3.4 Operating Procedures, Training, Contractors, and PSSR
Key Takeaways
- Operating procedures under 1910.119(f) must cover each operating phase — initial startup, normal, temporary, emergency shutdown, emergency operations, normal shutdown, and startup after a turnaround or emergency shutdown — plus limits, consequences, safety and health considerations, and safety-system functions
- Procedures must be readily accessible to employees who work in or maintain the process and must be certified at least annually as current and accurate
- Operator training is required initially and refresher training at least every three years (more often if needed), with a record of the employee’s identity, the date, and the means used to verify understanding
- The host employer informs the contract employer of known fire, explosion, and toxic hazards and applicable emergency provisions, and evaluates contractor safety performance; the contract employer trains its employees and documents that training
- PSSR is required for new facilities and for modifications significant enough to require a change in PSI, and must confirm design-spec construction, adequate procedures, PHA recommendations resolved or MOC met, and training complete before highly hazardous chemicals are introduced
Once PSI exists and a PHA has named the hazards, OSHA still expects written instructions, trained people, controlled contractors, and a gate before charging. Those four elements are 1910.119(f), (g), (h), and (i). They are the CIRO’s daily language: how we start, how we stop, who is allowed in the engine room, and whether a weekend piping change is allowed to see ammonia on Monday morning.
ANSI/IIAR 7 is the ammonia-industry standard for developing operating procedures; it is RAGAGEP-adjacent help for writing the book. This section teaches the OSHA minimums. IIAR 7 depth lives with the IIAR chapter.
Operating procedures — 1910.119(f)
The employer must develop and implement written operating procedures that provide clear instructions for safely conducting activities in each covered process, consistent with the process safety information. Vague tribal knowledge (“crack the king valve until it sounds right”) is not a procedure.
Steps for each operating phase
Procedures must address steps for each of these phases:
| Operating phase | Ammonia-plant meaning |
|---|---|
| Initial startup | First charge and first run of a new or newly assembled process — the PSSR must already have passed |
| Normal operations | Steady refrigeration: compressor sequencing, levels, defrost as designed, oil management |
| Temporary operations | Running with a package isolated, a condenser cell down, or a bypass that is still inside the safe envelope |
| Emergency shutdown | When shutdown is required, and who is assigned to execute it so it happens safe and timely |
| Emergency operations | Running or isolating under abnormal conditions that are not yet a full shutdown — for example, evacuating a room while keeping a critical load on another package if the PHA and procedures allow it |
| Normal shutdown | Planned pump-out and isolation for maintenance |
| Startup following a turnaround, or after an emergency shutdown | Restart is not the same as initial startup; trapped liquid, air, and closed valves are the usual killers |
Emergency shutdown must include the conditions that require it (detection at emergency levels, fire, major leak, relief lift into an occupied path) and assignment of shutdown responsibility to qualified operators. A procedure that says “someone should hit the big red button” without naming who is qualified on nights fails this bullet.
Operating limits, health, and safety systems
Procedures must also include:
- Operating limits — the same safe upper and lower bands that live in PSI — plus the consequences of deviation and the steps to correct or avoid deviation. If high-side pressure is climbing, the procedure says what to do (more condenser, unload, shutdown) and what happens if you do not (relief lift, release, vessel overpressure).
- Safety and health considerations — properties and hazards of the chemicals; precautions to prevent exposure including engineering controls, administrative controls, and PPE; what to do if contact or airborne exposure occurs; quality control of materials and control of hazardous chemical inventory levels; any special or unique hazards (hot-gas defrost liquid, oil-pot opening, confined machinery pits).
- Safety systems and their functions — what the detector, emergency ventilation, ESD, high-level cutout, and oil-pressure safety do, not just that they exist.
Access, annual certification, and safe work practices
Operating procedures shall be readily accessible to employees who work in or maintain a process. A controlled electronic folder that operators can open on the machinery-room terminal counts; a locked office binder on a superintendent’s desk does not.
The employer shall review procedures as often as necessary so they reflect current operating practice, including changes in chemicals, technology, equipment, and facilities. The employer shall certify annually that the operating procedures are current and accurate. Annual certification is a dated management act, not a hope. If the P&ID changed in March and the SOP still shows the old dual-relief arrangement in November, the certification was false.
The employer shall develop and implement safe work practices to control hazards during lockout/tagout, confined space entry, opening process equipment or piping, and control over entrance into a facility by maintenance, contractor, laboratory, or other support personnel. Those practices apply to employees and contractor employees. Opening an oil pot or a strainer is “opening process equipment.” It is not a casual wrench job even if “we only expect oil.”
