RC&E Chill - Industrial Refrigeration and Process Safety / Risk Management

Chill - We Got This!

Tag: RMP (Page 4 of 5)

Properly Addressing PSM / RMP Findings & Recommendations

August 3, 2018 /

Process Safety managers are often buried under a torrent of Findings and Recommendations from PSM/RMP elements such as Employee Participation (EP), Process Hazard Analysis (PHA), Pre-Startup Safety Review (PSSR), Incident Investigations (II), and Compliance Audits (CA).

In compliance audits over the past decade the single most likely deficiency I find is failing to properly “address” these Findings / Recommendations. Note: a Finding / Recommendation is considered “addressed” when you either accept & implement it, or justifiably delay the implementation while assuring safe operation. The most common problems are:

  • Failing to respond to the Finding / Recommendation.
  • Failing to document the response to a Finding / Recommendation even if it was addressed.
  • Planning to accept a Recommendation (or proposing a solution to a Finding) in the future (usually through CapEx) while not either:
    • Assuring the situation is safe in the interim.
    • Implementing an interim solution to ensure the process is safe during the delay.

Let’s look at each of these and discuss how Process Safety manager typically fail, and what YOU can do to avoid common failures.

 

Failing to respond to a Finding / Recommendation

Failing to respond to known issues is all too common. There are many reasons this happens, but in my experience, here are the most common problems:

Not understanding the issue.

Solution: Ask questions about the reason for the Finding / Recommendation. Don’t let someone tell you that something has to be done a certain way without an adequate explanation. Many unnecessary Findings / Recommendations  can be avoided or solved simply by asking the person making it to provide their actual reasons for it. This isn’t about feelings. Ask for the specific hazard, regulation, code, standard, etc. You can’t judge a Finding / Recommendation without understanding it, and neither can management. In the case of legitimate Findings / Recommendations, understanding the issues behind the Finding / Recommendation will help you gain momentum to address the problem.

Assuming the solution won’t be approved

Solution: Don’t prejudge. That isn’t your role. Your role as the Responsible Person is to bring these issues to the people that are in charge of the process. Ask the right questions and present the necessary information to management. THEY are responsible for their decisions after that. Your role is to document their responses and remind them if you haven’t received adequate direction on the disposition of the Finding / Recommendation.

Losing Track of the Finding / Recommendation

Solution: Implement a robust tracking method. Personally, I’ve always liked tracking sheets, but electronic software can work too. Whatever your method, you need a *system* to promptly address and resolve Findings / Recommendations. Once you’ve established this system, use it to set the agenda of your regularly scheduled Process Safety meetings. A tracking system should document:

Where the Finding / Recommendation came from.

Why the recommendation was made and the the actual text of the Finding / Recommendation.

When the Finding / Recommendation was made. When the Finding / Recommendation (and any interim measures) are to be completed by. When activities on it occur and, ultimately, when it is marked as fully addressed.

Who is Responsible for it.

What has been done, is being done, and is planned to be done.

 

Failing to document the Response

If you’ve implemented a system to track Findings / Recommendations, then this shouldn’t be an issue. Where most people fail here is not documenting what they are told. An example: you bring up a recommendation during a conversation with management and they give you an answer, but you don’t document that verbal answer in your tracking system. Even better, when you are given verbal answers to a Finding / Recommendation, either document that answer in the meeting notes or in a follow-up email to the person that gave you the verbal answer.

Even when you actually addressed the Finding / Recommendation, failing to document it can come back and bite you. I’ve witnessed a situation where a recommendation to paint a valve group was implemented but not documented. A few years later, during an OSHA inspection, the facility was cited for not documenting that they did the work – even though the CSHO agreed that the valve group appeared to have been painted. Remember, there are explicit requirements in the PSM rule that you document Finding / Recommendation resolutions: PHA e(5) “the resolution is documented; document what actions are to be taken…” Incident Investigation m(5) “…Resolutions and corrective actions shall be documented.” Compliance Audit o(4) “…determine and document an appropriate response to each of the findings of the compliance audit, and document that deficiencies have been corrected.”

 

Assured Interim Safety or Interim Measures

When you receive a Finding / Recommendation, it’s best to work with the j(5) standard: “… correct deficiencies…before further use or in a safe and timely manner when necessary means are taken to assure safe operation.”

Put simply: Either shut it down or ensure it’s safe to operate while you are planning & implementing your response.

Let’s use the example of a valve group that has been identified as “rusty.”

First, we need to evaluate the condition of the valve station. Is it so bad that you don’t know if it’s safe? If so, shut it down until you can evaluate it further. Document this decision and the reasons for it.

Is it mild surface rust such that it just needs cleaning and a fresh coat of paint? Either clean and paint it right away or document why it’s safe to operate until when you plan on cleaning and painting it.

 

Bonus: What a flowchart of a SYSTEM for Finding / Recommendation resolution can look like:

What can we learn from the Fernie Ammonia fatalities?

July 30, 2018 /

The October 17th, 2017 Ammonia release in Fernie, BC resulted in three fatalities:

On October 16, 2017, the curling brine chiller at the Fernie Memorial Arena was put back into operation after a seasonal shutdown. During the shutdown and seasonal maintenance, ammonia had been detected in the curling brine system, indicating that the curling brine chiller was leaking… A total of three people were found deceased in the mechanical room: the director of leisure services, the refrigeration operator, and a refrigeration contractor mechanic.

 

Three people died in a completely avoidable incident. If you want to know the particulars of the incident, I’d recommend you go read the Incident Report itself. While we can’t go back in time and avoid this particular incident, we can extract some valuable lessons from it to prevent a similar incident in the future.

There’s a lot that went wrong, but we’re going to focus on a few key failures in Mechanical Integrity, Process Safety, and Release / Incident Response. We’ll briefly discuss each failure and provide ten opportunities for improving your current Process Safety system.

