Process Safety Finding Subset Mechanical Integrity

Finding
1.

The facility has not implemented applicable standards and practices to control the critical aspects of all facility operations as
required by the Process Safety Guideline. Continuity testing of alcohol transfer lines to vessels or testing of earthing systems
designed to prevent static electrical charge buildup during the charging of solids into alcohol containing vessels is not
performed.

2.

Integrity testing is conducted for some hazardous material transfer lines but the activities are not listed in the computerized
maintenance program as required by the Pfizer Process Safety Management Guideline, Section 1.3.5.

3.

A list of Safety Critical Equipment and Instrumentation has not been identified as required by the Process Safety Guideline,
Section 11.6.5.

4.

The facility was unable to provide documentation of follow-up continuity testing of alcohol transfer lines or testing of earthing
systems designed to prevent static electrical charge buildup in the ethanol processing system as required by the Process
Safety Guideline.

5.

The facility does not fully meet the inspection and maintenance requirements of the Process Safety Guideline Section 11.6.5:
It was observed that:
Relief valves on the solvent discharge pumps are not pressure tested; and
Five of twelve locks used to secure the solvent loading caps were not in place or the device to secure locks is damaged.
These caps are not included in the department inspection program.

6.

Specialty piping items used as a basis for process safety (e.g. restrictive flow orifices, check valves) have not been fully
identified as safety critical for establishing appropriate maintenance routines and intervals as required by Section 11.6.5 of the
Process Safety Guideline.

7.

A number of mechanical items, including ammonia transfer lines, flame arrestors and non-return (check) valves are not
included in the preventive maintenance program as required by Section 11.6.5 of the Process Safety Guideline.

8.

Currently mechanical integrity inspections are done on a semi-annual basis following written Pfizer procedures and tracked
using an excel spreadsheet that is maintained and used by the contractor. Production also tracks the inspection work that
needs to be done. This results in two separate data management systems. While this manner of conducting inspections has
not presented a compliance problem, it is burdensome for demonstrating compliance and also presents an opportunity for
data that is not in alignment between the two systems.

9.

Scheduled maintenance for PSE devices (rupture disks) is not documented in the computerized maintenance system as
required by the Process Safety Guideline Section 11.6.5.

10. Check valves are used extensively in the operations to provide isolation of the nitrogen supply from process streams as
required by plant policy. In some situations, there appears to be potential for contamination of sections of the nitrogen header
due to faulty check valve operation. These valves are not presently identified for scheduled maintenance and this particular
hazard has not been assessed per requirements of 29 CFR 1910.119 (e) (3).
11. The facility installed a low pressure mechanical relief device to serve as emergency relief for tanks # 1, 2, and 3. The device is
not listed in the mechanical integrity program for periodic testing, nor are the other pressure relief devices associated with
these tanks.
12. Blanking caps were not attached to several open-ended hazardous chemical lines fitted with ball valves in the production
building as required by standard operating procedures.
13. Not all of the process equipment in the Kilo-Lab has been routinely tested as required by Regulations. Examples of
equipment include: six reactors, two steam reducers, and two nitrogen reducers. The facility has identified this problem,
included the items on the written scheme of inspection and arranged for inspection and testing of the equipment to be
completed during shutdown.
14. The facility does not have a smoke detector in the electric panels room to warn of electric loss in the event of a fire nor does it
conduct annual grounding/bounding inspection in the flammables storage area as required by Section 4.6.1 of the Incident
Preparedness and Response Guideline.

Process Safety Finding Subset MODELING

Finding
1.

The Chemical Production unit has not modeled the worst-case credible release of flammable materials to evaluate if these
scenarios could result in harm to colleagues or the community as required by Section 11.6.3 of the Process Safety Guideline.

2.

Sufficient toxicology research (OELs and ERPGs) has not been completed to allow consequence modeling of potential off-site
effects from spills of cyclohexanone, ethyl cyanoacetate, and di-N-propylamine as required by the Process Safety Guideline,
Section 11.6.3.

3.

The facility has not completed consequence modeling for releases of a number of flammable substances as required by
Section 11.6.3 of the Process Safety Guideline.

4.

