from delivery, storage, process vessel, and piping systems for raw and intermediate materials and for the heat transfer media system. b) Vapor cloud explosion potentials exist from storage, process vessels, and piping systems using VCM. c) Reactor, vessel, pumps, and piping failure potentials exist due to high pressure, corrosivity, and reactivity exposures. d) BP manufacture requires potentially unstable hazardous materials. e) Dust explosion potentials exist from plasticized product. f) The plant is in a semi-tropical climate but is subject to periodic severe freezes. g) The plant is in a potential hurricane zone. h) Power supplies are subject to possible off-premises interruptions. i) Public water supplies and emergency response are not available. j) A plant with potential wide range explosion hazard abuts the site. In the process hazard analysis step, the above data and design drawings (as complete as possible) are sub jected to a systematic and critical examination to determine failure modes whereby incidents could occur. HAZOP, What If, Checklist, Failure Modes and Effects Analysis (FMEA), and more quantitative analysis methods might be used. Vapor dispersion, explosion and radiant heat modeling, if needed, will be done during this stage. These examinations might reveal the following potential concerns and consequences: a) The manufacture of peroxides on site presents many failure modes and several potentials for a peroxide self initiation, with high damage potential, compared with the relatively small amounts of material needed. b) Flammable spill fire and vapor release potentials cannot be completely eliminated through process control or design, short of not producing the product. Steel structure is subject to severe radiant heat, confirmed by fire modeling. c) VCM represents a vapor cloud explosion potential, and the process unit arrangement and congestion will produce high overpressures throughout the plant, as confirmed by modeling. d) Prevailing winds and distance indicate potential for vapor cloud from neighboring facility to enter process unit, confirmed by modeling. e) A single large reaction autoclave is harder to control than a smaller unit. It also presents extreme liquid spill or vapor release potentials thus increasing protection system demands, and if damaged would shut down all operations. f) Plasticized plastic dust presents a dust explosion hazard, confirmed by laboratory testing. g) A rare but possible sudden freeze could severely damage plant utilities. h) A sudden power outage could cause loss of control of the reaction. i) Many different release and failure modes of vessels, pumps, piping, and utility systems exist, but these can be mitigated through process control and design improvements. j) Use of a large volume of combustible heat transfer material presents significant fire potential on a higher frequency than other flammable materials, due to its high corrosivity, confirmed by loss history.



7-43 17-2


Page 19

In the process risk management step all of the data collected and derived from the two prior steps is used to make risk management decisions. In the example, these may include (but are not limited to) the following decisions, listed in order of a tiered preferential safety approach: Inherent safety: a) Replace combustible thermal oil system with water system. b) Reduce production bottleneck by changing from one large reactor to several smaller reactors. c) Reduce in-unit flammable inventories by eliminating product day tanks, large reboilers, large reactor, oversized piping, etc. d) Purchase additional land to protect against off premises exposures e) Refrigerate VCM bulk storage tanks to reduce vaporization. f) Collect plastic dust in wet slurry to reduce dust hazard. Passive mitigation: a) Use a concrete frame or fireproof steel for process unit. b) Space unit apart from support facilities and site boundaries. c) Use open process unit for maximum explosion venting. d) Limit and space equipment within unit to minimize congestion. e) Lay out unit with flammable materials accessible on outer edge. f) Install drainage systems. g) Design process controls and interlocks to maximize reliability of process. h) Design process vessels/piping to maximum expected pressure. i) Blast proof control room and emergency services building. j) Provide emergency containment systems. Active mitigation: a) Provide on site water system for fire protection. b) Provide deluge sprinkler protection. c) Provide combustible gas detection. d) Inert and purge flammable storage, process and piping systems. e) Provide reactor emergency quench system. f) Provide reactor emergency venting. g) Computerize process control. h) Provide on-site emergency power supplies. i) Design to hurricane codes. j) Protect plant against freeze up. Operational administrative controls: a) Develop and train on site emergency fire response brigade. b) Train and empower operators to take manual process control. c) Provide ignition source control systems. d) Provide backup manual reactor emergency quench system. e) Provide natural hazard alert procedures.


7-43 17-2


Page 20


Risk Avoidance: a) Eliminate on-site manufacture of peroxide catalyst. Risk transfer: a) Accept inherent risk by retention of high insurance deductibles. In the risk management process, there may be a need to revisit and re-analyze hazards several times prior to deciding on the level and type of mitigation or use of other risk tools such as elimination of hazard or risk transfer. In fact, risk management becomes a constant cycle of analysis, transfer and acceptance throughout the life of the facility. As the facility ages and changes are made, the risk will change. Keeping abreast of this aging and change process will ensure that the facility will achieve the risk management goals originally accepted. 3.1.2.4.2 HPR Requirements

The decision to meet or not meet HPR protection guidelines is determined during the process risk management stage. While achieving HPR status should always be the risk management goal, there may be conditions, especially in existing older plants, where this may not be economically or technically feasible. There are minimum requirements for a facility to qualify as an HPR risk. These are briefly identified in Section 2.1.2.1 and further discussed in Section 3.1.3, Concepts of Highly Protected Risk. 3.1.2.5 Management of Change Management of Change (MOC) means evaluating every change to technology, facilities or personnel at the earliest possible stage for its potential impact on property loss prevention. The earliest possible stage is the moment an idea or proposed change becomes known. These changes can be emergency, permanent, temporary, recognized or unrecognized. The purpose of a management of change process is to prevent the unrecognized change. Changes are made routinely throughout the life of a facility. These may vary from major highly visible projects to daily routine maintenance activities. Changes can occur to technology, chemicals, products, equipment, and procedures. Any change from original design intent represents a deviation. If the impact of this deviation is not fully understood, the change, even if minor, can cause a significant incident. Appropriate process hazards management systems should be put into place to help ensure that hazards associated with a change or deviation are identified and controlled. Changes fall into three main categories: technology, facilities and personnel or organization. Although some changes may be minor, with little likelihood of compromising loss prevention and process safety, all changes have some potential for disruption. 3.1.2.5.1 Change in Technology

Change in technology arises whenever the process or mechanical design is altered. Examples are changes in feedstocks, catalysts, product specifications, byproducts or waste products, design inventory levels, instrumentation and control systems, or materials of construction. Typical instances in which change in technology would likely occur include the following: a) New projects that involve tie-ins or equipment modifications on existing units. b) Projects to increase facility throughput or accommodate different feedstocks or products. c) Significant changes in operating conditions, including pressures, temperatures, flow rates, or process conditions different from those in the original process or mechanical design. d) Equipment changes including the addition of new equipment or modifications of existing equipment. These can include changes in alarms, instrumentation and control schemes. e) Modifications of the process or equipment that cause changes in the facility’s relief requirements. These can include increased process throughput, operation at higher temperatures, increased size of equipment, or the addition of equipment that might contribute to greater relief requirements. f) Bypass connections around equipment that is normally in service.



7-43 17-2


Page 21

g) Changes in operating procedures, including procedures for startup, normal shutdown, and emergency shutdown. h) Changes made in the process or mechanical design or in operating procedures that result from a PHA performed as described in Section 3.1.2.3. i) Introduction of new or different process additives (for example corrosion control agents, antifoulants, antifoam agents). j) Corrective actions developed as a result of an accident investigation. 3.1.2.5.2 Changes in Facilities

Changes in facilities are those in which physical changes are made that would not necessarily appear on plant drawings, or piping and instrument diagrams (P&ID). Examples are: temporary connections, replaced components that are ‘‘not in kind’’, site modifications, transient storage, temporary structures, etc. Specifically, these can include the following: a) Temporary equipment (tanks, offices, drum storage, etc.). b) Replacement equipment or machinery that differs from the original equipment. c) Temporary piping, connections, hoses, or wiring. d) Temporary software configurations, jumpers, shortened algorithms, bypassed controls. e) Pipe clamps, braces, stands, wiring, ropes. f) Temporary utility connections (steam, power, water, etc.) g) An alternative supply of process materials, catalysts, or reactants, such as through drums or tanks temporarily located within the facility. h) Temporary electrical equipment or connections. These changes have the ability to affect design, construction, operation, maintenance, and decommissioning. 3.1.2.5.3 Changes in Personnel

Changes in personnel are those in which key responsibilities are shifted from a position of stability to instability. Examples are retirement, promotion, other career changes and personal issues (sickness, death, leave-of-absence, etc.). These changes are ones in which continuity of responsibility may lapse. Training and assignment of alternates is a key feature needed to mitigate lapses caused by these changes. Supervision must be skilled for early recognition of these changes, with an ability to plan in advance to mitigate these changes. Goals of the company, business and operating unit must support prevention efforts associated with these changes. 3.1.2.5.4 Examples

3.1.2.5.4.1 The Clean Air Act Amendments of 1990 require a 50% reduction of sulfur dioxide levels (SO2) in the U.S. by the year 2000. This act affects approximately 2,000 electric utilities. The method of choice to control SO2 emissions probably will be the installation of wet scrubbers as they provide the highest level of control. Along with the additional costs and plans for scrubber installations, the person(s) planning these changes need to look at the effect these installations will have on loss prevention. For instance, scrubbers are subject to fires and explosions and they can affect furnace draft. Induced draft fans may have to be upgraded, which, in some cases could increase the risk of implosions and boiler vibrations. To prevent corrosion of scrubbers, ducts and stacks, it may be necessary to use plastic or plastic-lined equipment, which could present a fire hazard. A typical agreement between a company and the property insurance company requires that a loss prevention professional within the company be advised of all management of change activities in the plant. This individual is then responsible for involving the specialist from FM Global to allow an opportunity for the change to be evaluated in its earliest stages.


7-43 17-2


Page 22


3.1.2.5.4.2 ABC is a manufacturer of commodity polymer using batch-scale polymerization of the monomer. Because of favorable opportunities in the market, ABC has plans to double the capacity of its sevenreactor plant in a two-phase expansion over the next 10 years. The first phase will include construction of utilities and the footprint for a second seven-reactor manufacturing building. Initially, a building containing three reactors will be built. There is a close relationship between ABC and the FM Global specialist assigned to this plant. While the idea is being developed by senior management within ABC, meetings are held with the FM Global specialist to discuss the effect this may have on loss prevention. ABC is guided by a principle that promotes continuous improvement in all areas of operation including loss prevention and they call upon the expertise of FM Global to provide guidance to meet this goal. In consultation with the FM Global specialist, several opportunities are identified. These include ways to mitigate VCE potentials, provide more cost efficient and effective water spray systems, and arrange the Instrumentation and Control features for increased reliability. In order to expand the process water features for the new plant expansion, several pumping and distribution changes were needed. Opportunities were identified to add outlets and normally closed connections between the fire protection system and the process water supply system. This increased both the normal supply to the fire protection water system, and the supply that would be available in a catastrophic event. In consultations, an opportunity was identified to relate current maintenance issues for the older electronic heat detection systems on the water spray systems to a design specification needed for all the new water spray systems. Review of maintenance records and costs pointed to an opportunity to replace older electronic heat detectors with air-pilot detection systems. In doing this, the plant maintenance was provided with a single common type of system which has lower maintenance costs, a single set of replacement parts and requires simpler maintenance skills. Existing features for protection and control often are duplicated exactly during plant expansions. Many design groups operate with the assumption that existing protection and control features are adequate and satisfactory, and they do not take the opportunity to consider improvements, as above. 3.1.2.5.4.3 Mr. Howard has been the person in charge of fire protection in this plant for many years. He is the direct interface between top management, engineering, and safety personnel for matters relating to loss prevention. He is in charge of administering all loss prevention related inspection programs within the plant. He supervises all impairments to fire protection, and reports them throughout the company and to FM Global. Mr. Howard is very important in the review process for new construction. Because he is so familiar with current design requirements, he is able to work closely with plant and corporate engineers to develop plans for new construction and modifications. Mr. Howard spent many years in the plant as an operator. Because of this involvement, he oversees many important operator duties as they relate to fire response, and use of emergency process equipment (flares, alarms, shut-downs, etc.). He also is the liaison to community groups including the mutual aid groups. Mr. Howard has announced he will retire in 2 years when he reaches the age of 60. Loss of this level of experience could create serious gaps related to steady provision of the services provided by Mr. Howard. All of his job duties should be described in writing. A plan for his replacement, with alternates, should be developed sufficiently in advance of his departure so that proper training can be provided. If timing is not sufficient to establish that his duties have been sufficiently taken over by others, management should arrange for Mr. Howard to return to work as a consultant. He should periodically return after his retirement to make sure all areas of past responsibility are being covered. In the planning for replacement of Mr. Howard, the local assigned FM Global specialists should be notified. Specific sessions can be arranged so that the programs recommended by FM Global can be introduced or reviewed with the person who has taken over for Mr. Howard. 3.1.2.5.4.4 Mr. Jones was the Safety Engineer at this major plastic film plant reporting to the plant manager before he resigned. He was responsible for implementing all safety and loss prevention programs in the plant. He was the direct liaison to the plant maintenance department, providing review and supervision of all maintenance and testing of the plant fire protection systems including the fire pump, suction tank, sprinkler systems, alarm systems, and gaseous extinguishing systems. Because of his expertise he was the



