<< Back to OSHA Voluntary Protection Programs
Public burden reporting, for this collection of information is estimated to take
approximately 40 hours
per response including time for reviewing instructions, searching existing data
sources, gathering and
maintaining the data needed, and completing and reviewing the collection of
Standard must provide responses to each question that is applicable to their
operations. Responses must cover all PSM-related operations. Please indicate that a question is "Not
Applicable" if it addresses functionality outside the scope of the operations, and briefly explain why.
I. Management of Change.
- Has the throughput changed from its original design rate? Has the site conducted a management of
change (MOC) procedure for each throughput change since May 26, 1992?
- For the MOC procedures conducted for the unit(s), has the procedure listed the technical basis
for the change and ALL potential safety and health impacts of the change prior to its
- From the site's list of MOCs, identify the oldest MOC procedure which might affect the integrity
of one or more pressure vessels in the unit(s). Do these MOC procedures meet all 1910.119(l)
- Does the MOC process address temporary changes as well as permanent changes?
- Have MOCs been conducted on all changes to process chemicals, technology, equipment and
procedures, and changes to facilities that affect a covered process?
II. Relief Design.
- For each throughput MOC procedure conducted, has the procedure addressed a review/analysis of the
relief system (includes relief devices, relief discharge lines, relief disposal equipment and flare
system) to determine if there may be any safety and health impacts due to increased flow as a result
of throughput changes which might impact the existing relief system?
Guidance: An MOC procedure is required anytime a change per the requirements of 1910.119(l) is
considered. An MOC procedure is a proactive management system tool used in part to determine if a
change might result in safety and health impacts. OSHA's MOC requirement is prospective. The
standard requires that an MOC procedure be completed, regardless of whether any safety and health
impacts will actually be realized by the change.
- After a change in the throughput in the unit(s), did the process hazard analysis (PHA) team
consider the adequacy of the existing relief system design with respect to the increased throughput
during the next PHA?
Guidance: Typically, the PHA team does not do a relief system engineering analysis.
However, the PHA team should determine, through proper evaluation and consultation with the
engineering/technical staff, if the existing/current engineering analysis of the relief system is
adequate for the current/actual unit throughput.
If the throughput change was implemented between the time the PSM standard became effective (May 26,
1992) and the time the original PHA was required based on the PHA phase-in schedule, the original
PHA would need to address the throughput change. However, if there was a throughput change after the
original PHA, the next PHA update/"redo" or PHA revalidation would need to address the throughput
change. In either event, an MOC procedure on the throughput change would need to have been conducted
and incorporated into the next scheduled PHA.
- Does the site's process safety information (PSI) include the codes and standards used in the
design of relief systems?
- Does the site's PSI include the relief system design and design basis?
Guidance: This includes the original design and design changes. Examples of PSI
related to relief devices, their design and design basis include, but are not limited to such items as:
Similar design and design bases PSI are required for the rest of the relief system equipment
downstream from the relief devices, i.e., relief vent lines, manifolds, headers, other relief
disposal equipment, and flare stack.
- Identification/descriptor of each relief device;
- A listing of all equipment which will be relieved through the device;
- Design pressure;
- Set pressure;
- Listing of all sources of overpressure considered;
- Identification of the worst case overpressure scenario or relief design;
- State of material being relieved (i.e.,, liquid, vapor, liquid-vapor, liquid-vapor-solid, along
with an identification of the material which was the basis for the relief device selection);
- Physical properties of the relieved materials, vapor rate, molecular weight, maximum relieving
pressure, heat of vaporization, specific gravity and viscosity; and
- Design calculations.
- Are there intervening valves on the upstream or downstream lines to/from relief devices? If so,
does the PHA consider the possibility that these valves could be closed during operation, rendering
the relief devices non-functional?
- If there are intervening valves on the upstream or downstream lines to/from relief devices, does
the site have effective controls in place to ensure these intervening valves remain open during
- If there are intervening valves on the upstream or downstream lines to/from relief devices, is
there an administrative procedure (e.g., car-seal procedure) to assure these valves are in the open
position during operations? If so, has this procedure been subsequently audited?
