Process safety management is the set of practices that keep hazardous materials and energy where they belong. It matters most in refining, gas processing, chemicals, power, and other energy operations where a rare failure can have severe consequences.
This guide summarizes the elements in OSHA's PSM standard, then focuses on management of change: the review that catches a modification, bypass, or procedure change before it introduces a new hazard. A worked example shows how a routine instrument replacement could have shifted a safety trip. Whether specific regulations apply to your site is a question for your safety and compliance professionals.
Before You Start
Why Process Safety and Change Control Matter
Low-Frequency, High-Consequence Events
A fire, release, or explosion is rare but can be catastrophic. Process safety management targets the causes before they line up.
Changes Are a Common Root Cause
Many serious incidents follow a modification, a temporary bypass, or a procedure change that was not fully reviewed.
Leading Indicators Beat Lagging Ones
Counting incidents shows what already went wrong. Tracking overdue inspections and open changes shows what is about to.
Regulators and Insurers Expect It
Facilities handling highly hazardous chemicals face formal requirements. Even where none apply, the discipline reduces risk.
What Process Safety Management Is
Process safety management (PSM) is a framework for preventing catastrophic releases of hazardous materials and energy. In the United States, OSHA's Process Safety Management standard, 29 CFR 1910.119, applies to processes involving certain highly hazardous chemicals above threshold quantities, and the EPA's Risk Management Program has related requirements. Whether a rule applies to a given site depends on the chemicals, quantities, and jurisdiction, so confirm with your safety and compliance professionals.
The Center for Chemical Process Safety (CCPS) describes a broader approach called Risk Based Process Safety. The elements below are the ones in the OSHA standard.
| Element | What it is for |
|---|---|
| Employee participation | Involve workers in hazard analysis and other elements |
| Process safety information | Documented hazards, technology, and equipment information |
| Process hazard analysis (PHA) | A systematic review of hazards, using methods such as HAZOP or What-If |
| Operating procedures | Clear, current instructions for normal, abnormal, and emergency operation |
| Training | Initial and refresher training for those who operate the process |
| Contractors | Safe work practices and qualification for outside workers |
| Pre-startup safety review (PSSR) | Confirm new or changed facilities are ready before startup |
| Mechanical integrity | Inspection, testing, and maintenance of critical equipment |
| Hot work permit | Control of ignition sources during welding and cutting |
| Management of change (MOC) | Review and approval of changes before they are made |
| Incident investigation | Investigate incidents and near misses and act on the findings |
| Emergency planning and response | Prepared plans and drills |
| Compliance audits | Periodic audits of the program |
| Trade secrets | Access to information needed for the other elements |
Management of Change
Management of change is the discipline of reviewing any modification to equipment, procedures, materials, or operating conditions before it is implemented, so that a change intended to help does not introduce a new hazard. "Change" includes more than a big project: a different instrument range, a substitute gasket, a new setpoint, or a temporary jumper all count.
| Change type | Typical control |
|---|---|
| Permanent change | Full MOC review before implementation. |
| Temporary change | MOC with a defined end date, an owner, and a review before it can be extended. |
| Emergency change | Fast approval path with a documented review completed promptly after the fact. |
| Replacement in kind | Usually exempt from MOC, but the definition of "in kind" must be strict and written. |
Worked Example: Replacing a Level Transmitter
A maintenance team plans to replace a failed level transmitter on a separator with a newer model that has a different measurement range. The change looks routine. The MOC review finds otherwise. The steps are illustrative.
| MOC step | What the team found or did |
|---|---|
| Request | Replace transmitter LT-101 with a model measuring 0–100 inches instead of 0–80 inches. |
| Technical basis | The new range changes the scaling of the level reading and the alarm and trip setpoints stored in the control system. |
| Hazard review | A high-level trip set at 72 inches on the old scale would trigger at a different real level unless re-scaled. Left as is, the vessel could overfill before the trip acts. |
| Approve | The operations manager and process safety engineer approve, with conditions to re-scale and test. |
| Implement | Install the transmitter, re-scale the control system, and set the trip to the same real level as before. |
| Update and train | Update the P&ID and setpoint list, brief operators on the new range, and revise the calibration procedure. |
| Pre-startup review | A second person confirms the trip functions at the correct real level using a test, then signs off. |
| Close out | The MOC is closed with documents attached, and the record is checked at the next audit. |
The change that looked like "replace in kind" would have shifted a safety trip. The MOC process caught it before startup.
Leading indicators to track
- Open MOCs past their due date: for example, 3 of 24 opened this quarter (12.5%) are overdue.