7-43 17-2


Page 23

interface between local contractors who provide maintenance and testing. Mr. Jones kept all the letters, files, receipts, plans, and correspondence in his office relating to protection systems and plant insurance matters. Unfortunately, he quit at a time when the plant was completing a 50% production expansion, and beginning to plan for a new warehouse expansion. Ongoing issues relate to false alarms, alarm system repairs, and a history of broken underground water mains in a certain area of the plant. Mr. Jones had been a proponent of looping of the plant fire water mains to provide better service to the areas of future expansion. In a case like this, it is important that key plant personnel from all levels meet to review the impact of this departure on loss prevention. Some careful accounting should begin at once to make sure elements of Mr. Jones’ responsibilities are identified. The FM Global contact should be advised of the personnel change. This will allow for meetings to take place to ensure that proper training is provided to a replacement employee. In many cases, FM Global can provide the following: — Training on fire protection systems, maintenance and testing can be offered to a new employee. — A review of maintenance and testing programs can be made to ensure that correct programs are not lost or lapsed. — Contract maintenance programs can be evaluated to determine adequacy of these programs. 3.1.2.5.5 References Management of Process Hazards, API Recommended Practice 750, First Edition, January 1990, American Petroleum Institute. Managing Change, FM Global publication P9201.

3.1.2.6 Process and Equipment (Mechanical) Integrity Equipment that processes hazardous materials, and accessory or utility equipment that is important to continued operation of the plant should be designed, constructed, installed, operated, protected and maintained in a way that minimizes the risk, while providing process reliability. This element of the PSM program addresses the management system required to achieve this objective; it is called Process and Equipment Integrity by the CCPS, and Mechanical Integrity by others. A Process and Equipment Integrity program should address some or all of the following: pressure vessels and piping, tanks, rotating machinery, electrical equipment, boilers and furnaces, etc., together with their instrumentation, controls, accessories and supporting structures. The components of Process and Equipment Integrity, which are discussed further below, are reliability engineering, materials of construction and fabrication, installation procedures, preventive maintenance and demolition procedures. As with all elements of PSM, a strong audit and verification component is necessary to ensure that all the required procedures are being followed and qualified personnel are used to perform the various steps. 3.1.2.6.1 Reliability Engineering

Reliability engineering is the evaluation of a process system or individual component to determine its safe operating lifetime. Since, at some point, all equipment requires inspection, testing, maintenance or replacement, the evaluation should include equipment accessibility and suitability for the process, and the need for standby/spare equipment and bypasses. Identifying the critical equipment and determining its reliability can affect installation decisions and maintenance planning. An important component of reliability engineering is to establish factual data on equipment operation and history. A file for each piece of process equipment should be maintained. It should contain information that covers its specifications, materials of construction, instrumentation diagrams, electrical equipment and emergency relief. The file also should contain the operating and inspection history of the equipment, as well as any data on repair, alteration and re-rating, as applicable. This information can then be used to plan future maintenance, determine spare parts requirements and schedule replacement. If maintenance frequency is high, it could justify using better equipment for replacement. The information should be readily available for review by knowledgeable personnel who can identify trends that could indicate future reliability concerns.


7-43 17-2


Page 24


3.1.2.6.2 Materials of Construction and Fabrication

Choice of suitable materials for construction or repair can be critical in safe operation of a facility. This element of Process and Equipment Integrity should ensure that appropriate vessel and piping standards are adopted (national standards like ASME and API, for example), standard updates are recognized and adopted and that specific responsibility for such efforts is assigned. (See also Section 3.1.2.10.) Once such standards are adopted, a system is present to ensure compliance. This could include ‘‘mill to installation’’ tracking of material for critical components or a much simpler system for other components. Protection of the equipment is imperative to help prevent catastrophic failures involving hazardous materials or equipment critical to the plant’s operation. It is provided by installing safety devices that protect against abnormal operating conditions such as overpressure, overheating, vibration, over speed, electrical faults, misalignment, etc. During fabrication, maintenance or repair, the system should identify needed qualification or certification of craftsman. A quality assurance system should be in place and be able to track and ensure compliance including use of proper material, installation/fabrication according to specification and documentation of necessary tests and inspections. Where outside vendors are involved, the management system may need to extend to their operations. Prior to startup of a new process or restart after modifications, the Process and Equipment Integrity system should identify the need for field inspection, and identify the areas of concern such as piping location, safety and emergency equipment features, accessibility of process and safety equipment, operation, functional testing and calibration of instrumentation, controls, protective devices, etc. A good pre-startup review should be based on a checklist. 3.1.2.6.3 Installation Procedures

Planning and quality control are needed to ensure the proper installation of process equipment, as specified in the design or the instructions provided by the manufacturer. They should include the critical steps and important verification points during the installation. In many cases, especially in piping systems, installations are not covered by codes or standards, and, therefore, poor execution may lead to failures. Prior to startup, conduct an overall equipment integrity check to validate the installation. 3.1.2.6.4 Preventive Maintenance

This element addresses ongoing preventive maintenance needed to monitor and service the equipment so that defects are detected before serious failures occur. Preventive maintenance consists of a system to develop and track the following activities: identifying the critical equipment; determining the required tests and inspections, together with the associated acceptability criteria; establishing the frequency of each test and inspection; establishing maintenance procedures; training of the maintenance personnel; documenting and analyzing the results. At a minimum, preventive maintenance should follow manufacturer’s recommendations. For some equipment, Factory Mutual Research standards specify procedures and frequency beyond the manufacturer’s minimums. Factory Mutual Research requirements should then become the minimum acceptable level. These requirements do not eliminate the possibility of ‘‘Risk Based Inspections’’ (RBI). If RBI are implemented, detailed records on the basis for the chosen inspection frequency are needed including the test results, process data and decision trees used to develop the procedure. The documented maintenance procedures should address the targeted equipment with detailed instructions on performing the particular activity. They should address the steps needed to prevent adverse conditions both during the procedures and when the equipment is put back in service. They should provide a means to ensure the completion of the work as ordered. Scheduled and unscheduled maintenance should be initiated by written work orders and/or work permits prepared by authorized personnel with clear responsibilities. Periodic reviews of these procedures is needed to monitor their effectiveness and ensure they are up to date. Process monitoring and alerting the operators to abnormal conditions is necessary for reliable operation. Therefore, the preventive maintenance program should include alarms, instrumentation and safety devices.



7-43 17-2


Page 25

3.1.2.6.5 Demolition Procedures

Demolition procedures entail an appropriate method for the safe removal of a piece of equipment or process that is no longer needed. The procedures should include isolation from active equipment, marking to identify its out of service condition, any necessary decontamination and ultimate disposal of the equipment. 3.1.2.7 Incident Investigation This element ensures that all incidents - classified as major accident, accident or near-miss by CCPS - are promptly and comprehensively investigated. The depth of investigation is commensurate with the level of complexity and size of incident. This will ensure that lessons learned can be quickly applied within the facility or corporation. Lessons might manifest themselves as physical, process control or personnel changes or new or better training programs. Documentation and periodic review aids in determining common cause or root cause factors when multiple losses have occurred. The purpose of incident investigation is to prevent a recurrence. This requires a management system that: a) Investigates incidents to determine the root cause. b) Develops recommendations to prevent a recurrence. c) Ensures follow-up to complete recommendations as part of MOC. Incidents can be grouped many ways, but the three general types listed below (as defined by CCPS) will serve for most purposes. Major Accident: an incident where the impact is above an acceptable level, usually involving major property damage, multiple injuries or fatalities. Accident: an incident having an undesirable impact on company resources, usually involving minor property damage or a single injury. Near-miss: An incident with the potential to be an accident or major accident. 3.1.2.7.1 Basic Elements

There is a long history of incident investigation in the chemical process industry, but only since about 1985 has it been recognized that incident investigation needs to be formalized as part of the overall process safety management system. Basically, this requires management to be involved for support and direction, so incident investigation results can be used to support the other elements of PSM. Suggested elements needed for incident investigation are as follows: Management Commitment: Top management support is required for an effective program. This is necessary for the resources required, and the ability to hold managers accountable for achieving results. Documentation should clearly define the details of the process safety management system employed and the expected performance. Classification System: Several classification systems have been developed to group incidents, including the CCPS version noted above. None have been adopted for universal use. They may be modified to meet the needs of the organization. It should be understood that all classification systems have vague areas generated by differences in opinion along technical lines. The biggest area of disagreement is the near-miss classification, where views on probability and possibility of consequences vary greatly. Team Organization: Team make-up and organization will vary, depending on the size and nature of the company. Normally accepted assignments include team leader, safety department representative, operations representative, maintenance department representative and a supervisor and worker from the unit involved in the incident.

There may be a need for others, depending on the nature of the incident. This can include those inside the company with speciality knowledge, or even outside consultants. It is difficult for the team to be impartial unless it is autonomous. Reporting through the normal chain of command should be avoided, where possible. Team Selection/Training: Team members should be selected based on their interest, job function, and experience. All members should be trained in the basics of process safety management, not just incident investigation.


7-43 17-2


Page 26


Team Function: The incident investigation team function needs to be integrated with the overall emergency response plan. Well established lines of communication and assigned functions will let the team perform its assigned work. Incident Investigation:

a) Determine Cause: Determining the cause (root causes and contributing causes) is one of the main functions of the incident investigation team. Some special effort will likely be needed to determine underlying system related causes. b) Develop Recommendations: Recommendations needed to prevent a recurrence should be identified. While it might not be possible to actually prevent a recurrence in all cases, it is likely that preventive measures can be developed that will reduce the probability and/or consequences. c) Implement Prevention Measures: Management should have a system that ensures follow-up action is taken to implement recommendations. 3.1.2.7.2 Incident Investigation Concepts

Incident investigation covers a broad area. Some investigations are extremely structured and detailed. One example would be the investigation to determine why a passenger plane crashed. Some are brief, for common accidents that are easily understood and have low impact, such as a small non-hazardous chemical spill at a dispensing station. However, for an adequate process safety management program, all incidents need to be reported and investigated, with adequate follow-up to ensure that corrective action is taken. Procedures should document how this is done, with all major incidents elevated to upper management. Minor incidents and near misses might be handled only at the local level, but could be elevated if the lesson learned could be applied to many plants. All should be reported, since company trends can be spotted that might elude the local level. If minor incidents and near-misses are too numerous, and the procedures do not give good guidance concerning the difference between reporting and investigation, the system can break down. Extensive investigation of all reported incidents is generally beyond the ability of most companies. Incident investigation is usually a problem-solving process. Generally this involves data collection, data analysis, and presentation of findings. Tools and effort deployed depend on the type of incident and consequences. A systems oriented approach integrated with a process safety management program is usually required for a major accident. However, it is important to investigate a near-miss incident that had the potential for a catastrophic failure; such incidents can be just as difficult to analyze. One example would be a major flammable vapor release that dissipated without ignition. 3.1.2.7.3 Investigative Techniques

In simple terms, scope and resources required for incident investigations can be classed in three broad areas: 1. Area supervisor conducts an informal investigation, in the traditional manner. 2. Team-based investigation requiring specialized knowledge to determine a credible scenario. 3. Team-based investigation and a systems-oriented approach integrated with a process safety management program aimed at determination of root causes. Usually the traditional informal investigation done by the area supervisor does not employ advanced techniques, nor are they needed. Some advanced techniques could be used by the team-based investigation that requires specialized knowledge. Frequently some system is needed to keep the team focused, and to ensure that all necessary areas are considered. The third type of investigation inherently requires advanced techniques. It should be noted that while there are many advanced techniques, the science is still evolving. Basically there is no one technique usable for all cases. There are some common features essential to a structured analytical approach, regardless of the techniques used. Some of these are: a) Force the team to dig beneath the obvious to determine the underlying causes. ©2000 Factory Mutual Insurance Company. All rights reserved.


