20.1 Operating Procedures, Startup, and Shutdown
Key Takeaways
- OSHA PSM (29 CFR 1910.119) requires written operating procedures covering **initial startup, normal operations, temporary operations, emergency shutdown, emergency operations, normal shutdown, and startup after a turnaround or emergency shutdown**, certified annually as current and accurate.
- Procedures must state **operating limits**, the **consequences of deviation**, and the **steps required to correct or avoid deviation** — an instruction list without limits and consequences does not satisfy the standard.
- A **pre-startup safety review (PSSR)** is required before introducing hazardous chemicals to a new or modified facility, confirming that construction matches specification, procedures are in place, PHA recommendations are resolved, and training is complete.
- **Management of change** applies to every change that is not a **replacement in kind**, including changes to chemicals, technology, equipment, and procedures — a "temporary" change is still a change.
- Startup and shutdown are **transient, non-routine operations** in which composition passes through the flammable range, equipment operates outside steady-state design conditions, and instruments read outside their calibrated spans; a disproportionate share of major process incidents occur during these phases.
20.1 Operating Procedures, Startup, and Shutdown
The NCEES specification lists Operation (e.g., procedures, startup/shutdown) as the first subtopic under Operation and Maintenance. A licensed chemical engineer writes and approves these documents, and the exam tests whether you know what must be in them and why the transient phases are the dangerous ones.
1. The PSM Framework
OSHA's Process Safety Management standard, 29 CFR 1910.119, applies to processes holding more than a threshold quantity of a listed highly hazardous chemical, or more than (10{,}000\text{ lb}) of a flammable liquid or gas. It has fourteen elements:
Employee participation Process safety information Process hazard analysis
Operating procedures Training Contractors
Pre-startup safety review Mechanical integrity Hot work permit
Management of change Incident investigation Emergency planning & response
Compliance audits (every 3 years) Trade secrets
Process hazard analysis is Section 17.1 and mechanical integrity is Section 20.2. This section covers the procedural elements.
2. What an Operating Procedure Must Contain
Under (1910.119(f)), written procedures must address steps for each operating phase:
| Phase | Why it needs its own procedure |
|---|---|
| Initial startup | Commissioning a system never operated; inventory is being established for the first time |
| Normal operations | The steady-state case |
| Temporary operations | Running on a spare, bypassing a unit, operating with a control loop in manual |
| Emergency shutdown | Must state who is authorized to initiate it and under what conditions |
| Emergency operations | Actions short of full shutdown |
| Normal shutdown | Controlled removal of inventory and energy |
| Startup after turnaround or emergency shutdown | Differs from initial startup because catalyst, inventory, and equipment state differ |
Each procedure must also state:
- Operating limits — the boundaries of the safe operating envelope.
- Consequences of deviation — what physically happens if the limit is exceeded.
- Steps required to correct or avoid deviation.
- Safety and health considerations — chemical hazards, exposure controls, PPE.
- Safety systems and their functions — what the interlocks do and why.
Procedures must be certified annually as current and accurate, and must be readily accessible to the people who operate the process.
The exam's favorite distinction. A step list ("open V-101, start P-201, ramp to (180^\circ\text{C})") is not a compliant operating procedure. Without the operating limits, the consequence of exceeding them, and the corrective action, the operator has no basis for recognizing that something is going wrong — which is precisely the situation the standard was written to prevent.
3. Startup Sequence
A generic hydrocarbon-service startup runs in this order, and the order is not negotiable:
1. Confirm mechanical completion, punch list cleared, PSSR signed
2. Remove blinds per the blind list; verify valve line-up against the P&ID
3. Pressure / tightness test; leak check with inert
4. PURGE to below the limiting oxygen concentration (Section 17.4)
5. Establish utilities: instrument air, cooling water, steam, power, nitrogen
6. Function-test interlocks and trips; confirm relief devices installed and set
7. Commission on an inert or water circulation; establish levels and control loops
8. Introduce feed at low rate
9. Controlled heat-up / pressure ramp within metallurgical and thermal-shock limits
10. Bring to specification; transition loops from manual to automatic
Step 4 is where the hazard concentrates. A vessel being filled with hydrocarbon after an air-filled outage passes through the flammable range on its way to a fuel-rich atmosphere. Purging first means the composition trajectory goes from air to inert to hydrocarbon, skipping the flammable envelope entirely. Skipping the purge means it goes from air directly into the flammable range with the unit warming up and pumps running.
