The VPP Application Supplement for Sites Subject to the Process Safety
Management (PSM) Standard has been submitted to the Office of Management
and Budget (OMB) for review under the Paperwork Reduction Act of 1995.
No person may be required to respond to, or may be subject to a penalty
for failure to comply with, this supplement until it has been approved.

The public may submit comments on this application as well as other VPP
information collection requirements at
[http://www.reginfo.gov](http://www.reginfo.gov/). You may also obtain
an electronic copy of the complete Voluntary Protection Information
Collection Request (ICR) at this website. Click on \"Inventory of
Approved Information Collections, Collections Under Review, Recently
Approved/ Expired,\" then scroll under \"Currently Under Review\" to
Department of Labor (DOL) to view all of the DOL\'s ICRs, including
those ICRs submitted for extensions. To make inquiries, or to request
other information, contact Mr. Todd Owen, OSHA, Directorate of Standards
and Guidance, Room N-3609, U.S. Department of Labor, 200 Constitution
Avenue, NW., Washington, DC 20210; telephone (202) 693-2222.

**VPP Application Supplement**

**for**

**Sites Subject to the Process Safety Management (PSM) Standard**

VPP applicants whose operations are covered by the Process Safety
Management (PSM) Standard must provide responses to each question that
is applicable to their operations. Responses must cover all PSM-related
operations. Please indicate that a question is "Not Applicable" if it
addresses functionality outside the scope of the operations, and briefly
explain why.

I. [Management of Change]{.underline}**.**

A.  Has the throughput changed from its original design rate? Has the
    site conducted a management of change (MOC) procedure for each
    throughput change since May 26, 1992?

B.  For the MOC procedures conducted for the unit(s), has the procedure
    listed the technical basis for the change and ALL potential safety
    and health impacts of the change prior to its implementation?

C.  From the site's list of MOCs, identify the oldest MOC procedure
    which might affect the integrity of one or more pressure vessels in
    the unit(s). Do these MOC procedures meet all 1910.119(l)
    requirements?

D.  Does the MOC process address temporary changes as well as permanent
    changes?

E.  Have MOCs been conducted on all changes to process chemicals,
    technology, equipment and procedures, and changes to facilities that
    affect a covered process?

II\. [Relief Design]{.underline}.

A.  For each throughput MOC procedure conducted, has the procedure
    addressed a review/analysis of the relief system (includes relief
    devices, relief discharge lines, relief disposal equipment and flare
    system) to determine if there may be any safety and health impacts
    due to increased flow as a result of throughput changes which might
    impact the existing relief system?

> *Guidance:* *An MOC procedure is required anytime a change per the
> requirements of 1910.119(l) is considered. An MOC procedure is a
> proactive management system tool used in part to determine if a change
> might result in safety and health impacts. OSHA's MOC requirement is
> prospective. The standard requires that an MOC procedure be completed,
> regardless of whether any safety and health impacts will actually be
> realized by the change.*

B.  After a change in the throughput in the unit(s), did the process
    hazard analysis (PHA) team consider the adequacy of the existing
    relief system design with respect to the increased throughput during
    the next PHA?

> *Guidance: Typically, the PHA team does not do a relief system
> engineering analysis. However, the PHA team should determine, through
> proper evaluation and consultation with the engineering/technical
> staff, if the existing/current engineering analysis of the relief
> system is adequate for the current/actual unit throughput.\
> *\
> *If the throughput change was implemented between the time the PSM
> standard became effective (May 26, 1992) and the time the original PHA
> was required based on the PHA phase-in schedule, the original PHA
> would need to address the throughput change. However, if there was a
> throughput change after the original PHA, the next PHA update/"redo"
> or PHA revalidation would need to address the throughput change. In
> either event, an MOC procedure on the throughput change would need to
> have been conducted and incorporated into the next scheduled PHA.*

C.  Does the site\'s process safety information (PSI) include the codes
    and standards used in the design of relief systems?

