RC&E Chill - Industrial Refrigeration and Process Safety / Risk Management

Chill - We Got This!

Tag: Best Practice (Page 2 of 4)

Why use the “buddy system” during Line Openings?

January 20, 2020 /

Most LEO (Line & Equipment Opening) policy a.k.a. “Line Break” policies require a second person away from the work but in the immediate area. It is reasonable to ask why the procedure demands this.

Put as simply as possible:

  1. PSM/RMP and IIAR 7 require procedures for Line & Equipment Openings. (or IIAR 7 alone if you have under 10k pounds)
  2. The PHA asks questions that identify hazards which result in administrative controls aka procedures. Those procedures will have to control the unique hazards identified in the PHA.
  3. RAGAGEP for procedures (such as IIAR 7) require the buddy system be addressed in Line & Equipment Opening procedures.
  4. HazMat & Firefighting history show it is useful.
  5. Human Nature tells us that people tend to hold each other accountable.

 

Let’s work through this step-by-step

1. PSM/RMP requires us to have a procedure:

1910.119(f)(4) The employer shall develop and implement safe work practices to provide for the control of hazards during operations such as lockout/tagout; confined space entry; opening process equipment or piping; and control over entrance into a facility by maintenance, contractor, laboratory, or other support personnel. These safe work practices shall apply to employees and contractor employees.

Put another way: We have to develop a written procedure on Line & Equipment Openings which everyone must follow.

 

2. Hazards identified during a PHA are often controlled with Administrative controls, such as SOPs. SOP content therefore must address the hazards identified in the PHA. Some examples:

…the Ammonia exposure increases while the operator is using an APR/SCBA? (II.8) This is what makes us mandate the use of a personal NH3 detector during line openings and leak investigations.

…there is inadequate isolation prior to maintenance? (HF.3) …the Ammonia pump-out for a length of piping or for a piece of equipment is incomplete? (PO.1) This is why SOPs include a pressure check to confirm pumpdown. This is also why the LEO procedure (and permit) require a written SOP & permit to check the effectiveness of the procedure.

…an injured worker is unable to summon assistance? (HF.56) This (among other reasons) is why we require a Buddy System. The LEO policy, in the General Precautions section, states “A buddy-system is used for all LEO procedures. The second person must be trained to initiate emergency action and must be stationed close enough to observe the activity but far enough away to ensure that they would not be endangered by an accidental release.”

 

3. The RAGAGEP for procedures IIAR 7-2019 has this requirement:

4.4.2 Buddy System. Operating procedures shall indicate when the buddy system shall be practiced in performing work on the ammonia refrigeration system

A4.4.2-The buddy system should be practiced for operations where there is the potential that ammonia could be released, for example, operations which involve opening ammonia refrigeration equipment or piping. The buddy system should also be practiced during emergency operations involving ammonia releases.

 

4. HazMat & Firefighting history: Hazardous Materials teams and Firefighters have long used a 2-person team for increased safety. To some degree, this is enshrined in OSHA rules in 1910.134(g)(3)…

1910.134(g)(3) Procedures for IDLH atmospheres. For all IDLH atmospheres, the employer shall ensure that:

1910.134(g)(3)(i) One employee or, when needed, more than one employee is located outside the IDLH atmosphere;

1910.134(g)(3)(ii) Visual, voice, or signal line communication is maintained between the employee(s) in the IDLH atmosphere and the employee(s) located outside the IDLH atmosphere;

While we don’t INTEND to work inside a IDLH atmosphere during a LEO procedure, the possibility certainly exists if something goes wrong. The “buddy system” allows the person performing the LEO to focus on the work while the second person remains in the area situationally aware and ready to respond in the event that the situation changes or something goes wrong.

 

5. Human Nature: The LEO policy is written around accountability. The policy requires that we demonstrate to a second person that we’ve followed the policy and adequately prepared for the work before the LEO occurs.  The “buddy system” tends to keep the actions “in-line” during the actual work.

Note: While it’s certainly possible  – from a regulatory view – that you could have certain specific LEO procedures that did not require a “buddy,” you would have to be able to document how you managed to address all of the issues outlined above without the second person.

Thanks to Bryan Haywood of SaftEng.net and Gary Smith of ASTI (Ammonia Safety Training Institute) for their time and thoughts in helping review this post.

Trump EPA goes LIVE with new RMP rule: Is this finally the end of the saga?

December 31, 2019 /

The story so far…

Dec 2016: Outgoing Obama EPA releases changes to the RMP rule on the way out the door.

Apr 2017: Incoming Trump EPA puts the RMP rule changes on hold.

Jun 2017: Trump EPA further delays the RMP rule changes.

May 2018: Trump EPA proposes new RMP rule changes, reversing Obama changes.

Aug 2018: DC District Court reverses Trump Rule and re-instates Obama rule essentially making it the existing rule with compliance dates in the past. Trump EPA is basically told that it can change the rules, but it needs to follow different procedures to do that. Trump admin appeals and the rule changes are put on hold.

