How Effective has OSHA CFR 1910.119 Been? 1

[owg]

In 1992 we started to implement the OSHA Regulation of the Process Safety Management of Highly Hazardous Chemicals. Has anyone seen any papers on the effectiveness of the program? Its been 15 years now and we should have some idea of how it is working.

HAZOP at

http://www.curryhydrocarbons.ca

 

[JLSeagull]

Even if we find statistics, how would we diffentiate direct Process Safety Management changes from related changes. Would you lump all operator and contractor training as well as the SIS equipment into 1919.119? This would be logical but not necessarily correct.

 

[sdl]

From what I have seen, the program is effective for those who choose to follow it. I believe the intent is to create a corporate culture of safety.

I also believe that the biggest issue is enforcement. There are too many facilities and the enforcement agency is forced into reactive mode.

Too many are relying on past history and "it can't happen to me"... complacency.

 

[JLSeagull]

New projects generally provide the segregation between the basic regulatory process control and safety shutdown. This is not the case with the existing plants.

Clearly the existing facilities continue to put off the installing the additional transmitters and separate shutdown systems. This also suggests that less SIL evaluation etc. exists for operating facilities. A study of the BP accident at Texas City reflects this lack of initive within existing plants. Even where new shutdown signals are added, some companies appear to delay providing proper SIS equipment pending a major control systems upgrade. Often the projected upgrade projects just don't happen. Perhaps some existing facilities will put off compliance as long as possible.

Other aspects such as the contractor safety training and access to MSDS etc. are implemented pretty well.

 

[dcasto]

The major chemical plants had a similar program in place way before 1910.119 so they saw no change. It was the smaller and less engineered facilities that were forced into compliance and implimented the program that have seen changes.

 

[JLSeagull]

Where do you rank the Union Carbine plant at Bhopal India and Phillips Chemicals at Pasadena, TX?

http://www.bhopal.com

http://www.hse.gov.uk/comah/sragtech/casepasadena89.htm

 

[dcasto]

Bhopal and Pasadena had not no root cause linked to SIS. Most disasters are the result of more than one failure that includes human intervention. The biggest factor (IMHO) has been the implimentation of training for operators. Investing time with them has so many benefits. Just the fact that bigger plants had to add staff to covering training is allows more time for people to rest, understand, and debate how the plants operate. As an engineer, open discussions (and sometimes stopping them and telling operators NO can be good) lets everyone come away more alert. I'll never let an SIS drive my car or supercede the pilot on a plane I fly in.

As for having segregation between regulatory and safety, not a fan either. I come from an industry the uses SCADA with individual packages on each piece of equipment to control and shutdown. That is true distributed control. No master room where one problem can stop everything.

 

[sdl]

dcasto:

I am more familiar with the Bhopal accident, so my comments will relate to that.

You are correct that the SIS did not cause the accident at Bhopal - it never had a chance to - it was turned off because someone saw a way to save some money. Recommendations for further mitigation measures were not instituted. There were several root causes, as is the case in most accidents, that stem all the way back to the conceptual design stage of that project. Training was an issue as well. All layers throughout the project and facility must work together in order to reduce the likelihood. In this case, if one layer of protection was operating correctly, then the accident could have been avoided. From what I have read, the operators did everything they could to prevent it.

Bhopal is a case where several layers of protection did not work (for varying reasons) at the same time. I have referred to it as an accident but it was a catastrophe that could have been avoided.

One point to note - if you give a human a choice in a stressful and critical moment, odds are he will make the wrong decision. A statistic I heard the other day is that NASA trains their pilots for 3 days straight before a mission and still only expect the correct decision to be made less than 50% of the time.

The single and specific purpose of an SIS is to monitor the process for deviations and place it into a safe state before a catastrophe occurs. I must also state that we should not be putting in SISs at will, they must be considered only after all other avenues have been exhausted. Smaller is definitely better.

There are several reasons for segregation between regulatory and safety systems:
1. Single point of failure
2. Common Cause
3. Regulatory typically do not monitor the circuits and states of safety critical functions. Safety critical functions are dormant - hopefully for years, but we must know that they will work when we need them to.

I know of several SCADA systems that do not provide the level of risk reduction required. I hear of failures in ESD equipment all the time and the owner insists on fixing the symptoms rather than going back to the root cause. If there is an accident on that line, I know that the SCADA system will be a major contributing factor. Because they are not following a PSM program, they turn a blind eye to the possibility of failure. (What to do about it is for a different post - ethics).

One of the root causes of Texas City was operational error that could have been avoided if the safety system was operational. A root cause of the Westray Mine Accident in Canada was owner neglect for applying a layer of protection (dust control). There are numerous others. My point is that while human interaction is important, it cannot be the only layer of protection. We forget, we get distracted, we get tired, we get replaced at the end of a shift, etc. Several layers, as many as possible, need to be in place in case of a failure in one - not just the human factor either.

 

[owg]

Thanks for the discussion. Perhaps the program has not been audited.

HAZOP at

http://www.curryhydrocarbons.ca