Printer Friendly Version

VPP Application Supplement A
(Revised 2014)

Sites Subject to the Process Safety Management (PSM) Standard

VPP applicants whose operations are covered by the Process Safety Management (PSM) Standard must provide responses to each question that is applicable to their operations. Responses must cover all PSM-related operations. Please indicate that a question is "Not Applicable" if it addresses functionality outside the scope of the operations, and briefly explain why.

1. Management of Change.

   1. Within the last six months how many MOCs have been conducted on changes to process chemicals, technology, equipment and procedures, and changes to facilities that affect a covered process?
   2. For the MOC procedures conducted for the unit(s), have the procedures listed the technical basis for the change and ALL potential safety and health impacts of the change prior to its implementation?
   3. From the site's list of MOCs, identify and describe the oldest MOC procedure which might affect the integrity of one or more pressure vessels in the unit(s). Does this MOC procedure(s) meet all 1910.119(l) requirements? Who {job title(s)} determines that all MOC procedures meet the PSM standard requirements?
   4. Does the MOC process address temporary changes as well as permanent changes? For MOCs involving temporary changes with completion times within the last six months, have the temporary changes been removed as scheduled?

2. Pressure Relief System Design.

   1. For each throughput MOC procedure conducted, describe how increased throughput is addressed in the MOC procedure with particular emphasis on relief systems. Has the procedure addressed a review/analysis of the relief system (includes relief devices, relief discharge lines, relief disposal equipment and flare system) to determine if there may be any safety and health impacts due to increased flow as a result of throughput changes which might impact the existing relief system?

      Guidance: An MOC procedure is required anytime a change per the requirements of 1910.119(l) is considered. An MOC procedure is a proactive management system tool used in part to determine if a change might result in safety and health impacts. OSHA's MOC requirement is prospective. The standard requires that an MOC procedure be completed, regardless of whether any safety and health impacts will actually be realized by the change.

   2. After the last change in the throughput in the unit(s), describe how the process hazard analysis (PHA) team addressed the adequacy of the existing relief system design with respect to the increased throughput during the subsequent PHA?

      Guidance: Typically, the PHA team does not do a relief system engineering analysis. However, the PHA team should determine, through proper evaluation and consultation with the engineering/technical staff, if the existing/current engineering analysis of the relief system is adequate for the current/actual unit throughput.

      If the throughput change was implemented between the times the PSM standard became effective (May 26, 1992) and the time the original PHA was required based on the PHA phase-in schedule, the original PHA would need to address the throughput change. However, if there was a throughput change after the original PHA, the relevant process safety information (e.g., relief system design and design basis) would need to be updated and the next PHA update/"redo" or PHA revalidation would need to address the throughput change. In either event, an MOC procedure on the throughput change would need to have been conducted and incorporated into the next scheduled PHA.

   3. Does the site's process safety information (PSI) include the codes and standards used in the design of relief systems? How does the facility document the relief system design and design basis of relief systems?"

      Guidance: This includes the original design and design changes. Examples of PSI related to relief devices, their design and design basis include, but are not limited to such items as:

      1. Identification/descriptor of each relief device;
      2. A listing of all equipment which will be relieved through the device;
      3. Design pressure;
      4. Set pressure;
      5. Listing of all sources of overpressure considered;
      6. Identification of the worst case overpressure scenario or relief design;
      7. State of material being relieved (i.e.,, liquid, vapor, liquid-vapor, liquid-vapor-solid, along with an identification of the material which was the basis for the relief device selection);
      8. Physical properties of the relieved materials, vapor rate, molecular weight, maximum relieving pressure, heat of vaporization, specific gravity and viscosity; and
      9. Design calculations, including pressure relief system sizing (capacity) and hydraulic calculations.

      Similarly, the design and design bases PSI are required for the rest of the relief system equipment downstream from the relief devices, i.e., relief vent lines, manifolds, headers, other relief discharge disposal equipment, such as flare stacks, scrubbers, atmospheric discharge stacks, or thermal oxidizers.

   4. Describe how the PHA addresses malfunctioning or mis-operated intervening valves on the upstream or downstream lines to/from relief devices. (e.g., how does the PHA address the possibility that these valves could be closed during operation, rendering the relief devices non-functional?)