Sep 2018: Trump admin loses appeals. Obama RMP rule changes are officially LIVE. Trump EPA announces that they will follow the different procedures and change the rule the right way. (Not-so-secretly, the entire EPA is told NOT to enforce the new rule, but out of an abundance of caution, most RMP adherents implement the changes anyway. After all, it IS the law.)

Dec 2019: Trump EPA officially posts the new rule and places it in the CFR making it LIVE on 12/19/19. (See links at the end of the post)

 

So, where do we stand now?

Ok, we’ve got a new RMP rule. It appears to have gone through the correct rulemaking process. It’s been published in the Federal Register making it the law of the land.

 

So, what do we do now?

Well, let’s be honest; the Trump administration IS GOING TO GET SUED over this. What happens then? Who knows!? If you follow the courts in modern America, you know there is very little that can be accurately forecasted.

What we do know is that we have a new rule. The new rule appears to have been done correctly with sound documentation as to the reasoning for the changes. In my opinion, the new rule will LIKELY hold up in court. Even if it doesn’t, it is highly unlikely the EPA could get away with fining / citing people for not following a court-reinstated rule under such a cloud of confusion.

In any case, the new rule is easier to follow and makes more sense than the Obama EPA rule changes did. It reverts the majority of the RMP rule to match the PSM rule where they SHARE jurisdiction. The only substantive changes are to the EPA-specific areas where the EPA alone holds jurisdiction.

 

Ok, so how do I comply with this new rule?

If you do use our template system, I’ve got some good news for you! This is where using a set of open-sourced, professionally curated templates really shines. ALMOST ALL THE WORK has been done FOR YOU!

  • To improve your understanding of the new rule, read how we changed the program to meet the new requirements. This will help you to train your colleagues on them.
  • Replace existing copies of the affected Written Plans / Forms, taking a moment to look at the changes between the older versions and the new ones.
    1. Implement new EAP-C form.
    2. Modify the MI-EL1 EAP/ERP line to reflect the new text.
  • Train all Responsible Persons and affected management on the new policies.

Note: Estimated time for the above is about 2-4 hours depend on how well you know your PSM/RMP program.

 

On the other hand, If you don’t use our template system, you’re going to have to re-create the work I’ve already done:

  • Skip to the end of this article to get the links to the new information.
  • Read the 83-page Federal Register notice and make a series of notes about the new requirements. You can probably skip the 109 footnotes for now.
  • Compare those new requirements to the version of the RMP rule your program is CURRENLY written to comply with; whether that’s the pre-Obama, Obama, or Trump proposed version.
  • Starting at the beginning of your program, read through each of your Element Written Plans and see what changes have to be made. Refer to your notes from the first step. (You may wish to read how we changed our program to meet the new requirements)
  • Update / alter your program to meet these new requirements.
  • Train on these new changes

Note: Estimated time for the above is about 40-80 hours depend on how well you know your PSM/RMP program and the EPA RMP rule.

 

Template Program changes in detail

Please note, where not specifically shown below all affected Element Written Plans had their CFR section updated to the current 12/19/19 CFR.

Element What Changed Changes to Program Templates
01 – RMP
  1. A few definitions were deleted
  2. Some compliance dates and RMP references were changed
  3. Various Program 2 Changes
  4. Public meetings changes
  5. RMP Filing changes regarding 3rd party compliance audits, public meetings, etc.
  6. Removed significant amounts of publicly available information
  1. As our definition file isn’t limited to EPA sources, no changes were made to the template program documents.
  2. Previously there were sections about the Obama-era law that had a 2021 date tag – these sections were either deleted (because they were removed) or the date tag was removed.
  3. The element written plans are designed around Program 3, so no changes were made in them however all relevant CFR sections were updated.
  4. Updated the Element Written Plan to address these issues
  5. Updated the CFR to reflect the changes.
  6. Updated the Element Written Plan to address these issues
02 – EP N/A None
03 – PSI
  1. Removed the explicit requirement to keep PSI up to date.
  1. While we updated the CFR text, this is sort of implicit in the MOC/PSSR program and the very nature of PSM, so no changes made to the Element Written Plan.
04 – PHA
  1. Removed a nebulous requirement to look for “any other potential failure scenarios”
  2. Removed a section on alternative risk management for chemical / petro plants.
  1. While we updated the CFR text, this is sort of implicit in the idea of a PHA, so no changes were made in the Element Written Plan.
  2. These changes did not cover the NH3 refrigeration industry, so no changes were needed in the Element Written Plan.
  3. Since the explicit PSI “up to date” requirement was removed from the PSI section, it was removed from the PSI checklist in the PHA What-If checklists.
05 – SOP N/A None
06 – OT
  1. Removed an explicit requirement that “supervisors with process operational responsibilities” were covered under this program.
  1. We believe that operators under this element are defined by their function not their title / job position, so no changes were needed in the Element Written Plan.
07 – CQ N/A None
08 – MI No changes to RMP requirements
  1. The MI-EL1 section covering recurring PSM tasks in EAP/ERP was updated to remove the 2021 date codes. While the 10yr Field Exercise frequency is now just a suggestion (rather than a mandate) we’ve kept it in as a good practice.
09 – HW N/A None
10 – MOC / PSSR No changes to RMP requirements
  1. The procedural section “Implementation Policy: Managing Equipment / Facility Changes and using form MOC-1” includes a chart on possible changes to RMP-required information based on an MOC. The reference to “public information” has been removed from this chart.
11 – II
  1. Removed explicit requirements for incident location, time, all relevant facts, chronological order, amount released, number of injuries, etc.
  2. Removed a requirement that Incident Investigations be completed within a year
  1. While we removed these requirements from the CFR section, we believe they are still important for Incident Investigations and they’re already required by relevant RAGAGEP, so no changes were made to the Element Written Plan, the investigation instructions, or the Form-IIR Incident Investigation form.
  2. While we can’t imagine this wouldn’t occur naturally in a functioning process safety program, we removed the requirement. The program – as written – already suggests interim reports when investigations are lagging.
12 – EPR
  1. Lots of changes here: Modified information sharing requirements with responders, modified frequency of field exercises, modified scope of field and tabletop exercises, documentation requirements, compliance dates, etc.
  1. These changes were all incorporated in the Element Written Plan.
  2. To improve program performance, a new form was created “EAP-C Local Authority Coordination Record.” This form was also included in the Element Written Plan.
13 – CA
  1. Removed requirements for 3rd party audits
  1. These changes were all incorporated in the Element Written Plan.
14 – TS
  1. Modified text in the “CBI” section to reflect new wording in the updated rule.
  1. While it’s been changed in the CFR text, it requires no change to the Element Written Plans.