D.  Does the site's PSI include the relief system design and design
    basis?

> *Guidance: This includes the original design and design changes.
> Examples of PSI related to relief devices, their design and design
> basis include, but are not limited to such items as:\
> *

1.  *Identification/descriptor of each relief device;*

2.  *A listing of all equipment which will be relieved through the
    device;*

3.  *Design pressure;*

4.  *Set pressure;*

5.  *Listing of all sources of overpressure considered;*

6.  *Identification of the worst case overpressure scenario or relief
    design;*

7.  *State of material being relieved (i.e.,, liquid, vapor,
    liquid-vapor, liquid-vapor-solid, along with an identification of
    the material which was the basis for the relief device selection);*

8.  *Physical properties of the relieved materials, vapor rate,
    molecular weight, maximum relieving pressure, heat of vaporization,
    specific gravity and viscosity; and*

9.  *Design calculations.*

> *Similar design and design bases PSI are required for the rest of the
> relief system equipment downstream from the relief devices, i.e.,
> relief vent lines, manifolds, headers, other relief disposal
> equipment, and flare stack.*

E.  Are there intervening valves on the upstream or downstream lines
    to/from relief devices? If so, does the PHA consider the possibility
    that these valves could be closed during operation, rendering the
    relief devices non-functional?

F.  If there are intervening valves on the upstream or downstream lines
    to/from relief devices, does the site have effective controls in
    place to ensure these intervening valves remain open during
    operations?

G.  If there are intervening valves on the upstream or downstream lines
    to/from relief devices, is there an administrative procedure (e.g.,
    car-seal procedure) to assure these valves are in the open position
    during operations? If so, has this procedure been subsequently
    audited?

H.  Are there open vents which discharge to atmosphere from relief
    devices? If so, has the PHA considered whether these relief devices
    discharge to a safe location?

> *Guidance: PHA teams must address basic questions regarding what
> happens to the hazardous materials after they are relieved to
> atmosphere, including:\
> *

1.  *Are there negative effects on employees or other equipment that
    could cause another release ("domino effects") of hazardous
    materials/HHC?*

2.  *What presumptions or assessments exist to support that there will
    be no negative effects of an atmospheric release of hazardous
    materials/HHC?*

3.  *Are employees near where relief devices discharge, including
    downwind locations (e.g., on the ground, on platforms on pressure
    vessels in the vicinity of elevated relief devices, etc.)?*

4.  *Could a release from a relief device cause a release from other
    equipment, or could other nearby equipment affect the released
    material (e.g., a furnace stack could be an ignition source if it is
    located proximate to an elevated relief device that is designed to
    relieve flammable materials)?*

> *Part of the site's PHA team's evaluation, after it identifies the
> locations of open vents, is to determine if employees might be exposed
> when hazardous materials are relieved. If the PHA team concludes that
> a current and appropriate evaluation (such as the use of dispersion
> modeling) has been conducted, the evaluation could find that the
> vessels/vents relieve to a safe location. If the PHA team determines
> that this hazard has not been appropriately evaluated, the PHA team
> must request that such an evaluation be conducted, or make some other
> appropriate recommendation to ensure that the identified
> hazard/deviation is adequately addressed.*

I.  Does the site have a mechanical integrity (MI) procedure for
    inspecting, testing, maintaining, and repairing relief devices which
    maintains the ongoing integrity of process equipment?

J.  Does the process use flares? If so, verify that the flares have been
    in-service/operational when the process has been running. If the
    flares have not been in-service, has the site used other effective
    measures to relieve equipment in the event of an upset? Has an MOC
    procedure been used to evaluate these changes?

III\. [Vessels]{.underline}.

A.  Do pressure vessels which have integrally bonded liners, such as
    strip lining or plate lining, have an MI procedure which requires
    that the next scheduled inspection after an on-stream inspection be
    an internal inspection?

B.  Does the site have an MI procedure for establishing thickness
    measurement locations (TML) in pressure vessels, and does the site
    implement that procedure when establishing the TML?

C.  Does the site have an MI procedure for inspecting pressure vessels
    for corrosion-under-insulation (CUI), and does the site inspect
    pressure vessels for CUI?