      1. What effective controls are in place to ensure these intervening valves remain open during operations?
      2. What administrative procedure is used to assure these valves are in the open position during operations? Describe how these procedures have been subsequently audited?

   5. Are there open vents which discharge to atmosphere from relief devices? If so, how are employees protected from exposure to vented materials?

   6. Describe the model or analysis methodology used to determine and document that relief devices discharge to a safe location?

      Guidance: PHA teams must address basic questions regarding what happens to the hazardous materials after they are relieved to atmosphere, including:

      1. Are there negative effects on employees or other equipment that could cause another release ("domino effects") of hazardous materials/HHC?
      2. What presumptions or assessments exist to support that there will be no negative effects of an atmospheric release of hazardous materials/HHC?
      3. Are employees near where relief devices discharge, including downwind locations (e.g., on the ground, on platforms on pressure vessels in the vicinity of elevated relief devices, etc.)?
      4. Could a release from a relief device cause a release from other equipment, or could other nearby equipment affect the released material (e.g., a furnace stack could be an ignition source if it is located proximate to an elevated relief device that is designed to relieve flammable materials)?
      5. Relief valves in HHC service are typically equipped with bonnet vent connections that are plugged or vented to a safe location (for conventional relief valves) or open (for bellows sealed valves) How are employees protected against exposure to HHCs due to unplugged vents? How does the site ensure that open vents are routed to safe locations?

      Part of the site's PHA team's evaluation, after it identifies the locations of open vents, is to determine if employees might be exposed when hazardous materials are relieved. If the PHA team concludes that a current and appropriate evaluation (such as the use of dispersion modeling) has been conducted, the evaluation could find that the vessels/vents relieve to a safe location. If the PHA team determines that this hazard has not been appropriately evaluated, the PHA team must request that such an evaluation be conducted, or make some other appropriate recommendation to ensure that the identified hazard/deviation is adequately addressed.

   7. What controls have been implemented to ensure that condensate, rain, and/or ice do not impose a backpressure on or plug the outlet of the RV?

      Compliance Guidance: What controls does the employer use to assure this hazardous condition does not exist?

      PSI documentation (e.g., corporate or facility engineering standards/policies) from the employer addressing this hazardous condition.

      Select four relief devices which discharge to the atmosphere and determine what controls have been implemented and/or specified for this condition. Review the P&IDs to ensure they properly address these issues. Additionally, where this situation exists, does the PHA address this hazard?

      Reference 29 CFR 1910.106(i)(3)(ii) Paragraph UG-134(g), Section VIII of the 1968 ASME Boiler and Pressure Vessel Code - "Discharge lines from pressure-relieving safety devices shall be designed to facilitate drainage or shall be fitted with an open drain to prevent liquid from lodging in the discharge side of the safety device..."

   8. Describe the facility's mechanical integrity program for maintaining inspecting, testing, maintaining, and repairing relief devices which maintain the ongoing integrity of process equipment?

   9. For mechanical integrity issues and deficiencies found with relief devices (e.g., poorly functioning, plugged, or corroded relief valves or visual inspection deficiencies), what are the procedures to address and prevent found deficiencies to ensure safe operation? Please list RAGAGEP used and if applicable, please indicate any deviation from the RAGAGEP.

      Guidance: API 576, Section 6 provides guidance into the inspection of relief devices. Section 6.1.1 states, "Failure of pressure-relieving devices to function properly when needed could result in the overpressure of the vessels, exchangers, boilers, or other equipment they were installed to protect. A properly designed, applied, and installed pressure-relieving device that is maintained in good operating condition is essential to the safety of personnel and the protection of equipment during abnormal circumstances. The principal reason for inspecting pressure-relieving devices is to ensure that they will provide this protection.

      API 576, Section 5 discusses examples of "Causes of Improper Performance". More detail is provided in this section, but a brief overview in Section 5.2.2 states, "There are many causes of damaged valve seats in refinery or chemical plant service, including the following.