Item-by-Item changes:

  • Reference\EPA Reference\ has been updated with a PDF of the Register Notice.
  • Reference\CFR – Text of Federal Rules\ has been updated with a complete and formatted CFR reflecting the new changes.
  • The various element affected template directories have been updated with Element Written Plans that incorporate the new CFR text AND modified policies to comply with the rule changes
    • 01 – EPA RMP
      • Element Written Plan – REPLACE
    • 03 – Process Safety Information
      • Element Written Plan – REPLACE
    • 04 – Process Hazard Analysis
      • Element Written Plan – REPLACE
      • PHA Worksheet Template – REPLACE
    • 06 – Operator Training
      • Element Written Plan – REPLACE
    • 08 – Mechanical Integrity
      • MI-EL1 Form updated. You may just wish to modify the EAP/ERP line to reflect the new text rather than re-create the form.
    • 10 – Management of Change and PSSR
      • Element Written Plan – REPLACE
    • 11 – Incident Investigation
      • Element Written Plan – REPLACE
    • 12 – Emergency Planning and Response
      • Element Written Plan – REPLACE
      • NEW Form EAP-C – Implement
    • 13 – Compliance Audits
      • Element Written Plan – REPLACE
      • Optional Combined PSM RMP Compliance Self-Audit Checklist – REPLACE
    • 14 – Trade Secrets
      • Element Written Plan – REPLACE

 

EPA links for new information:

  • Updated CFR (aka “law”) from eCFR: link (37 Pages)
  • Federal Register Notice including reasoning for changes: link (83 Pages)

Direct Replacement, Replacement in Kind and Management of Change

December 16, 2019 /

Of all the PSM/RMP requirements, the Management of Change element is the most consistently problematic. Most of the difficulty is in answering two questions:

  • The compliance question: Does the change you considering count as a “change” per the PSM/RMP rule.
  • The safety question: Does the change you are considering have the potential to affect the safety of the process?

Note, it is quite possible that you answer NO to the first question and YES to the second question.

 

The text of the Rule

1910.119(l)(1) – The employer shall establish and implement written procedures to manage changes (except for “replacements in kind”) to process chemicals, technology, equipment, and procedures; and, changes to facilities that affect a covered process.

From a compliance perspective, how broadly you interpret the “…changes to facilities that affect a covered process” portion dictates how many changes will be subject to this element.

Of course, there’s also a little window that allows you to avoid the MOC element if you classify the change as a “replacement in kind.” The rule provides a fairly useless definition of Replacement in Kind:

1910.119(b) …Replacement in kind means a replacement which satisfies the design specification.

The “replacement in kind” exception is routinely abused to avoid MOC. To understand this element better, let’s consider a few scenarios: Replacing a Valve, replacing a Motor, replacing an Ammonia Detector, and replacing a Condenser.

 

Example: Replacing a Valve

In this example, we’re replacing a valve with the same model, size, etc. Is this a change? Some people would call this a Replacement in Kind, but I would not. I would call this a Direct Replacement. It’s not kind of like the valve we’re replacing, it’s exactly like it. Such a change is outside the scope of the MOC element entirely.