- Are there open vents which discharge to atmosphere from relief devices? If so, has the PHA
considered whether these relief devices discharge to a safe location?
Guidance: PHA teams must address basic questions regarding what happens to the
hazardous materials after they are relieved to atmosphere, including:
Part of the site's PHA team's evaluation, after it identifies the locations of open vents, is to
determine if employees might be exposed when hazardous materials are relieved. If the PHA team
concludes that a current and appropriate evaluation (such as the use of dispersion modeling) has
been conducted, the evaluation could find that the vessels/vents relieve to a safe location. If the
PHA team determines that this hazard has not been appropriately evaluated, the PHA team must request
that such an evaluation be conducted, or make some other appropriate recommendation to ensure that
the identified hazard/deviation is adequately addressed.
- Are there negative effects on employees or other equipment that could cause another release
("domino effects") of hazardous materials/HHC?
- What presumptions or assessments exist to support that there will be no negative effects of an
atmospheric release of hazardous materials/HHC?
- Are employees near where relief devices discharge, including downwind locations (e.g., on the
ground, on platforms on pressure vessels in the vicinity of elevated relief devices, etc.)?
- Could a release from a relief device cause a release from other equipment, or could other nearby
equipment affect the released material (e.g., a furnace stack could be an ignition source if it is
located proximate to an elevated relief device that is designed to relieve flammable materials)?
- Does the site have a mechanical integrity (MI) procedure for inspecting, testing, maintaining,
and repairing relief devices which maintains the ongoing integrity of process equipment?
- Does the process use flares? If so, verify that the flares have been in-service/operational when
the process has been running. If the flares have not been in-service, has the site used other
effective measures to relieve equipment in the event of an upset? Has an MOC procedure been used to
evaluate these changes?
- Do pressure vessels which have integrally bonded liners, such as strip lining or plate lining,
have an MI procedure which requires that the next scheduled inspection after an on-stream inspection
be an internal inspection?
- Does the site have an MI procedure for establishing thickness measurement locations (TML) in
pressure vessels, and does the site implement that procedure when establishing the TML?
- Does the site have an MI procedure for inspecting pressure vessels for corrosion-under-insulation
(CUI), and does the site inspect pressure vessels for CUI?
- Does the site's MI procedure address testing (e.g. leak testing) and repair of pressure vessels?
For example, does the MI procedure indicate how the testing and repair will be conducted and which
personnel are authorized to do the testing and repair, including what credentials those conducting
the testing and repair must have?
Guidance: API 510 requires in-service pressure vessel tests when the API
authorized pressure vessel inspector believes they are necessary.
Guidance: Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) that require
credentials include, but are not limited to:
- Credentials for pressure vessel inspectors, see API 510, Section 4.2.
- RAGAGEP for pressure vessel examiners credentials/experience and training requirements, see API
510, Section 3.18.
- RAGAGEP for contractors performing NDE are the training and certification requirements
ASNT-TC-1A, see CCPS, Section 10.3.2.1, (In-service Inspection and Testing) Nondestructive
- RAGAGEP for qualifications for personnel who conduct pressure vessel repairs, alteration and
rerating including qualifications for welders, see API 510, Section 7.2.1 and the BPVC, Section IX.
- RAGAGEP for certifications at CCPS, Section 5.4 Certifications, Table 5-3, Widely Accepted MI
Certifications, and Table 9-13, Mechanical Integrity Activities for Pressure Vessels.
- Were any deficiencies found during pressure vessel inspections? If so, how were they resolved?
Guidance: A deficiency (as per 1910.119 (j)(5)) means a condition in equipment or systems that is
outside of acceptable PSI limits. In the case of a pressure vessel, this could mean degradation in
the equipment/system exceeding the equipment's acceptable limits (e.g., operating a vessel, tank or
piping with a wall thickness less than its retirement thickness).