Note: While this incident occurred in Canada, which does not have robust Process Safety regulation, we’re going to provide our analysis as if it was a PSM/RMP plant. Even if this incident had occurred in the US, the total system inventory was estimated at less than 1,000 pounds, placing it in the General Duty category. Most operators of these General Duty systems do not choose to implement a PSM system – hopefully this incident will cause them to re-evaluate that choice.

 

Equipment Age and installation: In 2011, the facility received a recommendation from their mechanical contractor to replace the chiller due to its age. It had been in service for about 24 years and had a life expectancy of 20-25yrs. (At the time of failure the chiller was in service for approximately 31yrs.) The facility actually budgeted for this replacement, deferred it, and then dropped the idea altogether. The report (and appendices) detail this decision making and indicates that the people making these decisions didn’t understand the underlying safety issues or the possible repercussions of these decisions. In part this was due to management turnover – the people who received the initial recommendation no longer worked at the facility when those recommendations were due to be implemented. Additionally, post-release, it was determined that the failed coupling was not properly supported.

Possible PSM citations: 1910.119(d)(3)(ii) for not installing the coupling per the manufacturers recommendations. 1910.119(d)(3)(ii) for equipment operating outside manufacturer’s recommended lifespan. 1910.119(e)(1) for the PHA not analyzing the hazards associated with operating outside the manufacturer’s recommended lifespan. 1910.119(j)(5) for operating the equipment with a known (service life) deficiency without assuring safe operation. 1910.119(m)(5) for not addressing and resolving a recommendation. (if the recommendation was made due to an indication of NH3 in the brine)

Opportunity #1: When a piece of equipment has a stated service life, you need to either replace the equipment per the recommendation or support your decision to keep it in service with a suitable engineering rationale.

Opportunity #2: When operators & contractors make recommendations, they need to provide CLEAR and defensible reasons for those recommendations.

Opportunity #3: When recommendations are delayed, deferred, or not completed, the operators & contractors need to ensure that the decision makers understand the implications of their decisions.

Opportunity #4: A Pre-Startup Safety Review (PSSR) and ongoing MI tasks need to ensure that equipment is installed correctly and maintained in a safe manner / arrangement.

 

Signs of Failure and Deficiency Response: The facility detected NH3 in the brine (by scent) in April of 2017 and then followed it up with a lab test of the brine showing over 3,000ppm of NH3 in June. The facility decided to continue operating the chiller and “monitor” it. A second test in August showed an NH3 concentration near 2,000ppm. Again, the facility decided to keep “monitoring” the situation. The report indicated that the personnel performing the tests and receiving the results didn’t understand the safety implications of them. Even after receiving the tests showing the chiller had failed, the facility decided to keep operating it. According to the report, there was no evidence the facility understood the hazards associated with a leaking chiller.

Furthermore, due to a miscommunication, the contractor believed the facility had taken the chiller out-of-service and they were preparing a bid to replace the leaking unit. The contractor’s recommendation to “monitor” the unit was likely meant to monitor it to see if the valves were leaking by, but the facility interpreted it as a go-ahead to continue operating the defective chiller until it could be replaced as long as they “monitored” it.

The contractor had no policy or procedure in place to deal with a failed chiller outside the usual troubleshooting, repair and replace activities. The investigators concluded that none of the people involved with the decision to continue operating the chiller had training or qualifications involving condition/risk assessment.

Possible PSM citations: 1910.119(j)(5) for operating the equipment with a known (integrity) deficiency without assuring safe operation. 1910.119(m)(5) for not addressing and resolving a recommendation. 1910.119(g)(1)(i) for not training personnel of the hazards associated with a leaking chiller.

Opportunity #5: Personnel reviewing test results need to understand the meaning of the test results and the safety implication of those test results.

Opportunity #6: When test results are provided to decision-makers, these results need to provide adequate information so that the decision-makers understand them and their safety implications.

Opportunity #7: When contractors are called to deal with deficient equipment, they will almost always provide guidance / estimates on how to repair / replace the equipment, but facilities should demand a risk assessment on continued operation of the equipment if they intend to continue its operation while planning and preparing for the repair / replacement.

From Appendix V of the report: “In the majority of instances, owner/operators relied heavily on the refrigeration contractor’s assessment of the equipment and evaluation of the NH3 indication in the brine samples. The owner is accountable for the safe condition and operation of the equipment but in some instances, deferment to the refrigeration contractor’s assessment and recommendations for the equipment was observed.”

Opportunity #8: When a facility outsources maintenance work, they often erroneously think that they are outsourcing the responsibility as well. It is important for a facility to understand that this remains their process and their responsibility. Ask tough questions of your contractors to ensure that you understand the condition of your system.

 

Facility and Contractor Incident Release Response: On the day of the release at 03:53 the machine room NH3 alarm registered 300ppm. Responding facility personnel observed the brine expansion tank shaking and spilling brine. At 04:30, the facility personnel shutdown the system and closed the chiller suction valve, observing that the shaking in the brine tank stopped. This should have indicated to the facility personnel that the separation between the brine and NH3 sides was completely compromised and that the brine loop was now full of ammonia. At 05:18 the facility personnel called the contractor to come in and re-configure the system to operate without the brine chiller.

At some point during the work, the personnel isolated the brine chiller, trapping the ammonia-laden brine in the chiller with no outlet available for it. As this ammonia-laden brine warmed up, the pressure inside the brine chiller rose and, at an estimated pressure of 30-150psig, a coupling on the brine-side of the brine chiller failed releasing the contents into the machine room and onto the personnel in the room. The estimated total NH3 release was 22 pounds (9lbs immediately vaporizing) resulting in an immediate concentration in the area of 20,000ppm which dissipated to about 5,000ppm over a period of 5 minutes.

