SAFETY & ENVIRONMENT

Oleochemicals: process hazard analysis

Process hazard analysis is onepart of the process safetymanagement program mandated

by the Occupational Safety and HealthAct (OSHA) in regulation 29 CFR1910.1 19. We have two programs: onefor the mandated processes and anoth-er for the remainder.

The objectives of a process hazardanalysis are to protect people. proper-ly and the environment and to complywith the OSHA regulation. This regu-lation requires a complete processsafety management program thatincorporates "a comprehensive andholistic program, integrating tech-nologies. procedures and managementpractices" (I). It is performance-based, rather than permit-based, andwill be an iterative process character-ized by continuous improvement. Theregulations have been in force sinceMay 26, 1992, except for a phase-inperiod for the gathering of processsafety information and for the con-ducting of the process hazard analy-ses. The standard allows broad lati-tude to design and implement systemsand procedures and does not mandatespecific management systems.

The process safety managementprogram has 14 elements (Table I).This paper is about one element, pro-cess hazard analysis, which overlapswith the prestart-up safety review andmanagement of change elements.

OUTimplementation guidelines forthe process safety management pro-gram are to rank and schedule theprocess hazard analyses so that allthose mandated by OSHA are com-plete before May 1997. We identifyand choose the process hazardmethodologies that are appropriatefor our processes and organization.We include the proper expertise onthe review teams, address the processhazards and establish a system oftracking the recommendations. Theregulation requires the company tocertify the process safety manage-ment program every three years andto update and revalidate the processhazard analyses every five years. Thecompany must maintain the processsafety analysis documentation for thelife of the process.

The following arock was writr~n by David M. S/QnIerjohn and Suin Roo ofSherex ChnnicaJ Company Inc" now Q wlrolly owned subsidiary of WtICoCorporation, Mapleton. IUinoU. It is baud on Q preuntotitm giwn dMringthe 1993 AOCS Annual M~~lingand Exposition. Q joint lM~ringwith tlteJapan Oil Chemists' Society, held during May in AnaNim, California.

25% of the process hazard analyses tobe complete by May 1994, 50% byMay 1995,75% by May 1996 and100% complete by May 1997. There-after process hazard analysis must beupdated and revalidated every fiveyears. For those existing processes notmandated by regulation 29 CFR1910.119, we plan to conduct a pro-cess hazard analysis as prioritized bymanagement.

Selection of process hazardanalysis teamsOur firm has chosen a four-personcore committee to plan and supervisethe process hazard analyses. Thiscommittee contains a plant manager,the manager of safety and environ-ment, the manager of process engi-

Table 2A partial list of chemicals found Inoleochemlcal and surtactant plantsand In Appendix A OSHA 29 CFR1910.119

We conduct two types of processhazard analyses: one for changes andnew processes and the other forexisting processes. We conduct aprocess hazard analysis after the pro-cess flow diagram is completebecause the earlier we do the analy-sis the less expensive it is to makechanges. When the process andinstrumentation diagram is complete.we do a second process hazard anal-ysis to review the operation and con-trol concepts, the equipment specifi-cations and the equipment siting. Athird process hazard analysis, theprestart-up review, is done after 90%of the construction is complete butbefore the process starts up.

We ranked the existing processesusing Appendix A to 29 CFR1910.119 that identifies the mandatedprocesses. Table 2 lists a few chemi-cals, which may be found in oleo-chemical or surfactant plants, that areincluded among the 137 chemicalslisted in Appendix A of 29 CFR1910.119. The regulation calls for

Chemicalquantity

Threshold(pounds)Table 1

Elements of process hazardmanagement system Ammonia (anhydrous)

Ammonia (solutions> 44%)Dimethyl amine (anhydrous)Methylamine (anhydrous)Formaldehyde (formalin)Methyl chlorideEthylene oxideAammable liquids or gases

(not fuels)AcrylonitrileIsopropanolEthanolPropylene oxideHydrogenHexaneHeptane

10,00015,0002.5002,5001,000

t5,0005,000

10.000

Employee participationProcess safety informationProcess hazard analysisOperating proceduresTrainingContractorsPrestan-up safety reviewMechanical integrityHot work permitsManagement of changeIncident investigationEmergency planning and responseCompliance auditsTrade secrets

INFORM.Vol. 4. no.12 (Decembef 1993)

1403

1404

SAFETY Be ENVIRONMENT

neering, and a development engineer.The plant manager brings the con-cems and issues of production 10 thecommittee, and the manager of safetyand environment is an expert on theregulations and serves as the corelearn chairperson. The manager ofprocess engineering brings expertiseon engineering code standards. andthe development engineer has the limeand safety experience to participate inmost analyses. The managers under-stand the requirements and limits ofthe process hazard analysis while thedevelopment engineer can provide theconsistency from one review to thenext.The core cornmiuee's responsibili-

ties arc to implement the process safe-ty management program of OSHAregulation 29 CFR 19\0.119, to rec-ommend safety policies and to con-duct the process hazard analyses fornew processes and changes. The corecommittee does nOI do the processhazard analyses for the existing pro-cesses because they are very time-consuming, but one or more membersparticipate in the process hazard anal-yses for existing processes.

