Process Safety Management: What Engineers Actually Need to Know

# Process Safety Management: What Engineers Actually Need to Know

> Occupational safety prevents slips, trips, and falls. Process safety prevents explosions that kill 15 people and destroy a $200 million plant. They are not the same thing.

---

In 2005, a hydrocarbon vapor cloud explosion at BP’s Texas City refinery killed 15 workers and injured 180. The immediate cause was an overfilled distillation tower. The root cause? BP had excellent occupational safety metrics (low injury rates) and assumed that meant their process safety was good. It wasn’t.

OSHA’s Process Safety Management (PSM) standard (29 CFR 1910.119) and EPA’s Risk Management Program (RMP) were created to prevent exactly this. Here’s what process engineers actually need to understand — beyond the regulatory text.

---

The 14 Elements of PSM (And Which Ones Actually Prevent Accidents)

OSHA lists 14 elements. In practice, three matter more than all others combined:

Critical Three:

1. Process Hazard Analysis (PHA/HAZOP)

This is where you identify what can go wrong. A properly run HAZOP asks four questions for every node:

– What can go wrong? (deviation)

– What are the causes?

– What are the consequences?

– Are existing safeguards adequate?

The #1 HAZOP failure mode: rushing through nodes to “get it done.” A 60-node HAZOP can’t be done properly in 2 days. Schedule 4–5 days. The cost of the extra days ($20,000–40,000) is negligible compared to missing a scenario that could cause a $50 million incident.

2. Management of Change (MOC)

The single most important PSM element. Every major accident investigation finds that an un-reviewed change contributed to the incident. MOC requires formal review and authorization before:

– Changing process chemicals or catalysts

– Changing equipment or piping (even “like-for-like” — verify it’s truly identical)

– Changing operating conditions outside the established safe envelope

– Changing control system logic or safety instrumented system (SIS) settings

– Organizational changes that affect process safety expertise

The most dangerous words in process safety: “It’s just a small change.”

3. Mechanical Integrity (MI)

Your PHA and MOC systems can be perfect, but if the pressure vessel with 10 tons of flammable liquid has a corroded wall that’s lost 40% of its thickness, none of that paperwork matters.

MI requires:

– Written inspection and test procedures for all PSM-covered equipment

– Inspection frequency based on damage mechanisms (corrosion rate, fatigue, creep)

– Qualified inspectors (API 510 for vessels, API 570 for piping, API 653 for tanks)

– Tracking and trending of inspection data (wall thickness, vibration, relief valve test dates)

– Corrective action when inspection finds deficiencies (NOT “we’ll fix it next turnaround”)

---

Supporting Eleven (Important but Not as Critical):

4. Employee Participation — Workers must be involved in PHAs and have access to PSM information

5. Process Safety Information — Documented hazards of chemicals, technology, and equipment

6. Operating Procedures — Written, current, and actually followed (not sitting in a binder)

7. Training — Initial, refresher (every 3 years), and documented

8. Contractors — They must be trained on your site’s hazards. Their injury rates count on YOUR record.

9. Pre-Startup Safety Review (PSSR) — Before introducing hazardous chemicals after construction or major modification

10. Hot Work Permit — Welding, cutting, grinding near covered process equipment

11. Emergency Planning & Response — Written plan, trained personnel, annual drills

12. Incident Investigation — Within 48 hours, root cause analysis, track corrective actions to closure

13. Compliance Audits — Every 3 years, by someone independent of the facility

14. Trade Secrets — Can’t use trade secret claims to withhold safety information

---

What’s “PSM-Covered”?