- Temporary changes past expiry: for example, 2 temporary bypasses remain in place after their end dates.
- Overdue safety-critical inspections and tests: a count and percentage, reviewed monthly.
- Action items from hazard analyses and incident investigations that remain open.
The Management of Change Register Template tracks these automatically, including days open and temporary changes past expiry.
Layers of Protection
Process safety rests on the idea that no single safeguard is perfectly reliable. Several independent layers are placed between a hazard and its consequence, so that if one fails, another may still act. Understanding the layers explains why a change to any one of them needs review.
Why this matters for change. A replaced instrument with a different range, a changed alarm setpoint, a new relief valve size, or a revised operating procedure can each alter the performance of a layer. The management of change review asks, for each change, which layers are affected and whether they still perform.
Independence. Layers that share a cause, such as the same power supply or the same sensor, may fail together. Changes that introduce common points of failure reduce the real protection.
Inherently safer thinking first. Reducing the hazard, through less inventory, less hazardous materials, or milder conditions, is more reliable than adding protective layers. Consider it whenever a change is proposed.
Keeping Management of Change Effective
A management of change procedure only protects the site if it is used every time, for every kind of change that can matter. The following practices keep it working.
- Define what is a change, and what is a replacement in kind, in writing. Unclear boundaries are the main source of unreviewed changes.
- Cover temporary changes and emergency changes. Temporary changes should have an end date and an owner, and they should be reviewed before they expire. Emergency changes need a fast route that still gets a review afterwards.
- Include organizational changes, such as staffing levels, shift patterns, or contractor use, where they affect safe operation.
- Review before startup. A pre-startup safety review confirms that construction matches the design, procedures are updated, training is complete, and recommendations are closed.
- Update the records. Drawings, procedures, training material, and risk analyses should reflect the change. Outdated documents cause later errors.
Learn from incidents. Investigations of serious process incidents often find a change that was not reviewed, or one whose review missed an effect. Audit the procedure by sampling recent changes and checking that the review was complete, and use near-misses and incident findings to improve it.
Culture. People should feel able to stop a change when they have concerns, and leaders should reward that. Regulations such as the US OSHA Process Safety Management standard require management of change for covered facilities; check the requirements that apply to you with qualified professionals. See the Outage Planning Guide and the Management of Change Register. This guide is educational and is not engineering, safety, or legal advice.
Self-Assessment Questions
- Do people know what counts as a change, and is "replacement in kind" defined in writing?
- Are temporary changes given an end date and an owner?
- Does every change get a hazard review by someone independent of the request?
- Are drawings, procedures, and training updated before startup, not after?
- Do we track leading indicators such as overdue MOCs and safety-critical inspections?
Common Mistakes
Treating Small Changes as Exempt
A small change to a setpoint, range, or material can defeat a protection. Keep the "in kind" definition narrow.
Temporary Changes That Become Permanent
Bypasses and jumpers left in place past their date quietly become the new design. Track expiry.
Closing Before Documents Are Updated
If drawings and procedures lag the plant, the next person works from wrong information.
Counting Only Injuries
Recordable injury rates say little about process safety. Track leading indicators and near misses as well.
Process Safety and Management of Change: Frequently Asked Questions
What is management of change (MOC)?
Management of change is a formal review and approval process applied to modifications of equipment, procedures, materials, or operating conditions before they are implemented. It checks the technical basis and safety impact, updates documents and training, confirms readiness before startup, and closes the change out, so a change does not introduce an unreviewed hazard.
Is OSHA's PSM standard the same as process safety in general?
OSHA's Process Safety Management standard, 29 CFR 1910.119, is a U.S. regulation with defined scope and 14 elements, and it applies to processes involving certain highly hazardous chemicals above threshold quantities. Process safety as a discipline is broader and applies to any operation where a loss of containment could cause serious harm, whether or not a specific rule applies.
What are leading indicators in process safety?
Leading indicators measure the health of the safeguards that prevent incidents, such as the percentage of overdue safety-critical inspections, open management-of-change items, temporary changes past expiry, and open hazard-analysis actions. They warn of rising risk before a release or injury occurs, unlike lagging indicators, which count incidents that already happened.
Sources and Further Reading
- OSHA, Process Safety Management of Highly Hazardous Chemicals, 29 CFR 1910.119.
- Center for Chemical Process Safety (CCPS), Guidelines for Risk Based Process Safety.
- American Petroleum Institute, API RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries.
- Trevor Kletz, What Went Wrong? Case Histories of Process Plant Disasters and How They Could Have Been Avoided.