Process Safety Management & Risk Management Planning Overview

1. Process Safety Management & Risk Management Planning Overview Tulsa Chapter ASSE Meeting May 20, 2009 by Lee Jarman & Tom Faherty (The Williams Companies)

2. Objective (What is this all about?) • Provides a general background to Process Safety Management and Risk Management Planning • Is not an in-depth discussion of PSM

3. PSM Background • PSM is a result of significant process industry incidents, for example: • 1984 Bhopal, India, Chemical Release and Fatalities • 1985, Institute, West Virginia chemical plant incident (evacuations of local communities, no fatalities) • 1989 Pasadena, Texas, chemical plant explosion, 23 deaths and over 100 confirmed injuries • Congressional pressure, concerns over protecting the Public and workers • OSHA PSM rules issued 1992, EPA RMP Rules issued 1996

4. Ammonium Nitrate Explosion Oppau, Germany – Sept. 21, 1921 Photo shows crater and destruction at plant following explosion. At 7:30 a.m. on September 21, 1921, two powerful explosions occurred at the BASF plant in Oppau, Germany. Hazardous material: Ammonium sulfate & ammonium nitrate (50/50) Facility type: fertilizer manufacturing Deaths: 430-530 (differing numbers on reported fatalities)

5. Ammonium Nitrate ExplosionTexas City, Texas – April 16, 1947 This aerial photograph , looking south over Monsanto Chemical Co., was taken about 30 minutes following the blast of the ship S. S. GRANDCAMP during loading of ammonium nitrate. The accident damaged more than 90% of the city's buildings and killed nearly 600 people. Source: Fire Prevention And Engineering Bureau Of Texas

6. Cyclohexane Release & ExplosionFlixborough, England – June 1, 1974 20” bypass piping fabricated on-site from shop stock. This pipe ruptured and released Cyclohexane which exploded. Source: UK Health and Safety Executive, Hazardous Installations Directorate On June 1, 1974 the Nypro Co. site at Flixborough, England was severely damaged by a large explosion. Twenty-eight workers were killed and a further 36 suffered injuries. It is recognized that the number of casualties would have been more if the incident had occurred on a weekday, as the main office block was not occupied. Offsite consequences resulted in fifty-three reported injuries. Property in the surrounding area was damaged to a varying degree.

7. Seveso, Italy - 1976 The Seveso accident happened in 1976 at a chemical plant manufacturing pesticides and herbicides. A dense vapor cloud containing tetrachlorodibenzoparadioxin (TCDD – dioxin) was released from a reactor, used for the production of trichlorofenol. Commonly known as dioxin, this was a poisonous and carcinogenic by-product of an uncontrolled exothermic reaction. Although no immediate fatalities were reported, kilogram quantities of the substance lethal to man even in microgram doses were widely dispersed which resulted in an immediate contamination of some ten square miles of land and vegetation. More than 600 people had to be evacuated from their homes and as many as 2,000 were treated for dioxin poisoning. This lead to the European “Seveso Directive” to try to prevent similar incidents.

8. Methyl Isocyanate Tank Rupture and ReleaseBhopal, India – Dec. 2-3, 1984 Source: United Nations Environment Programme Photo Source: Indian state government of Madhya Pradesh On the night of December 2-3, 1984, a sudden release of about 30 metric tons of methyl isocyanate (MIC) occurred at the Union Carbide pesticide plant at Bhopal, India. The accident was a result of poor safety management practices, poor early warning systems, and the lack of community preparedness. The accident led to the death of over 2,800 people (other estimates put the immediate death toll as high as 8000) living in the vicinity and caused respiratory damage and eye damage to over 20,000 others. At least 200,000 people fled Bhopal during the week after the accident. Estimates of the damage vary widely between $350 million to as high as $3 billion.

9. Bhopal Aftermath Water entered tank 610 in foreground of picture reacting with MIC and caused an uncontrolled release of a vapor cloud. Bhopal flare tower with corroded and missing section of pipe.Plant enclosed by fence in foreground.