The report uses electricity demand to conclude that the personnel did not attempt a pump-out of the brine chiller. Unlike a CSB report, the report does not go into the fatalities. We have no idea where the personnel were positioned in the room, or what – if any – PPE they were wearing at the time of the release. It can reasonably be surmised that they weren’t wearing any respiratory PPE at all.

Possible PSM citations: 1910.119(g)(1)(i) for not training personnel of the hazards associated with NH3 contaminated brine and the hazards of trapping it. 1910.119(h)(3)(ii) for the contractor not being trained in the hazards associated with NH3 contaminated brine and 1910.119(h)(2)(v) for the facility not ensuring this training occurred. 1910.119(n) for not providing “procedures to handle small releases.” 1910.119(f)(1)(i)(D) for not providing an emergency shutdown procedure. 1910.119(f)(1)(i)(E) for not providing an emergency operations procedure.

Opportunity #9: While we often train on the dangers associated with trapping NH3, the dangers of trapping NH3 contamination in a secondary loop is rarely discussed. Operator training in facilities that utilize secondary cooling loops must address contamination and its possible safety implications.

Opportunity #10: While it’s not possible to know for sure, it is extremely likely that all three of these fatalities could have been avoided if the personnel were wearing full-face APRs at the time of release. Note: They would have to have been wearing them, not have them “near-by.” APR’s aren’t magic.

 

090618 Update: Full WorkSafeBC Incident Report

Is a condenser change a Replacement in Kind?

July 18, 2018 /

The Question:

Imagine a project where you are going to replace an existing condenser with a newer model. Does this “change” trigger the MOC element or does it fall into the Replacement in Kind exemption to the MOC requirement?

This question comes up from a customer several times a year.

 

The Short answer:

The answer – if you are short on time – is: An equipment change rarely qualifies as a Replacement in Kind. 

 

The LONG answer:

First, let’s look at the relevant text of the PSM MOC requirement:

1910.119(l)(1) – The employer shall establish and implement written procedures to manage changes (except for “replacements in kind”) to process chemicals, technology, equipment, and procedures; and, changes to facilities that affect a covered process. (The RMP text is essentially the same, so we’re just going to focus on the PSM text)

This text is about the scope of the MOC requirement; or to put it another way: What triggers the requirement?

This proposed condenser change is obviously a change to equipment that has the potential to affect a covered process so it could be covered. In theory, if the new condenser does not affect a covered process we could classify it as a Replacement in Kind. Unfortunately, we don’t actually know if the new condenser will affect the process until we investigate the change. Some questions we’ll need to ask include (but are not limited to):

1) Are there piping / valving changes?

2) Is the overpressure protection the same?

3) Does the new equipment require any changes to the inventory calculation, relief calculation, equipment schedule, etc?

4) Are there any changes to the electrical requirements and controls?

5) Does the new equipment require any changes to existing SOP(s) and MIP(s)?

6) Does the new equipment require any changes to the existing MI schedule?

7) Does the new equipment require any changes to the existing Operator Training?

8) Does the new equipment require any change to the existing Process Hazard Analysis to ensure it properly identifies, evaluates and controls the hazards of the new equipment?

9) Are there any other ways that this new equipment could affect safety and health?

That’s a lot of questions to ask and it’s really just the beginning of them. To even consider this new equipment a Replacement in Kind, we’d have to ask all these questions (and more) and answer them with “No, there are no changes required”.

You know a great way to ensure that you ask these types of questions and properly document your answers? THE MOC ELEMENT. It is literally a written program to Manage Changes.

While it’s not very likely that you will go through the entire MOC procedure and find there are no required changes to the PSM program, if you did so, then you could properly quantify the replacement as a Replacement in Kind and you would have your written questions and answers to defend that judgement.

 

Where does the confusion come from?

Why do so many people think that these types of equipment changes are not covered by the MOC requirement? Often it’s as simple as getting bad advice from consultants or refrigeration “schools.” I think part of the confusion on the issue stems from legacy industry guidance. For the vast majority of Ammonia PSM practitioners, the IIAR is our go-to guidance on design, construction, startup, decommissioning, maintenance, etc., so it’s natural to refer to them for PSM guidance.

Here’s a section from the IIAR’s  1994  Guide to the Implementation of Process Safety Management for Ammonia Refrigeration:

 

Here’s the same section from the IIAR’s 2012 updated Process Safety Management and Risk Management Program Guidelines:

 

Some quick thoughts on that guidance:

1) The term “Like for like” does not exist in the text of the PSM or RMP rule(s) and only leads to more confusion.

2) The first bullet of the 1994 guidance muddles the issue with assumptions. In the legal realm this is referred to as “Assuming facts not in evidence” meaning that the argument is relying on data that hasn’t been provided. We don’t know if the “piping, specifications, connections, instrumentation, and controls” are identical until we actually perform the MOC or something A LOT like it.

3) The second bullet of the 1994 guidance and the revised 2012 guidance are clearer, but they suffer from the same problem with assumptions.

Note: The IIAR is currently updating the Process Safety Management and Risk Management Program Guidelines and I expect the new version to significantly alter this guidance.

 

Why does this matter?

Misclassifying a covered change as a Replacement in Kind often allows the facility to circumvent the Management of Change procedure.

Let me offer a real-world example: During a client visit it was discovered that they were having a replacement condenser installed and that they were classifying it as a Replacement in Kind. They explained that they were doing this because they treated a previous condenser replacement as a Replacement in Kind due to advice from a class one of their employees had attended. We started asking some questions and in under an hour found the following:

1) The relief valves had been removed from both condensers and replaced with hand valves and pipe stubs. (Presumably to allow manual purging)

2) The new stubs did not have caps installed and were therefore open to the atmosphere.

3) The P&IDs no longer reflected the as-built condition of the facility for either of the condensers.

4) The SOPs still referred to the OLD models, not the current ones.

5) The SOPs still referenced the removed relief valves.

6) The PHA section covering condensers still listed relief valves as a safeguard and therefore did not properly identify, evaluate and control the hazards of the condensers.