7-43 17-2


Page 27

b) Determine as many of these causes as possible. c) Provide excellent documentation that aids training and information sharing, and provide support for recommendations. A process safety incident investigation is similar to a process hazard analysis. The main difference is the investigating team knows the incident happened. As a result, many of the PHA techniques can be applied with good results. Once the evidence has been collected, application of a system theory is necessary to analyze it. Many analytical tools inherent in PHA can be applied directly to incident investigation, and have been incorporated into many of the techniques. Many of the PHA tools are well developed, and have been proven to provide reliable results. Frequently they are available as PC-based software. Some of the publicly available systematic techniques are: Deductive FTA: Fault Tree Analysis AAM: Accident Anatomy Method MORT: Management Oversight and Risk Tree MCSOII: Multiple-Cause Systems-Oriented Incident Investigation Inductive HAZOP: Hazard and Operability Analysis AAM: Accident Anatomy Method CELD: Cause and Effect Logic Diagram Other techniques have been developed for use where the major effort required by the above techniques was not considered necessary or justified. The field of incident investigation is still developing and the approach applied by the investigator does not have to be limited by the above. However, the investigator should be aware that new approaches need to be built on proven and accepted concepts. 3.1.2.7.4 Example

Phthalic anhydride made by air oxidation of o-xylene is very exothermic. Typically, heat of reaction is collected by a molten salt/water heat exchanger to make steam. In this case, three pumps supplied water to the heat exchanger, with one normally operating and two on standby. When the operating pump failed, the operator first tried to restart it several times. When this did not work, the operator tried to start one of the standby pumps, but one was out of service, and the second one was tagged out. The second pump had actually been repaired on the previous shift, but the ‘‘Do Not Operate’’ tag had not been removed. During the period when the operator was trying to clear the tag and reduce o-xylene feed, the reactor overheated igniting the phthalic anhydride. Eventually 20 fire departments responded, but the loss was still in excess of $1 million (mostly due to damage to catalyst tubes). On the surface, the cause appears to be a mechanical failure, compounded by operator action. However, some of the human factors that could be considered the underlying cause are: 1. Design: A process design that allows operation where one failure can cause an incident could be considered unsafe. Alternates include an assured back-up water supply, and/or interlocks to prevent operation with only one pump available. 2. Management/Operations: There are several possibilities in this area. Management that encourages continued operations when the process is upset (reason operator delayed initiating shutdown) is operating on the edge. Management that accepts an unsafe design, and then does not take operational steps (require that two pumps be available at all times) is ignoring safety.


7-43 17-2


Page 28


3. Maintenance: There are several possibilities in this area also. While the backup pump repair had been completed, the tag was not removed because the worker’s shift ended. Maintenance workers on the next shift had already been assigned their work, and removing the tag went to the end of the work list. Repairs to the other pump had been delayed due to cost (needed new impeller). Some of the human factors listed here also could reflect management style (overtime and expensive repairs were discouraged). The above is an extreme example, but does illustrate some of the underlying causes in a multiple-cause incident. 3.1.2.8 Training and Performance Training is the systematic transfer of knowledge, skills and abilities to workers that results in improved performance in the work place. Proper training of all personnel is critical to the safe operation of a chemical processing facility. Due to the magnitude of different hazards normally found in such facilities, numerous types of process equipment, and elaborate computer control schemes currently in use, a thorough understanding of all aspects of the operation is necessary for safe operation. As newer technology is implemented, the need for training will continue to escalate. Before a successful training program can be developed, a needs analysis should be conducted. An analysis of the job for which training is to be accomplished is required to determine which tasks are actually required for a specific job, and which skills, knowledge and abilities are essential to success in the task. The first element is to analyze the needs of the organization, that is the goals of management, resource allocation and time frame for training purposes. The second element is to evaluate the specific area in which training is to be given. This could be in the form of job evaluation, observation or an interview with those currently performing the job. Information gathered during this phase will be used to determine critical elements of the job where training is needed. Last, an evaluation of the individuals to receive the training is performed. This is useful in establishing a baseline in the development of the training as well as providing feedback on the effectiveness of the trainer. Training in chemical processing facilities should focus on plant-wide aspects, as well as process-specific criteria. Plant-wide training should include general plant safety rules, alarm designations, smoking regulations, hot work procedures, etc. Process-specific training should begin with an overview of the specific process or operation and the associated unit operations involved in that particular area. The hazards (flammability, explosivity, toxicity) associated with each material used in the process also should be covered. Due to the widespread use of computer control of chemical processes, it is vital that all operators understand how the process is monitored, controlled and safeguarded by the computer system. Next, training in the process chemistry associated with the operation and typical operating parameters should be covered. In addition, abnormal process parameters should be detailed. The training program should utilize the ‘‘Standard Operating Procedure’’ and typical operator logs for the specific operation. This will ease the transition when the operator returns to the work area to perform the learned material. Not only should the operator possess a cursory understanding of the process chemistry, but also should have the depth of knowledge necessary to trouble-shoot and diagnose abnormal process conditions. This component of training is necessary due to the fact that every conceivable process excursion cannot be taught to each and every operator. Once the formal training has been given, a method to evaluate the effectiveness of the program is needed. Not only is it necessary to evaluate the level of learning that has occurred during the actual training session, but also to measure the level to which the knowledge is applied to the actual work situation. Formal evaluation of an employee’s training may consist of one or all of the following methods, depending on the types of skills or knowledge presented: written tests, practical hands-on performance evaluation or simulation. The types of skills and knowledge conveyed in the training program will dictate which of the three, or combination of the three will be needed. Regardless of the proficiency of operators, re-training should be conducted on a regular frequency. Some activities (fork truck operations, lockout/tagout, etc.) fall under regulatory requirements that have established re-training frequencies. Management should establish a program to identify the need and frequency for re-training all employees. Re-training also should be considered when changes are made to the process.



7-43 17-2


Page 29

3.1.2.8.1 Example: Three Mile Island

On March 28, 1979, a combination of mechanical failures and human error resulted in a release of nuclear radiation to the environment at a nuclear power facility. The incident was initiated by a loss of cooling water to the nuclear reactor that automatically initiated a trip of the feed water pumps and the turbine generator. As a result of the shutdown, a buildup of steam pressure within the cooling system of the reactor occurred, which automatically opened an electromagnetic relief valve. The operators did not recognize that the valve was stuck in the open position as the control panel indicated that the valve was closed. Simultaneously, the reactor shut down and the control rods lowered into the reactor core to absorb neutron flow as designed. At this point, multiple audible and visual alarms were activated in the control room. As the water coolant pressure dropped, the relief valve failed to reseat as designed, which allowed coolant to escape into the containment building unknown to the operators. Due to loss of cooling water through the relief valve, the water level around the core started decreasing. By design, an emergency core cooling system was automatically activated and it was assumed to be functioning properly, although the cooling system did not operate as designed. The control room instrumentation however, did show a rise in water level in the core. The operator was not aware of the fact that two valves in the emergency feed water system had been closed two days before for maintenance. There were alarm lights registering the valves as shut on the control panel. However, one was obscured by a caution tag and the other was blocked by an operator. This resulted in no cooling water to the core for an extended period. The control panel incorrectly indicated that too much water was entering the core, therefore, the operator overrode the automatic control system and reverted to manual control. Ultimately, the shut coolant water lines were discovered and reopened, which again flooded the control panel with a Christmas-tree effect of red and green indicator lights. Assuming the coolant system was now operating, the feed pumps were activated, which ultimately forced water through the stuck-open relief valve into a tank designed for containment of radioactive water and steam. The rupture disk on the tank burst, which allowed contaminated water onto the floor of the auxiliary building. As a result of loss of cooling water, the reactor core was partially uncovered, resulting in excessively high temperatures. This contributed to increased radiation levels within the facility. Estimates of this loss range from $1.0 to $1.86 billion, with roughly 60% of this being costs of replacing the lost power resulting from the event.1 This loss shows the importance of proper training of all employees and recognition of human factor elements of operators and maintenance operations in production facilities. The operators were not well versed in the process intricacies, specifically the relationship between pressure and temperature in the reactor. The operators did not realize that a small amount of water was being lost. It was also recognized that the operators were not trained in process diagnosis.2 While this incident occurred in a nuclear power generating facility, similar events are just as likely to occur in chemical processing facilities. This event also demonstrates the fact that incidents of this magnitude typically involve several consecutive failures, as opposed to a single discrete incident. 3.1.2.8.2 References

1. Cantelon, Philip L., and Williams, Robert C., Crisis Contained: The Department of Energy at Three Mile Island, Southern Illinois University Press, 1982. 2. Kletz, Trevor A., An Engineer’s View of Human Error, The Institute of Chemical Engineers, Rugby, Warwickshire, England, 1985. 3.1.2.9 Human Factors Human factor refers to the complex interaction between people and the processes and equipment they operate. Optimization of these interactions is the principal objective when using a human factor approach to minimize and/or mitigate risk in an industrial setting. Factors such as employee selection, work design, ergonomics, human/computer interaction, work conditions and training methods are all important in improving the level of reliability of the human/machine interface. It is not the intent of this data sheet to prepare the user to design systems/processes from a human factor perspective. The principle objective is to familiarize the user with the concepts of the field, which should aid in evaluating the effectiveness of a facility’s existing programs. Design and implementation of human factor systems should be performed by those specially trained for such functions, including system designers, human performance specialists and psychologists.


7-43 17-2


Page 30


Various references estimate that human factor errors are responsible for 80 to 90% of all loss incidents.1 The best references to human factor empirical data relate to nuclear plants, where human error is reported to contribute 50 to 70% of the risk.2 One reference cites that 10% of all human error accidents result from personal influences such as carelessness, emotional health or physical health. The remaining 90% have been attributed to external factors, such as inadequate procedures, ineffective training, poor design of humanmachine interfaces, work environment and reduced staffing levels.3 These statistics show that more emphasis needs to be placed on human factor engineering than has been in the past. Many types of errors occur in a production facility. However, these can be broken down into two broad categories. The first type, low-stress error, is an action planned but not carried out as intended. Such is the case when an operator presses the wrong push button on a control panel, although pressing the proper push button was intended. These type errors generally do not result from a lack of time to make a judgment, or a highly stressful situation. Often these errors can be designed out of the system by simply separating the push buttons. The second class of error, high-stress error, usually occurs due to a faulty decision or diagnosis of a problem, or lack of planning. In many cases, these type errors can be eliminated by proper training and frequent rehearsal of critical emergency procedures. In reviewing most severe losses, it usually is obvious that multiple errors occurred prior to the significant event. Rarely does a single human error result in catastrophic failure.4 The impacts that human behavior, physiological and psychological effects have on individuals in the work place are multiple and diverse — much too complex to be detailed in this text. These elements of human factor can be divided into three broad categories: human behavior, human/machine interface and work environment. 3.1.2.9.1 Human Behavior

Human behavior is shaped by the way in which a human being senses (sight, touch, smell or hearing) a stimulus, processes the information and ultimately responds. The subsequent response may be either appropriate or inappropriate, depending on the conditions in the environment and thought process at that particular instant. A human’s sensing and information processing capabilities are limited, and therefore must be understood and considered in the design of the worker’s environment. For example, an operator’s short-term memory is extremely limited. If operators perform a critical task infrequently, there is a high probability that erroneous action will be taken when actually required to respond in an emergency situation. However, once training and practice with real life situations have been accomplished, the operator has a better chance of reacting in a more reliable manner. Operators become accustomed to the way processes normally operate. Therefore, when changes are made, care should be taken to ensure that all operators are thoroughly aware of these changes through operator logs, internal directives, etc. If not, in an emergency situation, operators will tend to react to how the system was previously arranged rather than how the system is presently configured. All of the above reinforces the need for continual operator training, to allow the operator to remain familiar with the proper actions to take in emergency situations. Operator performance sharply declines during extended work periods (e.g., double shifts, seven day shifts, etc.) and after repetitive tasks. The work environment also influences human behavior to a great extent. High levels of stress, such as during periods of job layoffs, economic uncertainty and reorganization negatively impact worker performance. Additionally, as operators approach task overload, accuracy and efficiency are compromised. All of these factors influence an operator’s information processing ability in an emergency situation. In addition to training programs for employees and limiting overtime hours for dangerous or critical service duty, a commitment to human behavior issues could be indicated by the presence of a ‘‘Fitness for Duty’’Policy and the availability of access to outside stress hotlines. 3.1.2.9.1.1 Organization The dynamics within an organization have changed over the years, changing from companies that once maintained long-term relationships with employees, to companies required to reduce their numbers due to global competition and other factors. Due to the need to reduce operating costs, many organizations have resorted to such business initiatives as downsizing, restructuring, mergers, etc. These initiatives have the obvious



