OSHA PSM Enforcement

Thanks to the President’s Executive Order on Improving Chemical Safety and Security (EO 13650) there are a couple of efforts underway to improve the OSHA Process Safety Management (PSV) program. There are a number of different suggestions under discussion that would expand various parts of that program. Unfortunately, the expansion of the PSM program will do little to increase industrial safety because of the enforcement model being used by both PSM and the EPA’s Risk Management Program; they are both reactive rather than pro-active enforcement programs.

Infrequent Inspections

One of the things that most major industrial accidents, certainly the ones that have made the biggest splashes in the news, have in common is that in describing the incidents the news media almost always reports that it has been years since an OSHA inspector was in the facility. The simple reason for this is that there are simply way too few inspectors available (in both the Federal and the affiliated State programs) to be able to make more frequent inspections possible.

So OSHA inspectors show up after serious accidents, do their inspections/investigations and record numerous shortcomings. While many of the shortcomings reported have little to do with the incident at hand, invariably there are some that would have apparently prevented the accident if they had been corrected earlier. And in hindsight, these problems would have been pretty easy to spot.

The easy way to make the OSHA PSM program more effective would be to increase the inspection force so that every covered facility gets inspected at some reasonable frequency. Of course, there is no way that Congress will fund a hundred fold increase in the size of the OSHA inspection force. An adequately sized inspection force is not an option.

So we need to find a way to make the current inspection force more effective. And I think that we can turn to the DHS Chemical Facility Anti-terrorism Standards (CFATS) program for a potential solution.

CFATS Program

The CFATS program has its own problems, but lack of inspector contact with the facilities is not one of them. Now the inspection force to facility ratio is better at ISCD than with either OSHA PSM or EPA RMP, but those programs do not require either agency to approve the respective plans prior to their enforcement. But neither do the OSHA or EPA inspections typically require the same level of detail as do the CFATS visits which typically involve 3 to 5 inspectors at a time.

Still, the amount of detail involved in a CFATS pre-approval inspection requires that when an inspection team arrives at a facility that they already have a good understanding of the issues involved at that facility and they come prepared to look for specific information. The Chemical Security Inspectors are aided in this by the information that the facilities are required to provide via the Chemical Security Assessment Tool (CSAT), a secure on-line tool that requires facilities to provide information about the facility, the chemicals it has on site, and the security measures in place to protect those chemicals from terrorist attack.

The information provided and the analysis of that information by the ISCD headquarters staff and their contractors allows the inspectors to arrive at the facility with a pretty good understanding of the situation on the ground and the potential shortcomings that the facility has in its security program. This allows the CSI to quickly identify program problems and to work with the facility to develop a corrective action plan.

Require PSM Data Submission

A similar model could be used by the PSM (and RMP) program. OSHA could develop a PSAT (Process Safety Assessment Tool) based upon the CSAT model. It would be a secure on-line application that provided tools for facilities to:

• Register as potentially covered PSM sites (Register);

• Provide initial information about chemicals stored on site (PSM Screen);

• Provide information about the facility PSM program (PSM Plan); and

• Provide information about facility changes to PSM program (PSM Change).

The Register tool would provide facilities a way to provide point of contact information to OSHA and allow OSHA to provide passwords for selected individuals at the facility to access the PSAT.

The PSM Screen tool would be used by any facility that had PSM covered chemicals on site at greater than the PSM covered quantity to report that information to OSHA. OSHA would use this preliminary information to determine if the facility was actually covered under PSM and to establish a risk tier ranking based upon the number of employees potentially affected and the degree of risk posed by that particular combination of covered chemicals. Higher risk facilities would get more frequent and closer scrutiny.

All PSM covered facilities would be required to provide information on their program to OSHA via the PSM Plan tool. The amount of detail provided would depend on the assigned risk tier ranking. Lower risk facilities would be required to just answer a series of questions about their plan. Higher risk facilities would provide more detailed information. OSHA would be able to tailor the details required based upon the data provided in the PSM Screen submission.

Finally, facilities would use the PSM Change tool to provide OSHA with information about changes made to the PSM program. These changes could be driven by either process changes made at the facility or by inspection results.

PSM Data Analysis

The PSAT data would allow OSHA to have a better understanding of how various facilities were implementing the PSM program. This would, of course, require OSHA to have some additional data analysis capability.

A certain amount of this data analysis could be strictly computer based. Initial computer screening of PSM Screen data would provide OSHA with a much more complete picture of the use of hazardous chemicals in industry. This would enable OSHA to work with industry groups to better enhance both their PSM enforcement activities and work with industry to upgrade process safety capabilities.

Computer based analysis of PSM Plan and PSM Change information would allow OSHA to identify obvious plan shortcomings and administratively request that the submitting organizations provide additional data on specific requirements. This alone may help those organizations improve their PSM programs without the need for inspector visits.

More detailed analysis of the PSM Plan and PSM Change information will require analysis by subject matter experts (SME). OSHA would be able to contract out most of this analysis, increasing the agency efficiency without raising personnel overhead costs. This would also allow OSHA to expand and contract its base of SME as required.

