4.1 Regulatory Compliance & Safety Criteria (OSHA PSM, EPA RMP, 21 CFR Part 11)

4.1 Regulatory Compliance & Safety Criteria (OSHA PSM, EPA RMP, 21 CFR Part 11)

In industrial automation engineering, control systems do not operate in a regulatory vacuum. During Domain 2 (Definition), the automation professional is legally and ethically charged with identifying, cataloging, and embedding all statutory mandates, governmental regulations, and consensus safety criteria directly into the system requirements baseline. Failure to establish these compliance boundaries early results in severe operational consequences: regulatory shutdown orders, civil and criminal liabilities, catastrophic industrial incidents, and astronomical capital retrofits during commissioning.

Regulatory compliance criteria are non-negotiable functional requirements. Unlike standard process optimization requests, regulatory criteria represent strict design constraints that dictate control hardware architectures, safety instrumented system (SIS) segregation, field instrumentation redundancy, software validation lifecycles, operational audit logging, and formal change control workflows.

Regulations, Codes, Standards and Guidance: Know the Difference

The CAP outline expects candidates to understand the differences between standards, regulations, codes and guidance documents:

Voluntary standards can still carry legal weight. OSHA PSM requires employers to document that equipment complies with recognized and generally accepted good engineering practices (RAGAGEP), and regulators commonly point to consensus standards such as ISA-84 as that benchmark. Contracts and insurers can also make a standard mandatory for a project, and listing or approval marks (UL, FM, CSA) show that a product was tested against a recognized standard.

---

OSHA 29 CFR 1910.119: Process Safety Management (PSM)

The Occupational Safety and Health Administration (OSHA) standard 29 CFR 1910.119, Process Safety Management of Highly Hazardous Chemicals, governs facilities that handle, store, or process toxic, reactive, flammable, or explosive chemicals exceeding specific threshold quantities (e.g., chlorine at 1,500 lbs, anhydrous ammonia at 10,000 lbs, or flammable liquids and gases in quantities of 10,000 lbs or greater). The standard establishes fourteen mandatory management elements. Four of these elements directly dictate automation system design, baseline definition, and operational administration.

1. Process Safety Information (PSI)

Process Safety Information is the foundational technical baseline for process safety. Before defining any control logic or safety trip thresholds, the automation engineer must assemble and verify complete PSI. Under OSHA 1910.119(d), PSI encompasses:

• Hazards of the Process: Toxicity, permissible exposure limits (PEL), physical data, reactivity data, and thermal/chemical stability data.
• Technology of the Process: A block flow diagram or simplified process flow diagram (PFD), process chemistry, maximum intended inventory, and rigorously documented Safe Operating Limits (SOL). Safe upper and lower bounds for temperatures, pressures, flows, levels, and compositions must be defined, along with a documented evaluation of the chemical or mechanical consequences of deviations.
• Equipment in the Process: Materials of construction, Piping and Instrumentation Diagrams (P&IDs), electrical area classifications (NEC/NFPA 70), relief system design baselines, ventilation design, and the design codes and standards employed (e.g., ASME, ISA, IEEE).

2. Operating Procedures (SOPs)

Under 29 CFR 1910.119(f), employers must develop clear, written operating instructions covering each operating phase:

• Initial startup, normal operations, temporary operations, emergency operations, emergency shutdown (including assignment of shutdown responsibility), and normal shutdown.
• Operating limits, consequences of deviation, and corrective steps operators must execute.
• Safety systems and their functions (e.g., interlocks, detection devices, bypass procedures).

In modern automated facilities, standard operating procedures are increasingly embedded directly into control software via procedural automation standards such as ANSI/ISA-106 (Procedural Automation for Continuous Process Operations) and ANSI/ISA-88 (Batch Control). Automated state transitions must enforce the exact sequences and hold conditions stipulated in the written operating procedures.

3. Mechanical Integrity (MI)

Under 29 CFR 1910.119(j), automated systems classified as safety-critical or protective must adhere to formal mechanical integrity programs. This applies directly to:

• Pressure vessels and storage tanks
• Piping systems (including piping components such as valves)
• Relief and vent systems and devices
• Emergency shutdown systems (ESD / SIS)
• Controls (including monitoring devices, sensors, alarms, and final control interlocks)

The automation baseline must mandate written inspection, proof-testing, and preventive maintenance protocols. Every safety sensor, logic solver, and actuated trip valve requires a documented inspection frequency based on manufacturer recommendations, engineering codes, and prior operating experience to guarantee reliability throughout its operating lifecycle.