What if we were replacing the valve with a different brand or model? Then we don’t know if it is a Replacement in Kind until we ask enough questions to assure ourselves that it satisfies the design specification. Some questions we might ask are:

  • Is it made of the same materials?
  • Does it have the same flow ratings / capacity?
  • Does it have the same mode of operation in manual and automatic?
  • Does it have the same Mechanical Integrity requirements?
  • Does it affect the PHA section that this equipment belongs to?

It’s quite possible that you answer enough questions to assure yourself that the replacement valve satisfies the design specification making it a Replacement in Kind. While this means it is outside of the MOC element for compliance purposes, we’d still recommend you document the rationale you used to determine that it meets these design specifications. You could even take this documentation one step further and declare that in the future all replacements of Brand A Model X valve with Brand B Model Y valve can be considered a Direct Replacement in this application.

 

 

Example: Replacing a Motor

A motor might be considered by some (incorrectly) to be outside of the MOC element because it doesn’t (usually) contain ammonia, but this is short-sighted. Remember, the MOC element is about Changes to…equipment…that affect a covered process. A motor for equipment that is part of your covered process would certainly fall within the scope of the element for consideration.

Ideally, we’re replacing the motor with the exact some one – a Direct Replacement that would place it outside the MOC element. But, if we are replacing it with another motor, we will be looking to prove that it satisfies the design specification so we can consider it a Replacement in Kind. Again, we need to ask questions:

  • Does it have the same electrical requirements (phase, voltage, etc.)
  • Does it have the same frame size?
  • Does it have the same RPM, duty rating, capacity, etc?
  • Does it affect the PHA section that this equipment belongs to?

Just like earlier in our valve example, it’s quite possible that you answer enough questions to assure yourself that the replacement motor satisfies the design specification making it a Replacement in Kind. While this means it is outside of the MOC element for compliance purposes, we’d still recommend you document the rationale you used to determine that it meets these design specifications. You could even take this documentation one step further and declare that in the future all replacements of Brand A Model X motor with Brand B Model Y motor can be considered a Direct Replacement in this application.

 

 

Example: Replacing an Ammonia Detector

Like earlier, with the motor example, a change to an ammonia detector might be considered by some (incorrectly) to be outside of the MOC element because it doesn’t (usually) contain ammonia, but this is short-sighted. Remember, the MOC element is about Changes to…equipment…that affect a covered process. You definitely consider these detectors as safeguards in your PHA, so we need to exercise some caution on this change.

If we’re replacing the detector with the exact same one, then it’s a Direct Replacement. If we’re replacing it with a different detector, we need to assure that it satisfies the design specification so we can consider it a Replacement in Kind. Again, we need to ask questions:

  • Does it have the same electrical requirements?
  • Does it have the same output signal / alarm outputs?
  • Does it have the same sensitivity?
  • Does it have the same Mechanical Integrity requirements? The same calibration equipment, schedule and calibration procedure?
  • Does it affect the PHA section that this equipment belongs to?

In my experience, unless you are dealing with a Direct Replacement, no detector meets the requirements for a Replacement in Kind because they almost all fail the last question on calibration equipment, schedule and procedure. That means such a change would require the implementation of a Management of Change procedure.

Here’s where we can get a little clever. The PSM/RMP rules require that we “establish and implement written procedures to manage changes” but they don’t require that we use the same procedure for every change! If we sit down and think through all we need to do to successfully change from Brand A Model X NH3 detector to Brand B Model Y NH3 detector, we could establish a standard procedure for doing so. That means that in a facility with, say, 45 detectors that you are changing over a period of time, you have a Single MOC (to establish the new procedure) and then simply implement the new NH3 Detector Change SOP 45 times as the changes occur.

 

 

Example: Replacing a Condenser

In this example we’re replacing a brand A evaporative condenser with 500 tons of capacity with a brand B evaporative condenser with 500 tons of capacity. Note: this would work the same with if you were replacing it with a different model of brand A as well. Also, if you were replacing a condenser with an exact duplicate, then theoretically you may be able to get by with a PSSR, but that assumes you don’t need any non-standard operating modes during the change-out.

First question: Is it a change to equipment which satisfies the design specification? Answer: Well, I don’t know because there is a lot that goes into that determination. But every part of a condenser changeout has the potential to affect the safety of your system. Questions you should ask include:

  • Does it have the same electrical requirements (phase, voltage, amp draw, etc.)
  • Is it have the same size and weight?
  • Is it made of the same materials?
  • Does it have the same flow ratings / capacity?
  • Does it have the same mode of operation in manual and automatic?
  • Does it have the same Mechanical Integrity requirements?
  • Does the P&ID need to be updated?
  • Does the SOP need to be updated?
  • Does it affect the PHA section that this equipment belongs to?
  • …and the list goes on.

While it is technically possible that you could ask these (and 100 other) questions concerning a condenser replacement in such detail that you ensure it satisfies the design specification, you are going to want to document all that work. I’ve personally never seen it happen unless it was the same make and model. In our opinion, the best way to document all that work is by following the Management of Change procedure.