7-43 17-2


Page 31

impact of reducing the number of employees available to operate a production facility. This in turn can lead to reduction or elimination of safety-related functions that also will impact the effectiveness of a plant’s safety programs. The impact that is not so obvious is the loss or reduction in morale of chemical plant employees, which may also jeopardize the safety of an operation. While quantifying the effect that downsizing has on safety in a chemical facility is difficult, its impact should not be ignored.5 3.1.2.9.2 Human/Machine Interface

3.1.2.9.2.1 Computer Control Chemical processes are now commonly controlled with complex distributive control systems as opposed to the earlier analog control systems. Much more of the process control is placed in the domain of the computer versus active monitoring and controlling by the operator. Studies have shown that optimum performance is achieved when moderate levels of mental activity are present. This phenomenon was originally reported by Yerkes and Dodson6. However, more current literature by Poulton7 and Welford8 support these findings. When mental activity is either too high or too low, reduced performance usually results. With the increased usage of computer control and lesser involvement by the operator, care should be taken to ensure that process safety is not compromised due to the lower mental activity required of the process operator. It also has been shown that humans are unable to remain alert during extended periods of inactivity, such as in a control room setting when a process is running smoothly. While many tasks can be adequately automated, there remain tasks where human understanding is required to prevent jeopardizing reliable system performance. This has been shown in many recent losses. Operators must work in conjunction with, and not isolated from, the computer interface for effective control of the process. Studies have shown that failures of computer controlled systems can be attributed to operator error that disables protective features (20%) and software failures (20%), both of which have the ability to disable the entire system.9 Operator error can include actions of operators, as well as actions during maintenance operations, which compromise the integrity of the control system. Errors associated with software are especially critical, as the software is often the only element of the control system that is not redundant. Therefore, software can become the critical link in a computer controlled process. Errors in software are not obvious until an unusual sequence of events occurs. If a software error can produce devastating results, a thorough HAZOP is critical for the software as well as the process parameters. 3.1.2.9.2.2 Alarms Another significant occurrence associated with increased computer control is the increasing number and complexity of process control interlocks and alarms. Alarms should be categorized according to their impact on process control and designated accordingly, so that the operator is able to understand and prioritize the alarms sounding in the control room environment. As noted earlier, extremely high mental activity during a deluge of alarms may be detrimental to achieving optimum process control. 3.1.2.9.2.3 Control Panel Layout The design of control and display panels plays a critical role in operator intervention in an abnormal or emergency situation. If the display and controls are well laid out and understood by an operator, the chance of appropriate action is increased. Much study has been given to ergonomic design in the control room to facilitate safer operations. All displays should be legible, labeled appropriately and arranged for optimal viewing by the operator. The display should be designed such that abnormal or emergency situations are readily apparent. Monitors are now typically arranged with multiple screens requiring operators to scroll through many screens to view individual parameters. Care is needed to design systems that allow prompt discovery of abnormal or emergency situations. Only pertinent data necessary to observe the process should be present on the monitor to prevent extraneous information that could divert the operator or require additional time to find and react to pertinent information.


7-43 17-2


Page 32


3.1.2.9.3 Work Environment

The environment in which workers operate plays a significant role in their ability to perform as intended. Improper lighting can lead to erroneous operation of equipment and/or controls. Abnormal operating conditions requiring operator intervention may be hindered by inadequate illumination. Excessive noise can interfere with communications between personnel, leading to either a misunderstood communication or even failure to hear the communication. Additionally, excessive noise may impact the operators cognitive ability to make appropriate decisions in abnormal or emergency situations. Operators exposed to extreme temperature can also be detrimental to optimal performance. Research shows that exposure to extreme temperatures, such as below 60°F (16°C) or above 85°F (30°C) reduce a worker’s physical as well as mental performance as exposure duration increases. When operators are exposed to vibrations, many work place implications can occur. For instance, visual acuity is often impaired as a result of exposure to vibration, and operations requiring steadiness or precision are jeopardized.10 3.1.2.9.4 Human Factor in Maintenance Operations

The discussion thus far has referred specifically to operator-machine interfaces. However, maintenance of a process system poses similar concerns. Communication between operators and maintenance operations is critical so that all parties are aware of the scope of work to be performed. To facilitate optimum communication, all maintenance activities should require written authorization prior to start of work. 3.1.2.9.4.1 Example: Phillips Petroleum, Inc. On October 23, 1989, a release of approximately 85,200 lb (36,646 kg) of hot isobutane from a vertical loop reactor occurred at a large polyethylene plant in Pasadena, Texas. High density polyethylene is manufactured using ethylene gas dissolved in isobutane at high temperatures and pressures in the loop reactors. As a result of the reaction in the system, polyethylene settles out in the settling leg of the loop reactor and is eventually removed from the system. In this particular system, plugging of the leg occurs frequently, requiring that a single block valve on the bottom of the reactor be closed and the leg removed for cleaning. Cleaning of the settling legs is routinely conducted by contractor employees. Work was started on cleaning three of the six legs on a single reactor but was ceased for a crew lunch break. After returning from lunch, work on cleaning of the fourth leg resumed and a contractor employee was dispatched to the control room to request assistance from an operator. Shortly thereafter, initial release was reported from the unattached settling leg. This resulted in release of 99% of the reactor’s contents within several seconds. After reaching an ignition source, the unconfined vapor cloud ignited, which created a severe overpressure that caused extensive damage to the facility. Reports of the damage indicate nearly $750 million in property damage and $700 million in business interruption. An investigation after the explosion revealed air lines that activate the valve used to isolate the settling leg were installed in reverse position. In this configuration, the valve would open even though the control panel indicated that it was closed. This incident highlights several oversights directly attributable to human factor errors. The design of the block valve was determined to be inferior as it allowed installation of the air lines in a fashion that would allow the valve to open when assumed closed. In addition, there was no safe work permit system in place to allow for coordination with maintenance contractor employees and operators at the facility. 3.1.2.9.5 References

1. Attwood, D.A., Schmaltz, L.E., and Wixom, E.D., ‘‘The Exxon Chemical, Human Factors Program’’, 29th Annual Loss Prevention Symposium, AIChE (1995) 2. Gertman, D.I., and Blackman, H.S., Human Reliability and Safety Analysis Data Handbook, John Wiley & Sons, Inc., (1994) 3. Bridges. W.G., Kirkman, J.Q., and Lorenzo, D.K., ‘‘Including Human Errors in Process Hazard Analysis’’, Chemical Engineering Progress, May 1994, (74-75). 4. Latino, C.J., ‘‘Solving Human-Caused Failure Problems’’, Chemical Engineer Progress, May 1987, (42-43). 5. Friedlander, R. H. and Perron, M.J., ‘‘Downsizing’s Effect on Safety in the CPI/HPI’’, 29th Annual Loss Prevention Symposium, AIChE, (1995)



7-43 17-2


Page 33

6. Yerkes, R.M. and Dodson, J.D., ‘‘The Relation of Strength of Stimulus to Rapidity of Habit Formation’’, Journal of Comparative Neurology and Psychology, 18, 459-482, (1908) 7. Poulton, E.C., Environment and Human Efficiency, Springfield, Ill.: Charles C. Thomas Publisher, (1970) 8. Welford, A.T., Skilled Performance: Perceptual and Motor Skills, Glenview, Ill.: Scott, Foresman and Company, (1976) 9. Paula, H.M. and Battle, R.E., ‘‘Reliability Performance of Fault-Tolerant Digital Control Systems’’, 24th Annual Loss Prevention Symposium, AIChE, (1990) 10. McCormick, E.J., Human Factors in Engineering and Design, McGraw-Hill Book Company, New York, (1976) Bailey, R.W., Human Performance Engineering: A Guide for System Designers, Prentice-Hall, Inc., New Jersey, (1982) Burgess, J.H., Designing for Humans: The Human Factor in Engineering, Petrocell Books, Princeton, New Jersey, (1986) Kletz, T. A., Chung, P., Broomfield, E. and Shen-Orr, Chaim, Computer Control and Human Error, Institute of Chemical Engineers, Rugby, Warwickshire, England, (1985) Lorenzo, D.K., A Manager’s Guide to Reducing Human Error: Improving Human Performance in the Chemical Industry, Chemical Manufacturers Association, Inc., Washington, D.C., (1990) 3.1.2.10 Standards, Codes, and Laws The purpose of this element in a program based on PSM principles is to address and communicate a company’s minimum acceptable safe practices from the corporate level and ensure that all locations within the company share the same approach to process safety. This can be accomplished by creating internal standards to address the critical issues, or by documenting and communicating which national regulations, industry standards or consensus standards will be applied. This will ensure a consistency in decision making by design engineers and plant personnel. Once a set of standards is adopted, there is a need to develop a variance procedure where local conditions make precise application unreasonable. The variance procedure should require demonstration that the alternative approach is at least equivalent in safety to the required method. There should be a formal approval procedure for the variance at a management level, commensurate with the scope of the deviation from accepted practice. The variance procedure should be well documented and maintained as part of the plant design records. It also will be necessary to assign responsibility for maintaining the standards current and in keeping with the latest technology. This would include obtaining and filing the latest revisions of existing national regulations, industry or consensus standards as well as any new regulations applicable to the company’s operations. Where the changes are substantive, a company-wide bulletin should alert users to the change and direct any steps that are needed either in updating current practices or applying the change to future designs. Internal standards need to have a formal review cycle to maintain currency. Finally, there is a need for an audit procedure to ensure consistent application of the correct standards across the organization. This audit should ensure that new projects are in agreement with the latest standards and that any variances have followed the required approval steps. It also will be necessary to audit the various operating sites relative to their compliance with company policy and current documents. This audit can be part of the overall PSM program audit function described in the following section. 3.1.2.11 Audits and Corrective Actions Audits are needed to ensure the PSM system is consistent, effective, and appropriate for the exposure. These are usually done by a third party but many chemical companies have staff auditing teams. An audit employs a well-defined review process to ensure consistency. Corrective action items are reported and the company reviews and resolves the items. While just one part of overall process safety management, it is the critical one that attempts to ensure management control of the other parts.


7-43 17-2


Page 34


3.1.2.11.1 PSM Audit Preparation Scope : All parties need to understand the scope of the audit. Scope can be shaped by many factors, including regulatory requirements, corporate policies, resources available, and nature of exposure. Usually there is a balance between available resources and exposure, taking into account regulatory requirements.

This balance is impacted by type of facility, ownership, location, program content, and degree of site coverage needed. As an example, a small, low hazard, joint venture in a remote location does not command the same resources as a nearby high hazard wholly owned plant making products critical to the company. In some cases, it is more efficient to audit process units by type, where preparation is difficult and the process units are accessible. At remote locations where travel costs are high, a complete audit is usually more economical. Frequency : Audit frequency is controlled in part by some of the scope factors (regulatory requirements, corporate policies, exposure and resources). Other important factors to consider include results of prior audits, incident history, program maturity, and process maturity. Some of these factors affecting audit frequency decisions are noted below:

a) Degree of Risk vs. Maturity of Process. Operations that are inherently hazardous should have a higher audit frequency than operations that are inherently safe. Extremely exothermic reactions involving unstable materials is an example of the former. Endothermic reactions involving stable materials is an example of the latter. A mature process involving an extremely exothermic reaction may not need a higher audit frequency. Bulk Grignard reactions are considered hazardous. However, some have been done for over 40 years without major incident. Along the way, major incidents and technology indicated there were some essential factors for safe operation. A new Grignard process may still need more frequent audits, particularly if the vessel is not properly designed (low design pressure reactor with small rupture disk). b) Prior Audits. Results of prior audits may indicate an audit frequency change is justified. A finding of gaps in the PSM procedures indicates more frequent audits are needed. In turn, the frequency can be reduced for low hazard processes where the PSM procedures are excellent. c) Incident History. More frequent audits would be prudent for a process with a high incident history, or even a history of ‘‘near misses’’. d) Government Regulation and Company Policies. Sometimes the audit frequency is set by government regulations or company policy. Audit Staffing: A single person can conduct an audit, where the process is mature, well understood, and well documented. However, a mature process that is being changed needs special attention.