      a) Corrosion.
      b) Foreign particles introduced into the valve inlet and pass through the valve when it opens, such as mill scale, welding spatter or slag, corrosive deposits, coke, or dirt. The particles may damage the seat contact required for tightness in most pressure-relief valves. The damage can occur either in the shop during maintenance of the valve or while the valve is in service.
      c) Improper or lengthy piping to the valve inlet or obstructions in the line. These can cause a valve to chatter. The pressure under the seat may become great enough to open the valve. However, as soon as the flow is established, the built-up pressure drop in the connecting piping may be so great that the pressure under the seat falls and allows the valve to close. A cycle of opening and closing may develop, become rapid, and subject the valve seating surfaces to severe hammering, which damages the seating surfaces, sometimes beyond repair.
      d) Careless handling during maintenance, such as bumping, dropping, jarring, or scratching of the valve parts.
      e) Leakage past the seating surfaces of a valve after it has been installed. This leakage contributes to seat damage by causing erosion (wire drawing) or corrosion of the seating surface and thus aggravating itself. It may be due to improper maintenance or installation such as misalignment of the parts, piping strains resulting from improper support, or complete lack of support of discharge piping. Other common causes of this leakage are improper alignment of the spindle, improper fitting of the springs to the spring washers, and improper bearing between the spring washers and their respective bearing contacts or between the spindle and disk or disk holder. Spindles should be checked visually for straightness. Springs and spring washers should be kept together as a spring assembly during the life of the spring. Seat leakage may also result from the operating pressure being too close to the set pressure of the valve.
      f) Improper blowdown ring settings. These can cause chattering in pressure-relief valves. The relief valve manufacturer can be contacted for specific blowdown ring settings for liquid service and for vapor service.
      g) Severe oversizing of the pressure-relief valve for the relief loads encountered can cause the valve to close abruptly, resulting in disc and nozzle seating surface damage."

   10. How does the site verify that flares function properly.

       1. If the flares have not been in-service, list other effective measures used to safely dispose of effluent from the process' pressure relief systems.
       2. Has an MOC procedure been used to evaluate these changes?

   11. Is the flare design and design basis current with the process configuration and throughput? What are the procedures used to evaluate and verify this? When was this operation last evaluated?

3. Vessels.

   1. Describe the internal inspection process and frequency for lined pressure vessels (such as glass or hast alloy-lined)?

   2. What process is used to establish thickness measurement locations (TML) in pressure vessels, and does the site implement that procedure when establishing the TML (Condition Monitoring Locations)?

   3. Describe how the facility inspects for corrosion under insulation (CUI) and the frequency at which the CUI inspection is performed and with what frequency does the site inspect pressure vessels for CUI?

   4. How does the site's MI program address testing (e.g. leak testing) and repair of pressure vessels? Describe how the testing and repair will be conducted. Which personnel are authorized to do the testing and repair, and list the credentials those conducting the testing and repair must have?

      Guidance: API 510 requires in-service pressure vessel tests when the API authorized pressure vessel inspector believes they are necessary.

      Guidance: Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) that require credentials include, but are not limited to:

      1. Credentials for pressure vessel inspectors see API 510, Section 4.2.
      2. RAGAGEP for pressure vessel examiners credentials/experience and training requirements see API 510, Section 3.18.
      3. RAGAGEP for contractors performing NDE are the training and certification requirements ASNT-TC-1A, see CCPS, Section 10.3.2.1, (In-service Inspection and Testing) Nondestructive Examination.
      4. RAGAGEP for qualifications for personnel who conduct pressure vessel repairs, alteration and rerating including qualifications for welders, see API 510, Section 7.2.1 and the BPVC, Section IX.
      5. RAGAGEP for certifications at CCPS, Section 5.4 Certifications, Table 5-3, Widely Accepted MI Certifications, and Table 9-13, Mechanical Integrity Activities for Pressure Vessels.

   5. Describe any deficiencies found during pressure vessel inspections in the last 3 years? List the specific deficiencies and describe how they were resolved.

      Guidance: A deficiency (reference 29 CFR 1910.119 (j)(5)) means a condition in equipment or systems that is outside of acceptable PSI limits. In the case of a pressure vessel, this could mean degradation in the equipment/system exceeding the equipment's acceptable limits (e.g., operating a vessel, tank or piping with a wall thickness less than its retirement thickness).

   6. Choose three pressure vessel operating procedures and list the safety systems that are described in the procedures.

      Guidance: Examples of safety systems include but are not limited to: emergency relief systems including relief devices, disposal systems and flares; automatic depressurization valves; remote isolation capabilities, aka emergency isolation valves; safety-instrumented-systems (SIS) including emergency shutdown systems and safety interlock systems; fire detection and protection systems; deluge systems; fixed combustible gas and fire detection system; safety critical alarms and instrumentation; uninterruptible power supply; dikes; etc.