4. Management of Change (MOC)

Under 29 CFR 1910.119(l), any temporary or permanent modification to process chemicals, technology, equipment, procedures, or facilities affecting a covered process requires a formal, written Management of Change (MOC) procedure prior to implementation.

In automation engineering, the scope of an MOC includes:

• Modifying PLC or DCS application software code, control algorithms, or sequence logic
• Changing an analog alarm trip setpoint, PID tuning constant, or interlock deadband beyond established PSI operating envelopes
• Upgrading controller firmware, operating system patches, or communication network switch configurations
• Replacing a retired field transmitter or control valve with a make or model that does not match the original engineering specifications ("replacement in kind")
• Applying temporary software or hardware bypasses (jumpers) to safety interlocks

An MOC requires a multi-disciplinary impact review (evaluating safety, health, environmental, and operational impacts), authorization by designated engineering and operations authorities, formal updates to PSI and schematics, and documented training for affected operators and technicians before the modified system is placed in service.

---

EPA 40 CFR Part 68: Risk Management Program (RMP)

While OSHA PSM focuses primarily on on-site worker safety within the facility boundary, the Environmental Protection Agency (EPA) 40 CFR Part 68, Chemical Accident Prevention Provisions (commonly known as the Risk Management Program or RMP), focuses on protecting public health and the surrounding environment off-site.

Facilities holding threshold quantities of regulated toxic substances (e.g., sulfur dioxide, chlorine, hydrogen fluoride) or flammable substances must register an RMP with the EPA, comprising:

• Hazard Assessment: Five-year accident history and off-site consequence analysis (OCA), modeling both worst-case release scenarios and alternative release scenarios using atmospheric dispersion models (e.g., toxic vapor endpoint distance, overpressure radiuses).
• Prevention Program: Depending on the chemical inventory and process complexity, facilities fall under Program 1, Program 2, or Program 3 (Program 3 requirements mirror and expand upon OSHA PSM elements).
• Emergency Response Program: Detailed coordination with local emergency planning committees (LEPCs), emergency response plans, and public notification systems.

Automation Implications of EPA RMP

RMP does not prescribe specific instruments, but its hazard review, off-site consequence analysis and emergency-response requirements commonly lead to these automated safeguards:

• Perimeter Toxic and Flammable Gas Detection: Automated optical (open-path IR, point IR, laser) and electrochemical toxic gas detection arrays wired into the control architecture.
• Automated Mitigation and Containment: Dynamic triggering of vapor deluge curtains, foam suppression systems, toxic scrubber intake dampers, and flare header depressuring systems upon confirmed gas detection.
• Meteorological Station Integration: Direct integration of on-site wind speed, wind direction, ambient temperature, and barometric pressure data into the automation system to drive real-time atmospheric dispersion modeling during an accidental release.

---

FDA 21 CFR Part 11: Electronic Records and Signatures

For automation systems deployed in pharmaceutical, biotechnology, medical device, and life-science manufacturing governed by Good Manufacturing Practices (cGMP), the Food and Drug Administration (FDA) standard 21 CFR Part 11 establishes criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and legally equivalent to paper records and handwritten signatures.

┌────────────────────────────────────────────────────────┐
│         FDA 21 CFR Part 11 Data Integrity Core         │
├──────────────────────────┬─────────────────────────────┤
│  Electronic Records      │   Electronic Signatures     │
├──────────────────────────┼─────────────────────────────┤
│ • System Validation      │ • Unique Identification     │
│ • Immutable Audit Trails │ • Non-Repudiation           │
│ • Accurate Record Copies │ • Two Distinct Components   │
│ • Secure Archiving       │   (e.g., Username/Password) │
│ • Strict Access Controls │ • Clear Meaning / Intent    │
│ • Authority Device Checks│   (Review, Approval, Auth)  │
└──────────────────────────┴─────────────────────────────┘

The ALCOA+ Data Integrity Framework

The automation baseline must guarantee the ALCOA+ principles across all process data, electronic batch records (EBR), and configuration files:

• Attributable: Every logged event, parameter modification, or recipe execution must record the unique identity of the individual performing the action.
• Legible: Records must be readable, clear, and retrievable throughout the entire mandatory record retention period.
• Contemporaneous: Process variables and user interactions must be recorded at the exact moment they execute, verified via synchronized network time protocols (NTP).
• Original: The primary raw recording (or a certified true copy) must be preserved without post-hoc manipulation.
• Accurate: Data must be free from errors, unapproved edits, or uncalibrated sensor drift.
• Complete, Consistent, Enduring, Available: Comprehensive metadata (engineering units, timestamps, user IDs) must be permanently retained and readily accessible for regulatory inspection.