The facility has not carried out dispersion modeling for Toxic Volatiles (e.g., anhydrous Hydrogen Chloride) or flammable
liquids with a potential for release of greater than 500 liters, as required by the Process Safety Guideline, Section 11.6.3.

5.

The facility has not modeled the worst-case scenario of an alcohol release as required by Section 11.6.3 of the Process
Safety Guideline.

6.

Dispersion modeling has not been completed for all processes with the potential for release of highly hazardous substances
as required by the Pfizer Process Safety Management Guideline, Section Process Safety 4.

7.

The facility has not conducted dispersion modeling for the worse case credible scenarios for the 22-liter scale-up laboratory as
required by Section 11.6.3 of the Process Safety Guideline.

8.

The site has not conducted dispersion modeling for the worse case credible scenarios for the 22-liter scale-up laboratory as
required by Section 11.6.3 of the Process Safety Guideline.

9.

The facility has not modeled their worst-case releases of flammable materials to evaluate the potential harm to colleagues or
the community as required by Section 11.6.3 of the Process Safety Guideline. Isopropyl alcohol is stored in two (2) 3,000
gallon aboveground storage tanks.

10. The facility has not performed dispersion analysis to analyze the potential for a release of a flammable substance involving
500 liters or more as required by the Process Safety Guideline, Attachment 11D.
11. The facility has not conducted consequence modeling for flammable solvents used on site in quantities greater than 500 liters,
as required by the Process Safety Guideline, Section 11.6.3, Attachment D.
12. PHAs do not incorporate consequences of process safety incidents such as releases, fires, and explosions as required by 29
CFR 1910.119(e) (3) vii.

Process Safety Finding Subset INERTING

Finding
1.

In the hydrogen charging area for Building 1, a check valve is used to prevent back flow of hydrogen into the house nitrogen
system. Likewise, the same system exists in the HCl gas cylinder charge booth. The effectiveness of check valve usage in
this application is not established, required by Attachment 11E of the Process Safety Guideline.

2.

The Building 1 general emergency relief header/knockout tank is not presently nitrogen inerted, as required by Attachment
11E of the Process Safety Guideline.

3.

The emergency relief header/knockout tank is not maintained in a verifiable inert state as required by the Process Safety
Guideline Attachment, 11E.

4.

The solvent storage tanks for the Chemical buildings and waste solvent storage tanks at Building 1 are not inerted as required
by the Process Safety Guideline, Attachment 11E.

5.

Reverse flows in utility connections (nitrogen supply) are not provided to process equipment in Building 1 as required by
Section 11.6.4 of the Process Safety Guideline.
The intermediate storage vessel in the chemical building and the outside storage tanks used to store flammable liquids do not
have inerting capabilities to assure flammable vapors remain outside the explosive range as required by Process Safety
Guideline Section 11.6.4.

6.

7.

Inerting of the Building 1 emergency relief header/knockout tank is not verified on a regular basis as required by Attachment
11E of the Process Safety Guideline.

8.

Currently, the tank farm vessels are not inerted. The hazard analysis report states that whether or not to inert the tanks is
under review.

9.

The XXX unit for the process vapor header in Building 1 was reading an average oxygen content of 16%, not a sufficient level
of inerting for flammable vapor handling, or compliance with recognized and generally accepted good engineering practice as
required by 29CFR1910.119(d)(3)(ii).

10. Centrifuge operating instructions for Process #1 indicate a minimum required nitrogen flow rate of 29 / 30 scfm to maintain an
inert atmosphere. However, the equipment is not configured to ensure that the minimum flow rate is maintained throughout
the entire operation. Validated inerting was used as the basis of safety of this operation en lieu of on line O2 monitoring.
11. The emergency vent header tank (Building 1)) nitrogen inertion rotameter was closed contrary to the requirements of the
Process Safety Guideline Attachment 11E Good Engineering Practices. The rotameter shows evidence of contamination.

Process Safety Finding Subset EMERGENCY RELIEF

Finding
1.

Emergency relief vents on vessels handling highly hazardous processes are not directed to a catch tank as required by
Attachment 5 of the Process Safety Guideline.

2.

Emergency vent sizing calculations as per the Pfizer Emergency Release Guidelines, show emergency relief vents for
external flammable storage tanks to be undersized. There is currently no program to upgrade to adequate size.

3.