A team effort is normally needed for a comprehensive audit at a more complex process. As a group, team members should have experience in process safety management and auditing techniques. At least one should be familiar with the process being audited. Audit Report Content: While report content can vary from plant to plant, reports should be consistent within a company. The required content should be formalized beforehand for consistent results. This should include treatment of audit findings. Audit Report Distribution: The value of an audit is limited if distribution does not include appropriate individuals. Naturally, distribution should include those responsible for any needed corrections, but could include management responsible for similar production units for common cause problems. It should be noted that some legal departments hamper audit report distribution. Audit Follow-up: Items requiring corrective action need to be addressed using some form of audit followup. The procedure should be formalized, with assigned responsibilities and expected completion dates. Verification of completed steps also should be formalized. Usually it is best if the verification process is performed by the audit team, either at the next audit or a by a special review.



7-43 17-2


Page 35

3.1.2.11.2 PSM Audit Techniques Pre-Audit Planning : Proper preparation and planning are critical to the audit quality. Initial steps include selecting units to be audited, selecting the team, and scheduling the visit. Initially, selection of units to be audited should be based on process hazards, or value to the company. However, geography (location of units) and maturity of the PSM program also can be factors.

Interim steps include defining the scope of the audit, and collecting supporting documents. Audit scope should be a formalized part of the PSM program. Collecting adequate supporting documentation can be the most difficult part for an older unit that has been modified over the years. Even well run companies have found critical drawings, such as P&ID, wiring, and piping drawings are not current, or there is only one set of hand corrected paper plans. The final steps involve a review of background information and preparing the audit agenda. The team needs to understand the process, including the basic design and modification, plus the organizational system used for operation. The latter includes corporate policies, facility organization and regulatory requirements. Audit Activities: The audit team needs to develop an understanding of the plant’s internal PSM system used to operate the facility before actually auditing the unit. An excellent corporate process safety management system still depends on local management and operating staff for proper enforcement. Basically, the auditor needs to determine if the local system employed meets the intent of the overall program. This is done by auditing the plant’s process safety management system.

Excellent documentation is a good start, but this alone does not ensure the unit is operated as intended and is safe. Some potential weaknesses include inadequate staff to administer the local program, production goals that impair the PSM goals, and a relaxed management style concerning the PSM program. Considerable judgment is needed to determine if these weaknesses are actually deficiencies. Actual deficiencies need to be addressed as part of the audit report. Where satisfactory program controls exist, the auditor can focus on how well they function on a consistent basis. This can be done by interviewing staff, observing the operation and checking records. A deviation from the desired operation is a negative, but it is how well the process safety management system responds to the deviation that is important. It should be noted that no process safety management system will eliminate all deviations, so trends (deviations going up or down) are actually more important. During the audit, the team should review progress and discuss areas of concern that may need additional attention. Plant staff should be involved in these reviews since they frequently can supply the missing information or explain how and why local procedures differ from expected performance. Negative findings should be fully explored since it is poor technique to base an audit finding or recommendation on a single item. Actually, the quantity of information collected should be adequate to support the objectives of the audit and the conclusions of the team. To be adequate, the information collected should be relevant to the unit being audited, be completely unbiased, and should be objective. Enough information should be collected so the same conclusion can be determined by different people. At the conclusion of the visit, the audit team should finalize tentative findings and discuss them with management. Areas of disagreement should be resolved. If team findings are consistent with the PSM goals while taking into account local variances, the areas of disagreement will be minimized. Post-Audit Activities: The audit team usually prepares a formal report, which is distributed in accordance with the program. They also may be involved in the action plan prepared by the unit audited to ensure it meets the intent of the audit findings. Audit Tools: The process safety management system usually will have suggested tools to aid the audit process. Some of the tools include guidelines, checklists, questionnaires, outlines and suggested procedures. While they are not required to be used, the suggested tools usually have proven to be effective in aiding data collection. Data Collection: As an example, a ‘‘Process Safety Information’’ guideline, which can be customized to meet the needs of the corporation and tailored to match the requirements of individual production units might suggest that the following information be documented:

1. Chemical hazard a) Toxicity.


7-43 17-2


Page 36


b) Permissible exposure limits. c) Physical, reactivity, and corrosion data. d) Thermal and chemical stability. e) Hazardous effects of mixing. 2. Process technology a) Process description and flow diagram. b) Process chemistry. c) Inventory permitted. d) Safe upper and lower limits for temperature, pressure, flows and compositions. e) Consequences of deviations. 3. Process equipment a) Construction materials. b) P&ID. c) Electrical classification drawing. d) Relief system design and design basis. e) Ventilation system design. f) Drainage system design. g) Design codes and standards. h) Material and energy balance. i) Safety systems (interlocks, detection, control and suppression systems). 4. Safety inspections a) Code inspection reports for pressure equipment. b) Policy mandated inspection reports for safety equipment (rupture disk, safety relief valves, etc.). c) Policy mandated inspection/test reports for safety systems (short stop system, water quench system, interlocks, back-up power, etc.). 3.1.2.12 Emergency Response Planning Emergency response planning is intended to cover a wide range of activities for mitigating and controlling incidents, such as fires, explosions, vapor releases and chemical spills. A well developed emergency response plan is fully documented and well thought out. The level of detail of the various components of the plan should be commensurate with the site hazards. A management system should be in place to ensure that the emergency response system is effective and kept current with changes at the facility. The following plan elements should be available, up to date, and documented: 1. Facility policy regarding emergency response planning 2. Facility description a) Organization and staffing. b) Risk assessment of site hazards. c) Plot plans. 3. List of site hazardous material safety information 4. Emergency response plans a) Description of possible incident scenarios.



7-43 17-2


Page 37

b) Plan to respond to each scenario. c) On-site emergency equipment and supplies. d) Description of external resources and support organizations. 5. Emergency response teams a) Staffing and organization. b) Capabilities of members. c) Retraining plans. 6. Description of emergency systems and equipment 7. Post incident contingency plan 8. Regulations applicable to the facility 3.1.3 Concepts of Highly Protected Risk

The high hazard chemical industry, like other industries, can be protected to a loss prevention level which is defined, by insurance companies and risk management, as preferred risk. Preferred risk also is known as Highly Protected Risk (HPR). For any plant, whether high hazard chemical or otherwise, this level of protection has been established over decades of loss experience and fire and explosion research. In many occupancies, the difference between HPR and non-HPR status is usually based on whether or not the facility has sprinkler protection with adequate water supplies. This is somewhat simplistic in that other factors, such as management interest in loss prevention, also play an important role. In the chemical industry the presence or lack of sprinklers alone cannot solely define HPR status. 3.1.3.1 Requirements to Achieve HPR Status In the chemical industry all of the following elements are considered required, as needed based on exposure, for HPR status. Sprinklers or other automatic suppression systems alone cannot always be the dividing line between a good plant and a poor plant. Because chemical incidents can occur so fast and in some cases approach worst case type events with the initial event sequence, sprinklers alone may not be capable of providing the desired level of mitigation. In some cases sprinkler systems in these occupancies can only cool steel components without any effect on suppression or control. Prevention activities, as defined in an integrated program based on PSM principles, are critical to identification of potential incidents and to minimize the occurrence through careful design and process control. In fact, there are unsprinklered chemical facilities with excellent fireproofing, drainage, on-site response, and fully integrated PSM systems that may be equivalent to a fully sprinklered facility without a PSM system in place. The latter facility may have more frequent losses, one of which may ‘‘get away’’ due to poor attention to maintenance, testing, and inspections of suppression systems. In most cases, however, the need for sprinklers is a minimum requirement along with other protection. The protection scheme includes all components working as a system. If one is missing, the system may not be effective in limiting potential loss to the desired level and the plant may not be suitable for HPR status. The following elements are considered when determining HPR status of a chemical facility. Several FM Global data sheets specific to the element are listed when appropriate. Many other data sheets and reference sources on each element may exist but are not listed. 3.1.3.1.1 Integrated PSM System

Process safety management is described elsewhere in this document. This HPR element can be compared to the need for property conservation programs in other occupancies. PSM should be fully integrated into the chemical facility for all processes and activities, not just for those processes, systems, or chemicals mandated by government regulations. There are many processes and materials, for example, powders (dusts), fuels, and propellants, that are usually excluded from PSM regulations. (Sometimes these could be included under the umbrella of the General Duty Clause found in most regulations.) These can and should benefit from a program based on PSM principles as well as regulated processes or chemicals. In other words, an integrated PSM system means that all processes within the boundaries of the plant are covered. ©2000 Factory Mutual Insurance Company. All rights reserved.

7-43 17-2


Page 38


PSM is critical toward identification of hazardous materials and processes, mitigation of those hazards, and management of change throughout the life of the plant. A plant without a fully integrated program based on PSM principles appropriate for the level of hazard (or equivalent program by any other terminology) cannot be considered for HPR status. This subject also is broadly covered in FM Global Data Sheet 9-7/17-5, Property Conservation, and numerous publications by the CCPS, API, CMA, and other groups. (See Appendix D, Bibliography.) 3.1.3.1.2 Management Commitment and Oversight

Management commitment and oversight of loss prevention and process safety activities are crucial toward achieving and maintaining the desired level of protection throughout the life of a chemical facility. Examples abound that show how one management group that is production oriented, without commensurate attention (both monetary and staffing) to loss prevention, passes on a loss prone legacy to the next generation. Management commitment must start at corporate level, be part of the management culture at all lower levels, and be continued throughout the life of the plant. 3.1.3.1.3 Instrumentation and Process Control

Control of processes through proper instrumentation and interlocks minimizes operator error and ensures that incipient events are detected in time to take corrective action. There is no correct level of instrumentation or interlocks. Each facility or process within a facility needs individual assessment prior to determining needs. Needs are usually predicated on results of hazard analyses backed by common sense and loss history. Benign processes, which are easy to control and have little potential exposures, may require only a single layer of process control or perhaps only manual control. Highly complicated or hazardous processes may require multiple levels of interlocks and controls designed to be fully fail safe. Most chemical processes require one or more levels of redundancy. Data Sheet 7-45, Instrumentation and Control , addresses process safety controls, not operational process control systems. Other occupancy-specific data sheets, such as Data Sheet 7-35, Air Separation Processes , cover needs for that occupancy. 3.1.3.1.4 Operator Training and Empowerment

Operators must be trained not only in the hazard of the materials but in the way these materials interact within the process system. ‘‘What if’’ scenarios are helpful in training operators in potential variances from normal operation. Because the operator is responsible, on a daily basis, for ensuring both plant and process production and safety, this position is critical toward overall loss prevention. Where possible, the operator should be involved in hazard analyses. Operators must be empowered to make and act upon decisions without management oversight. The ability to shut down production when safety of the plant is at risk must be resident with the operators. Operator involvement and human factors are covered in more detail elsewhere within this document. 3.1.3.1.5 Vessel, Piping and Reaction Overpressure Protection

Equipment within a chemical facility is designed to contain energy. Vessels, piping, pumps, and other equipment may contain gases, liquids under pressure, or solids that can produce pressure if reacted or ignited within the system. Equipment must be protected, usually by code, to normal expected pressures and for unexpected but potential overpressures caused by reactivity or other events, such as confined dust or vapor explosions. Most significant chemical incidents can be attributed to failure of a pressurized system. Many FM Global data sheets cover overpressure protection, from vessel design to safety relief valves to emergency reactor venting. A few are listed: Data Sheet 7-46/17-11, Chemical Reactors and Reactions. Data Sheet 7-49/12-65, Emergency Venting of Vessels. Data Sheet 7-59, Inerting and Purging of Tanks, Process Vessels, and Equipment. Data Sheet 7-73, Dust Collectors and Collection Systems. Data Sheet 7-76, Prevention and Mitigation of Combustible Dust Explosions and Fires. 12 Series on boilers and pressure vessels.