D.  Does the site's MI procedure address testing (e.g. leak testing) and
    repair of pressure vessels? For example, does the MI procedure
    indicate how the testing and repair will be conducted and which
    personnel are authorized to do the testing and repair, including
    what credentials those conducting the testing and repair must have?

> *Guidance*: *API 510 requires in-service pressure vessel tests when
> the API authorized pressure vessel inspector believes they are
> necessary*.\
> \
> *Guidance: Recognized and Generally Accepted Good Engineering
> Practices (RAGAGEP) that require credentials include, but are not
> limited to:*

1.  *Credentials for pressure vessel inspectors, see API 510, Section
    4.2.\
    *

2.  *RAGAGEP for pressure vessel examiners credentials/experience and
    training requirements, see API 510, Section 3.18.\
    *

3.  *RAGAGEP for contractors performing NDE are the training and
    certification requirements ASNT-TC-1A, see CCPS, Section 10.3.2.1,
    (In-service Inspection and Testing) Nondestructive Examination.\
    *

4.  *RAGAGEP for qualifications for personnel who conduct pressure
    vessel repairs, alteration and rerating including qualifications for
    welders, see API 510, Section 7.2.1 and the BPVC, Section IX.\
    *

5.  *RAGAGEP for certifications at CCPS, Section 5.4 Certifications,
    Table 5-3, Widely Accepted MI Certifications, and Table 9-13,
    Mechanical Integrity Activities for Pressure Vessels.*

```{=html}
<!-- -->
```
E.  Were any deficiencies found during pressure vessel inspections? If
    so, how were they resolved?

> *Guidance: A deficiency (as per 1910.119 (j)(5)) means a condition in
> equipment or systems that is outside of acceptable PSI limits. In the
> case of a pressure vessel, this could mean degradation in the
> equipment/system exceeding the equipment's acceptable limits (e.g.,
> operating a vessel, tank or piping with a wall thickness less than its
> retirement thickness).*

F.  Do the operating procedures for pressure vessels list the safety
    systems that are applicable to the vessels?

> *Guidance: Examples of safety systems include but are not limited to:
> emergency relief systems including relief devices, disposal systems
> and flares; automatic depressurization valves; remote isolation
> capabilities, aka emergency isolation valves;
> safety-instrumented-systems (SIS) including emergency shutdown systems
> and safety interlock systems; fire detection and protection systems;
> deluge systems; fixed combustible gas and fire detection system;
> safety critical alarms and instrumentation; uninterruptible power
> supply; dikes; etc.*

G.  Have there been any changes to pressure vessels or other equipment
    changes that could affect pressure vessel integrity, such as a
    change to more corrosive feed, a change in the type of flange seal
    material used for the vessel heads or nozzles, etc.,? If so, was an
    MOC procedure completed prior to implementing the change?

IV\. [Piping]{.underline}.

A.  Is there information in the MI piping inspection procedures or other
    PSI that indicates the original thickness measurements for all
    piping sections?

B.  Is there information in the MI piping inspection procedures or other
    PSI that indicates the locations, dates and results of all
    subsequent thickness measurements?

C.  Is there anomalous data that has not been resolved for any piping?
    (For example, the current thickness reading for a TML indicates the
    pipe wall thickness is greater/thicker than the previous reading(s)
    with no other explanation as to how this might occur.)