The Schenk catalyst filter, when full, has the potential to discharge catalyst into the emergency relief header, compromising
the containment of a dangerous material as required by Section 11.6.4 of the Process Safety Guideline.

4.

The facility has completed studies to determine emergency relief venting capacity for some credible scenarios, but have not
defined the worst case scenarios as required by the Process Safety Guideline, Section Process Safety 5. These typically
would be the hypothetical worst case runaway reaction and internal vapor space ignition.

5.

Nitrogen pressure relief valves vent inside closed rooms contrary to the requirements of Attachment 11E of the Process
Safety Guideline. An example is the centrifuge room in Building 1. The Guideline requires, control of the exhaust (and/or
possible leakage) of nitrogen. Since nitrogen is an asphyxiant, it must be managed so that it does not create an oxygen
deficient atmosphere in the operator's work area.

6.

The design basis for the emergency relief systems located on process vessels associated with the XXX process is not
documented as required by 29 CFR 1910.119 (d)(3).

7.

The facility had not implemented all design criteria required by Appendix 11E of the Process Safety Management Guideline.
The following design deficiencies were noted in emergency relief systems:
-IPA tank rupture disk vent releases about eight feet above IPA tank. System should be modified to vent into dyke near
ground; and
-Rupture disks on two of four portable vessels located in or near Building 1 were missing their ID/information tabs.

8.

Vessels #1 and #2 in Building 1 have not been provided with emergency relief.

9.

A vent for the co-generation Ammonia solution tank (outside Building 1)) is located such that the discharge is close to a light
fixture contrary to the requirements of the Process Safety Guideline Attachment 11E. A potential flammable atmosphere may
occur near light and water can accumulate in the relief discharge piping.

10. Relief devices on Tank #1 and #2 have been routed through flame arrestors.
11. The emergency relief valve for pump X in Building 1 does not necessarily protect the pump due to a manual valve between it
and the pump. Section 7.6.2 of the Basic Safety Guideline requires implementation of controls to assure safety of activities.

Process Safety Finding Subset Process Hazard Analysis

Finding
1.

Process hazard analyses (PHA) have not been conducted as per facilitys annual schedule. The schedule has not been
updated as required by the Process Safety Guideline.

2.

While a qualitative evaluation of the bulk alcohol storage tanks has been completed, a detailed Process Hazard Analysis has
not been conducted as required by the Process Safety Guideline.

3.

Section 4.2 of the Building 1 Process Safety procedure lists responsibilities for the key job functions to participate/coordinate a
process hazard analysis for each new process. It was noted that:
No process hazards analyses have been conducted to date; and
The checklist PHA format has not been developed.

4.

The facility does not carry out formal Process Hazard Analysis (PHA) as required by Section 11.6.3 of the Process Safety
Guideline.

5.

There is no system to periodically review Process Hazard Assessments (PHAs), at least once every five years, as required by
Section 11.6.3 of the Process Safety Guideline.

6.

Process hazard assessments do not fully consider the capabilities and limitations of the specific process equipment
designated for a product step as required by Section 11.6.3 of the Process Safety Guideline.

7.

The site does not have a formalized process hazard assessment (PHA) process for the 22-liter scale-up laboratory as
required by Section 11.6.2 of the Process Safety Guideline. The site conducted a generic PHA for the process in 1995 and
has made some informal modifications.

8.

A HAZOP has not been conducted for the new API as required by Section 11.6.3 of the Process Safety Guideline. Chemical
XXX, a major component of the API, is a toxic volatile as well as a severe lachrymator.

9.

A hazard analysis, required by Process Safety Guideline Section 11.6.3, has not been completed to evaluate the potential for
a release of anhydrous XXX through the purge nitrogen headers pressure relief valve at Building 1, which could result in an
unmonitored leak of XXX-HC2 outside the shed.

10. The process hazard analysis notes that various drawings are reviewed, rather than listing the specific drawings reviewed.
This does not allow the revalidation review team to easily judge whether changes have been made to the system, as there is
no indication of which drawings were to be reviewed as a part of the required management of change process.

Process Safety Finding Subset Process Safety Information

Finding
1.