This off-line analysis of PSM data would allow OSHA to gain a better understanding of the processes and programs under its regulatory purview. Data shortcomings would be communicated to facilities, again allowing for PMS improvements without the need for involving government inspectors. Severe shortcomings or particularly dangerous situations could be identified early allowing for proactive regulatory visits rather than waiting for accidents and incidents to occur before an inspection team arrives at the facility.

The PSM Change tool would then become a particularly effective way for OSHA to track the responses to inspection discovered deficiencies. Adequate responses would not require inspector re-checks and clearly inadequate responses could be dealt with quickly. Most responses would fall somewhere in between and could be addressed by requests for additional information. Inspection team efficiency would be greatly increased.

Finally, this data analysis would ensure that an OSHA inspector headed to a facility would have a great deal of readily available information available before entering the facility. It would also allow for prioritizing the areas requiring detailed looks by that inspector. It could also allow for assigning an inspector with a particular area of expertise, again increasing the efficacy of the inspection program.

Increasing OSHA Efficiency

It is increasingly obvious to even the most uneducated observer that the current OSHA inspection program is woefully inadequate. It is also apparent that this is not due to poor inspection force, but rather to an inadequate inspection force. Since Congress is extremely unlikely to significantly expand the force, OSHA needs to take significant efforts to increase the efficiency of the inspection force particularly if there are going to be any major expansions of the coverage or requirements of the PSM program.

One way of increasing the efficiency is to provide more information to the PSM program, allow for better analysis of the available information, and to better target the inspection activities of the existing inspection force. The establishment of a PSAT program would provide OSHA with the tools to do all three.

ICS and OSHA PSM

In doing this week’s review of public comments on the OSHA PSM ANPRM I made a brief mention of a comment that suggested the addition of requirements for reviewing control systems in the Process Safety Management program. I thought that those comments deserved a bit more attention in this blog.

Control Systems and PSM

The comments were posted by Terry Hardy, the Director of Safety and Risk Management at Great Circle Analytics, LLC. Mr. Hardy makes a very important point about control systems in the opening portion of his comments about safety in the chemical process and energy production industries:

“Because computing systems are increasingly being used to control critical functions, software may directly contribute to an accident. Software can also be used in hazard controls to reduce risks, and computing systems can provide valuable information used to help make safety decisions. Therefore, software must be included as part of an organization’s safety efforts to analyze and manage hazards and risks. However, for many organizations, software is not effectively incorporated into the safety process. I have collected hundreds of examples of software-related accidents and incidents – the following are a sample of those accidents.”

Hardy provides brief descriptions of two separate catastrophic accidents where control system issues contributed to exacerbating the incident; the 2005 explosion at a natural gas decompression/recompression facility near Empress, Alberta and the 1999 gasoline pipeline rupture and fire in Bellingham, WA. The descriptions provided include a discussion of how the control systems contributed to the incidents.

He goes on to make the point that control system software developers have an integral part to play in the development of safe control system software. He points at standards “such as IEC 61511, Functional Safety - Safety Instrumented Systems for the Process Industry Sector, and DO-178B, Software Considerations in Airborne Systems and Equipment Certification” (pg 3) that provide guidance on how vendors can do their part to develop systems that have safety considerations built in to the control system package.

But, he goes on to point out that:

“Improving software safety requires a change in the way process safety practitioners think. Software safety must be fully integrated into the Process Safety Management process. Organizations need to increase the attention given to addressing and analyzing the potential for hazards related to software, computing systems, and automation.”

Hardy then makes a number of specific recommendations:

• OSHA should consider adding specific language to address software and computing systems to its Process Safety Management standard;

• Software and computing systems must be part of the elements of process safety including process safety information, process hazard analysis, management of change, operating procedures, contractors’ obligations, compliance audits, pre-start-up safety review, and training;

• Create specific regulations for software and computing system information to be provided by an operator as part of the PSM process; and

• Particular attention should be paid to the human-computing system interface and how the operator interacts with the computing system.

Control System Security

Hardy does not address this in his comments, but it seems to me that any discussion of control systems and process safety management must include at least some minimal discussion of control system security.

Both the OSHA Process Safety Management Program and the EPA’s Risk Management Program were instituted well before the 9/11 attacks made it clear that the United States was no longer (if it ever truly was) exempt from terrorist attacks. As a result neither program ever considered process security as a part of process safety and that has not changed significantly since the fall of the Twin Towers.

The Stuxnet virus made it clear that modern industrial control systems, even those physically isolated from the Internet, are susceptible to outside attack. With control system automation allowing for the increased complexity of chemical process engineering and design, it is becoming increasingly difficult for a limited number of operators to monitor and safely control modern chemical manufacturing processes without nearly blind reliance on the data provided by modern control systems. With those twin facts in mind, it is becoming increasingly obvious that safe operation of modern chemical manufacturing processes ultimately depends on the security of the control systems used in those processes.

It is certainly time for OSHA to start to consider how control system security, and probably process security in general, should be included in the process safety management program. Protecting control systems and manufacturing processes from outside control or interference should be a central part of the safety process. Industry, government and worker organizations should begin to discuss what level of basic cybersecurity should be an integral part of any process safety system.

NOTE: A copy of this blog post was just submitted as a comment on the OSHA PSM ANPRM 08:31 CST 3-16-14