D.  Has each product piping been classified according to the
    consequences of its failure?

> *Guidance: If the site inspects and tests all piping the same,
> regardless of the consequence of failure of the piping (i.e., piping
> inspections are implemented using the same MI program (1910.119(j)(2)
> and action/task (1910.119(j)(4) procedure for all piping without
> consideration of their consequence of failure or other operational
> criteria), then this question is not applicable.*
>
> E. Based on a review of piping inspection records, have all identified
> piping deficiencies been addressed?
>
> *Guidance: An example of a piping deficiency would be a situation
> where piping inspection data indicates that its actual wall thickness
> is less than its retirement thickness, and the site has conducted no
> other evaluation to determine if the piping is safe for continued
> operation. For a discussion on equipment deficiencies the definition
> of deficient/deficiency.*
>
> F. How does the site ensure that replacement piping is suitable for
> its process application?
>
> *Guidance: Typically, piping replacements are replacements-in-kind
> (RIK) when the process service does not change. However, if the piping
> replacement is not an RIK, then an MOC procedure is required.*
>
> G. Does the site's MI procedure list required piping inspectors'
> qualifications, welders' qualifications for welding on process piping,
> and when qualified welding procedures are required?
>
> H. Is there information in the MI piping inspection procedures or
> other PSI that indicates the original installation date for each
> section of piping?
>
> I. Is there information in the MI piping inspection procedures or
> other PSI that indicates the specifications, including the materials
> of construction and strength levels for each section of piping?
>
> J. Does the site's MI procedure for piping inspections list
> criteria/steps to be followed when establishing TML for injection
> points in piping circuits?

V. [Operating Procedures -- Normal Operating Procedures (NOP), Emergency
Shutdown Procedures (ESP) and Emergency Operations (EOP)]{.underline}.

A.  Are there established operating procedures, including: normal
    operating procedures (NOP), emergency operating procedures (EOP),
    and emergency shutdown procedures (ESP)?

B.  Are operating procedures implemented as written?

C.  Are there ESP for the all Unit(s), and if so, do these ESP specify
    the conditions that require an emergency shutdown?

> *Guidance: ESP are usually warranted during events that may include
> the failure of process equipment (e.g., vessels, piping, pumps, etc.)
> to contain or control HHC releases, loss of electrical power, loss of
> instrumentation or cooling, fire, explosion, etc. When EOP do not
> succeed during upset or emergency conditions in returning the process
> to a safe state, implementation of an ESP may be necessary.\
> \
> When normal operating limits for parameters such as pressure,
> temperature, level, etc., are exceeded during an excursion, system
> upset, abnormal operation, etc., a catastrophic release can occur if
> appropriate actions are not taken. These actions must be listed in the
> EOP and must specify the initiating conditions or the operating limits
> for the EOP (e.g., temperature exceeds 225^o^F or pressure drops below
> 15 psig).*
>
> *\
> Information typically listed in EOP and/or ESP includes, but is not
> limited to the responsibilities for performing actions during an
> emergency, required PPE, additional hazards not present during normal
> operations, consequences of operating outside operating limits, steps
> to shutdown the involved process in the safest, most direct manner,
> conditions when operators must invoke the emergency response plan, or
> scenarios when they themselves must stop and evacuate.*

D.  Have control board operators received sufficient training, initial
    and refresher, to be qualified to shutdown the units?

E.  Does the ESP specify that qualified operators are assigned authority
    to shutdown the unit(s)?

F.  Are qualified control board operators authorized or permitted to
    initiate an emergency shutdown of the unit without prior approval?

G.  Do EOP procedures identify the "entry point," i.e., the
    initiating/triggering conditions or operating limits when the EOP is
    required, the consequences of a deviation from the EOP, and the
    steps required to correct a deviation/upset once the operating
    limits of the EOP have been exceeded?

H.  Do NOP list the normal operating limits or "exit points" from NOP to
    EOP; the steps operators should take to avoid deviations/upsets; and
    the precautions necessary to prevent exposures, including
    engineering and administrative controls and PPE?