- Do the operating procedures for pressure vessels list the safety systems that are applicable to
Guidance: Examples of safety systems include but are not limited to: emergency relief systems
including relief devices, disposal systems and flares; automatic depressurization valves; remote
isolation capabilities, aka emergency isolation valves; safety-instrumented-systems (SIS) including
emergency shutdown systems and safety interlock systems; fire detection and protection systems;
deluge systems; fixed combustible gas and fire detection system; safety critical alarms and
instrumentation; uninterruptible power supply; dikes; etc.
- Have there been any changes to pressure vessels or other equipment changes that could affect
pressure vessel integrity, such as a change to more corrosive feed, a change in the type of flange
seal material used for the vessel heads or nozzles, etc.,? If so, was an MOC procedure completed
prior to implementing the change?
- Is there information in the MI piping inspection procedures or other PSI that indicates the
original thickness measurements for all piping sections?
- Is there information in the MI piping inspection procedures or other PSI that indicates the
locations, dates and results of all subsequent thickness measurements?
- Is there anomalous data that has not been resolved for any piping? (For example, the current
thickness reading for a TML indicates the pipe wall thickness is greater/thicker than the previous
reading(s) with no other explanation as to how this might occur.)
- Has each product piping been classified according to the consequences of its failure?
Guidance: If the site inspects and tests all piping the same, regardless of
the consequence of failure of the piping (i.e., piping inspections are implemented using the same
MI program (1910.119(j)(2) and action/task (1910.119(j)(4) procedure for all piping without
consideration of their consequence of failure or other operational criteria), then this question is
- Based on a review of piping inspection records, have all identified piping deficiencies been
Guidance: An example of a piping deficiency would be a situation where piping
inspection data indicates that its actual wall thickness is less than its retirement thickness, and
the site has conducted no other evaluation to determine if the piping is safe for continued operation.
For a discussion on equipment deficiencies the definition of deficient/deficiency.
- How does the site ensure that replacement piping is suitable for its process application?
Guidance: Typically, piping replacements are replacements-in-kind (RIK) when the
process service does not change. However, if the piping replacement is not an RIK, then an MOC procedure
- Does the site's MI procedure list required piping inspectors' qualifications, welders'
qualifications for welding on process piping, and when qualified welding procedures are required?
- Is there information in the MI piping inspection procedures or other PSI that indicates the
original installation date for each section of piping?
- Is there information in the MI piping inspection procedures or other PSI that indicates the
specifications, including the materials of construction and strength levels for each section of
- Does the site's MI procedure for piping inspections list criteria/steps to be followed when
establishing TML for injection points in piping circuits?
V. Operating Procedures – Normal Operating Procedures (NOP), Emergency
Shutdown Procedures (ESP) and Emergency Operations (EOP).
- Are there established operating procedures, including: normal operating procedures (NOP),
emergency operating procedures (EOP), and emergency shutdown procedures (ESP)?
- Are operating procedures implemented as written?
- Are there ESP for the all Unit(s), and if so, do these ESP specify the conditions that require an
Guidance: ESP are usually warranted during events that may include the failure
of process equipment (e.g., vessels, piping, pumps, etc.) to contain or control HHC releases, loss of
electrical power, loss of instrumentation or cooling, fire, explosion, etc. When EOP do not succeed
during upset or emergency conditions in returning the process to a safe state, implementation of an
ESP may be necessary.
When normal operating limits for parameters such as pressure, temperature, level, etc., are exceeded
during an excursion, system upset, abnormal operation, etc., a catastrophic release can occur if
appropriate actions are not taken. These actions must be listed in the EOP and must specify the
initiating conditions or the operating limits for the EOP (e.g., temperature exceeds 225oF or
pressure drops below 15 psig).
Information typically listed in EOP and/or ESP includes, but is not limited to the responsibilities
for performing actions during an emergency, required PPE, additional hazards not present during
normal operations, consequences of operating outside operating limits, steps to shutdown the
involved process in the safest, most direct manner, conditions when operators must invoke the
emergency response plan, or scenarios when they themselves must stop and evacuate.