7-43 17-2


Page 39

3.1.3.1.6 Maintenance, Inspection, and Testing programs

Once systems are installed, they need maintenance, inspection, and testing at specified frequencies. This applies to production equipment that is in day-to-day operation as well as emergency systems such as sprinklers and alarms. An HPR plant will have these programs in place commensurate with appropriate standards, codes, and manufacturers’ recommended practices. Refer to FM Global Data Sheet 9-0/17-0, Maintenance, and various protection system, pressure vessel, mechanical equipment, and electrical equipment data sheets, such as Data Sheet 2-8N, Installation of Sprin- kler Systems (NFPA); Data Sheet 5-20, Electrical Testing; Data Sheet 12-0, Applicable Pressure Equipment Codes and Standards; and Data Sheet 12-43, Pressure Relief Devices. 3.1.3.1.7 Adequate and Reliable Water Supply and Delivery System

Water supplies are usually required for a chemical facility regardless of whether sprinklers are needed or provided. A strong water supply feeding an underground main system with properly spaced and arranged hydrants or monitor nozzles is a minimum requirement for HPR status. Larger chemical facilities may need systems capable of providing tens of thousands of gallons per minute to cool steel and protect exposures around a flammable liquid pool fire. The system must be laid out as reliably as possible; often, multiple sources at opposite ends of the facility are provided for maximum availability and reliability. Water supply and distribution system needs and design considerations that may be used when evaluating chemical plants are covered in various FM Global data sheets including: Data Sheet 3-0, Hydraulics of Fire Protection Systems. Data Sheet 3-2, Water Tanks for Fire Protection. Data Sheet 3-7N/13-4N, Centrifugal Fire Pumps (NFPA). Data Sheet 3-10, Installation/Maintenance of Private Service Mains and their Appurtenances. 3.1.3.1.8 Ignition Source Control

Ignition source control is a broad area covering such potential sources as smoking, electrical, hot work, lightning, non-sparking equipment, spontaneous or chemical decomposition heating, hot surfaces such as heat transfer fluid or steam piping, chemical reaction heat and other process heat sources, and open flames such as flares or gas-fired equipment. Some potential sources, such as hot work, are easily identified and can be controlled by awareness, training and permit systems. Others, such as reaction heat, may occur only under adverse conditions and may not be identifiable without a hazard analysis. The intent in chemical facilities is to eliminate ignition sources so that a spill or vapor release can be mitigated before ignition occurs. Ignition source control is covered in several FM Global data sheets including: Data Sheet 5-1, Electrical Equipment in Hazardous Locations. Data Sheet 5-8, Static Electricity. Data Sheet 5-10, Protective Grounding for Electrical Power Systems and Equipment. Data Sheet 5-11, Lightning and Surge Protection for Electrical Systems. Data Sheet 7-0, Causes and Effects of Fires and Explosions. Data Sheet 7-99/12-19, Heat Transfer by Organic and Synthetic Fluids. 3.1.3.1.9 Adequate Spacing of Buildings, Process Units and Tanks

The degree of confinement or openness of a chemical facility will determine the potential for a small incident to progress into a worst case event. Closely spaced facilities can be exposed to larger incidents due to ‘‘knock on’’ events, such as thermal radiation, missiles and fragments, and overpressure. In general, process units should be separated by 100 feet (30 m) from other process units by unobstructed roadways. Tank farms or other unusually hazardous processes such as catalyst manufacture may require additional spacing. Administrative, utility, and emergency response facilities also require careful siting, remote from process hazards.


7-43 17-2


Page 40


The following FM Global documents provide guidance on chemical plant spacing: Data Sheet 7-28N, Explosive Materials (NFPA). Data Sheet 7-42, Guidelines for Evaluating the Effects of Vapor Cloud Explosions Using a TNT Equivalency Method. Data Sheet 7-44/17-3, Spacing of Facilities in Outdoor Chemical Plants. Data Sheet 7-88, Storage Tanks for Flammable and Combustible Liquids. 3.1.3.1.10 Emergency Response and Post-loss Contingency Plans

An HPR plant will have a plan in place to respond to any potential incident scenario. Scenarios will be developed based on hazard analyses. Incident response includes both response of operators to control the event and emergency fire fighting, but is not limited to these activities. It also includes a timely investigation to determine cause and written contingency plans for acquiring spares, restoring production, obtaining raw materials, etc., following the incident. 3.1.3.1.11 Testing and Understanding of Process Chemistry

This HPR element ties in well with process safety knowledge, described in Section 3.1.2.2. Knowledge of the hazards of materials and their reactivity when combined with other materials, either intentionally or unintentionally, is critical to safe operation of the facility. Several FM Global data sheets provide guidance on process safety information including: Data Sheet 7-46/17-11, Chemical Reactors and Reactions. Data Sheet 7-49/12-65, Emergency Venting of Vessels. and occupancy specific data sheets such as: Data Sheet 7-22, Hydrazine and its Derivatives. Data Sheet 7-51, Acetylene. Data Sheet 7-52, Oxygen. Data Sheet 7-53, Liquefied Natural Gas (LNG). Data Sheet 7-54, Natural Gas and Gas Piping. Data Sheet 7-55/12-28, Liquefied Petroleum Gas. Data Sheet 7-58, Chlorine Dioxide. Data Sheet 7-80, Organic Peroxides. Data Sheet 7-89, Ammonium Nitrate and Mixed Fertilizers Containing Ammonium Nitrate. Data Sheet 7-91, Hydrogen. Data Sheet 7-92, Ethylene Oxide. 3.1.3.1.12 Adequate and Reliable Fixed Suppression Systems

Because of large quantities of high heat release hydrocarbons and other flammable liquids and gases, chemical facilities almost always require some level of fixed automatic suppression. Due to cost and reliability, water-based deluge or water spray systems are often used. Protection may include exposed structural steel, production vessels, pumps, tanks, pipe racks, loading stations, and oil lubricated rotating equipment. Foam systems are used when faster suppression is needed, often due to poor drainage or lack of steel protection. High speed systems are used for high-energy materials such as propellants. Explosion suppression may be used in high frequency areas with combustible dusts or vapors. High volume water spray systems may be used for vapor cloud dispersal or as thermal shields between process units. An HPR chemical facility requires fixed suppression, where needed, as a minimum requirement for preferred risk. FM Global resources on suppression system selection and design include: Data Sheet 2-8N, Installation of Sprinkler Systems (NFPA). Data Sheet 4-0, Special Protection Systems. Data Sheet 4-1N, Water Spray Fixed Systems (NFPA). Data Sheet 4-7N, Low Expansion Foam Systems (NFPA). Data Sheet 7-17, Explosion Protection Systems.



7-43 17-2


Page 41

For resources on protection needs for process units, structures, or equipment common to chemical plants, also see: Data Sheet 1-6, Cooling Towers. Data Sheet 5-4, Transformers. Data Sheet 5-31, Cables and Bus Bars. Data Sheet 5-32, Electronic Data Processing Systems. Data Sheet 7-2, Waste Solvent Recovery. Data Sheet 7-14, Fire and Explosion Protection for Flammable Liquid, Flammable Gas and Liquefied Flammable Gas Processing Equipment and Supporting Structures. Data Sheet 7-29, Flammable Liquid Storage in Portable Containers. Data Sheet 7-32, Flammable Liquid Operations. Data Sheet 7-48, Disposal of Waste Materials. Data Sheet 7-54, Natural Gas and Gas Piping. Data Sheet 7-55/12-28, Liquefied Petroleum Gas. Data Sheet 7-78, Industrial Exhaust Systems. Data Sheet 7-88, Storage Tanks for Flammable and Combustible Liquids. Data Sheet 7-95, Compressors. Data Sheet 7-99/12-19, Heat Transfer by Organic and Synthetic Fluids. Other data sheets that are specific to certain chemical occupancies also have guidelines on fixed suppression needs, including: Data Sheet 7-30N, Solvent Extraction Plants (NFPA). Data Sheet 7-34, Electrolytic Chlorine Processes. Data Sheet 7-35, Air Separation Processes. Data Sheet 7-89, Ammonium Nitrate and Mixed Fertilizers Containing Ammonium Nitrate. 3.1.3.1.13 Drainage and Containment Systems

Fires involving lighter-than-water hydrocarbons cannot be suppressed by water systems alone. While the water can be effective at keeping building and equipment steel cool and allowing emergency personnel to gain access, other systems are needed for full suppression. Drainage systems and containment, such as curbs and dikes, are important to channel liquids away from important equipment or confine liquids at a safe location. In fact, drainage systems can aid in suppression by elimination of oxygen within the drainage piping and collection system. Care must be taken to ensure that hazardous material drainage systems are not connected to benign systems, such as those from a control room. Incidents have occurred when flammable or corrosive vapors have entered non-hazard rated areas and exploded or contaminated sensitive electronic equipment. Attention to environmental regulations is needed to ensure that a drainage or containment system is acceptable. The following FM Global data sheets cover these systems and their design in detail: Data Sheet 7-83, Drainage Systems for Flammable Liquids. Data Sheet 7-88, Storage Tanks for Flammable and Combustible Liquids. 3.1.3.1.14 Equipment and Structural Steel Fire Protection

Exposed building steel under load cannot withstand a hydrocarbon fire exposure for any significant length of time. Because steel is often the structural element of choice, due to cost or flexibility, special protection is needed to prevent early collapse of an important process structure. Steel vessels such as reactors, exchangers, and distillation columns, or tanks on steel legs are also highly susceptible to heat failure which could release contents, adding fuel to a fire. The goal is to keep the steel cool while the burning liquids or gases are removed by drainage or the fluid release is stopped. Steel can be protected by water spray or by fireproofing with noncombustible heat resistant materials. Preferably, reinforced concrete would be the structural choice where there are large amounts of flammable liquids or gases that may be released.


7-43 17-2


Page 42


Refer to the following FM Global data sheets for information on steel protection: Data Sheet 1-21, Fire Resistance of Building Assemblies. Data Sheet 7-14, Fire and Explosion Protection for Flammable Liquid, Flammable Gas and Liquefied Flammable Gas Processing Equipment and Supporting Structures. 3.1.3.1.15 Damage Limiting and Noncombustible Construction

To minimize the effects of fire and explosion pressure damage, an HPR facility will have appropriate damage limiting (DLC) or fire resistive construction. Examples of DLC include high strength, blast resistant control rooms and low strength venting walls for an occupancy containing flammable vapors or dusts. Noncombustible construction also is an HPR requirement for important support and utility buildings. Control rooms and other critical operations or emergency response centers need careful evaluation as to hardening against blast overpressures. Cost and importance to safe shutdown and continued long term production are key variables. The following FM Global data sheets provide information and application requirements: Data Sheet 1-44, Damage-Limiting Construction. Data Sheet 1-57, Rigid Plastic Building Materials. 3.1.3.1.16 Combustible Gas Detection

Combustible gas detection is desirable for fast notification of a release of gas or hot vapor. This may prompt an automatic or manual emergency response such as vapor cloud water spray dispersal systems or fire department response. Refer to Data Sheet 5-49, Gas and Vapor Detectors and Analysis Systems, for more information on this subject. 3.1.3.1.17 Inerting and Purging Systems

Elimination of oxygen within flammable vapor spaces may be required to prevent explosion or fire incidents. Nitrogen inerting or purging prior to filling a system with hydrocarbons is commonly used. In many cases, a pressurized inert gas is used to push materials safely through a system. Detection to ensure oxygen levels are maintained at proper concentrations are part of an inerting system. Inerting can apply to storage vessels, production vessels, piping, and drainage/collection systems. The following FM Global data sheets cover this subject: Data Sheet 7-30N, Solvent Extraction Plants (NFPA). Data Sheet 7-59, Inerting and Purging of Tanks, Process Vessels, and Equipment. Data Sheet 7-88, Storage Tanks for Flammable and Combustible Liquids. 3.1.3.1.18 Barriers and Barricades

In some cases, a barricade may be needed to protect important buildings or production areas against missile or fragment impact from a nearby source of frequent explosions. Barriers and barricades are commonly used in plants handling explosives and propellants. They have been successfully applied in chemical facilities such as high pressure polyethylene plants. Barriers are not usually acceptable for overpressure protection. Pressure waves generated by a vapor cloud or vessel explosion will pass around or over barriers and re-form on the back side. Fire resistive barriers, such as noncombustible fire walls, often are used as separation between important production areas or between high hazard and low hazard areas. The following FM Global Data Sheets provide more detail on these systems: Data Sheet 1-19, Fire Walls, Subdivisions, and Draft Curtains. Data Sheet 1-20, Protection Against Fire Exposure (From Buildings and Yard Storage). Data Sheet 1-22, Criteria for Maximum Foreseeable Loss Fire Walls and Space Separation. Data Sheet 1-23, Protection of Openings in Fire Subdivisions. Data Sheet 7-16, Barricades.