Building 1 does not have an effective system to assure that all relevant process and design information is readily available as
required by Section 11.6.1 of the Process Safety Guideline. In a review of the process safety information for the XXX process
it was noted that:
.P&IDs were not available for process equipment;
Materials of construction of piping is not defined;
Specifications for the centrifuge instrumentation are not available;
Safety system description and design criteria are not defined for vapor monitoring;
.There has not been a calculated determination that the emergency vent lines for in-process and above ground storage tanks
are adequately sized to account for fire situations; and
.Obsolete information (for example, old batch records) are not marked obsolete or identified as no longer applicable.

2.

The facility does not have readily available documentation of process and equipment design features for the XXX process as
required by Section 11.6.1 of the Process Safety Guideline. Examples include:
Description of process chemistry;
Identification of safety critical control set points;
Material Balance;
Material of construction of piping;
Instrument and equipment design basis;
Availability of pressure relief valve design calculations;
Safety system description and design criteria;
P&IDs are not complete; missing elements include;
-Sizes of pressure relief piping;
-Check valves in utility lines; and
-Quick disconnect connections made after initial installation.

3.

Process design documentation does not include the design basis (controlling scenario relieving capacity) for every pressure
relief device currently in process safety relevant service, as required by Section 11.6.1-Attachment 11A of the Process Safety
Guideline. For example, older equipment pools such as found in Building 1 and 2 are lacking this information. This analysis
will establish relieving capacity limitations for process vessels and facilitate assignment of the appropriate process and
operating conditions for a given vessel.

4.

Section 4.2 of the Building 1 Process Safety procedure lists responsibilities for various job functions to Maintain files of all
process safety testing and evaluation reports, along with the actions taken to implement the recommendations; only one of
five recent process files reviewed had information regarding actions taken to implement recommendations.
The PFD does not contain information regarding material balance or flows or operating conditions. This is standard
information usually included in PFDs used in industry.

5.

6.
7.

The facility process safety procedure does not include provisions for marking or identifying obsolete information that is no
longer applicable as required by Attachment 11A of the Process Safety Guideline.
Design basis information intrinsic to equipment on the hydrogen chloride (HCl) tube trailer (rupture disc and restrictive flow
orifice) is not available on site as required by 29CFR1910.119(d)(3)(i).

8.

Design basis information for PSM related equipment is not always supplied with the purchase and delivery of the equipment
(an example would be pressure safety relief valves) as required by 29 CFR 1910.119(d) (3) (i).
9. Tank farm is not listed under OSHA covered processes as required by 29 CFR 1910.119(e)(1).
10. The P&ID for Building 1 shows nitrogen supply to Tanks #1, 2, and 3, however field checks show that these lines do not exist.

Process Safety Finding Subset Minimum Ignition Energy Data

Finding
1.

The facility has not implemented a process safety program as required by new elements of the Process Safety Guideline.
The facility has identified three materials (X1, X2, and X3) that meet the requirements for inclusion into the program as they
have minimum ignition energies (MIE) of less than 25 millijoules. Fluid-bed drying, using ethanol, is a process in the
manufacture of X1 and X2.

2.

The facility has not implemented a process safety program as required by new elements of the Process Safety Guideline.
XXX (active ingredient in XXX-HC) meets the requirement for inclusion into the program as it has a minimum ignition energy
(MIE) of less than 25 millijoules. The facility uses approximately 11,400 kg of the material annually.

3.

The facility has not implemented a process safety program as required by Section 11.2 of the Process Safety Guideline. The
facility mills explosive powders #XXX, XYX, and XXY, materials that have minimum ignition energies of less than 25
millijoules.

4.

The facility has not evaluated 17 explosible compounds as required by the Process Safety Guideline. These have been
identified as requiring inclusion in the program as they have a Minimum Ignition Energy below 25 milli joules.

5.

The facility has not implemented a process safety program as required by elements of the Process Safety Guideline. The
facility has identified three compounds (AB1, AB2, and AB3) that meet the requirements for inclusion into the program as
these have minimum ignition energies (MIE) of less than 25 millijoules.

6.

The facility has not implemented a process safety program as required by the Process Safety Guideline. The facility has
identified three compounds that meet the requirements for inclusion into the program because they have minimum ignition
energies (MIE) of less than 25 millijoules. Three other compounds have not been tested to determine the MIE, and no
compounds have been tested to determine if they are covered by the impact sensitivity criteria of the guideline

7.

