Henry Ozog, R. Peter Stickles
Arthur D. Little Inc.
Cambridge, Mass.
The American Petroleum Institute (API) has recently published Recommended Practice 750 on Management of Process Hazards.1
This is a landmark document that for the first time defines a framework of procedures and practices to manage risk in oil and gas operations.
A review of API RP 750 is important because there are important differences between it and other recent documents on process hazards management. Guidance and more details for implementing the specific elements in the recommended practice will also be covered in this article.
COMPARISON
API RP 750 is intended to "...help prevent the occurrence of, or minimize the consequences of, catastrophic releases of toxic or explosive materials." It addresses the management of process hazards during design, construction, start-up, operation, inspection, maintenance, and modification of facilities in eleven specific areas.
A similar, more comprehensive document aimed at the chemical process industry was issued about the same time by the Center for Chemical Process Safety (CCPS) of the American Institute of Chemical Engineers.2 It identifies 12 elements of a comprehensive risk management program. Whereas both documents overlap considerably, there are notable differences.
Subsequent to the publication of both these documents, the Occupational Safety & Health Administration (OSHA) published a proposed rule (29 CFR 1910.119) "Process Hazards Management of Highly Hazardous Chemicals."3 It also defines 12 elements of a process hazards management system. Both the API and OSHA documents have a common origin in a report by ORC.4 Table 1 summarizes the key elements of the API, CCPS, and OSHA documents.
APPLICATION
The API recommended practice applies to facilities that use, produce, process, or store toxic or flammable materials.
For comparison, the applicability of the proposed OSHA regulation is shown in Table 2. Whereas AP[ RP 750 is directed toward refineries, petrochemical operations, and major oil and gas processing facilities, the OSHA regulation would apply to any process handling one of the specified chemicals above the threshold quantity.
OSHA also has extended the proposed regulation to cover the manufacture of explosives and pyrotechnics as defined in 29 CFR 1910.109. The CCPS guidelines are applicable to all industries where hazardous chemicals are handled, used, or stored.
For refineries, most units have the potential for offsite impact based on the criteria in Table 2. Prioritization of units for implementation of a process hazards management (PHM) program or the individual elements requires a screening mechanism that can compare the consequences of toxic exposure and fires/explosions.
Although we believe that any PHM program designed to comply with API RP 750 should apply to the entire facility, the prioritization mechanism would define which areas to implement first, particularly for those elements where significant effort may be involved, such as updating process safety information (especially piping and instrument drawings), operating manuals, and conducting process hazards analysis.
Table 3 summarizes the important differences in the required intervals for implementing certain elements of the PHM programs proposed by API and OSHA.
ACCOUNTABILITY
Accountability for process hazards management is addressed in API RP 750 under the principles upon which the recommended practice is based. We feel that a process hazards management program cannot be effective unless there is a clear statement of company expectations, objectives, and goals. A common practice is to issue a statement of company safety policy, supplemented by specific goals and expectations.
It is vital that any process hazards management program have support of upper management because substantial resources will generally be needed to implement and maintain an effective program. An important first step is to appoint an on site coordinator. A company with many locations should also have a corporate coordinator. The coordinator needs to be independent in order to manage the program effectively, and he should report directly to the facility manager or through the facility safety committee.
A process hazards management program should include specific definition of the program requirements, individual roles and responsibilities, and means of updating and auditing the program. Once an overall framework for the program is established and resources defined, the coordinator should develop a plan for implementation. As mentioned earlier, many elements of PHM are related and depend on other elements for effective implementation.
IMPLEMENTATION
The first step in developing a PHM program is to conduct an assessment of where the major deficiencies exist. The assessment should include a review of documentation, interviews of key facility staff, and verification of records. The assessment must consider not only whether adequate procedures and documentation exist to satisfy the requirement of API RP 750, but also whether the information is up-to-date and reflects current operation.
Based on this assessment, the necessary resources to correct identified deficiencies can be estimated. These resources include skilled manpower and capital. In some areas, training may be an effective way to develop skills as opposed to hiring new staff.
