Process Safety Management (PSM): The Core Elements and the Lessons of Major Accidents

How does process safety differ from occupational safety?

Occupational safety deals with personal injuries: falls, slips and cuts. Process safety deals with a different kind of hazard: loss of containment of flammable or toxic materials, which can lead to a fire, an explosion or a release that reaches beyond the site boundary.

Confusing the two is a recurring lesson. One of the lessons drawn in an analysis of Piper Alpha is the priority given to personal safety over process safety ^[4], and the US Chemical Safety Board (CSB) recommendations after Texas City address the absence of process safety performance indicators. ^[3] A site can log millions of hours without an injury while its barriers against a major accident erode.

What did the major accidents reveal?

Piper Alpha (North Sea, 6 July 1988): 167 men died. The inquiry judged the most likely cause to be a condensate leak from a blind flange that had not been secured or tested, fitted in place of a pressure safety valve removed for maintenance. Maintenance permits were suspended overnight, and the operators did not know the valve was missing because permit information was not reliably passed on at shift handover. ^[4]

Texas City (United States, 23 March 2005): 15 workers were killed and 180 injured during the restart of an isomerisation unit. A distillation tower flooded with hydrocarbons and over-pressurised, sending material out of a vent stack, and many of the victims were in work trailers nearby. The CSB recommendations covered multiple level indicators, automatic controls to prevent overfilling, adequate staffing and supervision during start-up, fatigue prevention, and management of change for reorganisations and budget cuts. ^[3]

What are the elements of OSHA 1910.119?

The US regulation on process safety management of highly hazardous chemicals sets 14 elements for covered facilities. Coverage includes, for example, a Category 1 flammable gas or a flammable liquid with a flashpoint below 100°F held on site in one location in a quantity of 10,000 lb or more, with specific exemptions. ^[1]

Source: ^[1]

Implementation details matter as much as the headings. An incident investigation needs a team that includes at least one person knowledgeable in the process involved, plus contract employees where the incident involved their work. Issuing the report is not enough: there must be a system to address its findings and recommendations promptly and to document the corrective actions. ^[1]

How does the RBPS framework extend these elements?

The Center for Chemical Process Safety (CCPS) of the American Institute of Chemical Engineers offers the Risk Based Process Safety (RBPS) framework, which can be designed and implemented at different levels of rigour. It has 20 elements under four pillars: ^[2]

• Commit to process safety: process safety culture, compliance with standards, competency, workforce involvement and stakeholder outreach.
• Understand hazards and risk: process knowledge management, and hazard identification and risk analysis.
• Manage risk: operating procedures, safe work practices, asset integrity and reliability, contractor management, training and performance assurance, management of change, operational readiness, conduct of operations and emergency management.
• Learn from experience: incident investigation, metrics, auditing, and management review and continuous improvement.

Among the most notable additions compared with the OSHA list are process safety culture, conduct of operations and metrics, and operational readiness, which extends to restarting existing units rather than only new or modified facilities. These are all areas where clear gaps appeared in both accidents.

Management of change: the element in every investigation

Before any change other than a replacement in kind, the OSHA standard requires the technical basis, the impact on safety and health, changes to operating procedures, the time period for a temporary change and the authorisation to be addressed. Affected employees must be informed and trained before start-up, and process safety information and procedures updated. ^[1]

A common weakness is limiting MOC to engineering modifications. The CSB recommendations at Texas City also covered organisational change: mergers, reorganisations, budget cuts and staffing changes. ^[3]

Hypothetical example: a “temporary” bypass of a level alarm

In a gas processing unit, a separator keeps tripping on a high-level alarm that operators believe is false, so the supervisor asks to disable it until the level instrument is repaired.

Under MOC, the reason for the request and the proposed compensating measure, such as an hourly manual level reading, are documented. A competent team assesses the effect of losing the alarm on overfill scenarios, the bypass is given an expiry date, and an authorised person approves it. Each shift crew is then told about the bypass and it is recorded in the handover log, and the request is closed by reinstating the alarm and proving it works. This is what was missing at Piper Alpha: critical information on equipment status did not reach the people who needed it. ^{[1, 4]}

How do you measure process safety performance?

The CCPS process safety metrics guide proposes four tiers, from the most severe events down to indicators of operating discipline. ^[5]

Tiers 1 and 2 are lagging indicators that count loss-of-containment events; Tier 3 captures events that challenged a protection layer, such as safety system activations or excursions beyond safe operating limits; Tier 4 is leading, covering items such as audit findings, overdue corrective actions and MOC performance. ^[5] The American Petroleum Institute (API) published the fourth edition of Recommended Practice 754 in August 2026, which treats Tiers 1 and 2 as suitable for public reporting and Tiers 3 and 4 for internal use. ^[6]

Where should your facility start?

The OSHA standard is a US regulation; in the Gulf states requirements are set by national regulators, operating companies’ standards and contractor agreements, so start by establishing which apply to you. Then review these points:

1. Management of change: does it cover temporary bypasses and organisational changes, and does every temporary change have an expiry date?
2. Permits to work and shift handover: are open permits and isolated equipment handed over in writing between shifts?
3. Start-up and restart: is there a documented readiness review and adequate supervision?
4. Location of people: are temporary and occupied buildings outside fire and blast impact zones?
5. Indicators: does management review Tier 3 and Tier 4 indicators, not just injuries?

Conclusion

Process safety management is a system for preventing the major accident, not a file for the auditor. Use the OSHA elements as a baseline and RBPS as the extension, and prioritise management of change, permits to work, shift handover and leading indicators, because failures in these areas recur in major accidents.