ALL the above issues would have been avoided with a properly conducted Management of Change procedure.

Considering a change to your system and have some questions? Drop us an email at [email protected]

 

Yet another update on the RMP Updates!

May 17, 2018 /

Note: See December 2019 Update.

Today, EPA’s Administrator, E. Scott Pruitt, signed a new proposed rule, further changing the Obama-era EPA’s proposed changes and the EPA is submitting that for publication in the Federal Register (FR).

Basically, it outlines two proposals for the Obama-era EPA’s proposed changes:

  • Repeal nearly ALL of the Obama-era EPA’s proposed changes essentially returning the RMP rule back to its 2004 condition.
  • Repeal about 90% of the Obama-era EPA’s proposed changes and alter/replace the remainder with some more flexible options for compliance.

While there is a lot of information to digest, the basic arguments for the changes the Trump-era EPA is making are:

  • The EPA wants to maintain its historic consistency with OSHA’s PSM standard as mandated by the Clean Air Act which established the requirement for the PSM/RMP rules. The EPA believes it may update the rule further if OSHA moves forward with its (currently stalled) update process but that it will do so in a coordinated fashion with OSHA to minimize divergence.
  • Address Security Concerns raised by many commenters.
  • Address BATF finding on West Fertilizer incident.
  • Reduce unnecessary regulations and regulatory costs in response to three Executive Orders that require Agencies to place greater emphasis on reducing regulatory costs and burdens.
  • Revise compliance dates to provide necessary time for program changes.

As always, stay tuned for further information. We’re still years away from a change at this rate!

Previous Coverage:

040217

061217

Updates:

081718

 

Learning from Failure

May 17, 2018 /

“Failure is only opportunity to begin again. Only this time, more wisely.” –Henry Ford

We often push PSM practitioners to perform Incident Investigations for fairly minor events in the hopes that the lessons learned from those minor incidents will stop the larger incidents from happening. This is, in part, due to CCPS (Center for Chemical Process Safety) guidance that, for every single catastrophic accident, there are typically nearly 9,900 minor issues / process upsets and 99 near misses.

So, if you only investigate the catastrophic incidents, then you are only acting on 0.010% of the opportunities available to you to improve your control over the process.

OSHA has promoted this idea as far back as a decade ago…

OSHA and industry have found that when major incidents have occurred, most of these incidents have included precursor incidents. Additionally, OSHA and industry (See CCPS [Ref. 41], Section 5, “Reporting and Investigating Near Misses” have concluded based on past investigations, that if employers had properly responded to precursor incidents, later major incidents might not have occurred. Consequently, anytime an employer has an “opportunity” to investigate a near-miss/precursor incident (i.e., an incident that could reasonably have resulted in a catastrophic release) it is important that the required investigation is conducted and that the findings and recommendations are resolved, communicated, and integrated into other PSM elements/systems so a later major incident at the facility is prevented. …It is RAGAGEP to investigate incidents involving system upsets or abnormal operations which result in operating parameters which exceed operating limits or when layers of protection have been activated such as relief valves. (An example RAGAGEP for investigating incidents, including near-miss incidents is CCPS [Guidelines for Investigating Chemical Process Incidents, 2nd Ed.], this document presents some common examples of near-miss incidents). (OSHA, Refinery PSM NEP, 2007)

Going a step further, it’s often true that you can learn something about managing complex operations from businesses in entirely different fields. One field that I like to follow – in part because it’s endlessly re-inventing itself – is information technology.

Google recently published an article on their Post-Mortem culture, with a farcical worked-example that includes the movie “Back to the Future” and a newly discovered sonnet by Shakespeare. The practice of learning from their failures is actually part of their Sight Reliability Engineer handbook and you can read the entire chapter if it appeals to you.

“Failures are an inevitable part of innovation and can provide great data to make products, services, and organizations better. Google uses ‘postmortems’ to capture and share the lessons of failure…

… For us, it’s not about pointing fingers at any given person or team, but about using what we’ve learned to build resilience and prepare for future issues that may arise along the way. By discussing our failures in public and working together to investigate their root causes, everyone gets the opportunity to learn from each incident and to be involved with any next steps. Documentation of this process provides our team and future teams with a lasting resource that they can turn to whenever necessary.

And while our team has used postmortems primarily to understand engineering problems, organizations everywhere — tech and non-tech — can benefit from postmortems as a critical analysis tool after any event, crisis, or launch. We believe a postmortem’s influence extends beyond that of any document and singular team, and into the organization’s culture itself.”

Google’s Pre-Mortem Tool – Anticipating what can go wrong.

Google’s Post-Mortem Tool – Dealing with what actually went wrong.

General Duty vs. PSM/RMP: Is there a benefit to dropping below the 10,000lb threshold?

February 26, 2018 /

Several times a year I get a phone call or an email from a client that wants to lower the NH3 inventory below the federal 10,000lb threshold so they are no longer subject to the PSM/RMP rules. It’s a conversation I’ve had nearly a hundred times over my career, so I thought it would be worth writing down my thoughts on this subject for posterity. The factors break down into three categories: Logistical, Regulatory and Safety.

Logistical: If you’re close to the 10,000lb threshold, you may be able to reduce the NH3 inventory below the regulatory line of 10,000lbs., but there are some things worth considering:

Is it safe? A system operating below the level it was designed to operate is often called starved. Starved systems can be unsafe due to the increased rates of vapor propelled slugging and low vessel levels causing pumps to cavitate. This isn’t something you want to do without consulting a design engineer.

Can I keep it at this level? If we dropped our system inventory to 9,900lbs., we are going to have to ensure it stays below the 10,000lb threshold or we can end up in a regulatory nightmare. Future charges (to replace losses) will require careful calculation to ensure that we stay on the right side of the threshold. This can be done through a good inventory management program, but it’s something you’re going to want to plan for.