The cost for implementation of a PHM program can vary considerably among facilities, as indicated by the following estimates. A recent analysis by BP Oil Co. at its Marcus Hook refinery estimated a cost of over 50,000 man-hours to initiate an API RP 750 compliance program and an additional 22,700 man-hours to maintain the program.5
In refineries for which Arthur D. Little has developed RP 750 implementation plans, the required level of effort is about half of that estimated by BP. The complexity of the facility and the current status of its PHM program elements are significant factors in these estimates. Single items can have a major impact on initial costs. For example, the cost of updating piping and instrument drawings for the process hazards analysis could double the cost to conduct the analyses.
The following sections provide guidance on implementation of each of the API RP 750 PHM elements.
PROCESS SAFETY INFORMATION
The heart of the PHM program is the process safety information. Without adequate knowledge of the process and its design basis, potential hazards cannot be adequately identified. Hazards which are not identified cannot be mitigated.
One item we have found missing in many facility programs is a clear definition of critical operating parameters (COPs). A COP is any process parameter where a deviation from the normal operating limits can result in loss of containment of a hazardous material. Thus, any indicators, alarms, or interlocks associated with a COP need to be well defined for inclusion in operating manuals and given priority in the preventive maintenance program.
Another item frequently overlooked is nonconforming equipment. Many facilities were built according to codes and standards which have been modified since their installation. Where the codes and standards have become more restrictive, there needs to be a mechanism for evaluating which equipment is nonconforming and deciding whether modifications are necessary.
The most universal deficiency in this area is keeping piping and instrument drawings (P&IDs) up-to-date. This is a difficult, but not impossible, task. It is, however, a critical component of an effective PHM program. Procedures must be in place to ensure prompt updating of P&IDS.
PROCESS HAZARDS ANALYSIS
Systematic and periodic process hazards analysis is also a major deficiency at most locations. Although it is common to conduct safety reviews of new projects, regular process hazard reviews of existing facilities are rare.
We highly recommend the hazard and operability (Hazop) technique6 for this element. The Hazop is a systematic approach to hazard identification which will readily identify COPs for input into the process safety information element, critical equipment requiring preventive maintenance, and need for changes in operating procedures, emergency procedures, or safe work practices.
Process hazards analysis, if done by a team, also provides considerable insight into the design and operation of the facility, even for more experienced staff. Thus, it can also serve as an effective training tool. Although API RP 750 limits the need for process hazards analysis to those facilities handling highly hazardous materials, it is important to consider associated facilities which could impact these facilities, such as common utilities and units immediately upstream or downstream.
In fact, we feel it is useful to review all process facilities.
For those areas considered less hazardous, the screening and prioritization mechanism could be used to determine which areas could be reviewed using less sophisticated techniques such as "What if?"8
In prioritizing units for PHA, other factors besides potential consequences, such as proximity to populated areas, process complexity (i.e., exothermic reaction), and severe operating conditions, should be considered.
Capital projects also require a process hazards analysis. An effective project safety review procedure should require a series of safety reviews at different stages of design and construction.2 The final review would be a prestart-up safety review.
Hazard identification techniques, including Hazop, allow identification of hazards, but do not assess risk. OSHA would require a consequence analysis of the effects of a potential release on all workplace employees.
Some assessment of risk is necessary in order to prioritize findings so that the valuable resources available to reduce risk are used in a cost effective manner. API RP 750 allows either qualitative or quantitative assessment of likelihood and consequences.
Whereas there are many commercially available software packages to assess potential consequences in a quantitative manner, the availability of quantitative likelihood data is limited. Thus, most facilities should start by using qualitative assessment techniques.7
Some findings may involve a number of failures both mechanical and human. Other findings may be very costly to mitigate.
In these situations, more detailed failure analyses, such as fault tree, may be appropriate to better define failure frequency and define alternative solutions.8
Assessment of risk, whether qualitative or quantitative, is also important in justifying not taking any action in response to PHA findings, if the assessment determines that the risk is acceptable.
MANAGEMENT OF CHANGE
Management of change (MOC) is an element frequently missing from existing facility programs. An important prerequisite of a good procedure is a system for distinguishing between normal maintenance (i.e., replacement in kind), changes carried out by maintenance, and capital project-related changes.