 

Closing Thoughts

Management of Change is a difficult element. But by working this element, you can find and address hazards before they are introduced to your process. There’s very little that can be said about it better than this advice from the Petroleum NEP:

OSHA’s MOC requirement is prospective.

The standard requires that an MOC procedure be completed, regardless of whether any safety and health impacts will actually be realized by the change. The intent is, in part, to have the employer analyze any potential safety and health impacts of a change prior to its implementation. Even if the employer rightly concludes there would be no safety and health impacts related to a change, 1910.119(l)(1) still requires the employer to conduct the MOC procedure.

Dealing with non-standard (non-routine) work in your Process Safety program

October 17, 2019 /

Occasionally we come across an issue we’ve customarily addressed, but never documented. Put another way: We realize we have a policy – even if an informal one – on how to deal with certain situations, but we’ve never turned that policy into a formal, written one.

It’s incredibly common to have these informal policies in smaller departments, or when a task is rare. You can usually identify them after-the-fact when you are told “That’s just the way we do things here. Everybody knows that.”

When we find these items in our Covered Processes, we should endeavor to document them. Today I’d like to talk about a big one: What do we do when the existing written procedures don’t match with the conditions or situations we are facing in our work. What written guidance are you providing to your Process Operators and Technicians on how to deal with this situation?

Every functioning Operations / Maintenance department has a policy – even if an informal, undocumented one – on how they deal with this issue.  

For years I’ve relied on the text in the SOP Written Plan concerning Temporary Operations:

The ammonia system is not operated in any temporary modes without a written SOP. If a component requires maintenance or replacement, that portion of the system is isolated and removed from service through a written SOP. Other Temporary Operations are handled through the MOC element which will ensure supervisory oversight. Temporary Operation SOPs are often via a written modification of an existing SOP in the form of an addendum.

This worked well, but it was a little bit obscure and (understandably) only thought to apply to SOPs themselves. That needed to change. What we’ve done to our system today, is formalized and documented guidance on how to deal with these non-standard / non-routine situations.

A new policy was placed in the RMP Management System Written Plan…

To ensure integration of this policy, the following text was added to the Operating Procedures (Implementation Policy: Using an SOP – Performing a Procedure, and Implementation Policy: Operating Phases, Temporary Operations) and Mechanical Integrity (Implementation Policy: Mechanical Integrity Procedures or MIPs) element Written Plans: “The Implementation Policy: Non-Standard Work. Addressing Conditions / Situations outside of existing Procedures found in the RMP Written Plan should be used when site/equipment/system Conditions or Situations are found to be different than those anticipated in the exiting written procedures.”

Are you handling non-standard / non-routine work well in your Process Safety program? If you are, and have a better idea, we’re always open to improvements. If you aren’t handling it well, perhaps you can implement the example above? 

For Inside-Baseball type people: This chart was inspired by the API RECOMMENDED PRACTICE 2201 Safe Hot Tapping Practices in the Petroleum and Petrochemical Industries, Chapter 4, Section 4.3.1, Figure 3—Example Decision Process for Authorizing Hot Tapping. Other than genericizing that flowchart to cover all types of work, I also made two large changes:

  • Routed the post “change conditions” step back to the start so we re-evaluate the existing procedure considering changed conditions/situations rather than short-circuiting back to the Management step.
  • Rewrote the flow/wording so that Condition Changes are preferred over mere procedural changes. The thinking was that we should prefer more engineering-type changes over administrative ones, where possible.

 

RAGAGEP Deficiencies and building a defensible case for an alternative solution

October 1, 2019 /

This issue: During a PHA, the facility is using an IIAR 2-2014a checklist and finds that the installation does not meet the requirements of section 6.14.3.3.

6.14.3.3 *Machinery room exhaust shall be to the outdoors not less than 20 ft (6 m) from a property line or openings into buildings.

The distance from the machinery room emergency exhaust outlets on the roof to a rooftop door leading into the building is approximately 8 feet. This is a 1910.119(j)(5) deficiency and a 1910.119(d)(3)(iii) RAGAGEP violation. They have a recommendation to address the issue.

Let’s think about the implications of this issue.

 

The Analysis: If there was an ammonia leak in the machinery room that activated the emergency ventilation, then the fans would exhaust on the roof very close to this door. In PHA terms, this could be thought of as a “siting” issue.

This situation is pretty rare: only technicians are allowed on the roof, and they are only up there for routine inspections and maintenance. Still, there are two ways the technician could be exposed to this hazard. If they used the door to:

  1. Access the building’s internal stairway from the roof.
  2. Access the roof from the building’s internal stairway.

For situation #1, a release would be easily observed / heard while on the roof in the area of the ventilation fans. There are also other entrances back into the building, including external stairs to the ground level. The team decided this situation was acceptable without any changes.

For situation #2, it would be possible (although not likely due to the noise of the fans) that someone could use the door to access the roof without knowing that they could be exposed to a release on the other side of the door. The team decided this was an unlikely, but possible issue. That is – it’s an unlikely turn of events that a release in the machinery room would occur at the same time as someone would be using the door – but it was possible so it should be addressed.