Technical Architecture Requirements for 21 CFR Part 11 Compliance

1. Immutable, Automated Audit Trails: The automation system must generate secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries, actions that create, modify, or delete electronic records, and record changes must not obscure previously recorded information (21 CFR 11.10(e)). In practice the trail also captures the user identity and the old and new values; a reason for change is required by EU Annex 11 and by most site procedures rather than by Part 11 itself. Audit trails should be append-only and must not be modifiable or disabled by operators, supervisors, or system administrators.
2. Strict Authority and Access Checks: The system must enforce Role-Based Access Control (RBAC). Shared logins (e.g., generic "OPERATOR" accounts) are incompatible with Part 11, because records must be attributable and each electronic signature must be unique to one individual (21 CFR 11.100(a)). Sites typically also configure automatic session time-outs and account lockout after repeated failed login attempts.
3. Electronic Signature Binding: Non-biometric signatures must use at least two distinct identification components, such as a user ID and password (21 CFR 11.200(a)); biometric signatures must be designed so that only their genuine owner can use them. When an individual signs an electronic batch step or recipe approval, the signed record must show the signer's printed name, the date and time, and the meaning of the signature (e.g., "Approved as Process Engineer" or "Reviewed by QA"). Signatures must be linked to their records (21 CFR 11.70) so that they cannot be excised, copied or otherwise transferred to falsify another record.
4. Computer System Validation (CSV / CSA): Systems must undergo rigorous lifecycle validation per frameworks such as GAMP 5 (Good Automated Manufacturing Practice), verifying that control hardware, runtime software, and data historian configurations perform consistently according to user and functional specifications.

---

Environmental Monitoring: Title V Clean Air Act and CEMS

Clean Air Act operating permits (Title V) for major sources gather the monitoring requirements of the underlying rules, such as the New Source Performance Standards (40 CFR Part 60), the Acid Rain Program (Part 75) and Compliance Assurance Monitoring (Part 64). As a result, many large combustion sources must continuously monitor and record stack emissions. The automation system interfaces with specialized analytical hardware known as Continuous Emission Monitoring Systems (CEMS).

CEMS Architecture & Data Acquisition and Handling Systems (DAHS)

A compliant CEMS measures extractive or in-situ gas concentrations ($SO_2$, $NO_x$, $CO$, $CO_2$, $O_2$), particulate matter (opacity), and volumetric flue gas flow rates. The automation system or dedicated Data Acquisition and Handling System (DAHS) must execute continuous mathematical processing:

• Diluent Correction: Normalizing raw pollutant parts-per-million (ppm) readings against reference oxygen ($O_2$) or carbon dioxide ($CO_2$) percentages to eliminate artificial dilution effects.
• Rolling Averages: Calculating legally binding 1-hour, 3-hour, or 24-hour block and rolling averages per EPA 40 CFR Part 60 and Part 75 performance specifications.
• Automated Daily Drift Checks: Initiating automated zero-gas and span-gas calibration cycles every 24 hours. The automation logic must automatically switch calibration solenoid valves, read analyzer response, calculate zero/span drift, compare against regulatory limits, and flag out-of-control analyzers.
• Regulatory Exceedance Logging: Immediately capturing and flagging any emissions exceeding permit limits, logging the duration, magnitude, process operating conditions, and probable cause for mandatory reporting to environmental regulatory authorities.

---

Consensus Combustion Safety Standards: NFPA 85 and NFPA 86

Combustion processes present extreme kinetic and explosion hazards. The automation engineer must enforce industry consensus standards during the Definition phase:

NFPA 85: Boiler and Combustion Systems Hazards Code

NFPA 85 applies to industrial boilers, fired utility steam generators, and thermal oxidizers operating above 12.5 million Btu/hr (3.7 MWt). It establishes strict technical requirements for the Burner Management System (BMS):