Most organizations have adequate safety review procedures for major capital projects; however, facility level projects involving changes often can be done under maintenance. If the facility has a good mechanism (e.g., via a work authorization system) to identify all projects involving changes and ensure they follow the project design and safety review procedures, the number of other changes requiring formal safety review can be minimized.
The areas which typically are not adequately addressed at most facilities include temporary changes, procedural changes, and changes in operating parameters.
Some changes may require a process hazards analysis, and suitable criteria need to be specified in the MOC procedure.
An effective MOC procedure should also have provisions for updating drawings and procedures to reflect the changes implemented. For this reason it is one of the most critical elements of a PHM program.
OPERATING PROCEDURES
Operating procedures are written for new projects, but rarely updated. As operators are trained and become experienced in the operation of the facilities, the need for operating procedures decreases.
They do serve an important function as a training tool and must be kept up-to-date for no other reason.
Procedures for safety review of capital projects and management of change should require operating procedures to be updated. Nevertheless, a periodic review every 3-5 years is beneficial. This can incorporate more subtle changes in operating philosophy and technique not always captured under formal change procedures, and lessons learned from operating upsets and incidents. OSHA proposes that operating procedures be reviewed as often as necessary to assure they reflect current operating practice.
SAFE WORK PRACTICES
API RP 750 defines a number of critical safe work practices including opening of equipment or piping, lockout and tagout of electrical and mechanical energy sources, work that involves ignition sources, entry into confined spaces, and the use of cranes and similar heavy equipment.
The OSHA-proposed rule addresses only hot work permits specifically. Most of the other items are covered by other OSHA regulations as summarized in Table 1.
We endorse the proposed requirements of API RP 750 and OSHA, but believe a good PHM program should go further. OSHA regulations (29 CFR 1910.179) for cranes address the safety of the equipment, but not the potential of a lift causing damage to equipment or piping containing hazardous materials.
We feel that special lifting procedures should be developed to ensure proper review of lifts over active equipment or piping to determine if the equipment should be shutdown or isolated. If not, the procedure should require a contingency plan for isolation/emergency response in case of damage to the process equipment.
We also feel that there should be a separate procedure to address excavation work from the perspective of preventing accidental damage to underground lines transferring hazardous materials.
Control of raw materials, catalysts, and other process materials is important to ensure that unwanted reactions do not occur in storage tanks or process equipment. These controls are usually in place for catalysts and feedstocks for product quality reasons. However, other process materials such as additives or treatment chemicals do not typically receive the same controls.
The most reliable technique is to sample each container received. In some cases, this is not practical because of the number of the containers or the hazards in taking samples. Suitable alternatives include specification of certified analyses from vendors or use of unique connections to reduce the possibility of hooking up the wrong container to a storage or process vessel.
TRAINING
A common deficiency is lack of, or an inadequate level of, classroom training. Sometimes this occurs because the operating procedures are not up to date. Too often, however, the bulk of operator training is delegated to "on the job," more commonly referred to as the "buddy system."
While field experience is an important element of training, there must be a balance. Classroom training is important to provide the operator with the knowledge of the physical and chemical principals and hazards involved in operation of the facilities, to define design philosophy, and to explain the reasons for operating the equipment in the way specified.
Without this knowledge, which is best done in the classroom, the operator cannot learn to troubleshoot problems as easily and will come to depend more on the process controls and interlocks to prevent upsets.
Use of up-to-date P&IDs and operating procedures as part of the classroom training also ensures that the operator is taught the proper way to operate the equipment. Without this introduction, on the job training can result in poor operating techniques or undesirable shortcuts being passed on to new staff.
Refresher training is rare at most facilities. This type of retraining is particularly important when operators are qualified in a number of jobs but routinely work only one. In this situation, adequate refresher training can be provided by requiring that the operator work his nonroutine jobs for a specified number of shifts each year. A reasonable number of shifts is between 5 and 10.
When major changes are made to facilities, it is important that all qualified operators be trained, not only those normally assigned to that job. OSHA is proposing annual refresher training, whereas API specifies a 3 year interval.
The OSHA proposed rule also includes training certification requirements.
ASSURING QUALITY, INTEGRITY
This element encompasses a quality assurance function during initial design, fabrication, and installation, and a program of preventive maintenance to assure mechanical integrity throughout the useful life of the equipment.
