Stop-Work Authority in Process Plant Operation

Authors: Raghava Nayak and Venkat Pattabathula

Stop-Work Authority (SWA) is widely practiced in every day occupational health, safety, and environment (OHSE) programs. All companies empower employees to intervene if they see unsafe situations. Several surveys have found that nearly 70 percent of catastrophic incidents happen during transient operations such as startups and shutdowns. Although later investigations identify several root causes, the immediate cause is invariably the omission orcommission of manual actions.

Comparison of SWA for OHSE and Process Safety

Numerous stop-work policy statements are available in the public domain and state that all workers are empowered to apply SWA in any situation involving unsafe conditions, actions, inactions, omissions, or mistakes that may harm people or the environment levy no blame on the employee applying the SWA. The six SWA steps, whether for process safety or OHSE, are:

Stop unsafe
Notify the affected people and the
Investigate the cause of the intervention without blaming the Some companies may reward the initiator.
Correct the situation to reduce the risk to a tolerable
Resume work after notifying the
Follow up with detailed reports, safety alerts, and lessons

SWA in the process safety context differs markedly from SWA in OHSE because the process safety issue can be too complicated. In a day-to-day OHSE context, people can generally visualize, hear, feel, and understand the imminent danger of a potential accident and issue the SWA. In the case of process safety, the imminent incident is less understood.

SWA applied prematurely or incorrectly can de-rate each plant’s integrity and decreaseproduction. Hence, timely and valid SWA calls for specialized, process-specific training and experience.The table below compares SWA in process safety with SWA in OHSE.

Enhancing SWA in Process-Safety Operation

The reasons why operators may fail to apply the SWA in the process safety context are:

They may not detect or perceive that the change in the process parameter woulddevelop quickly in to an uncontrolled, abnormal, unsafe situation.
At times, the operator’s previous experience may lead him to believe that he can manage the process oscillations and, not using the SWA may be an accepted practice.
Some operators tend to rely on safety instrumented systems and avoid applyingSWA.
Some operators may consider the level of risk to be below the actionable level.
Diffusion of responsibility can also cause non-use of the SWA.
Production pressures some times override the instinct to invoke the SWA.
The operator may also feel that he does not have the authority to intervene in anabnormal situation.
The operator may not wish to risk alienating his colleagues.
In a stable plant where deviations are very rare, operators may lose the ability tocompensate for abnormal situations.Their understanding of how a system worksdisappears over time.When a very rare deviation occurs,they no longer know howto react.
The Feynman Gap between engineers and managers on risk probabilities may also apply between operators and the production manager. The above inhibitions mimic the Rasmussen failure model consisting of slips, lapses,and mistakes.

Figure 1. shows that SWA application training in the operational context is a key to timely application of appropriate intervention and, therefore, the avoidance of costly errors. The training generally covers process introduction, basic maintenance, safety and environment, and classroom lectures on technology with assessments at each stage. Many firms give new operators on-the-job training with a buddy system in operating plants and use operator training simulators and desk top exercises for plant-specific scenarios that focus on minimizing SWA application through advance corrective actions, timing of SWA, and, finally, the SWA. An operator would be under immense pressure to respond during upsets. Automating the operator response with specific training would minimize the errors in SW Aapplication.

Standard operating procedures (SOPs) should have been developed for normaloperations as well as for transient operations. Often, SIS overrides are placed formaintenance, inspection, start-up,etc. The SOPs should include such possibilities and provide guidelines on SWA for specific scenarios. These scenarios and appropriateremedies should have been covered in documents such as HAZOP, Bow-Tie, LOPA, QRA, and operating philosophy.

Transient operating mode in a continuous plant is similar to batch-plant operation, where tasks are carried out manually. The frequency of tasks, time pressures, missed sequence of steps, and safety overrides are liable to cause catastrophes. Automation would help minimize the manual actions. A new standard ISA 106, is being developedto help with automating the procedures.

The API standard, API 584 Integrity Operating Windows, was released in 2014.
Although the standard is intended for inspection and maintenance, the operating envelope in Figure 2 is the right resource for SWA in process safety.

Making the safe operating limits for each of the critical equipment scenarios readily available to theoperator, either in the SOPs or alerts on the screen, minimizes the operators’ reliance on memory and reduces the error rate.Typical examples for an ammonia plant include the steam to carbon ratio for the primary reformer, steam drum level, pressure and temperature limits of reactors, methane slip, CO slip, and H2 to N2 ratio in the synthesis loop.

New software for forecasting or trending the process parameters can help support the operator’s action based on the likelihood of safe operating limits being exceeded. Alarm rationalization software and process-monitoring software, such as DynAMo, can reduce the number and severity of process upsets.

SWA for process safety is more complex than SWA for OHSE because the process risks may not be easily understood. All operating personnel need to know when SWA applies. SWA should be used sparingly because thermal shocks may lead eventually to unsafe plant conditions.