10. Mexico City ExplosionNovember 19, 1984 • 1984 – Mexico City, Mexico –Explosion • 300 fatalities(mostly offsite) • $20M damages HAZARD: Flammable LPG in tank

11. Phillips 66 Houston Chemical Complex Pasadena, Texas – Oct. 23, 1989 On October 23, 1989, at approximately 1:00 p.m., an explosion and fire ripped through the Phillips 66 Company Houston Chemical Complex in Pasadena, Texas. Twenty-three workers were killed and more than 130 were injured. Property damage was nearly three-quarters of a billion dollars. The accident resulted from a release of extremely flammable process gases that occurred during regular maintenance operations on one of the plant's polyethylene reactors. The evidence showed that more than 85,000 pounds of highly flammable gases were released through an open valve. A vapor cloud formed and traveled rapidly through the polyethylene plant. Within 90 to 120 seconds, the vapor cloud came into contact with an ignition source and exploded with the force of 2.4 tons of TNT. This event and the Bhopal disaster triggered the development of the PSM standard

12. Equilon Refinery Accident • Equilon Oil Refinery – Anacortes, WA • November 25, 1998 • Multiple Fatalities – 6 workers killed This was the worst worker fatality incident in the history of Washington State. The tragic incident illustrates the critical importance of developing and implementing the management systems that form the core of your facilities’ process safety programs.

13. Ammonium Nitrate ExplosionToulouse, France – September, 21 2001 Accident occurred exactly 80 years after the Oppau, Germany disaster! A huge explosion ripped through AZF (Azote de France) fertilizer factory in an industrial zone on the outskirts of Toulouse, southwest of France, at 10:15 am, Friday September 21, 2001. Immediately after the accident, 30 people were reported dead The total number of injuries was said to be 2,442. More than 350 people were in the plant at the time (266 AZF employees and 100 subcontractors). The explosion had occurred in a warehouse in which granular ammonium nitrate was stored flat, separated by partitions. The amount is said to be between 200 to 300 metric tons of ammonium nitrate, which is used to make fertilizers. A spokesman for the Interior Ministry in Paris ruled out a criminal attack, saying the explosion had been caused by an accident following an "incident in the handling of products". The exact cause remains unknown. Source: United Nations Environment Programme

14. Legislative, Agency Actions • Clean Air Act of 1990 required OSHA and EPA to issue regulations • OSHA Process Safety Management (PSM) regulations first published in 1990, effective 1992 • EPA Risk Management Program (RMP) regulations published in 1992, effective in 1996.

15. Legislative, Agency Actions (Continued) • Clean Air Act of 1990 authorized an independent investigation agency • U.S. Chemical Safety and Hazard Investigation Board (CSB) established in 1998 • The CSB Mission: • “The CSB conducts root cause investigations of chemical accidents at fixed industrial facilities… The agency does not issue fines or citations, but does make recommendations to plants, regulatory agencies such as the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA), industry organizations, and labor groups. Congress designed the CSB to be non-regulatory and independent of other agencies so that its investigations might, where appropriate, review the effectiveness of regulations and regulatory enforcement.” (CSB website, www.csb.gov)

16. Since 1992 PSM Program Implementation Incidents resulting in various levels of investigation from Federal agencies, such as: • Repeated incidents at site of 1989 explosion in Pasadena, Texas • Refinery and Chemical Plant incidents in Los Angeles and San Francisco Bay Area of California in 1996, 1998 • Creation of the Chemical Safety Board (CSB) • BP Amoco Texas City Incidents 2004, 2005, 2007, 2008 • BP Refinery Incidents in Illinois, New Jersey • Valero Refinery Incidents, 2006, 2007 • Total Fina Refinery Explosion, Borger/Amarillo, Texas, 2008 • Etc.