- Have control board operators received sufficient training, initial and refresher, to be qualified
to shutdown the units?
- Does the ESP specify that qualified operators are assigned authority to shutdown the unit(s)?
- Are qualified control board operators authorized or permitted to initiate an emergency shutdown
of the unit without prior approval?
- Do EOP procedures identify the "entry point," i.e., the initiating/triggering conditions or
operating limits when the EOP is required, the consequences of a deviation from the EOP, and the
steps required to correct a deviation/upset once the operating limits of the EOP have been exceeded?
- Do NOP list the normal operating limits or "exit points" from NOP to EOP; the steps operators
should take to avoid deviations/upsets; and the precautions necessary to prevent exposures,
including engineering and administrative controls and PPE?
Guidance: For NOP, the "operating limits" required are those operating
parameters that if they exceed the normal range or operating limits, a system upset or abnormal operating
condition would occur which could lead to operation outside the design limits of the equipment/process
and subsequent potential release. These operating parameters must be determined by the site and can
include, but are not limited to, pressure, temperature, flow, level, composition, pH, vibration,
rate of reaction, contaminants, utility failure, etc.
It is at the point of operation outside these NOP "operating limits" that EOP procedures must be
initiated. There may be a troubleshooting area defined by the site's EOP where operator action can
be used to bring the system upset back into normal operating limits. During this troubleshooting
phase, if an operating parameter reaches a specified level and the process control strategy includes
automatic controls, other safety devices (e.g., safety valves or rupture disks) or automatic
protection systems (e.g., safety instrumented systems/emergency shutdown systems), would activate
per the process design to bring the process back to a safe state. Typically, once the predefined
limits for troubleshooting have been reached for a particular operating parameter, the process has
reached a "never exceed limit". A buffer zone is typically provided above( and below if applicable)
the trouble shooting zone ("never exceed limit") to ensure the operating parameters do not reach the
design safe upper or lower limit of the equipment/process. This design safe upper and lower limits
of the equipment or process are also known as the boundaries of the design operating envelope or the
limit above (or below) which it is considered unknown or unsafe to operate. Once the operating
parameter(s) reach the buffer zone entry point, there is no designed or intentional operator
intervention (i.e., troubleshooting) to bring the process system upset back to a safe state. Any
intervention in the buffer zone is as a result of the continued activation of the safety devices and
automatic protection systems which initially activated at the predefined level during the
troubleshooting phase. All of these predefined limits are important information for operators to
know and understand and must be included in the PSI and operating procedures.
- Are operating procedures implemented as written?
VI. PHA, Incident Investigation, and Compliance Audits Findings/Recommendations.
- Have all corrective actions from PHA, incident investigations, MOCs, and compliance audits been
corrected in a timely manner and documented? Provide a list of all outstanding corrective actions,
the date of corrective initiation, and the projected completion dates.
Guidance: There may be instances when a PHA team identifies deficiencies in
equipment/systems which would violate the requirements of 119(j)(5) if left uncorrected. If the site
continues to operate the deficient equipment/system, they must take interim measures per 119(j)(5) to
assure safe operation, and they must also meet the 119(e)(5) requirements to resolve the findings and
recommendations related to the identified deficiency.
The phrase from 119(j)(5), "safe and timely manner when necessary means are taken to assure safe
operation", when taken in conjunction with 119(e)(5) means that when a PHA team identifies a
deficiency in equipment/systems and the site does not correct the deficiency before further use, the
site's system for promptly addressing the PHA team's findings and recommendations must assure: 1)
that the recommendations are resolved in a timely manner and that the resolutions are documented; 2)
the site has documented what actions are to be taken, not only to resolve the recommendation, but to
assure safe operation until the deficiency can be corrected; 3) that the site complete actions as
soon as possible; and 4) that the site has developed a written schedule describing when corrective
actions related to the resolution and any interim measures to assure safe operations will be
The system that promptly addresses and resolves findings and recommendations referred to in both
1910.119(e)(5) and 1910. 119(m)(5) are not requirements to develop a management program for globally
addressing the resolution of findings and recommendations. Rather, these "system" requirements
address how each specific finding and recommendation will be individually resolved (Hazard Tracking
requirement under VPP). Each finding or recommendation will have its own unique resolution based on
its nature and complexity.