> *Guidance: For NOP, the \"operating limits\" required are those
> operating parameters that if they exceed the normal range or operating
> limits, a system upset or abnormal operating condition would occur
> which could lead to operation outside the design limits of the
> equipment/process and subsequent potential release. These operating
> parameters must be determined by the site and can include, but are not
> limited to, pressure, temperature, flow, level, composition, pH,
> vibration, rate of reaction, contaminants, utility failure, etc.\
> \
> It is at the point of operation outside these NOP \"operating limits\"
> that EOP procedures must be initiated. There may be a troubleshooting
> area defined by the site\'s EOP where operator action can be used to
> bring the system upset back into normal operating limits. During this
> troubleshooting phase, if an operating parameter reaches a specified
> level and the process control strategy includes automatic controls,
> other safety devices (e.g., safety valves or rupture disks) or
> automatic protection systems (e.g., safety instrumented
> systems/emergency shutdown systems), would activate per the process
> design to bring the process back to a safe state. Typically, once the
> predefined limits for troubleshooting have been reached for a
> particular operating parameter, the process has reached a \"never
> exceed limit\". A buffer zone is typically provided above( and below
> if applicable) the trouble shooting zone (\"never exceed limit\") to
> ensure the operating parameters do not reach the design safe upper or
> lower limit of the equipment/process. This design safe upper and lower
> limits of the equipment or process are also known as the boundaries of
> the design operating envelope or the limit above (or below) which it
> is considered unknown or unsafe to operate. Once the operating
> parameter(s) reach the buffer zone entry point, there is no designed
> or intentional operator intervention (i.e., troubleshooting) to bring
> the process system upset back to a safe state. Any intervention in the
> buffer zone is as a result of the continued activation of the safety
> devices and automatic protection systems which initially activated at
> the predefined level during the troubleshooting phase. All of these
> predefined limits are important information for operators to know and
> understand and must be included in the PSI and operating procedures.*

I.  Are operating procedures implemented as written?

VI\. [PHA, Incident Investigation, and Compliance Audits
Findings/Recommendations]{.underline}.

A.  Have all corrective actions from PHA, incident investigations, MOCs,
    and compliance audits been corrected in a timely manner and
    documented? Provide a list of all outstanding corrective actions,
    the date of corrective initiation, and the projected completion
    dates.

> *Guidance: There may be instances when a PHA team identifies
> deficiencies in equipment/systems which would violate the requirements
> of 119(j)(5) if left uncorrected. If the site continues to operate the
> deficient equipment/system, they must take interim measures per
> 119(j)(5) to assure safe operation, and they must also meet the
> 119(e)(5) requirements to resolve the findings and recommendations
> related to the identified deficiency.\
> \
> The phrase from 119(j)(5), "safe and timely manner when necessary
> means are taken to assure safe operation", when taken in conjunction
> with 119(e)(5) means that when a PHA team identifies a deficiency in
> equipment/systems and the site does not correct the deficiency before
> further use, the site's system for promptly addressing the PHA team\'s
> findings and recommendations must assure: 1) that the recommendations
> are resolved in a timely manner and that the resolutions are
> documented; 2) the site has documented what actions are to be taken,
> not only to resolve the recommendation, but to assure safe operation
> until the deficiency can be corrected; 3) that the site complete
> actions as soon as possible; and 4) that the site has developed a
> written schedule describing when corrective actions related to the
> resolution and any interim measures to assure safe operations will be
> completed.*
>
> *The system that promptly addresses and resolves findings and
> recommendations referred to in both 1910.119(e)(5) and 1910. 119(m)(5)
> are [not]{.underline} requirements to develop a management program for
> globally addressing the resolution of findings and recommendations.
> Rather, these "system" requirements address how each specific finding
> and recommendation will be individually resolved (Hazard Tracking
> requirement under VPP). Each finding or recommendation will have its
> own unique resolution based on its nature and complexity.*

B.  Has the PHA incorporated all the previous incidents since May 26,
    1992 which had a likely potential for catastrophic consequences?

VII\. [Facility Siting/Human Factors]{.underline}.