   7. For the past three years, describe changes to pressure vessels or other equipment changes that could affect pressure vessel integrity such as a change to more corrosive feed, a change in the type of flange seal material used for the vessel heads or nozzles, etc.,? Include the MOC date and number completed prior to implementing the change?

4. Piping.

   1. In what process documents can the following information be found?

      1. The original thickness measurements for all piping
      2. The locations of subsequent thickness measurements
      3. The dates subsequent thickness measurements were taken
      4. The results of the subsequent thickness measurements

   2. Describe how the facility resolves anomalous pipe measurement data (such as increasing thickness at a TML/CML)

   3. What method(s) is used to monitor pipe wall thickness and calculate remaining service life and inspection intervals?

   4. Has each product piping been classified according to the consequences of its failure?

      Guidance: If the employer (site) inspects and tests all piping the same, regardless of the consequence of failure of the piping (i.e., piping inspections are implemented using the same MI program (1910.119(j)(2) and action/task (1910.119(j)(4) procedure for all piping without consideration of their consequence of failure or other operational criteria), then this question is not applicable.

   5. Based on a review of piping inspection records for the last three years, list any piping deficiencies that are documented and explain how each deficiency was addressed.

      Guidance: An example of a piping deficiency would be a situation where piping inspection data indicates that its actual wall thickness is less than its retirement thickness, and the site has conducted no other evaluation to determine if the piping is safe for continued operation.

   6. What process is used to ensure that replacement piping is suitable for its process application?

      Guidance: Typically, piping replacements are replacements-in-kind (RIK) when the process service does not change. However, if the piping replacement is not an RIK, then an MOC procedure is required.

   7. As a part of the site's MI procedure what qualifications are required for piping inspectors and welders who weld process piping? What factors determine the need for "qualified welders" and the use of qualified welding procedures?

   8. Where is information located that indicates the original installation date for each section of piping and how is it catalogued?

   9. List criteria/steps to be followed as part of the MI procedure when establishing TML for injection points in piping circuits?

5. Operating Procedures – Normal Operating Procedures (NOP), Emergency Shutdown Procedures (ESP) and Emergency Operations (EOP).

   1. Are there established process operating procedures, including: normal operating procedures (NOP), emergency operating procedures (EOP), and emergency shutdown procedures (ESP)? If so, how does the facility document normal, temporary, and emergency operations in its written procedures?

   2. Are operating procedures implemented as written How does the facility ensure that operating procedures are implemented as written?

   3. How does the facility specify the conditions that require an emergency shutdown?

      Guidance: ESP are usually warranted during events that may include the failure of process equipment (e.g., vessels, piping, pumps, etc.) to contain or control HHC releases, loss of electrical power, loss of instrumentation or cooling, fire, explosion, etc. When EOP do not succeed during upset or emergency conditions in returning the process to a safe state, implementation of an ESP may be necessary.

      When normal operating limits for parameters such as pressure, temperature, level, etc., are exceeded during an excursion, system upset, abnormal operation, etc., a catastrophic release can occur if appropriate actions are not taken. These actions must be listed in the EOP and must specify the initiating conditions or the operating limits for the EOP (e.g., temperature exceeds 225oF or pressure drops below 15 psig).

      Information typically listed in EOP and/or ESP includes, but is not limited to the responsibilities for performing actions during an emergency, required PPE, additional hazards not present during normal operations, consequences of operating outside operating limits, steps to shutdown the involved process in the safest, most direct manner, conditions when operators must invoke the emergency response plan, or scenarios when they themselves must stop and evacuate.

   4. How does the facility determine that control board operators received sufficient training, initial and refresher, to be qualified to shutdown the units? Where can the training documentation be found?

   5. Where (in what documents) does it specify that qualified operators are assigned authority to shutdown the unit(s)?

   6. Are qualified control board operators authorized or permitted to initiate an emergency shutdown of the unit without prior approval?