- Has the PHA incorporated all the previous incidents since May 26, 1992 which had a likely
potential for catastrophic consequences?
VII. Facility Siting/Human Factors.
- Does the PHA consider the siting of all occupied structures?
Guidance: Facility siting considerations for occupied structures include both
permanent and temporary (e.g., trailers) structures.
Global/generic facility siting questionnaires/checklists. Some employers (PHA teams) attempt to
comply with this 1910.119(e)(3)(v) requirement by answering global/generic facility siting questions
on a short questionnaire/checklist. PSM is a performance standard and the means the site uses to
comply with the standard are generally up to them as long as their performance ensures compliance
with the requirement of the standard. If the site uses a questionnaire/checklist as part of its PHA
to identify, evaluate and control all hazards associated with facility siting, this is permissible
as long as the method they used complies with the PHA methodology requirement, and, more
importantly, all facility siting hazards have been addressed (i.e., identified, evaluated and
controlled). This questionnaire/checklist type of methodology would not be compliant if the site (PHA
team) did not have specific justifications for each individual situation/condition that the
global/generic questions addressed.
For example, a PHA team responds "Yes" to a questionnaire/checklist asking, "Is process equipment
located near unit battery limit roads sited properly?" In this case, OSHA would first expect that
the site (PHA team) would have identified each location where process equipment
is sited near a unit battery limit road. Next, OSHA would expect the site would have evaluated
each piece of process equipment located in the vicinity of a roadway. This evaluation is conducted to
determine if each of the specific process equipment's siting is adequate/controlled
(e.g., guarded by crash barriers, elevated on a concrete pedestal, etc.) to protect it from releasing its
hazardous contents should it be struck by vehicular traffic. Without specific justification or other specific
evidence that corroborates the site's "Yes" response to this global/generic questionnaire/checklist
question, a possible regulatory issue could exist for failing to address process equipment siting near roadways
when it conducted its PHA.
Guidance: Occupancy Criteria Evaluations for Employee Occupied Structure. OSHA does not accept
occupancy criteria evaluations (see API 752, Section 2.5.2) as the basis for a site's determination
that adequate protection has been provided for employees in occupied structures which sites have
identified as being potentially subject to explosions, fires, ingress of toxic materials or high
energy releases. In these occupancy criteria evaluations, the site identifies vulnerable employee
occupied structures and the hazards they may be subjected to, but rather than providing protection
to either the structures or employees through measures like employee relocation, spacing, or
protective construction, the site simply accepts the employee exposures as adequate based on their
own acceptable occupancy criteria. This occupancy criteria evaluation is solely based on the
occupancy threshold criteria a site is willing to accept. For instance, API 752 list occupancy
threshold criteria used by some companies as 400 personnel hours per week as acceptable exposure for
employees in an occupied structure, regardless of the magnitude of the hazard these employees are
potentially exposed to. The 400 personnel hours per week equates to 2 employees continually exposed
in an occupied structure even if that structure has virtually no protective construction and it is
sited immediately adjacent to a high pressure-high temperature reactor which contains flammable or
extremely toxic materials.
Non-Essential Employees. A site's PHA facility siting evaluation must consider the presence of
non-essential personnel in occupied structures in or near covered processes. The "housing" of these
non-essential employees in occupied structures near operating units may expose them to explosion,
fires, toxic material, or high energy release hazards. Therefore, unlike direct support/ essential
personnel (e.g., operators, maintenance employees working on equipment inside a unit, field
supervisors, etc.) who are needed to be located in or near operating units for logistical and
response purposes, sites (PHA teams) must consider and justify why non-essential employees are
required to be located in occupied structures which are vulnerable to the hazards listed above. The
term "non-essential" identifies those employees who are not needed to provide direct support for
operating processes. Non-essential employees include, but are not limited to, administrative
personnel, laboratory employees when they are working inside a lab, maintenance staff when they are
working inside maintenance shops/areas, and employees attending training classes.