17. OSHA Response • Current emphasis program to inspect chemical facilities for PSM compliance • Refinery emphasis inspection program underway • Chemical processing facilities are next in cue • Other petroleum processing facilities to be inspected under the program • Congress considering additional mandates

18. OSHA PSM Program Goals • Targets protecting workers, on-site personnel • OSHA list of Highly Hazardous Chemicals focused on immediate, on-site hazards • Seeks implementation across chemical processing industry of key findings from incident investigations • Requires maintaining documents and records as long as the life of the process • Is a “performance-based” standard, identifies minimum program expectations

19. EPA RMP Program Goals • Primarily concerned with preventing off-site consequences, short- and long-term • Separate list of chemicals of concern (primarily airborne materials) • Adopted or referenced OSHA PSM as basis of program • Requires submitting various documents, plans and updates to the agency

20. U. S. Chemical Safety and Hazard Investigation Board • Established to investigate chemical incidents, independent of OSHA and EPA investigations • CSB selects which chemical or process incident to investigate based on public, worker impacts • CSB does not have authority to fine or issue citations • CSB investigations do not have maximum lengths, and can take as long as the Board thinks appropriate to conduct an investigation • CSB is required to hold public hearings on progress of investigation and possible findings • CSB is required to publish final reports identifying root causes, industry and agency gaps, maintain these in forums such as the CSB website, and to present these to Congress • PSM, RMP documents and programs are a primary basis for investigations at chemical and oil & gas facilities. • Office in Washington D.C, opening a second in Denver, CO in 2008/9

21. U. S. Chemical Safety and Hazard Investigation Board http://www.chemsafety.gov/index.cfm

22. Agency Investigation Triggers • CSB can select which incidents to investigate, EPA and OSHA have specific regulatory requirements for conducting incident investigations • OSHA: Deaths, multiple hospitalizations, significant facility evacuations, significant fires and explosions, worker complaints • EPA/State Environmental Authority: Release of regulated substances above specified levels, impacts to water resources, land impacts, third party evacuations, public complaints • CSB: Can investigate any fixed facility incident with public or worker impact, including those investigated by EPA, OSHA, DOT, plus those with other significant public attention

23. Note regarding process to develop regulations • Usually developed as result of incident investigation, Congressional order, court order, public pressure • Usually are based on an existing industry standard (API, ANSI, ASTME, or consensus boards) • Are modified after public review and comment (activist groups, court actions, union and industry groups, legislatures, etc.) • Are not easily changed once in place

24. 14 Key Elements of PSM • Employee Participation Plan • Process safety Information (Documentation of the process) • Process Hazard Analysis • Operating procedures • Operator Training • Contractor Evaluation and Selection • Pre-Start-Up Safety Reviews

25. 14 Key Elements of PSM (continued) • Mechanical Integrity Program • Hot Work Permitting Process • Management of Change • Incident Investigation • Emergency Planning and Response • PSM Compliance Audits • Control of Trade Secrets

26. Employee Participation • Employee involvement in hazard review • Employee participation in incident investigations • Communications of findings from hazard reviews, incident investigations, audits, change processes (MOC), to affected workers

27. Process Safety Information • List of specific documents, records to be maintained • Must be available for hazard reviews, investigations, training, etc. • Must be updated when impacted by MOC, other modifications

28. Process Safety Information • Information pertaining to the hazards of the highly hazardous chemicals in the process. This information shall consist of at least the following: • 1910.119(d)(1)(i) Toxicity information; • 1910.119(d)(1)(ii) Permissible exposure limits; • 1910.119(d)(1)(iii) Physical data; • 1910.119(d)(1)(iv) Reactivity data: • 1910.119(d)(1)(v) Corrosivity data; • 1910.119(d)(1)(vi) Thermal and chemical stability data; and • 1910.119(d)(1)(vii) Hazardous effects of inadvertent mixing of different materials that could likely occur.