Regulatory: If we drop below the 10,000lb threshold, we can remove ourselves from the federal RMP & DHS registries, but we will still have to meet the OSHA and EPA General Duty requirements for our NH3 refrigeration system.

To quote OSHA:

“Employers can be cited for violating the General Duty Clause if there is a recognized hazard and they do not take reasonable steps to prevent or abate the hazard.”

When we discuss things like “recognized hazard” we are discussing the things that are outlined in appropriate RAGAGEP. What would be RAGAGEP for an NH3 refrigeration system below 10,000lbs? At a minimum, ALL the IIAR standards & bulletins as well as the IIAR ARM (Ammonia Refrigeration Management) program. What does that mean?

  • The system design still has to comply with IIAR 2 Standard for Safe Design of Closed-Circuit Ammonia Refrigeration Systems
  • The installation still has to comply with IIAR 4 Installation of Closed-Circuit Ammonia Refrigeration Systems
  • The startup and commissioning still has to comply with IIAR 5 Start-up and Commissioning of Closed-Circuit Ammonia Refrigeration Systems
  • The process safety information and maintenance program still has to comply with IIAR
    • Bulletin 108 Guidelines for: Water Contamination in Ammonia Refrigeration Systems
    • Bulletin 109 Minimum Safety Criteria for a Safe Ammonia Refrigeration System
    • Bulletin 110 Guidelines for: Start-Up, Inspection and Maintenance of Ammonia Mechanical Refrigerating Systems
    • Bulletin 114 Guidelines for: Identification of Ammonia Refrigeration Piping and System Components
    • Bulletin 116 Guidelines for: Avoiding Component Failure in Industrial Refrigeration Systems Caused by Abnormal Pressure or Shock
    • The upcoming IIAR Standard 6 Inspection, Testing, and Maintenance of Closed-Circuit Ammonia Refrigeration Systems which will replace all the above bulletins
  • The operating procedures still has to comply with IIAR 7 Developing Operating Procedures for Closed-Circuit Ammonia Mechanical Refrigerating Systems
  • The overall system safety management program will have to comply with the IIAR ARM program which is about 90% of the paperwork burden of a full PSM/RMP program.

If you are looking at that list and thinking “There’s almost no benefit to dropping below the 10,000lbs mark from a regulatory standpoint” you aren’t wrong. There is ONE and it’s fairly minor: Generally speaking, your potential fines for violating OSHA’s or EPA’s General Duty clause are smaller than those for violating PSM/RMP. I say generally, because that’s not always the case. As an example, here’s a consent agreement for a $185,000 fine under the EPA’s General Duty clause.

Let me summarize the regulatory situation of a General Duty NH3 refrigeration facility in a single sentence: A General Duty NH3 refrigeration system is going to have 95% of the regulatory burden of a PSM/RMP facility (and thus have to do the same things as a PSM/RMP facility would) but you won’t have the well-understood PSM/RMP structure to help manage that regulatory burden.

Safety: In theory, any inventory reduction provides some small measure of reduced risk. In practical terms, though, there is usually very little effect. Often, due to the way our systems are designed (and the way the RMP scenarios are calculated) there is no change at all in the calculated area of effect of a release scenario*. Also, it’s important to keep in mind that very small amounts of NH3 can pose a danger to your personnel – it doesn’t matter that you’ve reduced your inventory from 11,000lbs to 9,900lbs when a release of 5lbs can pose mortal danger to a technician.

In my experience though, the real danger of reducing your inventory below the threshold is that facilities that do so almost always give their General Duty compliance a lower priority than they gave to their PSM/RMP compliance. These facilities become less safe because they believe that they are less exposed to OSHA and the EPA.

Conclusion: Yes, lowering your inventory can produce a slight increase in inherent safety and a lower regulatory exposure, but in practice, it usually does very little other than give the facility an excuse to de-prioritize safety and compliance.

I work with many companies with National and International brands. Nearly ALL of these companies treat their General Duty facilities as if they have over the 10,000lb threshold, for the same reason: Brand protection – You never want to be in a position where you are making the argument that you didn’t provide the highest level of safety to your employees and your community because you didn’t have to by law!

* No, Worst-Case and Alternate release scenarios are not required by General Duty plants, but I always calculate and map them so the facility understands the possible ramifications of a release on their community.

 

2019 UPDATE: The chart below shows the differences between the PSM/RMP requirements (as of July 2019) and the recently published 2018 ARM program. The compliance burden for ARM is roughly 90-95% of PSM/RMP due to the IIAR Standards and existing OSHA/EPA requirements OUTSIDE of PSM/RMP.

 

OSHA PSM & EPA RMP vs. GDC and IIAR’s 2018 ARM Program
PSM/RMP element Equivalent IIAR ARM (GDC) What’s the difference?
RMP & Hazard Assessment