Obviously, the cleanest solution would be to move either the door or the fans, but that’s not an easy thing to do! Also, it would be a very expensive fix for an issue with such a low probability of occurrence.

The team brainstormed a bit and came up with an alternative plan to address the issue.

 

The chosen Solution: First, there are only two ways the fans could be exhausting a large amount of NH3 vapor. Either they would me manually operated due to maintenance / leaks or they would be automatically operated due to the IIAR 2-2014a 6.14.7.2.1 required NH3 detection interlock. Either way, a RUN signal is sent to the fan controls and the team decided to install a visual alarm on both sides of the door and use this RUN signal to activate it. Coupled with proper signage and training, the team believes the alarm would provide adequate warning to anyone approaching the door that the emergency ventilation system was running and that the door should not be used.

The team believes this is a defensible solution to non-compliance with IIAR 2-2014a 6.14.3.3. I tend to agree with them – it’s defensible if imperfect.

Perhaps another, actually compliant solution, would be to install ductwork on top of the emergency exhaust fans to raise the exhaust point so the distance from them to the door would meet the 20-foot requirement. Of course, such a change would require a new ventilation calculation to ensure the additional restriction caused by the duct work didn’t pose a problem. This ducting solution would likely be a bit expensive and that could mean that it would take some time to implement. If this duct solution was chosen,  the earlier “alarm” idea would be an excellent interim measure until approval and construction of the ducting project occured.

Note: This 20’ requirement appears to show up first in IIAR 2-2008a effective August 2010. Previously the requirement was a vaguer “13.2.3.11 The discharge of air shall be to the atmosphere in such a manner as to not cause inconvenience or danger.”

Questions from the field: Who is responsible for the PSM/RMP duties?

September 18, 2019 /

From a legalistic perspective, we’ll first turn to the law. In this case, the EPA’s RMP rule…

68.15(a) The owner or operator of a stationary source with processes subject to Program 2 or Program 3 shall develop a management system to oversee the implementation of the risk management program elements.

68.15(b) The owner or operator shall assign a qualified person or position that has the overall responsibility for the development, implementation, and integration of the risk management program elements.

68.15(c) When responsibility for implementing individual requirements of this part is assigned to persons other than the person identified under paragraph (b) of this section, the names or positions of these people shall be documented and the lines of authority defined through an organization chart or similar document.

The short, legalistic answer is that the owner/operator is responsible. They must pick a qualified person who has overall responsibility for the program.

If the owner then chooses to break up the various requirements of the program to people other than that qualified person, they have to document all those people. In my programs, I call these people a “Responsible Person.”

 

Ok, but how does this actually work. Let’s imagine a small facility that is required to have a PSM/RMP program. They pick their Safety Manager, Sofía as their Process Safety coordinator, so she is now the person responsible under §68.15(b).

But, Sofía, while very knowledgeable in Safety and Environmental issues, is not as familiar with refrigeration or engineering. It’s unlikely she’ll be in the best position to manage most of the program elements on a day-to-day basis.  To address this issue, the facility decides to assign certain skilled people the responsibility for various program elements. They assign the Operating Procedure, Operator Training and Maintenance elements to Robert, their Maintenance Manager. They also decide to assign the Process Safety Information, Management of Change and Pre-Startup Safety Review elements to Jaylen, their Plant Engineer.  Because he usually manages them anyway, they assign Benny, the Lead Operator, the Contractor element. Of course, all these people are going to rely on the knowledge and experience of each other, the Facility Manager John, and the other operators, Tessa, Faraz, and Tiah.

This might be getting a little confusing at this point, which is why §68.15(c) wants us to document these assignments. For example:

Program Element Responsible Person
Overall PSM / RMP Management System PSM Coordinator
Risk Management Plan (RMP) PSM Coordinator
Process Safety Information Plant Engineer
Employee Participation PSM Coordinator
Process Hazard Analysis PSM Coordinator
Operating Procedures Maintenance Manager
Operator Training Maintenance Manager
Contractor Qualification and Safety Lead Operator
Pre-Startup Safety Review Plant Engineer
Hot Work Permit PSM Coordinator
Incident Investigation PSM Coordinator
Mechanical Integrity Maintenance Manager
Management of Change (MOC) Plant Engineer
Emergency Response Plan PSM Coordinator
Compliance Audits PSM Coordinator
Trade Secrets PSM Coordinator

How a facility arranges the responsibilities is entirely up to them as long as they can make the case that the person assigned as a “Responsible Person” is qualified to handle the work being assigned to them.

On a practical level, your Management System should also:

  • Show what person is responsible for each PSM/RMP element / requirement
  • Ensure that only one person is responsible for each requirement
  • Make it clear that a Responsible Person can’t authorize their own work requests, such as Hot Work, MOC, PSSR, etc.
  • Be easily understood by everyone involved

Please note, that just because someone is responsible for an element, doesn’t necessarily mean they are actually doing the work. They are just responsible for ensuring the work is done. A good example outside of PSM is the facility manager of a chicken plant. That facility manager is responsible for ensuring that food safety regulations are met so the chicken is cooled in an appropriate time-frame. It is extremely unlikely that the plant manager actually handles the chicken, the cooling equipment, etc. They simply provide the resources and oversight to ensure the work is done properly.