A.  Does the PHA consider the siting of all occupied structures?

> *Guidance: Facility siting considerations for occupied structures
> include both permanent and temporary (e.g., trailers) structures.*
>
> *\
> [Global/generic facility siting
> questionnaires/checklists]{.underline}. Some employers (PHA teams)
> attempt to comply with this 1910.119(e)(3)(v) requirement by answering
> global/generic facility siting questions on a short
> questionnaire/checklist. PSM is a performance standard and the means
> the site uses to comply with the standard are generally up to them as
> long as their performance ensures compliance with the requirement of
> the standard. If the site uses a questionnaire/checklist as part of
> its PHA to identify, evaluate and control all hazards associated with
> facility siting, this is permissible as long as the method they used
> complies with the PHA methodology requirement, and, more importantly,
> [all]{.underline} facility siting hazards have been addressed (i.e.,
> identified, evaluated and controlled). This questionnaire/checklist
> type of methodology would not be compliant if the site (PHA team) did
> not have specific justifications for each individual
> situation/condition that the global/generic questions addressed.\
> \
> For example, a PHA team responds \"Yes\" to a questionnaire/checklist
> asking, "Is process equipment located near unit battery limit roads
> sited properly?" In this case, OSHA would first expect that the site
> (PHA team) would have [identified]{.underline} [each]{.underline}
> [location]{.underline} where process equipment is sited near a unit
> battery limit road. Next, OSHA would expect the site would have
> [evaluated]{.underline} [each]{.underline} piece of process equipment
> located in the vicinity of a roadway. This evaluation is conducted to
> determine if [each]{.underline} of the specific process equipment's
> siting is adequate/[controlled]{.underline} (e.g., guarded by crash
> barriers, elevated on a concrete pedestal, etc.) to protect it from
> releasing its hazardous contents should it be struck by vehicular
> traffic. Without specific justification or other specific evidence
> that corroborates the site's "Yes" response to this global/generic
> questionnaire/checklist question, a possible regulatory issue could
> exist for failing to address process equipment siting near roadways
> when it conducted its PHA.\
> \
> Guidance: [Occupancy Criteria Evaluations for Employee Occupied
> Structure]{.underline}. OSHA does not accept occupancy criteria
> evaluations (see API 752, Section 2.5.2) as the basis for a site's
> determination that adequate protection has been provided for employees
> in occupied structures which sites have identified as being
> potentially subject to explosions, fires, ingress of toxic materials
> or high energy releases. In these occupancy criteria evaluations, the
> site identifies vulnerable employee occupied structures and the
> hazards they may be subjected to, but rather than providing protection
> to either the structures or employees through measures like employee
> relocation, spacing, or protective construction, the site simply
> accepts the employee exposures as adequate based on their own
> acceptable occupancy criteria. This occupancy criteria evaluation is
> solely based on the occupancy threshold criteria a site is willing to
> accept. For instance, API 752 list occupancy threshold criteria used
> by some companies as 400 personnel hours per week as acceptable
> exposure for employees in an occupied structure, regardless of the
> magnitude of the hazard these employees are potentially exposed to.
> The 400 personnel hours per week equates to 2 employees continually
> exposed in an occupied structure even if that structure has virtually
> no protective construction and it is sited immediately adjacent to a
> high pressure-high temperature reactor which contains flammable or
> extremely toxic materials.\
> \
> [Non-Essential Employees]{.underline}. A site's PHA facility siting
> evaluation must consider the presence of non-essential personnel in
> occupied structures in or near covered processes. The "housing" of
> these non-essential employees in occupied structures near operating
> units may expose them to explosion, fires, toxic material, or high
> energy release hazards. Therefore, unlike direct support/ essential
> personnel (e.g., operators, maintenance employees working on equipment
> inside a unit, field supervisors, etc.) who are needed to be located
> in or near operating units for logistical and response purposes, sites
> (PHA teams) must consider and justify why non-essential employees are
> required to be located in occupied structures which are vulnerable to
> the hazards listed above. The term "non-essential" identifies those
> employees who are not needed to provide direct support for operating
> processes. Non-essential employees include, but are not limited to,
> administrative personnel, laboratory employees when they are working
> inside a lab, maintenance staff when they are working inside
> maintenance shops/areas, and employees attending training classes.\
> \
> Guidance: An example of how a temporary structure could affect a
> release of HHC would include a situation where a trailer's
> unclassified electrical system could potentially ignite flammable
> materials/unconfined vapor cloud if released from the process.*

B.  Do the PHA teams identify and evaluate all situations where
    operators are expected to carry out a procedure to control an upset
    condition, but where the operators would not have enough time to do
    so based on operating conditions?