   7. How do you, as an employer, ensure that operating procedures are implemented as written?

6. PHA, Incident Investigation, and Compliance Audits Findings/Recommendations.

   Have all corrective actions from PHA, incident investigations, MOCs, and compliance audits been corrected in a timely manner and documented? Provide a list of all outstanding corrective actions, the date of corrective initiation, the projected completion dates, and the interim measures that are being taken to protect workers during the corrective action period

   Guidance: There may be instances when a PHA team identifies deficiencies in equipment/systems reference 29 CFR 119(j)(5). If the site continues to operate the deficient equipment/system, list interim measures reference 29 CFR 119(j)(5) to assure safe operation, and also 119(e)(5) requirements to resolve the findings and recommendations related to the identified deficiency.

   The phrase from 119(j)(5), "safe and timely manner when necessary means are taken to assure safe operation", when taken in conjunction with 119(e)(5) means that when a PHA team identifies a deficiency in equipment/systems and the site does not correct the deficiency before further use, your system for promptly addressing the PHA team's findings and recommendations must assure: 1) that the recommendations are resolved in a timely manner and that the resolutions are documented; 2) that you have documented what actions are to be taken, not only to resolve the recommendation, but to assure safe operation until the deficiency can be corrected; 3) that you complete actions as soon as possible; and 4) that you have developed a written schedule describing when corrective actions related to the resolution and any interim measures to assure safe operations will be completed.

   The system that promptly addresses and resolves findings and recommendations referred to in both 1910.119(e)(5) and 1910. 119(m)(5) are not requirements to develop a management program for globally addressing the resolution of findings and recommendations. Rather, these "system" requirements address how each specific finding and recommendation will be individually resolved (Hazard Tracking requirement under VPP). Each finding or recommendation will have its own unique resolution based on its nature and complexity.

7. Facility Siting/Human Factors.

   1. How does the PHA address facility siting of all occupied structures? What methodology does the facility use for its analysis?

      Guidance: Facility siting considerations for occupied structures include both permanent and temporary (e.g., trailers) structures.

      Global/generic facility siting questionnaires/checklists. Some employers (PHA teams) attempt to comply with this 1910.119(e)(3)(v) requirement by answering global/generic facility siting questions on a short questionnaire/checklist. PSM is a performance standard and the means the site uses to comply with the standard are generally up to them as long as their performance ensures compliance with the requirement of the standard. If the site uses a questionnaire/checklist as part of the PHA to identify, evaluate and control all hazards associated with facility siting, this is permissible as long as the method used complies with the PHA methodology requirement, and, more importantly, all facility siting hazards have been addressed (i.e., identified, evaluated and controlled). Does the siting study / PHA evaluate and document the application of each question / checklist item to the specific process under review? Do the questions / checklist items comprehensively address siting hazards in the process?

      For example, a PHA team responds "Yes" to a questionnaire/checklist asking, "Is process equipment located near unit battery limit roads sited properly?" based on this example it would first be expected that the PHA team would have identified each location where process equipment is sited near a unit battery limit road. Next, it would be expected that you would have evaluated each piece of process equipment located in the vicinity of a roadway. This evaluation is conducted to determine if each of the specific process equipment's siting is adequate/controlled (e.g., guarded by crash barriers, elevated on a concrete pedestal, etc.) to protect it from releasing its hazardous contents should it be struck by vehicular traffic. Without specific justification or other specific evidence that corroborates the site's "Yes" response to this global/generic questionnaire/checklist question, a possible regulatory issue could exist for failing to address process equipment siting near roadways when it conducted its PHA.

      Guidance: Occupancy Criteria Evaluations for Employee Occupied Structure. OSHA does not accept occupancy criteria evaluations as the basis for a site's determination that adequate protection has been provided for employees in occupied structures which sites have identified as being potentially subject to explosions, fires, ingress of toxic materials or high energy releases. In these occupancy criteria evaluations, the site identifies vulnerable employee occupied structures and the hazards they may be subjected to, but rather than providing protection to either the structures or employees through measures like employee relocation, spacing, or protective construction, the site simply accepts the employee exposures as adequate based on their own acceptable occupancy criteria. This occupancy criteria evaluation is solely based on the occupancy threshold criteria a site is willing to accept. For instance, API 752 list occupancy threshold criteria used by some companies as 400 personnel hours per week as acceptable exposure for employees in an occupied structure, regardless of the magnitude of the hazard these employees are potentially exposed to. The 400 personnel hours per week equates to 2 employees continually exposed in an occupied structure even if that structure has virtually no protective construction and it is sited immediately adjacent to a high pressure-high temperature reactor which contains flammable or extremely toxic materials.