Procedure for existing processesAfter identifying the existing process-es that must be reviewed and after pri-oritizing those processes, the coreteam selects a process hazard analysisteam. This team includes at least anengineer (from process, project, plantor maintenance engineering), a linemanager or someone with authority tomake changes, an operator or mainte-nance employee, and a member fromthe core team. The team has four tosix people, and some memberschange. depending on the part of theprocess being analyzed. OSHArequires employee participation. AIleast two team members should bepresent for all team meetings to makethe analyses consistent, and either aprocess engineer or core team memberis the leader. The team leader shouldbe familiar with the process hazardmethod used and trained for leadingthe team.A team member gathers the process

safety information, including genericprocedures, engineering codes, operat-ing procedures, process and Instru-

mentation diagrams. computer pro-gramming documentation, and check-lists. The team leader in consultationwith the core team selects a methodol-ogy. OSHA allows some flexibility inmethodology and specifies only that itbe an appropriate method. We genet-

We generally use a"what-if' method for

changes and thesimpler new processes,and we use checklistsfor existing processesand the complex new

processes.

existing processes and (b) complete atan appropriate time. A team secretaryrecords the minutes of every meetingand files these minutes for the penna-nent documentation. The secretaryrecords observations and suggestionsin the documentation. The team secre-tary lists the recommendations and thepart of the process remaining to bereviewed after each meeting in amemorandum to the appropriate man-agers. A separate committee, the cen-tral safety committee, is responsiblefor verifying the resolution of the rec-ommendations. Documented resolu-tion of the recommendations is anOSHA requirement.

Procedures for new processes andchanges in processesSherex follows a different procedurefor new processes or changes toexisting processes. The OSHA regu-lation requires that the process safetymanagement program specify howchange will be managed. The personwho is spearheading the new processor change, normally a process orplant engineer, requests a processhazard analysis from the chairpersonof the core team. The core teamchairperson schedules a meeting andsends the appropriate information tothe core team. The core team usuallyuses a combination of what-if andchecklist methods to analyze the pro-cess hazards. The core team docu-ments the process hazard analysiswith forms on which the questionsand answers are written. The formsare signed by the person who writesthe answer and the line manager whohas responsibility for operating theprocess. If the answer sufficientlyaddresses the concern or hazard, theperson who asked the question signsthe form. The signatures raise thelevel of commitment to follow theagreed-upon policies and procedures.A new process or change may notstart-up until the questioner indicatesapproval of the answer by signing theform. The core team chairperson filesthe forms at the plant site for the lifeof the process.

The core team conducts theprestart-up safety review the sameway, but includes a walk-throughinspection. The core team ensures that

tNFORM.Vol.4, no.12 (December 1993)

ally use a "what-if" method forchanges and the simpler new process-es, and we use checklists for existingprocesses and the complex new pro-cesses. Other methodologies that areappropriate are Hazard and Operabili-ty Analysis (HAZOP), Failure Modeand Effects Analysis (FMEA) andFault Tree Analysis (FTA). Descrip-tions of these methodologies can befound in Guidelines for Hazard Eval-nation Procedures (2).

At the meetings. the team address-es specific concerns and process haz-ards. The team reviews previous inci-dents, engineering and administrativecontrols, facility siting and human fac-tors. The team evaluates the conse-quences of control failure. includingoperator, management. computer andlocal controls. The hazard analysis isqualitative and need not be quantita-tive to be effective. In general, theteam reaches a consensus as towhether safeguards and number ofcontrol levels are appropriate for aparticular risk. If a consensus is notpossible (and this is rare). the teamrefers (he issue to the next level ofmanagement. The team classifies therecommendations as: (a) completebefore start-up or immediately for

,

1405

the construction is to design specifica-tions and that the safety, operating,maintenance and emergency proce-dures arc adequate and in place. Thecore team checks that employees andcontractors have been trained and thetraining documented and that all theprocess hazard analyses have beenperformed and reccmrnendarionsresolved.