·        Management System

·        WCS/ACS Scenarios

·        RMP Filing

 Management System

Hazard Assessment

 There is no RMP CDX filing, but the ARM requires that you calculate the WCS/ACS scenarios and establish a Management System. This is roughly 90% of the RMP burden.
Employee Participation NONE While the ARM doesn’t require this as a stand-alone element, the PSM/RMP burden for the element is fairly light. It is unlikely that ANY safety program would be functional without adequate employee participation.
Process Safety Information Refrigeration System Documentation No significant differences because the ARM references IIAR 2 & 9 which reference all the installation standard (IIAR 4) and the startup standard (IIAR 5) and the MI Standard (IIAR 6). Functionally identical to PSM/RMP.
Process Hazard Analysis Hazard Review No significant differences because the ARM references the IIAR What-If/Checklists. Functionally identical to PSM/RMP.
Procedures Operating Procedures No significant differences because the ARM references the SOP standard (IIAR 7). Only missing requirement is the annual SOP certification. This is roughly 99% of the PSM/RMP burden.
Operator Training Training Program No significant differences because the ARM has all the same requirements and references IIAR ARTG. Functionally identical to PSM/RMP.
Contractors Contractor Program No significant differences other than the lack of a requirement for a Contractor Injury Log. This is roughly 99% of the PSM/RMP burden.
Mechanical Integrity Preventative Maintenance Program No significant differences due to the requirements of ARM and the fact that the ARM references IIAR 2 & 9 which reference all the installation standard (IIAR 4) and the startup standard (IIAR 5) and the MI Standard (IIAR 6). Functionally identical to PSM/RMP.
Hot Work NONE Since OSHA requires Hot Work outside of the PSM standard, this is pretty much identical to the PSM/RMP burden. 
Management of Change and Pre-Startup Safety Review Managing Change No significant differences due to the requirements of ARM and the fact that the ARM references IIAR 2 & 9 which reference all the installation standard (IIAR 4) and the startup standard (IIAR 5) and the MI Standard (IIAR 6). Functionally identical to PSM/RMP.
Incident Investigation Incident Investigation ARM doesn’t include the new Obama-Era RMP requirements, but neither does PSM. Until the EPA publishes new GDC guidance we won’t know if ARM needs this too. Since the new EPA requirements were already done by most functional programs, there is very little change. This is roughly 95% of the current PSM/RMP burden.
Emergency Action / Response Emergency Planning & Response ARM doesn’t include the new Obama-Era coordination with local responders, but neither does PSM. Until the EPA publishes new GDC guidance we won’t know if ARM needs this too. Because the OSHA requirements are outside of PSM, this is all of the OSHA (PSM) burden and roughly 90% of the RMP burden.
Compliance Audit Self-Audits The only difference is the lack of a “certification” requirement. Note: ARM doesn’t include the new Obama-Era RMP 3rd party audits in the case of a 5yr History recordable accident, but neither does PSM and this requirement is still postponed until 2021. Until the EPA publishes new GDC guidance we won’t know if ARM needs this too. This is roughly 99% of the current PSM/RMP burden.
Trade Secrets NONE ARM doesn’t require an element for this, but since there are VERY few Trade Secrets in NH3 Refrigeration, it doesn’t much matter.

Answering the OSHA NEP Document Request List

November 24, 2017 /

OSHA’s published CPL-03-00-021 – “PSM Covered Chemical Facilities National Emphasis Program” includes an example document request list that often correlates fairly well to the one that OSHA inspectors provide during an NEP inspection. Below, I’ll outline how programs using our PSM system can answer those requests with PSM documents.

Table 1 – Documents That Should Be Requested Prior to Identifying the Selected Unit(s)

OSHA 300 logs for the previous three years for the employer and the process-related contractors*.

Documents regarding your OSHA 300 logs should be kept by your Safety Department. This is addressed in your Contractor Element Written Plan for the contractor and it’s likely your Safety Department.

All contract employee injury and illness logs as required by 1910.119(h)(2)(vi)*.

Most NH3 Refrigeration PSM facilities handle this with the contractor’s OSHA 300 logs.

A list of all PSM-covered process/units in the complex.

The vast majority of NH3 Refrigeration PSM facilities have a single covered process in the complex. If you have multiple processes on the same site, you likely handle / explain this fairly well in your RMP Hazard Assessment documentation.

A list of all units and the maximum intended inventories* of all chemicals (in pounds) in each of the listed units. Compliance Guidance: 1910.119(d)(2)(i)(C) requires employers to have process safety information (PSI) for the maximum intended inventories of chemicals that are part of their PSM-covered processes.

The inventory of the covered process(es) is in the PSI directory in a spreadsheet that shows the Inventory Calculation. Documentation regarding the Maximum Intended Inventory is handled in the PSI Element Written Plan.

A summary description of the facility’s PSM program.

The RMP Element Written Plan includes this information in general – individual Elements have information concerning that element in the Element Written Plan.  Showing the inspectors the procedural sections in the RMP entitled “Implementation Policy: Risk Management Prevention Plan” & “Implementation Policy: Management of Program Activities” has generally been more than sufficient to answer this question.

Unit process flow diagrams*.

Most NH3 Refrigeration PSM facilities handle this in the P&ID’s – possibly in conjunction with a Block Flow or Mass & Energy Balance.

Process narrative descriptions.

This is addressed in the beginning of the System ROSOP as well as in the individual equipment RESOPs.

Host employer’s program for evaluating contract employer’s safety information.

This is addressed in your Contractor Element Written Plan. Your documented use of forms CQ1-CQ4 should provide adequate information to answer the question.

Host employer’s program/safe work practices for controlling the entrance/exit/work of contractors and their workers in covered process areas.

This is addressed in your Contractor Element Written Plan. Likely, it redirects you to the facility Safety / Risk Management policies.

Emergency Action Plan* (If the employer has 10 or fewer employees they may communicate the plan orally (29 CFR 1910.38(b)) — i.e., they may not have a written emergency action plan; and Emergency Response Plan* if the facility is also required to comply with 29 CFR 1910.120(q).

This is generally handled by your Safety Department as it is a “general industry” requirement.

Host employer’s program for periodically evaluating contractor performance.

This is addressed in your Contractor Element Written Plan. Your documented use of form CQ6 should provide adequate information to answer the question.

Table 2 – Documents That Should Be Requested After the Selected Unit(s) Are Identified

Piping and instrumentation diagrams (P&IDs) including legends*.

Your P&ID collection will include title sheets that satisfy the requirement for legends.

Unit electrical classification documents*.

The vast majority of NH3 Refrigeration PSM facilities cover this in a stand-alone letter provided in the PSI directory. That letter will reference your IIAR RAGAGEP stating that the system is “unclassified” or an “ordinary location.” Your electrical classification is contingent on an accurate and compliant Ventilation calculation which should be in your PSI directory.

Descriptions of safety systems (e.g., interlocks, detection or suppression systems)*.