7-43 17-2


Page 43

3.1.3.1.19 Protection Against Natural Perils

Like all occupancies, chemical facilities may be exposed to a variety of natural events, some potentially catastrophic, such as earthquakes, hurricanes, and floods. Less obvious, but potentially equally damaging exposures such as a hard freeze in a temperate climate, also have caused large loss incidents. The following FM Global data sheets provide more detail on these exposures and methods of analysis and protection: Data Sheet 1-2, Earthquake. Data Sheet 1-7, Wind Forces on Buildings and Other Structures. Data Sheet 1-54, Roof Loads for New Construction. Data Sheet 9-2, Surface Water. Data Sheet 9-13, Evaluation of Flood Exposure. Data Sheet 9-18/17-18, Prevention of Freeze-ups. 3.1.4 Concepts of Inherent Safety

Opportunities exist to reduce the risk at a chemical facility at many stages of its life, but the primary opportunity exists during new project development or during major changes. At these stages, inherent safety opportunities can be explored economically. An inherently safer plant relies on the reduction or elimination of hazardous materials or processes through changes in the chemistry and physics of the process rather than layers of ‘‘add on’’ safety control and fixed protection systems. The traditional approach to loss prevention has been to accept the hazard and then to protect against it. This latter approach requires expensive active and passive protection systems, which are subject to failure during the life of the plant. An inherently safer plant has eliminated or reduced the hazard to where these systems may not even be needed, saving initial installation cost, lifetime maintenance and testing costs, and potential loss costs should systems fail. According to Kletz, there are five approaches to the development of inherently safer plants: intensification, substitution, attenuation, limitation of effects and simplification/error tolerance. 3.1.4.1 Intensification Intensification means using smaller amounts of a hazardous material. For example, a polyolefins plant required large quantities of LPG feedstock. In the past it had a large day tank within the process unit. This tank was fed from bulk storage spheres located many hundreds of feet away. The day tank was found to severely expose the production unit, and in fact was installed only as a production convenience if supplies were temporarily cut off from the larger tanks (due to a pump failure, for example). The day tank was eliminated and spare pumps installed for reliability. The plant was able to operate as efficiently without the hazardous large volume inventory within the production unit. In another case, a hazardous reaction involving potentially detonable materials was at one time conducted in a moderately sized batch reactor. The possibility of runaway with a subsequent detonation of a large quantity of high energy material existed due to many different failure modes because of the reactivity of the materials involved. The process was changed so that the two reactants were continuously reacted in a small pipe reactor with flows less than 5 gpm (19 lpm). The same amount of product was produced at a reduced risk due to substantially lower amounts of high energy material available at any given time. 3.1.4.2 Substitution Substitution means replacing a hazardous material with a non-hazardous or less-hazardous material. The classic example of substitution is the use of water as a coolant instead of combustible thermal oil. The advantage is obvious. Water is both nonflammable and non-corrosive. Fire protection will not be needed for the coolant alone, which could have been the case for the thermal oil. Another example is using an ammonia refrigeration system in an outdoor process unit instead of propylene. The propylene system represents fire and vapor cloud explosion hazards, where the ammonia hazard is substantially less from a fire and explosion standpoint. A trade off in toxicity, which may affect manual fire fighting response, would occur with this choice. A third example is the use of supercritical carbon dioxide instead of highly flammable solvents in processes that require extraction of oils, such as agricultural products. The hazards of fire and explosion from


7-43 17-2


Page 44


the solvent are eliminated, although combustible oils may still be present. A possible hazard trade off is made in the high pressures required for supercritical extraction. Substitution can apply to non-chemical systems as well. Use of noncombustible construction in buildings, use of electric cable inside metal conduit instead of exposed plastic insulated cable, and use of stainless steel instead of plastic for duct systems handling some corrosives are all examples of this element of inherent safety. 3.1.4.3 Attenuation Attenuation means using less hazardous process conditions or a less hazardous form of material. Attenuation is commonly achieved by using lower temperatures and pressures. It may be achieved through process chemistry (i.e., a new reaction with less potentially energetic effects). The 1974 Flixborough, U. K., incident was caused by a release of boiling cyclohexane, a raw material used to make caprolactam, an intermediate for nylon. Hundreds of thousands of pounds of boiling cyclohexane were present in the system under high pressure. Upon accidental release, the material flashed to vapor and an outdoor vapor cloud explosion occurred with essentially total damage to the plant. Another plant discovered a way to produce caprolactam using cyclohexane in a process below its boiling point. Should the cyclohexane be released, a severe fire hazard will exist. However, the fact that the material is below its boiling point at all times has completely eliminated any possibility of a vapor cloud explosion. Another common example is refrigerated storage of hazardous materials, such as ethylene oxide. Ethylene oxide stored at ambient conditions can form large vapor clouds if released. If stored as a refrigerated liquid, essentially no vapor cloud can form. In another plant, a combustible silicon metal dust presented an unacceptable risk. The dust was tested and found to have a very high energy potential, and conventional damage limiting systems would not be effective in reducing overpressures should the material ignite. The solution was to immediately dilute the dust in an inert material, a process called phlegmatization . This was done within the duct system prior to any large or important collection system. The resultant mixture was rendered noncombustible and the explosion hazard was eliminated. Another inherently safe solution for undesirable combustible dusts is to collect them in a liquid slurry. 3.1.4.4 Limitation of Effects Limitation of effects means designing a facility that minimizes the impact of a release of hazardous material or energy. The most common approach to this element of inherent safety is in proper siting and location of facilities. This can reduce the impact of a release or event by distance and by limitation of add-on events such as BLEVEs or missile punctures. Other factors considered could include proper drainage patterns, prevailing winds and meteorological conditions. At one plant, a typical process unit is constructed of a one-story concrete supported structure known as a pump house. The pump house has open walls and a solid concrete roof. Pumps are located within the concrete structure at grade level and piping is located at ceiling level. Major processing equipment, such as purification columns and rundown tanks with high volume flammable materials, are located around the perimeter of the concrete structure or on the solid roof. The structure is long and narrow with heavily sloped drainage toward the outside of the unit. All important equipment is fireproofed. These features were intentional to ensure that all significant quantities of flammable materials were fully accessible for manual fire fighting. Upon a release, the materials flow outward from the unit and can be more easily controlled. Damage, even in a worst case event, will be limited to peripheral equipment. Another approach to limitation of effects is by limiting the magnitude of a process deviation. For example, the rate of addition of a material to a reactor can be limited by sizing the feed pump so that it cannot possibly exceed the safe addition rate. This also can be achieved by use of small piping or orifice plates in pipes. Use of smaller but deeper dikes around LPG and other liquefied gases such as LNG and ethylene will substantially reduce the amount of exposed liquid surface area subject to vaporization.



7-43 17-2


Page 45

Another classic example of limitation of effects is by provision of barriers or complete containment of a hazardous material or process. This has been used effectively by the nuclear power and the propellant and solid rocket motor manufacturing industries. Blast barriers have been used effectively around high pressure ethylene processes. Containment is now commonly used for liquid chlorine tanks. 3.1.4.5 Simplification/Error Tolerance Simplification/error tolerance means designing a facility so that operating errors are less likely or the process is more forgiving if errors are made. This can apply to many operating conditions within a plant. For example, use of gravity systems is preferable to pumping systems because of the lack of moving parts and less potential for leaks (such as at pump seals). If pumps must be used, pumps without seals or double-sealed are preferable. Piping should be welded if possible, flexible couplings minimized or eliminated, and glass level devices eliminated. Sample points should be avoided, but should have double valving and collection pots if necessary. Many simplifications can be done to process units, especially in batch reactions, to minimize the potential for error in charging of reactants. Small charge vessels can be added for initial mixing instead of ‘‘dumping’’ all materials into one large reactor where hot spots can form due to poor mixing or cooling. At one petrochemical plant, the plant was simplified by reducing by 60 the number of vessels and equipment needed to run a similar but older plant. The complexity of running the plant and thus potential for loss was substantially reduced. 4.0 REFERENCES 4.1 FM Global

Several subsections above have related reference material. See Sections 3.1.2.1.2, 3.1.2.5.5, 3.1.2.8.2, 3.1.2.9.5 and 3.1.2.9.6. APPENDIX A GLOSSARY OF TERMS AICHE: American Institute of Chemical Engineers. API: American Petroleum Institute. IS: Inherent Safety. P&ID: Piping and Instrument Diagram. APPENDIX B DOCUMENT REVISION HISTORY

February 1974. Original publication. May 1999. Completely rewritten using PSM as basis. APPENDIX C: INTERNATIONAL ORGANIZATIONS AND REGULATORY CODES OVERSEEING CHEMICAL PLANT PROCESS SAFETY C.1 Mandatory Regulations Covering PSM and Related Chemical Industry Safety Oversight

To date, mandatory regulatory oversight of process safety has occurred only in the European Economic Council Countries (EEC) or European Union (EU), and within North American only in the United States. There are currently no mandatory PSM regulations in Canada, Mexico, or the AustralAsia countries, although studies are underway to promulgate laws similar to Europe and the U.S. in many of these areas. PSM regulation started in Europe following a series of serious chemical plant incidents, Flixborough (1974), Beek (1975) and Seveso (1976) being the most noteworthy. In 1982, the EU developed EC Directive 82/501/ EEC which required adoption of PSM. In 1992, following a series of accidents in chemical plants in the U.S., including Phillip Petroleum (1989), the OSHA 1910.119 PSM Rule was enacted. Also in response to environmental releases, the EPA in 1993 issued a proposal to require chemical plants to develop risk management plans. The EPA Rule was enacted in June 1996 with an effective date of August 19, 1996.


7-43 17-2


Page 46


C.1.1 Europe

C.1.1.1 EC Directive 82/501/EEC and its 1987 revision (87/216/EEC) are known as the Seveso Directive. A third revision (88/610/EEC) was developed following a major accident in Basel, Switzerland, in 1986. The purpose of the directive is to place into law an administrative structure to ‘‘identify, assess, control, and mitigate the major accidents, hazards and risks’’ of chemical and related industries. The directives contain the following key provisions: — unifying standards across the European Community — identification of competent oversight authorities — provision of a framework of controls involving: – identification – assessment – control – mitigation — information exchange between member states and the European Community — Community-wide reporting, with data base, of major accidents The directive requires a company to: — comply when certain threshold chemicals or process systems are present — report major accidents — demonstrate that plant risks have been identified, safety measures adopted, and that information, training, and equipment has been provided to personnel, following an established and documented process safety management program. Exemptions include nuclear, military, explosives and ordinance, mining, and waste disposal sites. A byproduct of the regulations is research into major industrial hazards including developing technologies for accident prevention and environmental restoration; improving the understanding of chemical and physical hazard phenomena; and improving the understanding of managing risk. C.1.2 United States

The U.S. Clean Air Act (CAA) Amendments of 1990, signed into law on November 15, 1990, included provisions for chemical accident prevention. Both the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) were instructed to promulgate process safety regulations. In addition, a number of individual states, including California, Delaware, Texas, Nevada and New Jersey have adopted related regulations. C.1.2.1 Occupational Safety and Health Administration In response to this act, OSHA promulgated Process Safety Management of Highly Hazardous Chemicals (29 CFR 1910.119), which went into effect on August 26, 1992. This law covers chemical accidents that can occur on a plant site and expose plant workers and the public to (principally) fires and explosions. The law lists 141 specific chemicals plus all flammable hydrocarbons, and provides threshold values above which a company using, storing or producing the chemicals must comply with the provisions of the law. The law is a performance-based standard rather than specification-based, so there are no specific measurements that the company is mandated to meet. The OSHA PSM law lists 14 specific provisions for compliance, including a requirement to conduct extensive process safety analyses. When the law was passed, it was estimated that approx 87,000 U.S. facilities would meet threshold requirements and need to comply with the law. Elements of process safety within the OSHA PSM Rule are similar to the CCPS elements. One significant difference between the two documents is in scope. CCPS is a general guideline that does not define what processes need to fall under PSM oversight. It is intended to be applied by the users according to their needs. OSHA specifies which areas of a facility must be managed by listing 141 specific chemicals and all flammable hydrocarbons. It also lists process situations and occupancy defaults. The law applies if these defaults are triggered. PSM does not have to be applied if these defaults are not triggered. Some of the OSHA-listed chemicals and their thresholds, as compared to EPA thresholds, are provided in Table 1.