ObservationsTo do a good process hazard analysis,team members need to develop a pes-simistic imagination. They mustdescribe the consequences, assumingthe failure of all controls-even ifcontrol failure is unlikely. You do notneed to quantify fisk to do an effectiveanalysis. The team normally agrees onwhether there are sufficient levels ofcontrol by identifying the conse-quences of control failure.The core team needs to develop

realistic management expectations.Managers unfamiliar with processhazard analyses may assume that theanalyses eliminate risk rather thanreduce it, and they may become impa-tient with the lime required for pro-cess hazard analyses. The objective isto reduce risk because you cannoteliminate it. We recommend that linemanagers attend process hazard analy-ses and that the team leader resched-ule the meetings if the line managerscannot attend because responsibilityfor safety cannot be delegated to theteam. Process hazard analyses willtake more lime than expected. This isespecially true if management atten-dance at the analyses is required or theprocess hazard team leader is new anduntrained.

The teams should not design pro-cesses nor write procedures during theprocess hazard analyses. If team mem-bers design the process, they maybecome defensive and the effective-ness of the review declines. You donot save time by writing the proce-dures and reviewing them simultane-ously and then the analyses is lesseffective. The teams can avoid allow-ing the meeting to become a design orprocedure writing meeting by requir-ing the proper documentation beforescheduling the meeting.

The team leader should limit

meeting times to four hours becausefatigue reduces the effectiveness ofthe analysis. The team leader shouldclearly define the boundaries of theprocess and limit discussion to thatprocess. You can waste much timedoing spontaneous reviews for whichyou do not have the proper docu-mentation. The team leader shouldschedule a regular time each weekfor the review, but remain flexible toget the appropriate people to attend.During the meetings. you may dis-cover weaknesses in control that arecommon to the whole plant. Whenthe process hazard analysis identifiesa weakness common to the plant, thecore team writes a policy designed tostrengthen control of safety. Exam-ples arc local on/off switches thatcan disable a computer control sys-tem, the procedures by which opera-tors acknowledge alarms on the con-trol computers and identification ofcritical alarms vs. informationalalarms.

Operator and maintenance workerinvolvement is important becausethose workers can verify the proce-dures and process controls. Processhazard analyses train operators insafety procedures and communicatehazards to the operators. To discoverhow written procedures may differfrom actual procedures, the teamshould observe the operation beforethe process hazard analysis, ask howthe operators maintain the ongoingintegrity of equipment and proce-dures, and ask "when you are in ahurry, what comers do you cut?"

Checklists work well because theyare more thorough and continue toget better as the team accrues experi-ence although checklists may bemore time-consuming. Process haz-ard analyses have elements of inter-nal audits because many items on thechecklist concern themselves withfollowing safety policies. Examplesare whether the training has beendocumented and whether the engi-neering codes have been followed.The "what-if' methodology can behaphazard and redundant unless theprocess analysis team combines itwith a checklist. "What-if' questionscan be used to get commitment to aprocedure or policy, especially if the

person who answers the question alsosigns the answer form. This buildsmanagement control into the ques-tion/answer form.

The teams must document thereviews well because a process hazardreview on a major process may lastover a year. The documentation mustbe clear enough that nontechnical peo-ple understand it, and it must be com-plete. A problem with long reviews isthat the team expands the checklists asits experience increases, and the earlyreviews may appear incomplete. Werecommend you do not changemethodology during the analysisbecause it is difficult to merge thedocumentation when the team usesmultiple methods.

The core team should divide theresponsibilities for the process safetymanagement program among severalteams. We have four committees tohandle the various responsibilities andpolicy recommendations. The corelearn is responsible for the processhazard analysis. but we have a centralsafety committee, incident investiga-tion committee, an emergencyresponse team, and a test and stan-dards committee. Coordinationbetween committees is facilitated bymembers who are on more than onecommittee.

The company needs to make acommitment to process hazard analy-ses and allocate adequate resourcesfor a successful program. The processsafety management system and imple-mentation program should be wellthought out and planned 10 be efficientand effective. The benefits of a goodprocess hazard analysis are significantin that there is less risk to people,property and environment due to theconduct of process hazard analyses.The consequences of failure may beheavy fines, loss of life and injuries,and some finns may go out of busi-ness.

ReferencesI. Federal Register 57:38601 (1992).2. Guidelines for Hotard Evaluation

Procedures, 2nd edn., Center for theChemical Process Safety, AmericanInstitute of Chemical Engineers,New York. NY. 1992. •

INFORM. Vol. 4, 00.12 (December 1993)