OSHA’s PSM standard applies to processes containing hazardous chemicals above threshold quantities. The key thresholds:

Chemical	Threshold Quantity	Why It Matters
Flammable liquids/gases	10,000 lbs (4,536 kg)	Almost every chemical plant, refinery, and many battery electrolyte facilities
Ammonia (anhydrous)	10,000 lbs	Refrigeration systems, SCR/SNCR
Chlorine	1,500 lbs	Water treatment, chemical manufacturing
Hydrogen sulfide (H₂S)	1,500 lbs	Refineries, biogas, some mining
Hydrofluoric acid (HF)	1,000 lbs	Alkylation units, semiconductor etching
Formaldehyde	1,000 lbs	Resin manufacturing

The common surprise: Lithium battery electrolyte solvents (DMC, EMC, DEC) are flammable liquids. A battery plant with electrolyte storage and mixing may have >10,000 lbs of flammable material and fall under PSM. Most battery plants don’t realize this. If you’re building a battery factory with a central electrolyte supply system, check your total flammable inventory.

---

Safety Instrumented Systems (SIS) — The Last Line of Defense

Per IEC 61511, Safety Instrumented Functions (SIFs) are classified by Safety Integrity Level (SIL):

SIL	Probability of Failure on Demand (PFD)	Risk Reduction Factor	Example
SIL 1	0.01 – 0.1	10–100	Tank overfill prevention (non-HHC)
SIL 2	0.001 – 0.01	100–1,000	High pressure trip on reactor
SIL 3	0.0001 – 0.001	1,000–10,000	Furnace fuel gas shutdown on flame failure
SIL 4	<0.0001	>10,000	Extremely rare in process industry (usually redesigned to reduce risk)

The rule: Don’t assign SIL 3 unless you must. SIL 3 requires redundant sensors, redundant logic solvers, redundant final elements, and rigorous proof testing. A SIL 3 SIF costs 3–10× more than SIL 2. Most applications are satisfied with SIL 1 or 2.

The most common SIS failure: The sensor, not the logic solver. A 2oo3 (2 out of 3) voting pressure transmitter configuration with diverse sensor types is far more reliable than a single transmitter feeding a TÜV-certified SIL 3 logic solver.

---

Layers of Protection Analysis (LOPA)

LOPA is a semi-quantitative risk assessment method that sits between HAZOP (qualitative) and full QRA (quantitative). For each hazard scenario identified in the HAZOP:

1. Estimate initiating event frequency (per year)

2. Identify Independent Protection Layers (IPLs)

3. Assign Probability of Failure on Demand (PFD) to each IPL

4. Calculate mitigated event frequency

5. Compare to tolerable frequency target

Typical PFD values for IPLs:

Protection Layer	PFD	Notes
Basic Process Control System (BPCS)	0.1	NOT an IPL unless specifically designed and maintained as one
Operator response (with >10 min available)	0.1	Must have clear alarm and written procedure
Operator response (with >40 min available)	0.01
Pressure relief valve	0.01	Single valve. Redundant valves = 0.0001
SIL 1 SIF	0.01
SIL 2 SIF	0.001
SIL 3 SIF	0.0001
Dike/bund (containment)	0.001	Assumes proper sizing and drainage
Gas detection + operator response	0.01	Depends on detector coverage and response time

The rule for IPL independence: Two protection layers can’t share a common cause failure. A BPCS alarm and an operator response to that same alarm are NOT independent — they share the sensor and the BPCS logic solver. You can’t claim both.

---

What Engineers Get Wrong About PSM

1. Confusing occupational safety with process safety. Low injury rates don’t mean low process risk. Measure leading indicators: overdue inspection findings, overdue MOC action items, PHA recommendations not implemented.

2. Not updating PHAs after changes. A 5-year PHA revalidation cycle is required. But if you make a significant change (new chemistry, new equipment, new operating limits), you need to update the PHA immediately — not wait for the 5-year cycle.

3. Assuming the relief system is adequate. Relief system design basis should be revalidated every 5 years OR whenever process conditions change. I’ve seen plants where the relief valve was sized for a fire case 20 years ago, but the vessel now contains a different chemical with different thermodynamics.

4. Writing procedures nobody reads. Operating procedures should be concise, task-specific, and written with operator input. If the procedure is 200 pages of dense text in a binder, it’s not a safety document — it’s shelf weight.

---

PSM isn’t paperwork. It’s a systematic way to ensure that when something goes wrong (and it will), the failure is contained, detected, and mitigated before anyone gets hurt. Every PSM element exists because someone died when it was missing.

---