      Non-Essential Employees. A site's PHA facility siting evaluation must consider the presence of non-essential personnel in occupied structures in or near covered processes. The "housing" of these non-essential employees in occupied structures near operating units may expose them to explosion, fires, toxic material, or high energy release hazards. Therefore, unlike direct support/ essential personnel (e.g., operators, maintenance employees working on equipment inside a unit, field supervisors, etc.) who are needed to be located in or near operating units for logistical and response purposes, sites (PHA teams) must consider and justify why non-essential employees are required to be located in occupied structures which are vulnerable to the hazards listed above. The term "non-essential" identifies those employees who are not needed to provide direct support for operating processes. Non-essential employees include, but are not limited to, administrative personnel, laboratory employees when they are working inside a lab, maintenance staff when they are working inside maintenance shops/areas, and employees attending training classes.

      Guidance: An example of how a temporary structure could affect a release of HHC would include a situation where a trailer's unclassified electrical system could potentially ignite flammable materials/unconfined vapor cloud if released from the process.

   2. Does the PHA team(s) identify and evaluate all situations where operators are expected to carry out a procedure to control an upset condition, but where the operators would not have enough time to do so based on operating conditions?

   3. Does the PHA team(s) identify and evaluate all situations where field employees must close isolation valves during emergencies, but where doing so would expose the employees to extremely hazardous situations? For example, to isolate a large inventory of flammable liquids, a downstream manual isolation valve would need to be closed, but the isolation valve is located in an area that could be consumed by fire.

      Guidance: Some sites (PHA teams) attempt to comply with this requirement by simply addressing some global/generic human factors questions on a short questionnaire/checklist. This type of methodology would not, by itself, be adequate if the PHA team did not have specific justifications for each of its global/generic responses.

      For example, if a PHA team responds "Yes" to a questionnaire/checklist asking whether emergency isolation valves (EIV) are accessible during emergencies, OSHA would then expect that the PHA team had identified, evaluated, and considered each EIV's accessibility ( i.e., would the EIV be located in an area that might be consumed in fire, or is the EIV located above grade).

   4. How do the PHA teams identify likely human errors and their consequences? What measures have been taken (or put in place) to reduce the frequency and consequences of these errors?

8. Operator Training.

   1. How does the facility train operating employees on the procedures and tasks each is expected to perform?

      Guidance: An "A" operator might be required to perform a different set of operating procedures than a "C" operator. Therefore, to determine if the employee has in fact been trained on the specific operating procedures they are expected to perform, cross-reference the specific procedures that an individual operator is expected to perform with the training records of the specific procedures for which the individual operator has received training. Also determine if operators perform tasks more than what is expected for their level of training.

   2. As an employer how do you determine that control board operators in the units, have received sufficient training, initial and refresher, to be qualified to shutdown the units per the requirements of 119(f)(1)(i)(D)?

   3. Based on your management of operator refresher training, how do you verify that operating employees received, completed, and understood the refresher training? For each employee who operates a process, how have you ensured that the employee understands and adheres to the current operating procedures? Additionally, what criteria are used to determine the necessary frequencies for refresher training if needed more often than the required three years?

9. Safe Work Practices.

   1. Describe a safe work practice in place for motorized equipment to enter operating units and adjacent roadways?

      Guidance: "Motorized equipment" includes, but is not limited to automobiles, pickup trucks, fork lifts, cargo tank motor vehicles (CTMV), aerial lifts, welder's trucks, etc.

   2. Describe the safe work practices/procedures audit process for opening process equipment, vessel entry, and the control of entrance to a facility or covered process area?

   3. Describe the safe work practice for linebreaking and opening process equipment, e.g. piping and vessels?

   4. How does the site ensure that their employees and contractor employees follow the practices referred to from Question C?

10. Incident Investigation Reports.

    Provide a list of incidents and near-miss incidents that occurred at the site within the last year. Describe the facility's process for uncovering causal factors. Have all factors that contributed to each of the incidents been reported and investigated?

    Guidance: An "actual incident" is defined as an incident with negative consequences such as a large HHC release, employee injuries or fatality, or a large amount of property or equipment damage. Typically, based on loss-control history, there is a much higher ratio of near-miss incidents in the chemical processing and refining industries than there are actual incidents.

11. Blowdown Drums and Vents Stacks (Blowdowns).

    1. What processes in your facility use blowdowns? If used, where can one locate the original design and design basis for each blowdown at the site?