Guidance: An example of how a temporary structure could affect a release of HHC would include a
situation where a trailer's unclassified electrical system could potentially ignite flammable
materials/unconfined vapor cloud if released from the process.
- Do the PHA teams identify and evaluate all situations where operators are expected to carry out a
procedure to control an upset condition, but where the operators would not have enough time to do so
based on operating conditions?
- Do the PHA team(s) identify and evaluate all situations where field employees must close
isolation valves during emergencies, but where doing so would expose the employees to extremely
hazardous situations? For example, to isolate a large inventory of flammable liquids, a downstream
manual isolation valve would need to be closed, but the isolation valve is located in an area that
could be consumed by fire.
Guidance: Some sites (PHA teams) attempt to comply with this requirement by simply
addressing some global/generic human factors questions on a short questionnaire/checklist. This type of
methodology would not, by itself, be adequate if the PHA team did not have specific justifications for
each of its global/generic responses.
For example, if a PHA team responds "Yes" to a questionnaire/checklist asking whether emergency
isolation valves (EIV) are accessible during emergencies, OSHA would then expect that the PHA team
had identified, evaluated, and considered
each EIV's accessibility ( i.e., would the EIV be located in an area that
might be consumed in fire, or is the EIV located above grade).
- How do the PHA teams identify likely human errors and their consequences? Have appropriate
measures been taken to reduce the frequency and consequences of these errors?
VIII. Operator Training.
- Have operating employees been trained on the procedures each is expected to perform?
Guidance: An "A" operator might be required to perform a different set of operating procedures than
a "C" operator. Therefore, to determine if the employee has in fact been trained on the specific
operating procedures they are expected to perform, cross-reference the specific procedures that an
individual operator is expected to perform with the training records of the specific procedures for
which the individual operator has received training. Also determine if operators perform tasks more
than what is expected for their level of training.
- From interviews with control board operators in the units, have these operators received
sufficient training, initial and refresher, to be qualified to shutdown the units per the
requirements of 119(f)(1)(i)(D)?
- Based on the employer's explanation of their management of operator refresher training, verify
that selected operating employees received, completed, and understood the refresher training. For
each employee who operates a process, has the employer ensured that the employee understands and
adheres to the current operating procedures and that the refresher training is provided at least
every three years, and more often if necessary?
IX. Safe Work Practices.
- Does the site have a safe work practice which it implements for motorized equipment to enter
operating units and adjacent roadways?
Guidance: "Motorized equipment" includes, but is not limited to automobiles, pickup trucks, fork
lifts, cargo tank motor vehicles (CTMV), aerial lifts, welder's trucks, etc.
- Does the site audit its safe work practices/procedures for opening process equipment, vessel
entry, and the control of entrance to a facility or covered process area?
- Does the site have a safe work practice for opening process equipment, e.g. piping and vessels,
and does the site require their employees and contractor employees to follow it?
X. Incident Investigation Reports.
- Provide a list of actual incidents and near-miss incidents that occurred at the site within the
last year. Have all factors that contributed to each of the incidents been reported and
Guidance: An "actual incident" is defined as an incident with negative
consequences such as a large HHC release, employee injuries or fatality, or a large amount of property
or equipment damage. Typically, based on loss-control history, there is a much higher ratio of near-miss
incidents in the chemical processing and refining industries than there are actual incidents.
XI. Blowdown Drums and Vents Stacks (Blowdowns).
- Does the site have any blowdowns? If so, does the PSI include the original design and design
basis for each blowdown at the site?