• System Independence: The BMS must be logically and physically independent of the Basic Process Control System (BPCS) / Combustion Control System (CCS). Modulating fuel and air flows (combustion control) is handled by the BPCS, but safety interlocking and fuel shutoff must reside in a dedicated, certified BMS logic solver.
• Mandatory Pre-Firing Purge: Before any fuel is introduced or igniters are energized, the BMS must complete a furnace purge with proven airflow. For multiple-burner boilers, NFPA 85 requires at least 25% of full-load mass airflow for at least 5 minutes or five volume changes, whichever is longer; for single-burner boilers it requires at least 70% of full-load airflow and at least eight air changes (watertube) or four (firetube). If airflow drops below the minimum during the purge, the purge must start over.
• Flame Supervision: Every active burner must have independent, continuous flame monitoring using certified flame scanners (ultraviolet, infrared, or flame flicker). Loss of flame must close the fuel safety shutoff valves automatically within the flame failure response time, which NFPA 85 limits to a maximum of 4 seconds.
• Master Fuel Trip (MFT): An automatic, hardwired, or certified functional safety shutdown that simultaneously closes all safety shutoff valves (SSVs) on both primary and pilot fuel lines upon detection of critical process faults (e.g., low drum water level, loss of draft fans, high/low fuel gas pressure, loss of all flame).

NFPA 86: Standard for Ovens and Furnaces

NFPA 86 governs industrial furnaces, thermal oxidizers, and curing ovens. It mandates:

• Safety Ventilation: Enforcing mechanical exhaust purging before heating elements or burners can ignite, preventing explosive solvent vapor accumulation.
• Independent Excess Temperature Limit Controllers: Dedicated, non-programmable or certified safety-rated high-temperature cutoff controllers with independent thermocouples that physically de-energize heating sources. The limit controller must be manual-reset only; it cannot automatically reset when temperature drops.

---

Regulatory Frameworks Comparison Matrix

---

Realistic Industrial Scenario

A bulk active pharmaceutical ingredient (API) synthesis plant expanded its operations by adding a 10,000-liter hydrogenation reactor utilizing pressurized hydrogen gas (flammable, covered under OSHA PSM) and producing a regulated sterile injectable compound (governed under FDA cGMP and 21 CFR Part 11).

During initial engineering definition, the automation project team established the baseline specifications:

1. PSI and Alarm Baselines: The safe upper limit for reactor jacket temperature was set at $65.0^\circ\text{C}$, and the reactor's maximum design pressure is 12.0 bar. The high-high emergency shutdown interlock (PSHH) was set at 10.5 bar, operating through an independent SIL 2 Safety Instrumented System.
2. Part 11 Compliance: The distributed control system was configured with an immutable SQL-based relational audit trail. All recipe parameter adjustments (e.g., agitator speed, hydrogen dosing rate) required dual credential entry (username and password) with an explicit drop-down selection of change rationales.

Three weeks before commercial validation, an operations engineer requested an "interim tuning bypass" to disable the low-level hydrogen purge flow interlock to allow rapid solvent rinsing between batches. The automation lead rejected the request, noting that under OSHA 1910.119(l), bypassing an engineered safety interlock constitutes a process modification requiring a formal MOC. The proposed change required a What-If hazard review, safety consequence re-assessment, and documented authorization by the Process Safety Committee. In addition, because the system was validated under GMP and 21 CFR Part 11, any logic modification would have to pass through change control with a documented impact assessment and whatever regression testing and revalidation that assessment required. The disciplined refusal prevented an unmitigated explosive solvent vapor accumulation hazard and avoided a likely FDA Form 483 observation during the pre-approval inspection.

---

ISA CAP Exam Pitfalls & Traps

• Trap 1: Merging BMS Safety Interlocks into the Basic Combustion Control Loop. An exam question may describe a cost-saving proposal to program the boiler Master Fuel Trip (MFT) and furnace purge sequences inside the existing DCS process controller executing the fuel/air ratio PID loop. Under NFPA 85, this is strictly prohibited. The BMS must remain logically and physically independent from the combustion control system (CCS) to eliminate common-cause controller failure.
• Trap 2: Shared Operator User Accounts. Exam questions addressing pharmaceutical or regulated manufacturing often describe a scenario where HMI consoles utilize a generic shift login (e.g., "Shift_A_Operator") to streamline shift handovers. Under FDA 21 CFR Part 11, shared accounts are an explicit compliance failure. Every individual who interacts with the system must be uniquely authenticated so that all audit trail records are attributable to a specific human identity.
• Trap 3: Treating Software Setpoint Changes as Maintenance Adjustments. Watch out for options suggesting that changing a high-temperature safety trip setpoint in a PLC can be authorized via a routine work order. Any modification that alters process operating parameters beyond documented Process Safety Information limits requires a formal, approved Management of Change (MOC) under OSHA PSM 1910.119.