C.  Do the PHA team(s) identify and evaluate all situations where field
    employees must close isolation valves during emergencies, but where
    doing so would expose the employees to extremely hazardous
    situations? For example, to isolate a large inventory of flammable
    liquids, a downstream manual isolation valve would need to be
    closed, but the isolation valve is located in an area that could be
    consumed by fire.

> *Guidance: Some sites (PHA teams) attempt to comply with this
> requirement by simply addressing some global/generic human factors
> questions on a short questionnaire/checklist. This type of methodology
> would not, by itself, be adequate if the PHA team did not have
> specific justifications for each of its global/generic responses.\
> \
> For example, if a PHA team responds \"Yes\" to a
> questionnaire/checklist asking whether emergency isolation valves
> (EIV) are accessible during emergencies, OSHA would then expect that
> the PHA team had [identified]{.underline}, [evaluated]{.underline},
> and considered [each]{.underline} EIV's accessibility ( i.e., would
> the EIV be located in an area that might be consumed in fire, or is
> the EIV located above grade).*

D.  How do the PHA teams identify likely human errors and their
    consequences? Have appropriate measures been taken to reduce the
    frequency and consequences of these errors?

VIII\. [Operator Training]{.underline}.

A.  Have operating employees been trained on the procedures each is
    expected to perform?

> *Guidance: An \"A\" operator might be required to perform a different
> set of operating procedures than a \"C\" operator. Therefore, to
> determine if the employee has in fact been trained on the specific
> operating procedures they are expected to perform, cross-reference the
> specific procedures that an individual operator is expected to perform
> with the training records of the specific procedures for which the
> individual operator has received training. Also determine if operators
> perform tasks more than what is expected for their level of training.*

B.  From interviews with control board operators in the units, have
    these operators received sufficient training, initial and refresher,
    to be qualified to shutdown the units per the requirements of
    119(f)(1)(i)(D)?

C.  Based on the employer\'s explanation of their management of operator
    refresher training, verify that selected operating employees
    received, completed, and understood the refresher training. For each
    employee who operates a process, has the employer ensured that the
    employee understands and adheres to the current operating procedures
    and that the refresher training is provided at least every three
    years, and more often if necessary?

IX\. [Safe Work Practices]{.underline}.

A.  Does the site have a safe work practice which it implements for
    motorized equipment to enter operating units and adjacent roadways?

> *Guidance: "Motorized equipment" includes, but is not limited to
> automobiles, pickup trucks, fork lifts, cargo tank motor vehicles
> (CTMV), aerial lifts, welder's trucks, etc.*

B.  Does the site audit its safe work practices/procedures for opening
    process equipment, vessel entry, and the control of entrance to a
    facility or covered process area?

C.  Does the site have a safe work practice for opening process
    equipment, e.g. piping and vessels, and does the site require their
    employees and contractor employees to follow it?

X. [Incident Investigation Reports]{.underline}.

A.  Provide a list of actual incidents and near-miss incidents that
    occurred at the site within the last year. Have all factors that
    contributed to each of the incidents been reported and investigated?

> *Guidance: An "actual incident" is defined as an incident with
> negative consequences such as a large HHC release, employee injuries
> or fatality, or a large amount of property or equipment damage.
> Typically, based on loss-control history, there is a much higher ratio
> of near-miss incidents in the chemical processing and refining
> industries than there are actual incidents.*

XI\. [Blowdown Drums and Vents Stacks (Blowdowns)]{.underline}.

A.  Does the site have any blowdowns? If so, does the PSI include the
    original design and design basis for each blowdown at the site?

> *Guidance: Blowdown(s) -- refers to a piece of disposal equipment in a
> pressure-relieving system whose construction consists of a drum to
> collect liquids that are separated ("knockout") from vapors and a vent
> stack, which is an elevated vertical termination discharging vapors
> into the atmosphere without combustion or conversion of the relieved
> fluid. Blowdown(s) are separate vessels intended to receive episodic
> (e.g., when de-inventorying a vessel for a planned shutdown) or
> emergency discharges. Blowdown(s) are designed to collect liquids and
> to dispose of vapors safely. In the refinery industry, hydrocarbons
> typically enter blowdown(s) as liquids, vapors, or vapors entrained
> with liquids. Blowdown(s) typically include quench fluid systems which
> reduce the temperature of hot, condensable hydrocarbons entering the
> blowdown as well as the amount of vapor released via the vent stack.
> These systems can include internal baffles to help disengage liquids
> from hydrocarbon vapors. Sometimes, blowdown(s) include inert gas or
> steam systems to control flashback hazards and to snuff vent stack
> fires if ignited by sources such as lightning*
>
> *Examples of PSI related to blowdowns, their design and design basis
> include, but are not limited to, such items as:*