       Guidance: Blowdown(s) – refers to a piece of disposal equipment in a pressure-relieving system whose construction consists of a drum to collect liquids that are separated ("knockout") from vapors and a vent stack, which is an elevated vertical termination discharging vapors into the atmosphere without combustion or conversion of the relieved fluid. Blowdown(s) are separate vessels intended to receive episodic (e.g., when de-inventorying a vessel for a planned shutdown) or emergency discharges. Blowdown(s) are designed to collect liquids and to dispose of vapors safely. In the refinery industry, hydrocarbons typically enter blowdown(s) as liquids, vapors, or vapors entrained with liquids. Blowdown(s) typically include quench fluid systems which reduce the temperature of hot, condensable hydrocarbons entering the blowdown as well as the amount of vapor released via the vent stack. These systems can include internal baffles to help disengage liquids from hydrocarbon vapors. Sometimes, blowdown(s) include inert gas or steam systems to control flashback hazards and to snuff vent stack fires if ignited by sources such as lightning

       Examples of PSI related to blowdowns, their design and design basis include, but are not limited to, such items as:

       1. Physical and chemical properties of the materials relieved to blowdowns (See API STD 521, Section 6.2.1);

          Guidance: Of particular concern are heavier-than-air hydrocarbons with relatively low boiling points. Additionally, hot hydrocarbons pose a greater risk because they are more volatile. Releasing these materials under the right conditions can result in the formation of unconfined vapor clouds which can and have resulted in major catastrophes at refineries and chemical plants.

       2. A definition of the loadings to be handled (See API STD 521, Section 7.1);
       3. The exit velocity of gasses/vapors released from the vent stack (See API STD 521, Section 7.3.4);
       4. Design basis/"worst-case" scenario for maximum liquid – vapor release to blowdown (See API STD 521, Section 4.5.j and 7.1.3);
       5. When more than one relief device or depressuring valve discharges to a blowdown, the geographic locations of those devices and valves must be defined (See API STD 521, Section 4.4.q. and 7.2.3);
       6. The design residence time of vapor and liquid in the drum (See API STD 521, Section 7.3.2.1.2);
       7. The design basis for the vapor – liquid separation for the drum;
       8. The design basis for the exit velocities for the vent stack; and
       9. The nature of other, lesser hazards related to smaller releases not related to the design "worst-case" scenario such as the release of toxic (e.g.,, H2S) and corrosive chemicals.

    2. Since the original installation of the blowdowns, have the original design and design basis conditions remained the same? How is it determined that the blowdown design and capacity are still adequate?

       Guidance: Examples of conditions that may have changed since the original design and installation of the blowdowns include: increased throughput in the unit(s) that relieve to the blowdowns; additional relief streams routed to the blowdown, blowdowns originally designed only to handle lighter-than-air vapor emissions from their stacks have had liquids or other heavier-than-air releases emitted from their vent stacks; additional equipment, a new unit, or occupied structures have been sited near the blowdowns in a manner that was not addressed in the original design or design basis, etc.

    3. Did the PHA identify all scenarios where hot, heavier-than-air, or liquid hydrocarbons might be discharged from blowdown stacks to the atmosphere?

    4. How do you document and demonstrate that atmospheric discharges from blowdowns are to safe locations? What determines if a location is considered safe from atmospheric discharges from blowdowns?

       Guidance: Other structures such as control rooms, trailers, offices, motor control centers, etc., must be considered in a PHA to determine if they have been sited in a safe location that might be affected by a hydrocarbon or toxic material release from a blowdown. Unsafe locations can include, but are not limited to, the location of equipment which could act as an ignition source, such as a furnace stack; an employee platform on a column where employees would be exposed in the event of a release; a control room; a satellite building; a trailer; a maintenance area/shop; an emergency response building; an administration building; a lunch or break room; etc.

    5. If there is a high-level alarm in the blowdown drum, is there an MI procedure for calibrating, inspecting, testing and maintaining the instrument/control?

       Guidance: The data must include the date of the inspection or test, the name of the person who performed the inspection or test, the serial number or other identifier of the equipment on which the inspection or test was performed, a description of the inspection or test performed, and the results of the inspection or test.

    6. How do you determine if blowdown operators received appropriate training, either initial or refresher?