The major weakness in most facilities is a comprehensive preventive maintenance (PM) program.
Whereas some items such as relief valves and critical shutdowns often receive adequate testing and inspection, many other items do not. At a minimum, any indicators, alarms, and interlocks associated with COPs should be included in the PM program.
Other items not specified in API RP 750 which we believe should be included in the PM program are: rupture discs, cathodic protection systems, grounding/bonding systems, tank bottoms, flame arresters/conservation vents, flame detectors, area monitoring devices, heater tubes, and underground piping.
The frequency of testing/ inspection is also critical. Reference 9 provides some typical testing/inspection frequencies. As large integrated refineries extend run times without major shutdowns to 4 or 5 year intervals, provisions need to be designed into the facilities to allow on-line testing and inspection. The results of these tests should also be reviewed so that test intervals can be changed accordingly.
PRESTART-UP REVIEW
A typical project, prestart-up inspection involves a team that reviews the installation for operability and occupational safety concerns. The prestart-up safety review should consist of a review meeting. During this meeting the status of all prior recommendations from process hazards analyses are reviewed; the availability of operating, maintenance, emergency, and safe work procedures are verified; and training of personnel is completed.
It should also include a field inspection that verifies the installation and location of critical safety equipment, vents and drains, means of safe egress, and accessibility of isolation valves.8
EMERGENCY RESPONSE
Emergency action plans are required by current OSHA regulations as listed in Table 1. Despite this requirement, many facilities have significant deficiencies in their plans and equipment requirements. One of the frequent items missing from emergency response plans is a section on hazardous materials emergencies.
Not enough planning is done in defining credible accidents and defining specific actions for isolation and control of such releases. Where plans are in place, drills are not generally conducted to verify the adequacy of those plans.
AUDITING
The last item in any PHM program is the auditing system. It is not unusual to find a limited amount of auditing being done, particularly in the areas of safe work practices and accident/incident investigation.
Although API RP 750 only requires a periodic (3-5 years) audit, an active ongoing internal auditing program is required to ensure an effective PHM program.
The internal program should include personnel who do not work at the facility. In this fashion, the audit will be independent and unbiased. OSHA is proposing a compliance audit every 3 years.
API RP 750, as reflected in the preceding sections, defines the basic requirements for a process hazards management program. It contains most of the elements of a program proposed by OSHA, and should allow any facility which implements the API program facility-wide to be close to full compliance should the proposed OSHA rule become effective in its present form.
The proposed OSHA rule includes only one element on contractor notification and training that is not specifically addressed in API RP 750.
REFERENCES
- "Management of Process Hazards," API Recommended Practice 750, First Edition, American Petroleum Institute, Washington, D.C., January 1990.
- "Guidelines for Technical Management of Chemical Process Safety," Center for Chemical Process Safety, American Institute of Chemical Engineers, New York, 1989.
- "Process Safety Management of Highly Hazardous Chemicals," Notice of Proposed Rulemaking Under 29 CFR 1910.119, U.S. Occupational Safety and Health Administration, Department of Labor, Washington, D.C., July 17, 1990.
- Recommendations for Process Hazards Management of Substances with Catastrophic Potential," Organization Resources Counselors, Washington, D.C., December 1988.
- Kulinski, E.S., "Implementation of the API Recommended Practice Management of Process Hazards," presented at the International Conference and Workshop on Chemical Process Safety Management, Toronto, May 15-18, 1990.
- "A Guide to Hazard and Operability Studies," Chemical Industries Association, London, 1990.
- Stickles, R.P., Ozog, H., and Long, M.H., "Facility Major Risk Survey," presented at the Spring National Meeting of the American Institute of Chemical Engineers, Orlando, Fla., Mar. 18-22, 1990.
- Ozog, H., and Bendixen, L.M., "Hazard Identification and Quantification," Chemical Engineering Progress, April 1987.
- "Guidelines for Safe Storage and Handling of High Toxic Hazard Materials," Center for Chemical Process Safety, American Institute of Chemical Engineers, New York, 1988.
Copyright 1991 Oil & Gas Journal. All Rights Reserved.