1.  *Physical and chemical properties of the materials relieved to
    blowdowns (See API STD 521, Section 6.2.1);\
    *

> *Guidance: Of particular concern are heavier-than-air hydrocarbons
> with relatively lower boiling points. Additionally, hot hydrocarbons
> pose a greater risk because they are more volatile. Releasing these
> materials under the right conditions can result in the formation of
> unconfined vapor clouds which can and have resulted in major
> catastrophes at refineries and chemical plants.\
> *

2.  *A definition of the loadings to be handled (See API STD 521,
    Section 7.1);\
    *

3.  *The exit velocity of gasses/vapors released from the vent stack
    (See API STD 521, Section 7.3.4);\
    *

4.  *Design basis/"worst-case" scenario for maximum liquid -- vapor
    release to blowdown (See API STD 521, Section 4.5.j and 7.1.3);\
    *

5.  *When more than one relief device or depressuring valve discharges
    to a blowdown, the geographic locations of those devices and valves
    must be defined (See API STD 521, Section 4.4.q. and 7.2.3);\
    *

6.  *The design residence time of vapor and liquid in the drum (See API
    STD 521, Section 7.3.2.1.2);\
    *

7.  *The design basis for the vapor -- liquid separation for the drum;\
    *

8.  *The design basis for the exit velocities for the vent stack; and\
    *

9.  *The nature of other, lesser hazards related to smaller releases not
    related to the design "worst-case" scenario such as the release of
    toxic (e.g.,, H~2~S) and corrosive chemicals.*

```{=html}
<!-- -->
```
B.  Since the original installation of the blowdowns, have the original
    design and design basis conditions remained the same? If not, was an
    MOC conducted to determine if the blowdown design and capacity are
    still adequate?

> *Guidance: Examples of conditions that may have changed since the
> original design and installation of the blowdowns include: increased
> throughput in the unit(s) that relieve to the blowdowns; additional
> relief streams routed to the blowdown, blowdowns originally designed
> only to handle lighter-than-air vapor emissions from their stacks have
> had liquids or other heavier-than-air releases emitted from their vent
> stacks; additional equipment, a new unit, or occupied structures have
> been sited near the blowdowns in a manner that was not addressed in
> the original design or design basis, etc.*

C.  Did the PHA identify all scenarios where hot, heavier-than-air, or
    liquid hydrocarbons might be discharged from blowdown stacks to the
    atmosphere?

D.  Can the site demonstrate that atmospheric discharges from blowdowns
    are to safe locations?

> *Guidance: Other structures such as control rooms, trailers, offices,
> motor control centers, etc., must be considered in a PHA to determine
> if they have been sited in a safe location that might be affected by a
> hydrocarbon or toxic material release from a blowdown. Unsafe
> locations can include, but are not limited to, the location of
> equipment which could act as an ignition source, such as a furnace
> stack; an employee platform on a column where employees would be
> exposed in the event of a release; a control room; a satellite
> building; a trailer; a maintenance area/shop; an emergency response
> building; an administration building; a lunch or break room; etc.*

E.  If there is a high-level alarm in the blowdown drum, is there an MI
    procedure for calibrating, inspecting, testing and maintaining the
    instrument/control?

> *Guidance: The required documentation data must include the date of
> the inspection or test, the name of the person who performed the
> inspection or test, the serial number or other identifier of the
> equipment on which the inspection or test was performed, a description
> of the inspection or test performed, and the results of the inspection
> or test.*

F.  Have blowdown operators received appropriate training, either
    initial or refresher?