Guidance: Blowdown(s) – refers to a piece of disposal equipment in a pressure-relieving
system whose construction consists of a drum to collect liquids that are separated ("knockout")
from vapors and a vent stack, which is an elevated vertical termination discharging vapors into the atmosphere
without combustion or conversion of the relieved fluid. Blowdown(s) are separate vessels intended to receive
episodic (e.g., when de-inventorying a vessel for a planned shutdown) or emergency discharges.
Blowdown(s) are designed to collect liquids and to dispose of vapors safely. In the refinery
industry, hydrocarbons typically enter blowdown(s) as liquids, vapors, or vapors entrained with
liquids. Blowdown(s) typically include quench fluid systems which reduce the temperature of hot,
condensable hydrocarbons entering the blowdown as well as the amount of vapor released via the vent
stack. These systems can include internal baffles to help disengage liquids from hydrocarbon vapors.
Sometimes, blowdown(s) include inert gas or steam systems to control flashback hazards and to snuff
vent stack fires if ignited by sources such as lightning
Examples of PSI related to blowdowns, their design and design basis include, but are not limited to,
such items as:
- Physical and chemical properties of the materials relieved to blowdowns (See API STD 521, Section
Guidance: Of particular concern are heavier-than-air hydrocarbons with relatively lower boiling
points. Additionally, hot hydrocarbons pose a greater risk because they are more volatile. Releasing
these materials under the right conditions can result in the formation of unconfined vapor clouds
which can and have resulted in major catastrophes at refineries and chemical plants.
- A definition of the loadings to be handled (See API STD 521, Section 7.1);
- The exit velocity of gasses/vapors released from the vent stack (See API STD 521, Section 7.3.4);
- Design basis/"worst-case" scenario for maximum liquid – vapor release to blowdown (See API STD
521, Section 4.5.j and 7.1.3);
- When more than one relief device or depressuring valve discharges to a blowdown, the geographic
locations of those devices and valves must be defined (See API STD 521, Section 4.4.q. and 7.2.3);
- The design residence time of vapor and liquid in the drum (See API STD 521, Section 188.8.131.52.2);
- The design basis for the vapor – liquid separation for the drum;
- The design basis for the exit velocities for the vent stack; and
- The nature of other, lesser hazards related to smaller releases not related to the design
"worst-case" scenario such as the release of toxic (e.g.,, H2S) and corrosive chemicals.
- Since the original installation of the blowdowns, have the original design and design basis
conditions remained the same? If not, was an MOC conducted to determine if the blowdown design and
capacity are still adequate?
Guidance: Examples of conditions that may have changed since the original design
and installation of the blowdowns include: increased throughput in the unit(s) that relieve to the
blowdowns; additional relief streams routed to the blowdown, blowdowns originally designed only to
handle lighter-than-air vapor emissions from their stacks have had liquids or other heavier-than-air
releases emitted from their vent stacks; additional equipment, a new unit, or occupied structures have
been sited near the blowdowns in a manner that was not addressed in the original design or design basis,
- Did the PHA identify all scenarios where hot, heavier-than-air, or liquid hydrocarbons might be
discharged from blowdown stacks to the atmosphere?
- Can the site demonstrate that atmospheric discharges from blowdowns are to safe locations?
Guidance: Other structures such as control rooms, trailers, offices, motor control
centers, etc., must be considered in a PHA to determine if they have been sited in a safe location that
might be affected by a hydrocarbon or toxic material release from a blowdown. Unsafe locations can include,
but are not limited to, the location of equipment which could act as an ignition source, such as a
furnace stack; an employee platform on a column where employees would be exposed in the event of a
release; a control room; a satellite building; a trailer; a maintenance area/shop; an emergency
response building; an administration building; a lunch or break room; etc.
- If there is a high-level alarm in the blowdown drum, is there an MI procedure for calibrating,
inspecting, testing and maintaining the instrument/control?
Guidance: The required documentation data must include the date of the inspection
or test, the name of the person who performed the inspection or test, the serial number or other
identifier of the equipment on which the inspection or test was performed, a description of the
inspection or test performed, and the results of the inspection or test.
- Have blowdown operators received appropriate training, either initial or refresher?