7-43 17-2


Page 47

Table 1. Comparison of OSHA and EPA Thresholds of the More Common Hazardous Chemicals Substance Anhydrous Ammonia Chlorine Chlorine dioxide Anhydrous hydrochloric acid Sulfuric acid Titanium tetrachloride Flammable hydrocarbons Explosives

EPA threshold, lb (kg) 1,000 (450) 1,000 (450) 500 (225) 1,000 (450) 5,000 (2250) 500 (225) 10,000 (4500) all (per DOT)

OSHA threshold, lb (kg) 5,000 (2250) 1,500 (680) 1,000 (450) 5,000 (2250) Not listed Not listed 10,000 (4500) Not covered

C.1.2.2 Environmental Protection Agency In response to the Clean Air Act Amendments of 1990, the U.S. EPA announced in the October 20, 1993 Federal Register (Vol 58, No. 201, 54190) a proposed rule entitled Risk Management Programs (RMP) for Chemical Accidental Release Prevention (40 CFR Part 68). The rule was finally enacted in 1996, with an effective date of August 19,1996. The rule is intended to protect public health and the environment. It closely parallels the OSHA law covering Process Safety Management of Highly Hazardous Chemicals, which is primarily intended to protect in-plant workers. The EPA RMP and the OSHA PSM laws are different yet complementary to each other. OSHA’s focus is on workplace consequences while EPA is on offsite consequences. However, EPA acknowledges that most locations that comply with the OSHA law will also comply to some extent with the EPA rule. The EPA estimated that the new rule will affect 140,000 U.S. facilities that have one or more of the 100 listed toxic substances, 62 flammable liquids or gases, or high explosives on their site above identified threshold values. The thresholds for toxic substances are based on a ranking method that considers each substance’s toxicity and potential to become airborne and disperse. The thresholds for listed flammable liquids and gases are based on the quantity that potentially might be involved in a vapor cloud explosion. The threshold for explosives is based on the quantity that could produce lethal blast waves from an explosion at a distance of 100 meters (330 ft). The presence of a threshold quantity is to be determined based on the maximum quantity in a single process. More facilities fall under the EPA rule than under the OSHA rule due to the generally lower threshold values of listed chemicals in the EPA rule. (A sample threshold list is shown in Table 1.) In addition to complying with the OSHA PSM provisions, the EPA rule adds two major components as part of the facility’s risk management program: hazards assessment and response programs. Facilities that meet EPA thresholds have to conduct hazard assessments for each covered substance. The hazard assessment has to look at a range of accidental release scenarios including worst case. The worst case release scenario is defined by EPA as ‘‘the release of the largest quantity of a regulated substance from a vessel or process line failure, including administrative controls and passive mitigation that limit the total quantity involved or the release rate. For most gases, the worst case release scenario assumes that the quantity is released in 10 minutes. For liquids, the scenario assumes an instantaneous spill; the release rate to the air is the volatilization rate from a pool 1 cm (3 ⁄ 8 in.) deep, unless passive mitigation systems (e.g., dikes) contain the substance in a smaller area. For flammables, the worst case assumes an instantaneous release and a vapor cloud explosion’’. The EPA lists meteorological conditions (wind speeds and atmospheric stability) which define worst case. It should be noted here that the OSHA law does not assume worst case, and for this reason much more severe exposures could be proven after conducting an EPA hazard assessment. The EPA rule does not yet define a likelihood (probability) beyond which an event can be considered ‘‘extreme’’ worst case. It does however address ‘‘alternative release scenarios’’. These non-worst case accidental releases for the hazard assessment portion of the risk management plan were presumed ‘‘more likely to occur’’ and ‘‘more realistic’’ than the worst case. EPA believes facilities should have flexibility to select non-worst case scenarios that are the most useful for communication with the public and first responders and for emergency response preparedness and planning. For ‘‘alternative scenarios’’, facilities may consider the effects of both passive and active mitigation systems.


7-43 17-2


Page 48


The EPA rule also goes well beyond OSHA in its provision for emergency response. Facilities will need to develop more extensive plans that detail how the facility would respond to a release to limit offsite consequences. EPA requires facilities to conduct drills and exercises to test their program. Facilities have to coordinate plans with the local emergency planning committee (LEPC), which is not required by OSHA. The EPA rule also allows for full public availability of the facility’s hazard analysis and response procedures, although there is still considerable discussion as to how this will be done. Examples of facilities covered by the new EPA law, that might not have been covered under OSHA, are smaller plants using ammonia refrigeration systems and waste treatment plants (using chlorine). With the EPA rule now law, a company has three years (from the effective date of August 19, 1996) to bring it into full compliance. C.2 Voluntary Chemical Industry Programs C.2.1 Responsible Care ®

There are many chemical industry resources and programs for process safety. The most noteworthy international program is called Responsible Care. This was started in Canada as a way to partner chemical plants with the neighboring communities. Hazard information is shared and emergency plans are developed and tested for hazard material release response. Responsible Care programs are generally not regulatory. That is, they are not mandated by law but instead are voluntary. However, they are usually a compulsory part of belonging to a local or national chemical industry association. That is, by voluntarily joining the organization, the company agrees to participate in Responsible Care. In Canada, the Canadian Chemical Producers Association (CCPA) oversees Responsible Care. In the U.S., it is overseen by the Chemical Manufacturers Association (CMA) and the Synthetic Organic Chemical Manufacturers Association (SOCMA). C.2.2 International Safety Rating System (ISRS)

ISRS is a structured approach to evaluate all areas of safety awareness and management at a facility. It provides a formal measurement tool and external accreditation if required. The International Loss Control Institute (Georgia, USA), that was acquired by DNV (Det Norske Veritas), developed ISRS in the 1970’s. It is used widely throughout Europe and the U.K. (DNV claims it is used at 6,000 industrial sites) including railroads, nuclear research labs, utilities and chemical and pharmaceutical plants. ISRS analyses 20 elements to determine the extent and quality of loss control management and it assists in addressing these criteria by applying risk management and cost/benefit techniques. This ensures that plans and controls are proportionate to the risk posed and prioritized for action. ISRS numerically ranks a company’s performance in relation to the criteria established with its 20 elements. The rating is from 1 (worst) to 10 (best). The 20 elements are as follows: 1. Leadership and administration 2. Leadership training 3. Planned inspections and maintenance 4. Critical task analysis 5. Accident/incident investigation 6. Task observation 7. Emergency preparedness 8. Rules and work permits 9. Accident/incident analysis 10. Knowledge and skills training 11. Personnel protective equipment 12. Health and hygiene control 13. System evaluation



7-43 17-2


Page 49

14. Engineering and change control 15. Personal communications 16. Group communications 17. General promotion 18. Hiring and placement 19. Materials and services management 20. Off-the-job safety Some of the elements of ISRS are similar to those in PSM. The focus of ISRS is on people safety and environmental issues, but just like the OSHA recordable injury rate and it’s trend, a plant’s ISRS score is a indicator of management’s commitment to safety and loss prevention. Some plants will use ISRS for health and environmental programs and PSM for process safety programs. C.3 Other Sources for Chemical Process Safety Guidelines

Following is a list of global chemical industry organizations that promote chemical process safety and publish guidelines. C.3 .1 Australia

C.3.1.1 Hazardous Industry Planning Advisory Paper No. 3, Environmental Impact Assessment Guidelines , Ministries of Local Government and Planning, Dept of Planning, Sydney, 1989 C.3.1.2 Plastics and Chemicals Industries Association (PACIA) C.3.1.3 National Community Advisory Panel (NCAP) C.3 .2 Canada

C.3.2.3 Canadian Chemical Producers Association (CCPA) C.3 . 3 India

C.3.3.1 Indian Chemical Manufacturers Association (ICMA) C.3 . 4 Far East

C.3.4.1 C.3.4.2 C.3.4.3 C.3.4.4 C.3.4.5 C.3.4.6

Association of International Chemical Manufacturers (AICM) Singapore Chemical Industries Council (SCIC) Chemical Industries Council of Malaysia (CICM) Petrochemical Industry Association of Taiwan (PIAT) Korean Petrochemical Industry Association (KPIA) Japan Chemical Industry Association (JCIA)

C.3 .5 South America

C.3.5.1 Responsible Care is present in Argentina, Brazil, Chile, Colombia, and Venezuela C.3 .6 United Kingdom

C.3.6.1 Health and Safety Commission (HSC) Advisory Committee on Major Hazards, 1980 C.3.6.2 Institution of Chemical Engineers (IChemE) C.3 .7 United States

C.3.7.1 C.3.7.2 C.3.7.3 C.3.7.4 C.3.7.5

Chemical Manufacturers Association (CMA) American Institute of Chemical Engineers (AIChE) Center for Chemical Process Safety (CCPS) American Petroleum Institute (API) Synthetic Organic Chemical Manufacturers Association (SOCMA)


7-43 17-2


Page 50


APPENDIX D BIBLIOGRAPHY D.1 Process Safety and Risk Management

Center for Chemical Process Safety Guidelines Series, AIChE: G-10, Guidelines for Technical Management of Chemical Process Safety, 1992 G-18, Guidelines for Hazard Evaluation Procedures, 1992 G-19, Guidelines for Investigating Chemical Process Incidents, 1992 G-20, Guidelines for Auditing Process Safety Management Systems, 1993 G-25, Guidelines for Implementing Process Safety Management Systems, 1994 G-27, Guidelines for Process Safety Documentation, 1995 Chemical Process Safety Management - Control of Acute Hazards, Chemical Manufacturers Association (CMA), May 1985

‘‘Management of Process Hazards’’ American Petroleum Institute (API) Recommended Practice 750, 1990 ‘‘Process Safety Management of Highly Hazardous Chemicals’’, 29 Code of Federal Regulations No 1910.119, Occupational Safety and Health Administration, August 26, 1992 ‘‘Risk Management Programs (RMP) for Chemical Accidental Release Prevention’’, 40CFR, Part 68; (Federal Register Vol 61, No.120, pgs 31667-31730), Environmental Protection Agency, June 20, 1996 EC Directive 82/501/EEC and its 1987 revision (87/216/EEC) (Europe) D.2 Highly Protected Risk Guidelines for Chemical Industry

FM Global Data Sheets: Data Sheet 1-44, Damage-Limiting Construction. Data Sheet 5-1, Electrical Equipment in Hazardous Locations. Data Sheet 7-0, Causes and Effects of Fires and Explosions. Data Sheet 7-14, Fire and Explosion Protection for Flammable Liquid, Flammable Gas and Liquefied Flammable Gas Processing Equipment and Supporting Structures. Data Sheet 7-42, Guidelines for Evaluating the Effects of Vapor Cloud Explosions Using a TNT Equivalency Method. Data Sheet 7-44/17-3, Spacing of Facilities in Outdoor Chemical Plants. Data Sheet 7-45, Instrumentation and Control in Safety Applications. Data Sheet 7-46/17-11, Chemical Reactors and Reactions. Data Sheet 7-47, Physical Operations in Chemical Plants. Data Sheet 7-49/12-65, Emergency Venting of Vessels. Data Sheet 7-59, Inerting and Purging of Tanks, Process Vessels, and Equipment. Data Sheet 7-83, Drainage Systems for Flammable Liquids. Data Sheet 7-88, Storage Tanks for Flammable and Combustible Liquids. Data Sheet 7-95, Compressors. Data Sheet 7-99/12-19, Heat Transfer by Organic and Synthetic Fluids. Data Sheet 12-0, Applicable Pressure Equipment Codes and Standards. D.3 Concepts of Inherent Safety Guidelines for Vapor Release Mitigation, Chapter 2, CCPS Guideline G-4, 1988

Englund, S.A., ‘‘Inherently Safer Plants: Practical Applications’’, Process Safety Progress, Vol 14 No 1 pp 63-70, Jan. 1995 Englund, S. A., ‘‘Opportunities in the Design and Operation of Inherently Safer Chemical Plants,’’ Advances in Chemical Engineering, 15, pp 73-135, 1990 Englund, S. A., ‘‘Design and Operate Plants for Inherent Safety,’’ Chemical Engineering Progress, pp 85-91, March, 1991 Kletz, T, A., ‘‘Inherently Safer Plants, An Update’’, Proceedings of the 24th Annual Loss Prevention Symposium, San Diego, CA August, 1990, American Institute of Chemical Engineers Kletz, T, A., ‘‘Friendly Plants’’, Chemical Engineering Progress, pp. 18-26, July 1989


Loss Prevention in Chemical Plants

Recommend Documents