A good PSM example might be Operating Procedures. In our case, we’ve assigned them to the Maintenance Manager. It is likely that the actual initial creation and review of the operating procedures is done entirely by the operators. Based on the results of that review, the Responsible Person would ensure that appropriate revisions are made and then certify the procedures.

Feel free to contact us If you want templates of a PSM/RMP management system.

Compliance Auditing and the Karenina Principle

August 2, 2019 /

Over the years I’ve audited well over one hundred Ammonia Refrigeration Process Safety (PSM / RMP) programs and one of the things that I always try and remember during the audit is something called the “Anna Karenina” principle. The first line in that Leo Tolstoy novel is:

“All happy families are alike; each unhappy family is unhappy in its own way.”

 

Put another way: Success requires certain key factors are addressed. Meeting those requirements means that those successful systems will be similar to other successful systems. For Process Safety programs, there are many key factors to success, but I think they all boil down to three main categories:

  • Does the facility have a written Process Safety Program that (on paper) meets the safety & compliance requirements of the law, the process, and the people, in a manner that meets the business needs of the company? If so;
  • Is the written Process Safety Program implemented as written? If so;
  • In the actual day-to-day process, does the written Process Safety Program as implemented address the safety & compliance requirements of the law, the process, and the people, in a manner that meets the business needs of the company adequately?

I often call this the “Three Levels of Compliance.” Shown in a flowchart:

While there are nearly infinite ways a Process Safety program can fail, but ALL successful programs will pass these three levels of compliance checks. Understanding this concept will help you be a better auditor, but it can also help you be a better implementer!

 

In Auditing, how does this work in practice?

Let’s look at an example of an identified deficiency of rusted pipe found during the walkthrough portion of an audit. Note, we’ve kind of started at the 3rd level of compliance here because we’ve found a problem in the field and therefore know that the plan as implemented isn’t adequate!

First-pass question concerning written plan could include:

    • Are there written instructions on their inspection frequency and acceptable conditions?
    • Is there a written plan on training to perform these inspections?
    • Does the written Mechanical Integrity Plan address these specific pipes?

The answers to these questions will help you define a finding / recommendation to improve the program.

Second-pass questions concerning implementation could include:

    • Is the written Mechanical Integrity Plan that addresses these pipes being conducted when it is scheduled to be?
    • Are the written instructions being followed?
    • Was the inspector trained in accordance with the written plan?

Again, if the answers to these questions may prompt a finding / recommendation to improve the program. If you have a written MI plan and you are implementing it, but you still have rusting pipes; then you need to fix either the plan or your implementation of it!

 

How can this concept help me be a better implementer?

Your Process Safety Program is, by its very nature, artificially bringing order to chaos. Because of Entropy, we know that all systems and processes will eventually decline into disorder and fail. This decay happens with no effort on your part but, with effort, it can be thwarted.

Ultimately. I believe the only way to continuously, sustainably maintain your Process Safety Program is by forcing a feedback loop. A feedback loop is where you ensure that the output of a system is routed back to the input of the system. In our earlier worked example, we need to ensure that the output (physical condition, daily practices, etc.) of the system is routed back to the input (written plan and implementation of it) so we can know how well the system is performing and make changes as needed.

When it comes to the mechanical world, there is no better feedback loop that actual inspections and tests. If it is properly designed, your Mechanical Integrity program should be providing this information. Your team needs to understand that (no matter how small) every single deficiency you find, or breakdown that you have, is a sign that your plan can be improved.

When it comes to the operation of the system (policies, procedures, etc.) your PSM team is supposed to be providing this feedback. I say “supposed to be” because more and more I see that this important feedback loop is not being properly utilized. For more information on what the purpose of a PSM team is and what it should do see this earlier article: What is the purpose of a PSM Team?

What is the Purpose of a PSM Team?

July 30, 2019 /

The implementation of the PSM/RMP Program is a team-based effort. In my opinion, no single part of a Process Safety Program is more important than your Process Safety Team. Put another way: If you don’t have a strong Process Safety Team you won’t have a strong Process Safety Program.

 

Who should be on the Team?

At a minimum:

  • Each Responsible Person listed in the “Management System” is a member of the PSM team. Responsible Person’s are people that have responsibility for implementing individual elements of the Process Safety Program.
  • If not already included as a Responsible Person, all Process Operators are also included as PSM team members.

The team can also benefit from additional diversity such as senior members of management outside of Process Safety. Examples might include the Plant Manager or Director of Warehousing, Production Supervisors /Managers, Health, Safety & Environmental staff, etc.

 

What should the team do?