Pre-startup safety review ((1910.119(i))) is the formal gate before hazardous chemicals are introduced to a new or modified facility. It confirms that:
- Construction and equipment match the design specification.
- Safety, operating, maintenance, and emergency procedures are in place and adequate.
- For new facilities, a PHA has been performed and its recommendations resolved or implemented.
- For modified facilities, management of change requirements have been satisfied.
- Training of each affected employee is complete.
4. Shutdown Sequence
Shutdown is not startup in reverse; it has its own hazards, mostly associated with removing inventory and energy in the correct order.
1. Reduce rates; transition control loops to manual as they leave their ranges
2. Stop feed; consume or route out remaining inventory
3. Drain and pump out liquid to a closed system
4. Depressure to flare or a closed system (never to atmosphere if flammable)
5. PURGE / inert the vapor space
6. Cool within thermal-gradient limits
7. Isolate: close, lock, and BLIND per the blind list
8. Decontaminate: steam-out, water wash, or chemical clean
9. Gas test; issue entry and hot work permits only on a passing test
Blinding, not just closing, is the isolation standard for entry or hot work. A closed valve can leak, can be opened by someone else, and gives no visual indication of its state; a blind is a physical barrier with a documented position on the blind list. Isolation is enforced administratively by lockout/tagout (29 CFR 1910.147), and entry into vessels is governed by the permit-required confined space standard (29 CFR 1910.146), which requires atmospheric testing for oxygen, flammability, and toxicity, continuous ventilation, an attendant, and a rescue plan.
5. Management of Change
Any change that is not a replacement in kind requires MOC. "Replacement in kind" means identical specification — same material, same rating, same performance. Substituting a (316\text{L}) valve for a (304\text{L}) valve is a change. Substituting a different gasket material is a change. Raising a setpoint is a change. Running a unit on a bypass "just for this week" is a change.
MOC must address, before the change is implemented: the technical basis, the impact on safety and health, modifications to operating procedures, the authorization required, the necessary period of the change if temporary, and training of affected personnel. Process safety information and P&IDs must then be updated.
Temporary changes are the classic failure mode. A temporary connection installed for a specific reason, with no defined expiry and no update to the drawings, becomes permanent by default and is invisible to the next hazard analysis. Every MOC for a temporary change must carry an expiry date and a documented restoration step.
6. Why Transients Carry Disproportionate Risk
Steady-state operation is the condition the process was designed for, the condition the control loops were tuned for, and the condition the operators see every day. Startup and shutdown are none of those:
- Composition passes through the flammable range as inventory is established or removed.
- Equipment operates outside design conditions — pumps below minimum flow, exchangers with one side dry, columns below turndown, compressors near surge.
- Instruments read outside calibrated spans, so the operator's picture of the plant is least reliable exactly when the process is least stable.
- Interlocks are frequently bypassed to permit startup, removing protection layers at the moment of greatest hazard.
- Non-routine tasks demand manual intervention, and the procedures for these phases are used rarely and therefore practiced rarely.
The engineering response is to write, review, and drill the transient procedures with the same rigor applied to the steady-state case, to define explicitly which interlocks may be bypassed and under what time-limited authorization, and to require a documented startup readiness review rather than a verbal handoff.
A unit's written procedure for the heat-up phase lists valve line-ups and a temperature ramp schedule but does not state the maximum shell temperature, what happens if it is exceeded, or what the operator should do about it. Under 29 CFR 1910.119(f), is this procedure adequate?
A vessel that has been open to atmosphere for maintenance is to be returned to propane service. An operator proposes admitting propane directly to displace the air, arguing that propane is heavier than air and will push the air out through the top vent. Evaluate this.
During a run, a failed 316L stainless steel control valve is replaced with a 304L valve of the same size, pressure class, and C_v because it is the only one in the warehouse. The service is warm chloride-bearing cooling water. What does process safety management require?