29. PSI regarding the process technology • Information concerning the technology of the process shall include at least the following • 1910.119(d)(2)(i)(A) A block flow diagram or simplified process flow diagram (see Appendix B to this section); • 1910.119(d)(2)(i)(B) Process chemistry; • 1910.119(d)(2)(i)(C) Maximum intended inventory; • 1910.119(d)(2)(i)(D)Safe upper and lower limits for such items as temperatures, pressures, flows or compositions; and, • 1910.119(d)(2)(i)(E) An evaluation of the consequences of deviations, including those affecting the safety and health of employees. • 1910.119(d)(2)(ii)Where the original technical information no longer exists, such information may be developed in conjunction with the process hazard analysis in sufficient detail to support the analysis.

30. PSI regarding the process equipment • 1910.119(d)(3) Information pertaining to the equipment in the process. • 1910.119(d)(3)(i) Information pertaining to the equipment in the process shall include: • 1910.119(d)(3)(i)(A) Materials of construction; • 1910.119(d)(3)(i)(B)Piping and instrument diagrams (P&ID's); • 1910.119(d)(3)(i)(C)Electrical classification; • 1910.119(d)(3)(i)(D)Relief system design and design basis; • 1910.119(d)(3)(i)(E) Ventilation system design; • 1910.119(d)(3)(i)(F) Design codes and standards employed; • 1910.119(d)(3)(i)(G) Material and energy balances for processes built after May 26, 1992; and, • 1910.119(d)(3)(i)(H)Safety systems (e.g. interlocks, detection or suppression systems).

31. OSHA PHA Requirements • The process hazard analysis shall address: • 1910.119(e)(3)(i) The hazards of the process; • 1910.119(e)(3)(ii) The identification of any previous incident which had a likely potential for catastrophic consequences in the workplace; • 1910.119(e)(3)(iii) Engineering and administrative controls applicable to the hazards and their interrelationships such as appropriate application of detection methodologies to provide early warning of releases. (Acceptable detection methods might include process monitoring and control instrumentation with alarms, and detection hardware such as hydrocarbon sensors.);

32. PHA Requirements(Continued) • The process hazard analysis shall address: • 1910.119(e)(3)(iv) Consequences of failure of engineering and administrative controls; • 1910.119(e)(3)(v) Facility siting; • 1910.119(e)(3)(vi) Human factors; and • 1910.119(e)(3)(vii) A qualitative evaluation of a range of the possible safety and health effects of failure of controls on employees in the workplace.

33. PHA Process Goals • Systematic Reviews of new, existing and modified processes • Requires participation by persons operating, maintaining process (“intimate knowledge”) • Requires participation by a technical expert • Includes an evaluation of health and safety impacts • Facilitated by person trained in method used

34. PHA Methods Acceptable to OSHA • What-If; • Checklist; • What-If/Checklist; • Hazard and Operability Study (HAZOP); • Failure Mode and Effects Analysis (FMEA); • Fault Tree Analysis; or • An appropriate equivalent methodology.

35. Example of PSM Elements that can be impacted by a PHA • Process Safety Information (Documentation of the process) • Operating procedures • Operator Training • Pre-Start-Up Safety Reviews • Mechanical Integrity Program • Emergency Planning and Response • PSM Compliance Audits

36. PHA Methods typically used in Williams Midstream and E&P • HAZOP: Hazard and Operability Study • What if / Checklist? • Facility Siting Checklist • Human Factors Checklist • Hazard Screening Review Checklist: Applies to minor changes conducted under MOC

37. Training • Initial operations training • 3-year recertification for operators • Task or function specific training for persons performing mechanical integrity functions. • Document that training has been conducted • Management Of Change requires training prior to a person operating a modified process initially

38. Contractors • Contractor selection process • Contractor review process • Contractor employee training on hazards of process • Company (Williams) and contractor (contract firm) duties and responsibilities • Contract operator/maintenance training

39. Pre-start-up Safety Reviews Requirement for new and modified processes and equipment. • 1910.119(i)(1) The employer shall perform a pre-startup safety review for new facilities and for modified facilities when the modification is significant enough to require a change in the process safety information. • 1910.119(i)(2) The pre-startup safety review shall confirm that prior to the introduction of highly hazardous chemicals to a process: • 1910.119(i)(2)(i) Construction and equipment is in accordance with design specifications; • 1910.119(i)(2)(ii) Safety, operating, maintenance, and emergency procedures are in place and are adequate; • 1910.119(i)(2)(iii)For new facilities, a process hazard analysis has been performed and recommendations have been resolved or implemented before startup; and modified facilities meet the requirements contained in management of change, paragraph (l). • 1910.119(i)(2)(iv) Training of each employee involved in operating a process has been completed.

