3.3 Process Hazard Analysis

Process hazard analysis (PHA) is 1910.119(e). PSI told you what the plant is. The PHA asks what the plant can do to people when deviations, failures, and bad decisions stack up. OSHA requires an analysis that is appropriate to the complexity of the process and that identifies, evaluates, and controls the hazards involved. A two-page checklist copied from another warehouse is not “appropriate” for a two-stage overfeed plant with hot-gas defrost, unless that checklist was built for this process and the team actually thought through the nodes.

When, and the five-year clock

Covered processes must have an initial PHA. OSHA originally staggered completion dates in the 1990s; CIRO candidates should not memorize those expired calendar dates as if they were still upcoming. What is always current: the PHA shall be updated and revalidated at least every five years by a team meeting the same qualifications as the original team requirement. Five years is a maximum interval, not a target to wait for. If you add a vessel, change the defrost method, or learn from a serious near miss, you do not sit on the old HAZOP until the fifth anniversary. Management of change (later chapter) and PSSR interact with PHA when the change is significant. Independent of MOC, the revalidation clock still ticks.

Priority among processes (when a company has several) considers the extent of the hazards, number of potentially affected employees, age of the process, and operating history. A rusty engine room with a history of liquid carryover and a dozen operators on two shifts outranks an isolated, simple package with a clean history — but both still need a competent PHA if they are covered.

The employer must retain the PHA and all updates and revalidations for the life of the process. Shredding last year’s HAZOP because a new one exists is how you lose the trail of unresolved recommendations.

Methods OSHA lists

The employer must use one or more of the following, or an appropriate equivalent methodology:

OSHA does not say “ammonia plants must HAZOP.” It says the method must fit the complexity. A CIRO should still recognize every name on that list. “We did a toolbox talk” is not a listed method.

What every PHA must address

Regardless of method, the analysis shall address all of the following:

1. The hazards of the process — toxic release, fire/explosion in the 15–28% flammable range, liquid hammer, overpressure, corrosion leaks, oil-system failures that send liquid ammonia the wrong way.
2. Previous incidents with a likely potential for catastrophic consequences in the workplace. That includes near misses, not only recordable injuries. A king-valve left cracked that vented to the roof is in scope even if nobody went to the hospital.
3. Engineering and administrative controls applicable to the hazards and their interrelationships — detection plus ventilation plus ESD plus SOPs plus PPE. The PHA should notice when every layer is a procedure and none is a hardwired cutout.
4. Consequences of failure of those controls — detector in bypass, ventilation off for winter noise, high-level float isolated, emergency stop behind a locked cage.
5. Facility siting — where people are relative to the engine room, occupied workrooms next to recirculators, control-room air intakes, truck docks under relief-discharge paths, whether a release in the penthouse can cascade into a production floor.
6. Human factors — labeling that looks identical on two valves, night-shift staffing of one person for an emergency shutdown, screens that hide superheat, fatigue during a 3 a.m. defrost jam, pressure to skip pump-out steps.
7. A qualitative evaluation of a range of possible safety and health effects of control failure on employees in the workplace. You do not need a full quantitative risk study to satisfy this bullet, but you must think through who gets hurt and how badly if the layers fail — from odor and eye irritation up through IDLH and fire.

Facility siting and human factors are the items plants skip because they feel “soft.” OSHA listed them on purpose. A HAZOP that only discusses valve failures and never asks where the forklift driver stands during a release is incomplete.

Team composition

The PHA shall be performed by a team with expertise in engineering and process operations. The team shall include at least one employee who has experience and knowledge specific to the process being evaluated and one member who is knowledgeable in the specific PHA methodology being used. That is two distinct seats:

• A person who has run this ammonia process (or one like it in a meaningful way) — the CIRO, lead operator, or technician who knows that the “manual” defrost actually gets jumped because the drain pan overflows.
• A person who knows HAZOP or whatever method you chose — often a facilitator. That person can be a consultant, but a consultant who has never seen an overfeed ratio cannot replace the process-experienced employee.

A plant manager alone, a corporate safety director who last visited during commissioning, or a facilitator with no operator in the room fails the team test. Employee participation (previous section) is how you get that operator into the study and how employees see the report afterward.

Findings are not souvenirs

OSHA does not allow a PHA binder that ends with “recommendations — see appendix” and a dusty appendix. The employer shall establish a system to promptly address the team’s findings and recommendations; assure that recommendations are resolved in a timely manner and that the resolution is documented; document what actions will be taken; complete actions as soon as possible; develop a written schedule of when remaining actions will be completed; and communicate the actions to operating, maintenance, and other employees whose work assignments are in the process and who may be affected.

Resolved can mean implement the safeguard or document a technically sound reason the recommendation will not be implemented — not “we disagree, ignore.” “As soon as possible” is not “next capital cycle in four years” for a missing isolation valve that the team said was the only way to pump out without entering a plume. Communication means the people who isolate king valves hear that the procedure and the tagging changed.

Ammonia nodes worth sweating in a PHA

Use these as mental drills; they are teaching examples, not an official OSHA node list:

• Hot-gas defrost: reverse flow, liquid accumulation, soft equalization skipped, drain-pan relief, check-valve failure sending high pressure to a low-side vessel.
• King valve and pump-out: opening process equipment, trapped liquid expansion, hoses, and who stands where.
• Oil draining and oil pots: opening a pot that still holds liquid ammonia, not just oil.
• High-level and low-level controls on surge drums and recirculators; bypassed floats; single-element level with no independent high-high.
• Relief discharge path and whether it creates a new occupied-space hazard (siting).
• Emergency shutdown that requires two people when only one is on nights (human factors).

Those nodes will show up again in mechanical integrity, hot work, MOC, and emergency planning. The PHA is where you find them. Later elements are where you keep the controls working.