The facility has not performed a Process Hazard Analysis (PHA) for the XXX process and other activities for covered
processes as required by Section 11.6.3 of the Process Safety Guideline. XXX is covered by the guideline because of the
explosion potential (minimum ignition energy less than 25 milli-joules).

8.

No MIE data is available for XXX. Although the regulation specifies that this information must be available for the highly
hazardous chemical (XXX is not the HHC), it would still allow for a more thorough review of the process to review this data.

Process Safety Finding Subset Standard Operating Procedures

Finding
1.

The facility has not developed a fire prevention plan as required by OSHA 29CFR1910.38(b). Examples of topics to be
covered in the fire prevention plan include, smoking, handling/storage of flammable liquids, hot work activities, electrical
equipment and housekeeping.

2.

The facility has not implemented all of the management system elements as required by Section 11.6.1 of the Process Safety
Guideline. For example:
Site and community emergency preparedness plans for all covered operations; and
Determine frequency and conduct PSM audits.

3.

Batch operating instructions do not advise operators of steps to be taken in the event of a process shutdown triggered by an
emergency control system, as required by the Pfizer Process Safety Management Guideline, Section Process Safety 1.

4.

It was reported that all high energy reactions are performed by an outside contract research firm. No written procedures are
in place for how the transfer of process safety information to contract research firms is performed, however, it was noted that
a transfer package containing process hazard data is provided to the contract research firm as required by Guideline
Sections 24.6.4 & 24.6.5 (Management of Contract Manufacturing and Research).

5.

The Building 1 PSM Procedure, Section J (1), states that the Equipment Inspection and Testing Manual will be reviewed and
revised every three years. Sections of the Manual are dated five to six years earlier.

6.

Written operating or other procedures do not describe or limit Operator response to a potentially significant XXX release at the
unloading shed. For instance, if the pipeline connecting the manual trailer manifold valve and automated transfer line valve
ruptured, a large amount of XXX could be released. The upper limit of the XXX detectors is 20 PPM and the IDLH is 50 PPM.
The operator indicated he would respond in SCBA and with a buddy to a release above 50 PPM AHCL. This would be above
the IDLH and would be a HazWoper activity beyond the OSHA limits placed on process operators. 29 CFR 1910.119 (f)(1).

7.

The facility has implemented a Process Safety Management Procedure, however, the procedure has not been formalized in
the SOP system as required by Section 11.6.1 of the Process Safety Guideline.

8.

Annual certification of operating procedures is not conducted as required by 29 CFR 1910.119(f)(3). Three of a sample of
three procedures did not have annual certification. These included: Building 1 Cleaning, Building 1 Pre-Cleaning, and
Building 1 Service Operation.

Process Safety Finding Subset TRAINING

Finding
1.

One of four operating colleagues assigned to work in Building 1 has not had a competency-based assessment as required by
the Process Safety Guideline, Section 11.6.1.

2.

Emergency Coordinators listed on the Emergency Plan and who may respond to a chemical spill do not have HAZWOPPER
training at the first responder or technician level. OSHA HAZWOPPER Standard 29 CFR 1910.120 requires people who
respond to a hazardous waste spill to be properly trained.

3.

A formalized refresher (triennial) training program for operations covered by the Process Safety Guideline is not in place as
required by Attachment 11A of the Process Safety Guideline.

4.

A formalized refresher (triennial) training program for operations covered by the Process Safety Guideline is not in place as
required by Attachment 11A of the Process Safety Guideline.

5.

PSM personnel have received the training required under the regulation. However, a written record that contains the means
used to verify that the employee understood the training is not maintained.

6.

Many training courses including PSM refresher training and equipment operating procedures meet the training requirements.
However, how these training programs fit together to form a comprehensive PSM training program is not well defined.

7.

The facility method of demonstrating competency in Process Safety related topics is not effective, contrary to the
requirements of 29 CFR 1910.119(g)(3). Testing records are not kept beyond three months. The training tracking software
indicates course attendance however does not provide an indicator of competency or understanding.

8.

Training records are not available for three of a sample of three procedures, contrary to the requirements of 29 CFR
1910.119(g)(3 Building 1 Cleaning, Building 1 Pre-Cleaning, and Building 1 Service Operation.