40. Mechanical Integrity Program • Applies to a list of specific types of components listed in regulations (basically, any piece of process equipment) • Written procedures, including testing schedule • Training programs • Inspection and testing records (date, item, inspector, what found, what corrected) kept for life of process or equipment

41. Hot Work Permit Specifically identified in PSM rule • 1910.119(k)(1) The employer shall issue a hot work permit for hot work operations conducted on or near a covered process. • 1910.119(k)(2) The permit shall document that the fire prevention and protection requirements in 29 CFR 1910.252(a) have been implemented prior to beginning the hot work operations; it shall indicate the date(s) authorized for hot work; and identify the object on which hot work is to be performed. The permit shall be kept on file until completion of the hot work operations.

42. Management of Change • 1910.119(l)(1) The employer shall establish and implement written procedures to manage changes (except for "replacements in kind") to process chemicals, technology, equipment, and procedures; and, changes to facilities that affect a covered process.

43. Incident Investigation • Requires that all incidents resulting in or which could have resulted in a release of a PSM material be investigated promptly, with the investigation beginning not later than 48 hours after the incident. • The team must include at least one person knowledgeable in the process (usually an operator or maintenance person), a contractor employee is a contract firm was involved, and other experts as appropriate.

44. Emergency Planning and Response • Requires a facility to develop and maintain an emergency response plan for major events and for handling small or minor events. • References other emergency response plan regulations and training requirements • A PHA recommendation can affect this plan by identifying a potential incident scenario

45. Compliance Audits • Certification that an audit has been conducted is required at least every 3 years • Audit meant to verify that all PSM elements are in place and are up to date • At least 2 audits must be available

46. Trade Secrets Employers may identify and maintain trade secrets. However: • 1910.119(p)(1)Employers shall make all information necessary to comply with the section available to those persons responsible for compiling the process safety information (required by paragraph (d) of this section), those assisting in the development of the process hazard analysis (required by paragraph (e) of this section), those responsible for developing the operating procedures (required by paragraph (f) of this section), and those involved in incident investigations (required by paragraph (m) of this section), emergency planning and response (paragraph (n) of this section) and compliance audits (paragraph (o) of this section) without regard to possible trade secret status of such information. • Employers may require and enforce non-disclosure requirements on company and contract personnel who have access to or using information designated as trade secrets.

47. Example of “Disposable” PSM Records (OSHA) • Incident Investigation Reports (minimum of 5 years) • PSM Audit Reports (minimum of last 2) • Hot Work Permits Always check Williams policies before disposing of any records

48. Example of “Evergreen” Records • Documentation that is to be kept current and updated • Process Safety Information Files • Process Technology Files • Procedures • Training files • Contractor Evaluation and Selection Files

49. Example of “Permanent” PSM Records (OSHA) Kept for the life of the process or equipment • All equipment inspection records • All PHA Reports • All Equipment Files (until equipment is disposed of permanently) • MOC-related files (become part of permanent equipment/process record of changes or modifications)

50. PSM vs. EPA Risk Management Plans(RMP) • Different chemical list and Threshold Quantities (TQ) for some chemicals. e.g., Chlorine 1500 lbs. (PSM) v. 2500 lbs. (RMP) • EPA requires hazard assessments that include analyses of the “worst case” accident consequences. • EPA requires preparation of written risk management plans to document the risk management program. The plans must be submitted to designated agencies and will be available to the public. • Risk Management Plans must be registered with the EPA. The principal areas in which the requirements of the EPA differ from the OSHA Rule are: