Process safety management (PSM) audits serve two main functions: to provide feedback on process safety program implementation and effectiveness to identify potential opportunities for improved performance; and to verify compliance with process safety regulations such as the 29 CFR 1910.119 Process Safety Management (PSM) standard of the U.S. Occupational Safety and Health Administration (OSHA) and the 40 CFR 68 Risk Management Program (RMP) rule of the U.S. Environmental Protection Agency (EPA) [1,2]. A facility with a process covered by these regulations must conduct compliance audits every three years.
Previous parts of this series covered some common issues observed in PSM compliance audits related to operating/safe-limits tables , operating practices  and mechanical integrity . Now, we will look at findings in the elements of process safety information (PSI); process hazard analysis (PHA); management of change (MOC) and pre-startup safety review (PSSR); contractors; incident investigation and emergency planning and response (EPR); compliance audits; and employee participation (EP) and trade secrets. (Industry guidance documents [2,6] provide additional information about PSM element requirements.)
Process Safety Information
Process safety regulations and good industry practice (GIP) require companies to compile and maintain information on chemical and material hazards, process technology, and process equipment. Complete and up-to-date PSI documentation helps plant personnel understand the process design and its hazards, evaluate and control the hazards and risks, and maintain safe and reliable operations. In addition, PSI provides the basis for the operating procedures, mechanical integrity program and MOC evaluations.
PSI accessibility. Often, lack of an index hinders finding the required PSI (e.g., process diagrams, maximum intended inventory, relief system design/basis, ventilation systems, safety systems or equipment files). In most cases, information does exist but its exact location has been forgotten over time or it has been misplaced or misfiled (due to changes in responsible personnel). Developing and maintaining a PSI index or “road map” that 1) details the exact location of electronic or hard-copy documents for each required PSI item and 2) uses terms for each item consistent with the PSM regulations is invaluable to ensure quickly finding the right information to support process safety program activities.
Chemical and material hazards. Issues frequently arise in three areas:
• General safety data sheets (SDSs). Two common SDS issues are 1) the available SDSs do not match the most-recent SDSs available from vendors and 2) hard-copy sets of SDSs are not kept current. These issues can be reduced by 1) eliminating or minimizing the number of hard-copy sets and keeping the hard-copy sets current and 2) periodically reviewing online and hard-copy SDSs of regulated chemicals to ensure they are up to date.
• Corrosivity. Facilities often rely solely on the SDSs for “corrosivity” information, but SDSs frequently only address the corrosivity to human skin and not the important aspect of corrosion of materials of construction of process equipment. This issue can be addressed by 1) referencing the piping and service index (or similar) and engineering specifications that provide such information or 2) including common materials of construction and their interactions with the process chemicals in a chemical interaction matrix (see next bulleted point). An online chemical compatibility database also is available .
• Hazardous effects of inadvertent mixing. Facilities often depend on the “incompatibilities” (or similar) sections in the SDSs for the hazardous effects of inadvertent mixing. However, SDSs rarely address the specific chemicals present in a process or only address the incompatible types of chemicals (e.g., bases, oxidizers) that may not be specific or well understood by the operators. Industry typically provides and references a chemical interaction matrix (or similar) [6, 8] that shows all the process chemicals (and, possibly, materials of construction) and notes the hazards involved with each possible specific interaction within the boundaries of the process. The Chemical Reactivity Worksheet is a free tool for evaluating chemical and material interactions .
Process technology. While the most common findings in this area relate to safe upper/lower limits and consequences of deviation, which are discussed in detail in part 1 of this series , issues also regularly arise in another area:
• Maximum intended inventory. Common issues are 1) there is an inventory (or inventories) but the basis is not documented, 2) the inventory is not consistent with that reported in the facility’s latest risk management plan (RMPlan) and 3) the inventory does not appear to include material in process piping and smaller equipment or to account for onsite inventories in railcars, trucks or containers (an EPA RMP requirement). GIP is to 1) document (e.g., via spreadsheets) details of the maximum inventory for each covered chemical in storage tanks, major equipment and onsite storage and 2) include (or estimate) a reasonable amount (typically, at least 10%) to account for piping and smaller equipment. Plants should document any differences between the maximum intended inventories and RMPlan inventories for consistency during PSM audits and RMPlan resubmissions.
Process equipment. This element frequently shows failings in several areas.
• Electrical classification. The most common issues are 1) the basis for the electrical classification (typically, NFPA 497  or API RP 500 ) is not provided on the drawings or associated documentation and 2) the existing boundaries of the classified areas simply stop at the process footprint or at the plant roadways. These issues can be addressed by ensuring 1) the classification is consistent with an appropriate standard, including the distances from possible flammable releases to the boundaries, 2) the standard used is adequately documented and 3) the classification documentation includes figures or notes to cover classified areas not easily shown on a plot plan (e.g., below grade or around vents).
• Relief system design. Available relief device calculations often lack documentation of all overpressure cases (e.g., design basis case and alternatives), inlet pressure drop, outlet pressure drop, reactive forces or venting to a “safe” location. API 521  provides guidance for developing and documenting relief device data. Failure to provide complete data for the relief system design and design basis has resulted in many OSHA citations. Ensuring a facility has complete and up-to-date relief system design information typically involves 1) surveying to determine whether calculations exist for all the relief devices (including relief valves, rupture disks, conservation vents and emergency vents), 2) assessing each calculation to ensure it meets API 521 or other appropriate requirements and 3) updating the calculations, as necessary.
• Ventilation system design. Often, there is inadequate design basis documentation (as well as maintenance) of cabinets/shacks that house nonexplosion-proof equipment (e.g., process analyzers, gas chromatographs). Such equipment should be identified and should meet the design/operating/maintenance requirements of NFPA 496  or other appropriate standard.
• Material and energy balances. The most common issues are the balances have not been updated for 1) capacity/throughput increases, 2) manufacturing recipe changes or 3) new chemicals additions. Also, simple or batch processes frequently lack documented balances. These issues can be addressed by 1) ensuring the MOC program reviews the balances for appropriate changes and 2) developing actual or representative balances for simple/batch processes.
• Safety systems. OSHA has requirements for safety systems in both operating procedures and PSI. The second article in this series  discusses common audit findings for these.
Process Hazard Analysis
PHAs must be performed periodically on processes that contain hazardous materials to develop an understanding of 1) what process hazards and risks exist, 2) how hazardous events can occur and how bad they can be, 3) what administrative and engineering safeguards are provided and 4) what, if any, additional safeguards can be adopted to make the process safer.
Lists of incidents, MOCs, and previous PHA recommendations. The regulations require PHAs to identify and review previous incidents (with catastrophic potential) and GIP also includes review 1) of MOCs completed (unless a complete “redo” revalidation is performed) and 2) if the previous PHA recommendations were adequately completed and sustained. Typically, lists of each of these items are developed and then reviewed by the PHA team. However, 1) these lists often are not documented, 2) the PHA team fails to evaluate them sufficiently and include any required changes to the PHA worksheets or 3) the current team does not adequately evaluate whether the recommendations were implemented and suffice. These issues can be addressed by 1) evaluating all these items and 2) adding a column to the lists that documents whether there was an impact on the PHA worksheets (e.g., adding a new deviation from an incident or a new safeguard from an MOC or PHA recommendation that was implemented).
Detection methodologies. Toxic or combustible gas detectors are included in 1) the safety systems in the PSI and operating procedures elements, 2) the PHA element and 3) the mechanical integrity element (i.e., monitoring devices). The PHA requirement is to address: “Engineering and administrative controls applicable to the hazards and their interrelationships such as appropriate application of detection methodologies to provide early warning of releases.” Often observed is a lack of such detectors in a process, as well as no documentation that the PHA team considered adding additional toxic or combustible gas detectors. This likely is because the team focused on evaluating the severity/likelihood/risk associated with each deviation and most of the risks are determined to be acceptable with the safeguards already in place. It is beneficial to 1) include a requirement to consider whether additional detectors would reduce the overall risk in PHA teams’ scopes/charters and 2) document the results of these evaluations in the PHA reports.
Facility siting and human factors. Issues frequently occur in two areas:
• Checklists. Both facility siting and human factors evaluations typically are addressed by completing industry standard checklists in addition to use of standard hazard evaluation methodologies (e.g., hazard and operability studies). However, some PHA teams only document the items they had concerns about and do not provide answers to all the checklist issues. OSHA views this as documentation “by exception” (see Facility Siting question H.1 in OSHA’s Refinery National Emphasis Program ). Also, it is not uncommon to see unresolved comments requiring some level of follow-up that could be recommendations but are not included in the PHA recommendation list. These issues can be addressed by ensuring PHA teams 1) justify/explain any nonstandard answers in the checklists and 2) resolve comments in the checklists by discussing why they did not believe any action was necessary for items that do not become recommendations.
• Facility siting studies. Many companies/facilities have expanded the facility siting review by performing detailed, sitewide facility siting studies per API 752/753 [14, 15] or other standards. PHA checklists (as discussed above) typically do not review these existing studies and whether the 1) related release scenarios and occupied buildings are still accurate and 2) recommendations have been completed or are in progress. This can be addressed by including a requirement for PHA teams to review the appropriate sections of the sitewide study and document this in the PHA report.
PHA communication. Actions resulting from each PHA are to be communicated to affected employees, but this often is not done or no documentation is provided indicating it was done. Common methods for adequate PHA communication are 1) providing a presentation that is reviewed in safety meetings with affected personnel (or with all personnel) and documented, 2) requiring signoff of the communication by each affected employee and maintaining these records or 3) providing a presentation via computer-based training with a short test or acknowledgement for the employee to indicate review of the information.
Completion of PHA recommendations. PHA recommendations should be resolved (i.e., reviewed by management, accepted/rejected, and assigned resources for completion with target dates) in a timely matter and actions taken should be documented and completed as soon as possible. However, recommendations often are 1) not resolved promptly (typically within 90 days), 2) rejected without appropriate justification and documentation or 3) not competed in a reasonable time (due to changes in assigned personnel, lack of funding, competing priorities, etc.). In addition, closure documentation frequently is inadequate (e.g., records just say “complete” and do not reference MOC numbers or provide pertinent attachments) or the resolution of a PHA recommendation does not address the specific issue(s) identified. In some cases, the final wording of recommendations also is not updated in the PHA worksheets as the report was edited and finalized. These issues can be addressed through 1) instituting a rigorous process for managing PHA recommendations, including timing requirements, 2) periodic reporting on the status of PHA recommendations, with extra “attention” to those becoming “overdue” or “old” and 3) cross-checking by supervisors or PSM department personnel of the adequacy of closure documentation. Care also should be taken to avoid closing recommendations based on the issuance, rather than the completion, of an MOC or other document that initiates implementation of the action.
Management Of Change And Pre-Startup Safety Review
The purposes of the MOC element and the associated PSSR element are to 1) prevent changes in the process and supporting facilities from introducing unacceptable hazards and 2) provide a review that ensures all requirements are met before the introduction of any highly hazardous chemical into a new or modified process.
Management of change. Several types of issues often arise.
• Impact on safety and health. MOCs must consider and address the impact of the change on safety and health, but often this only involves a checkoff by the health/safety/environment group (or similar) or brief discussion rather than a formal, adequately documented evaluation. A thorough evaluation should be part of the MOC process. This frequently takes the form of a “screening” review or checklist of possible safety/health impacts.
• Temporary changes. Limits seldom are established for the number of “extensions” allowed to temporary MOCs or criteria established to allow an extension. GIP typically limits 1) the timing for temporary changes (generally to no more than six months) and 2) the number of extensions allowed before the change must be reverted or made permanent (usually only two or three extensions are permitted). In addition, closure of the temporary MOC often is not documented or there is a poor “paper trail” (i.e., how the change was returned to the original design or was changed to permanent (via an expanded or new MOC)). The MOC system should 1) provide a maximum time limit for temporary MOCs (including extensions) and 2) ensure good documentation of all temporary MOCs, including reviews for extensions and the final resolution.
• MOC checklists. Paper or electronic systems usually use checklists (e.g., an extensive roster of PSI categories or other PSM element requirements) to ensure all required areas are adequately addressed. However, the checklists often are 1) very basic and short or are too long to be useful or 2) not comprehensive and lacking all pertinent topics of interest. While there is no requirement for use of a checklist, GIP MOC programs typically use a checklist with enough detail to ensure adequate review of changes.
Pre-startup safety review. A number of issues often afflict various aspects of these reviews.
• PSSR checklists. Frequently, a PSSR checklist is provided but it doesn’t explicitly include the four specific regulatory requirements. Checking additional pertinent items is a good practice, but facilities should ensure the required items are not overlooked (or are clearly documented) in the checklist. For example, because the OSHA PSM regulation specifically mentions safety, operating, maintenance and emergency procedures, including all four types of procedures on the PSSR checklist is appropriate.
• PSSR team. In some cases, PSSRs are performed by one or two persons. Although there is no specific regulatory requirement for a team to be involved, GIP PSSRs typically use a multi-disciplinary PSSR team (e.g., usually including operations, engineering, maintenance and safety personnel as a minimum) to ensure a thorough review.
• PSSR approval. Sometimes no documentation clearly shows how and when the PSSR was performed and how any PSSR-identified deficiencies were corrected prior to startup. All potential action items from the PSSR checklist should be captured for follow-up, which is important from both a process safety and regulatory perspective. Documentation also should be provided if no follow-up is to be performed. Facilities should check that their MOC/PSSR system and its workflow ensures all deficiencies are tracked and corrected and there is documented management approval that the change is “safe to start up.”
General issues. Failings frequently occur in two areas.
• Informing/training. MOC requires that affected employees be informed of and trained on the change, and PSSR requires confirmation that training of operations personnel has occurred prior to startup. Often, 1) people are “missed” when the communication is provided or 2) there is a lack of clear guidance and consistent application on when and how “training” is to be provided. Many MOCs typically are “simple” changes where “informing” personnel should suffice. These issues can be addressed by 1) ensuring designated employees are informed and sign-offs (or similar documentation) are complete and accurate and 2) establishing specific criteria for when formal training on an MOC is required and for which group(s).
• Management of organization change (MOOC). Although MOOC is not a specific regulatory requirement in the OSHA PSM regulation, OSHA has issued a memorandum  indicating that relevant organizational changes should be considered as part of the MOC system. However, often MOOC is not implemented or is implemented inconsistently for all personnel changes. Therefore, facilities should consider establishing an adequate MOOC program as part of their MOC system .
The contractor element provides requirements for both the employer (plant) and the contractor employer for contract work in covered PSM processes.
Contractor orientation. Most facilities offer safety and health orientation training or a video to all contract employees on an annual basis to inform them of the potential fire, explosion or toxic release hazards and of the actions they should take in case of an emergency. However, it often is found that no test is given to verify their understanding of the information. So, administering at least a simple test on the plant requirements covered during the orientation is recommended.
Performance evaluation. Employers must periodically evaluate the performance of contract employers in fulfilling their obligations. Usually, this should include 1) meetings with each major contract employer (e.g., typically annually) and smaller contractors (e.g., based on work activities) to review their performance and identify any needed upgrades, 2) periodic, detailed audits of contract employee safety programs, qualifications and training records and 3) documented periodic field audits.
• Skills training evaluation. Facilities typically require basic “safe work practices” training, usually provided by a contractor safety council or by including it in the contractor orientation training. However, many facilities do not verify that each contract employee has been appropriately trained on the skills associated with the person’s work (e.g., welding, crane operation, scaffold building). Some plants will accept a statement from the employer that the employee has received the necessary training or certification while other plants periodically audit, e.g., using a third-party service or company employees, a representative portion of contract employee training records for completeness and adequacy. Changes to contractor personnel assigned to the plant require additional review of qualifications.
• Field audits. Almost all facilities have practices in place to audit contract employees in the field as part of work permits or safety concerns. However, these audits may be 1) informal and undocumented, 2) not performed against a specified checklist(s) or 3) not performed very often. This can be addressed by establishing a formal field audit program, performed on a reasonable frequency and documented on an adequate checklist that must be reviewed with the contractor employer. Appropriate follow-up based on performance evaluations should be conducted and documented.
Incident Investigation And EPR
Process incidents are preventable but, unfortunately, still occur with some frequency. The incident investigation and EPR PSM elements help facilities 1) prepare for responding appropriately to emergencies to mitigate their consequences, 2) ensure that employees and public responders are aware of possible hazards and the proper response and evacuation procedures and 3) learn as much as possible from incidents to prevent recurrence of similar events.
Incident investigation. Several aspects often have failings.
• Incident investigation timing. The regulations require prompt initiation of an investigation, i.e., no later than 48 hours following the incident. However, sometimes, the date/time the investigation began 1) is not documented in the incident investigation reports or 2) indicates it started “late.” The latter often occurs when the documentation is based on the date/time of the first formal meeting of the incident investigation team, although the investigation usually begins when the pertinent facts and information are initially gathered and preliminary reporting occurs, which typically happens during the same shift or day of the incident. So, these issues can be addressed by ensuring the incident report documentation captures the date and time when the data collection for the preliminary incident report started.
• Incident reviews. Incident reports must be reviewed with all affected personnel, including contractors, if applicable. This is similar to the discussion earlier about communicating the results of PHAs to affected employees. However, OSHA uses “reviewed” rather than “communicated,” suggesting a higher level of interaction is desired. The issues and suggestions provided for the PHA actions are valid here for the incident investigation reports as well as for ensuring documentation of the incident reviews is maintained.
• Incident contributing factors. Incident reports (for incidents that resulted in or reasonably could have resulted in a catastrophic release of a highly hazardous chemical) must include any factors that contributed to the incident. However, the reports sometimes focus only on physical issues (e.g., corrosion leading to a leak) or human errors, and do not adequately address management system issues. GIP applies root-cause failure analysis, with trained resources and thorough documentation, to determine and document the physical, human and system contributing factors. Simple incident investigation methods often are used for investigation of near-misses or incidents with minor actual or potential consequences.
• Completion of incident report recommendations. As discussed in “Completion of PHA Recommendations” above, recommendations from incident reports may not be 1) resolved in a timely matter or 2) adequately documented or completed as soon as possible.
Emergency planning and response. Here, too, failings often are found in a couple of aspects.
• Small spill procedures. The EPR element requires facilities to have “procedures for handling small releases.” However, frequently, procedures that address handling of small spills of covered chemicals are not provided. This can be addressed by actions such as 1) defining “small” spills for the covered chemicals (e.g., in terms of the amount released or based on whether any flammable or toxic gas detectors are activated) and 2) developing specific emergency action plan procedures for handling each type of spill by plant personnel or contractors, including those not trained as emergency responders.
• Compliance with EPR-related regulations. Although OSHA’s EPR element is very brief, it incorporates the following regulations via reference: (1) 29 CFR 1910.38(a) [Emergency Action Plan]; (2) 1910.165 [Employee Alarm Systems, which is referenced in 1910.38]; and (3) 1910.120(a), (p), and (q) [Hazardous Waste Operations and Emergency Response]. Common issues with meeting the requirements of these referenced regulations include 1) names or titles of persons who can be contacted for more information are not provided, 2) issues with the facility alarm system being audible/detectable in all locations have not been addressed, 3) places of refuge (e.g., shelter-in-place locations) are not formally designated or do not meet a set of adequate, consistent requirements, 4) critiques of emergency responses or drills are not consistently issued or recommendations are not adequately addressed, 5) training of the emergency response team (or fire brigade) is inadequate or inconsistent and 6) required training levels through the facility are not well defined or consistently applied (i.e., first responder awareness, first responder operations, hazardous materials technician, hazardous materials specialist, and on-scene incident commander). Facility emergency personnel should 1) be knowledgeable of all these ERP-related regulations and 2) ensure their emergency action plan and emergency response plan (if they are a responding facility) and the associated program adequately complies with regulations.
The PSM regulations require that employers periodically evaluate (and certify) their PSM program by 1) determining that the PSM element practices comply with the provisions contained in the regulations and 2) verifying that the procedures and practices are adequate and are being followed.
Audit certifications. It is fairly common to find that 1) there is no formal “certification” of a previous audit(s), 2) the certification(s) has been lost or misplaced or 3) certifications are provided by third parties (e.g., independent auditors) rather than by the employer. These issues can be avoided by 1) establishing the form/format for compliance audit certifications to be made by the employer (e.g., typically the plant manager or designee) and 2) ensuring consistent retention of certifications along with the required two most recent compliance audit reports.
Completion of audit recommendations. As noted in “Completion of PHA Recommendations” above, recommendations from compliance audits often are not resolved in a timely manner, corrective actions taken are not adequately documented or corrective actions are not completed as soon as possible.
Employee Participation And Trade Secrets
EP is intended to ensure facilities 1) develop a written program to consult with and involve employees (and their representatives) in PSM activities and 2) make PSM information available to employees (and their representatives). Just because information is viewed as a trade secret for the plant is not adequate justification to withhold details from employees when the information is required for PSM purposes.
Written plan. Although almost all facilities have a written EP plan, the plan often does not 1) discuss how employees are expected to participate in all the pertinent PSM elements and 2) identify the activities and associated documentation to be provided to ensure such participation. This can be addressed by making certain the EP plan adequately addresses both above aspects. Discussion of trade secret policies in the EP plan, if applicable, also is desirable.
Employee consultation. The EP element in the regulations requires the employer “consult with employees and their representatives on the conduct and development of process hazards analyses and on the development of the other elements of process safety management.” While good employee participation on PHA teams often is observed, this frequently is not the case as far as consultation on the development/implementation of other PSM elements (e.g., lack of documentation the site safety and health or PSM committee, if one exists, is involved in the “development” or revision of the PSM procedures and also includes a cross-section of employees from various plant groups). One way to address this is to 1) ensure that safety and health (or PSM) committee meetings include employees from various plant groups or areas and are documented and 2) institute a “standing agenda item” to review any new/revised PSM element procedures. Also, document other methods of consulting with employees, such as participation in annual PSM-emphasis safety meeting for all employees.
Address The Issues
The OSHA PSM regulation was promulgated almost 30 years ago. Yet process safety audits continue to identify poor understanding and ineffective implementation of PSM regulation requirements. This article completes the four-part series on common process safety audit findings and how to avoid them through appropriate understanding and implementation of the relevant requirements and GIP. We hope the information provided in this series will help you better evaluate these important parts of your PSM programs for improved regulatory compliance and safe and reliable operations.
JIM THOMPSON, CPSA, is a Louisville, Ky.-based process safety consultant with ABSG Consulting. JIM KLEIN, CCPSC, CPSA, is a Minneapolis, Minn.-based process safety consultant with ABSG Consulting Inc. Email them at [email protected] and [email protected].
1. “Guidelines for Auditing Process Safety Management Systems,” 2nd ed., Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (2011).
2. “Guidelines for Risk Based Process Safety,” Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (2007).
3. Klein, J. A., and Thompson J. R., “Process Safety Management Audits Find Confusion Common,” pp. 18–24, Chemical Processing (Oct. 2021).
4. Thompson, J. R., and Klein, J. A., “Process Safety Management Audits Point Up Operating Practice Deficiencies,” pp. 19–24, Chemical Processing (Jan. 2022).
5. Dean, S., and Klein, J. A., “PSM Audits Uncover Mechanical Integrity Issues,” pp. 19–23, Chemical Processing (April 2022).
6. Klein, J. A., and Vaughen, B. K., “Process Safety: Key Concepts and Practical Approaches,” CRC Press, Boca Raton, Fla. (2017).
9. “Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas,” NFPA 497, Nat. Fire Protect. Assn., Quincy, Mass. (2017).
10. “Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class 1, Division 1 and Division 2,” API RP 500, 3rd ed., Amer. Petrol. Inst., Washington, D.C. (2012).
11. “Pressure-relieving and Depressuring Systems,” API 521, 7th ed., Amer. Petrol. Inst., Washington, D.C. (2020).
12. “Standard for Purged and Pressurized Enclosures for Electrical Equipment,” NFPA 496, Nat. Fire Protect. Assn., Quincy, Mass. (2017).
13. “Petroleum Refinery Process Safety Management National Emphasis Program,” OSHA CPL 03-00-004, U.S. Occ. Safety and Health Admin., Washington, D.C. (2007).
14. “Management of Hazards Associated With Location of Process Plant Permanent Buildings,” API RP 752, 3rd ed., Amer. Petrol. Inst., Washington, D.C. (2009).
15. “Management of Hazards Associated With Process Plant Portable Buildings,” API RP 753, Amer. Petrol. Inst., Washington, D.C. (2007).
17. “Guidelines for Managing Process Safety Risks During Organizational Change,” Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (2013).