Safety systems (e.g., interlocks, detection or suppression systems) are covered in each individual RESOP for each individual piece of equipment.

Design codes and standards employed for process and equipment in the Selected Unit(s).

The vast majority of NH3 Refrigeration PSM facilities cover this in a stand-alone letter provided in the PSI directory. That letter will document which RAGAGEP you’ve chosen and it also provides a place for you to certify it.

A list of all workers (i.e., hourly and supervisory) presently involved in operating the Selected Units(s), including names, job titles, work shifts, start date in the unit, and the name of the person(s) to whom they report (their supervisor).

This information should be captured in the individual operator OT1 forms in the Training Element directory. You may have to supplement the OT1 forms with information from your HR department.

The initial process hazard analysis*(PHA) and the most recent update/redo or revalidation* for the Selected Unit (s); this includes PHA reports*, PHA worksheets*, actions to address findings and recommendations promptly*, written schedules for actions to be completed*, and documentation of findings and recommendations*. Compliance Guidance: Any PHA performed after May 25, 1987 that meets the requirements of 1910.119(e) may be claimed by the employer as the initial PHA for compliance purposes, see 1910.119(e)(1)(v).

The PHA is located in the Process Hazard Analysis directory. It is not generally our custom to “revalidate” PHA’s but to complete a new PHA (compliant with the IIAR Compliance Guidelines questions) during the 5yr “revalidation.”

Safe upper and lower operating limits for the Selected Unit(s)*.

Safe upper and lower operating limits are covered in each individual RESOP for each individual piece of equipment.

A list by title and unit of each PSM incident report; all PSM incident reports for the Selected Unit*.

Generally speaking, the Incident Investigations aren’t sorted by unit, but providing all the Incident Investigations that have been created over the document request period should suffice.

Contract employer’s safety information and programs (this will be requested from the host employer after it is determined which contractor(s) will be inspected).

This is addressed in your Contractor Element Written Plan. Your documented use of forms CQ1-CQ4 should provide some information to answer the question. In facilities that allow contractors to provide their own Safety Programs, you will need to be able to provide those programs as well as your evaluation of them. The vast majority of NH3 Refrigeration PSM facilities  do not allow contractors to use their own Safety Programs – instead requiring them to use the established facility Safety Programs.

Contractor employer’s documentation of contract workers’ training, including the means used to verify employees’ understanding of the training* (this will be requested from the respective contractor employer(s) after it is determined which contractor(s) will be inspected).

This is addressed in your Contractor Element Written Plan. Your documented use of forms CQ3-CQ4 should provide adequate information to answer the question.

Note: This older Post provides additional questions from a recent NEP inspection.

If you need help preparing for, managing, or dealing with the aftermath of an OSHA or EPA inspection, please contact us.

IIAR 7 update now open for Public Review

November 10, 2017 /
November 10th, 2017
To: IIAR Members
Re: First (1st) Public Review of Standard BSR/IIAR 7-201x, Developing Operating Procedures for Closed-Circuit Ammonia Refrigeration Systems.
A first (1st) public review of draft standard BSR/IIAR 7-201x, Developing Operating Procedures for Closed-Circuit Ammonia Refrigeration Systems is now open. The International Institute of Ammonia Refrigeration (IIAR) invites you to make comments on the draft standard. Substantive changes resulting from this public review will also be provided for comment in a future public review if necessary.

BSR/IIAR 7-201x, defines the minimum requirements for developing operating procedures applicable to closed-circuit ammonia refrigeration systems. It presupposes that the persons who use the document have a working knowledge of the functionality of an ammonia refrigeration system(s) and basic ammonia refrigeration practices and principles. This standard is intended for those who develop, define, or review operating procedures, or a combination thereof, for closed-circuit ammonia refrigeration systems. This standard shall apply only to stationary closed-circuit refrigeration systems utilizing ammonia as the refrigerant. It supplements existing general refrigeration standards issued by IIAR and other organizations such as ASHRAE, ASME, and ANSI. It is not intended to supplant existing safety codes (e.g., model mechanical or fire codes).

IIAR has designated the draft standard as BSR/IIAR 7-201x. Upon approval by the ANSI Board of Standards Review, the standard will receive a different name that reflects this approval date.

We invite you to participate in the first (1st) public review of BSR/IIAR 7-201x. IIAR will use the American National Standards Institute (ANSI) procedures to develop evidence of consensus among affected parties. ANSI’s role in the revision process is to establish and enforce standards of openness, balance, due process, and harmonization with other American and International Standards. IIAR is the ANSI-accredited standards developer for BSR/IIAR 7-201x, and is responsible for the technical content of the standard.

This site includes links to the following attachments:

The 45-day public review period will be from November 10th, 2017 through December 26th, 2017. Comments are due no later than 5:00 pm Eastern Standard Time (EST) on December 26th, 2017.

A quick review of the update shows no significant changes are necessary to the current stock templates.

RAGAGEP Hierarchy in Application – A worked example

October 10, 2017 /

RAGAGEP (Recognized and Generally Accepted Good Engineering Practices/Principles) is extremely important to our Process Safety programs as it helps define the boundaries of what is (and isn’t) acceptable in our processes and our management of them. There seems to be some confusion in a significant portion of the industry as to how to practically apply RAGAGEP* so I thought a brief discussion (and worked example) might be useful.

Let’s say that we have multiple possible RAGAGEP’s for a single item – such as relief valve replacement schedule. Those multiple RAGAGEP’s may well have differing requirements so we will need to rank them to understand what we actually need to do. Here’s an example RAGAGEP listing from OSHA:

  1. Codes adopted by the AHJ (Authority Having Jurisdiction) such as IMC/UMC
  2. Consensus Standards such as IIAR or ASHRAE
  3. Non-consensus documents such as Pamphlets / Bulletins from industry organizations
  4. Internal Standards such as your corporate policy

What isn’t on that list is manufacturer’s recommendations and there’s a reason why. The things listed above set the RAGAGEP and the manufacturer’s recommendations can modify it.**

There are generally two ways to modify something: make it more or less restrictive.