Training — 1910.119(g)
Each employee involved in operating a process, and each employee before being involved in a newly assigned process, shall be trained in an overview of the process and in the operating procedures. Training shall emphasize specific safety and health hazards, emergency operations including shutdown, and safe work practices applicable to the job.
Refresher training shall be provided at least every three years, and more often if necessary, so the employee understands and adheres to current procedures. The employer, in consultation with the employees who operate the process, determines whether more often than three years is needed. A plant that changed defrost logic last month and waits 35 months to retrain has not met “more often if necessary.”
The employer shall ascertain that each operating employee received and understood the training, and shall prepare a record with:
- the identity of the employee,
- the date of training, and
- the means used to verify that the employee understood the training.
A sign-in sheet with no verification is incomplete. Verification can be a written quiz, a walk-through of an emergency shutdown, or observed pump-out under supervision — but the means must be in the record. Three-year refresher is not the same as the five-year PHA revalidation or the (later) three-year compliance audit. Do not mix those clocks.
Contractors — 1910.119(h)
This element applies to contractors doing maintenance or repair, turnaround, major renovation, or specialty work on or adjacent to a covered process. It does not apply to incidental services that do not influence process safety (janitorial, food service, laundry, delivery of supplies away from the process). The millwright opening the screw compressor is in; the sandwich truck in the parking lot is out.
Host employer (the plant) shall:
- obtain and evaluate information on the contract employer’s safety performance and programs;
- inform the contract employer of known potential fire, explosion, or toxic release hazards related to the contractor’s work and the process;
- explain the applicable provisions of the emergency action plan;
- implement safe work practices that control entrance, presence, and exit of contract employers and contract employees in covered process areas;
- periodically evaluate contractor performance against those duties;
- maintain a contract employee injury and illness log related to work in process areas.
Contract employer shall:
- assure each contract employee is trained in the work practices needed to do the job safely;
- instruct each contract employee in the known fire, explosion, or toxic hazards related to the job and the process, and in the applicable emergency action plan provisions;
- document that each contract employee received and understood the training, with identity, date, and means of verification;
- assure contract employees follow the facility’s safety rules, including the safe work practices of 1910.119(f)(4);
- advise the host of unique hazards the contractor’s work presents or finds.
The split is exam-critical. The host does not take over the contractor’s craft training, but the host does brief hazards and the EAP and does evaluate the contractor’s safety record before inviting them to pull heads next to a live recirculator. The contractor does train and document its own people. “They are union, so we assumed they knew ammonia” is not a host evaluation.
Pre-startup safety review — 1910.119(i)
PSSR is required for new facilities and for modified facilities when the modification is significant enough to require a change in the process safety information. Replacement-in-kind that does not change PSI is not a PSSR trigger (it may still need mechanical integrity and a work order). Adding a vessel, changing relief paths, altering inventory, or redrawing P&IDs is a PSSR trigger.
Before the introduction of highly hazardous chemicals to the process, the PSSR shall confirm:
- Construction and equipment is in accordance with design specifications.
- Safety, operating, maintenance, and emergency procedures are in place and adequate.
- For new facilities, a PHA has been performed and recommendations have been resolved or implemented before startup. For modified facilities, the change meets management of change (1910.119(l)) — taught in the next chapter; here you only need to know PSSR checks that MOC was done.
- Training of each employee involved in operating the process has been completed.
That fourth bullet is why you do not charge a new recirculator on Sunday and “train on Monday while it is running.” Ammonia stays out until operators who will start and stop the new equipment have been trained. PSSR is the last hard gate between a project punch list and a live highly hazardous chemical. Skipping it to make a production date is how plants put an unresolved PHA recommendation and an untrained night operator in the same room as a full charge.
Put the four elements in order on a real job: write procedures from PSI, train (and record verification), brief and evaluate contractors who will hot-work or open equipment, then PSSR before charge. Mechanical integrity, hot work permits, MOC paperwork, incident investigation, emergency/RMP, and audits continue after startup — they are the next chapter, not a substitute for this gate.
How often must the employer certify that PSM operating procedures are current and accurate?
For employees involved in operating a covered process, OSHA requires refresher training:
A plant adds a high-pressure receiver that changes maximum intended inventory and the P&IDs. When is a pre-startup safety review required, and what is the chemical-introduction rule?
A host ammonia plant hires a contractor to overhaul a screw compressor adjacent to a covered process. Which duty belongs to the host employer under 1910.119(h)?