While a successful team serves many functions, it is there for two essential purposes:

  • To educate and inform
  • To provide oversight

 

Process Safety Team as an Educator

Your covered process and the safety programs that cover it are large and complex. So it the overall business that they are a part of. Our first priority in the meeting is to inform each other of what is happening in the parts of the program we deal with on a daily basis – or we are responsible for. This is often referred to as “getting everyone on the same page.”

 

Process Safety Team’s Oversight Role

The most often failed function of a Process Safety Team is to provide oversight. The Responsible Person for an element has to make day-to-day decisions to keep the process (and the business) running and we should ensure that they defend these decisions to the Process Safety Team so that the team can either validate or correct them.

For example:If the MOC Responsible Person decided that a specific change was not required to go through the MOC process, they should make that argument to the Process Safety Team which should either validate that choice or – as a group – convince the Responsible Person that their decision was in error so they can take corrective action.

Another example: The Responsible Person and two other staff members have completed an Incident Investigation on a small process leak that recently occurred. The Process Safety Team should either validate that completed Investigation or – as a group – convince the Responsible Person to investigate additional avenues, or provide addition recommendations.

This simple concept: Defend your decisions to a team of your peers so they can validate them or correct your thinking is the beating heart of any Process Safety Program. If you do it well, you provide a feedback loop, and the entire team will get better at their jobs. Whether it’s an Incident Investigation, a Management of Change, Contractor evaluations, etc., Validating your decisions with your Process Safety Team will improve the performance of the program more than nearly any other thing you can do.

 

Bonus Content: What should we discuss at our PSM meetings?

I am often dumbstruck when this question is asked of me, because I NEVER run out of things to talk about. (You can all stop laughing now)

While PSM Team Meetings should be structured to allow diverse topics and input, certain topics should be discussed at any general PSM Team Meeting:

  • Any open recommendations in the program to review status and ensure recommendations are progressing towards resolution.
  • Any upcoming, ongoing, or recently completed MOCs, PSSRs, Incident Investigations, etc. to review status and/or adequacy of documentation.
  • Any upcoming, ongoing, or recently completed work that has, or may have, safety ramifications for the covered process(es).
  • Team Validation of any decisions / work product produced by Responsible Persons

 

Note: Special thanks to end-users VD & CG who prompted me to include this information (and more) directly into my PSM Element Written Plans. We ALL improve with feedback!

 

IIAR 7-2019 Update

May 31, 2019 /

It’s been coming for a while now and yesterday it became official:

Introducing: ANSI/IIAR 7-2019 – Developing Operating Procedures for Closed-Circuit Ammonia Refrigeration Systems

In 2013, the first issue of IIAR 7 replaced the operations information contained in IIAR Bulletin No. 110, Guidelines for Start-Up, Inspection, and Maintenance of Ammonia Mechanical Refrigerating Systems.

This standard was first approved as an American National Standard by the American National Standards Institute (ANSI) in August 2013. ANSI requires reaffirmation or revision for periodic maintenance requirements of existing standards every five years. Work began on periodic maintenance of this standard in February 2017 and was completed in April 2019.

This standard defines the minimum requirements for developing operating procedures for closed-circuit ammonia refrigeration systems. Informative Appendix A was added to provide explanatory information related to provisions in the standard.

 

A little over two years ago, the SOP templates were updated to include all the requirements of IIAR 7 2013. That was a pretty large undertaking, but if you already made those changes, it looks like you are in good shape! I’ve reviewed the new IIAR 7 and it turns out we only need to make one substantive change to programs using the current templates.

 

What’s the requirement / change? 

The 2013 version required a visual inspection of hoses when they were used. This was a pretty minor requirement. The newer version requires that procedures include “Steps to inspect hoses and fittings visually to make sure they are suitable for ammonia refrigeration service”  whenever you Transfer (such as in pump-down) or Charge ammonia. To address this issue, I’ve modified the ROSOP-LEO and Permit form to include an explicit check and a reference to the “ITPMR-AHT-365 – Ammonia Transfer Hose Annual ITPM Record” we recently added due to IIAR 6.

So, if you’ve already updated your system for IIAR 6 compliance, then all you need to do is update your LEO procedure and Permit. If you haven’t updated your system for IIAR 6 compliance, then you need to integrate the new ITPMR as well as make plans to address the entirety of IIAR 6.

Note: Overall the 2019 IIAR 7 is much simpler than the 2013  version. It’s moved a lot of stuff to informative appendices which removes most of my complaints about it. Unfortunately they renumbered* just about every single requirement in the standard. This meant I had to completely renumber / rewrite my standalone SOP audit template. The good news is that the IIAR7-2019 version of that audit was reduced from 110 pages to 87. Of those remaining 87 pages of questions, 60 pages are due to IIAR 7.

* This was not an attempt to drive me closer to insanity, but an attempt to harmonize numbering systems between all the IIAR standards. I know this because I actually asked the IIAR about this. Thankfully, Tony Lundell has a good sense of humor.

« Older posts Newer posts »

Contact Us

© 2024 RC&E Chill – Industrial Refrigeration and Process Safety / Risk Management

Theme by Anders Noren — Up ↑