More: In the event that the manufacturer gives you a recommendation that is more restrictive (conservative) than the RAGAGEP, you must*** accept that more restrictive recommendation.

Less: If the manufacturer gives you a recommendation that is less restrictive than the RAGAGEP, you can accept that less restrictive recommendation, but you will need to document why you believe that the manufacturer’s recommendation is superior to the existing RAGAGEP.

In a recent article, we discussed the replacement schedule for a relief valve that relieves back into the system. The codes reference the consensus standards, which in turn reference some non-consensus bulletins. The bulletin in question, IIAR B110 says that these valves are not subject to the 5yr changeout frequency that other relief valves are. Yet, we have an email from the manufacturer’s engineering department that still recommends the 5yr changeout schedule.

In this case, we have a disagreement between the non-consensus bulletin and the manufacturer’s recommendation. Put another way, we have a generic recommendation on relief valve changeout versus a manufacturer specific recommendation. Obviously, the manufacturer’s specific recommendation on their valves overrides the generic recommendation about all relief valves. Therefore, as long as we are going to use these specific valves, we need to follow the manufacturer’s recommendation. ***

*It’s important to understand that we’re talking about what RAGAGEP decision is the most defensible during an inspection / audit.

** In 1910.119(j)(4)(iii) manufacturer’s recommendations are explicitly called out in conjunction with good engineering practices to set inspection/testing frequency, but the point still holds true.

*** It’s theoretically possible that you can make the engineering case that you know more about the manufacturer’s equipment as it operates in your process than they do, so you can override their recommendation. One method that’s routinely used is to choose an alternative way to achieve the same goals – one where you can show the engineering rationale to prove your alternative is as safe or safer. A common example of that would be replacing the oil based on regular oil analysis rather than changing it out at a specific hour interval. Of course, such a change would have to be thoroughly documented through your Management of Change procedure.

The Cyrus Shank LQ Series Relief Valves – A Discussion on Manufacturer’s Recommendations and the 5 Year Pressure Relief Valve Interval

September 11, 2017 /

Many facilities I’ve been to recently use the Cyrus Shank LQ Series valves for internal/liquid relief applications. At these facilities, there tends to be some confusion on the 5-year replacement schedule since these are internal relief valves but still come with a replacement date tag.

Allow me to explain the conflict here:

Back in 2007, the IIAR issued a revision to their Bulletin 110 (Start-up, Inspection and Maintenance of Ammonia Mechanical Refrigerating Systems) which clarified the current standard on replacing or recertifying pressure relief devices. It states that you have 3 options for setting your relief valve replacement schedule:

  1. Every five (5) years from the date of installation. IIAR originally recommended (in 1978) that pressure relief valves be replaced every five years from the date of installation. This recommendation represents good engineering practice considering the design and performance of pressure relief devices; or
  2. An alternative to the prescriptive replacement interval, i.e., five years, can be developed based on documented in-service relief valve life for specific applications using industry accepted good practices of relief valve evaluation; or
  3. The manufacturer’s recommendations on replacement frequency of pressure relief devices shall be followed.

It’s a fairly straightforward list that led to both facilities and manufacturers setting a replacement schedule not to exceed 5 years unless conditions warranted earlier replacement of the devices. The major follow-up question for schedulers is what to do with internal or liquid relief valves, since they’re not usually subject to the same concerns as atmospheric relief valves.

The same IIAR bulletin covers this as an exception to the previous recommendation, stating that:

“Relief devices discharging into another part of the closed-loop refrigeration system are not subject to the relief valve replacement practices.”

Internal relief devices come in many configurations, so relief valves designated for liquid use are normally treated the same as relief regulators or similar devices in that they aren’t replaced until a regular inspection (or system operation) indicates the need.

Generally speaking, when we set our mechanical integrity schedule we first check the standards (IIAR Bulletin 110 in this case) and then modify that schedule based on the manufacturer’s recommendations for our specific equipment. The issue that occurs here is that the Cyrus Shank bulletin issued for their relief valves recommends that they be replaced at least every five years, without specifying which type. After contacting Cyrus Shank, their engineering department responded with the following:

“The cut sheet is a general recommendation that would apply to all of our valves, including the LQ valves. There is one difference between the vapor service valves and the liquid (LQ) ones: the LQ valves have a slightly different sealing ‘surface’ as compared to the vapor. Other than that, they are essentially the exact same in design. The replacement/inspection intervals greatly depend on the nature of the contents and operation of the system so only general recommendations can be given.  We would still recommend the general 5 year replacement interval for both the vapor AND liquid service valves regardless of application. However, the replacement interval is ultimately up to the customer. “

To be consistent with the other justifications in our (manufacturer recommendations based) mechanical integrity schedule, that means that we’ll be replacing those LQ Series valves at least every five years as well. It’s important when setting up a compliant program that we stay informed of all the different RAGAGEP sources that can affect our program. The exception in IIAR Bulletin 110 actually does allow us to set our schedule based on a method of our choosing, but our justification must be defensible. Our defense normally comes from the manufacturer recommendation, so in this case we would have to follow the 5-year recommendation on LQ valves as our RAGAGEP.

10/10/17 Update: Some people have suggested that statements from Cyrus Shank marketing materials somehow override the statements of the Cyrus Shank engineering department. This is absurd and a fundamental misunderstanding of RAGAGEP. If the Cyrus Shank engineering department changes their position then this issue can be re-evaluated, but until then it remains as shown above.

For more on this topic, click here.

11/09/18 Update: Cyrus Shank has helped us deal with this issue!

 

« Older posts Newer posts »

Contact Us

© 2024 RC&E Chill – Industrial Refrigeration and Process Safety / Risk Management

Theme by Anders Noren — Up ↑