NEBOSH PSM cheat sheet

Process safety management (PSM) focuses on preventing catastrophic releases of hazardous substances, distinct from occupational safety which targets individual injury.

A process safety management system typically includes 14 elements (e.g., process safety information, process hazard analysis, operating procedures, training, mechanical integrity, management of change, pre-startup safety review, hot work permit, compliance audits, incident investigation, emergency planning, trade secrets).

Leadership commitment is demonstrated through visible safety walks, resource allocation, and setting clear process safety goals; safety culture maturity models (e.g., Hudson, DuPont Bradley) describe progression from reactive to generative.

Key performance indicators (KPIs) for process safety include both lagging (incident rates, releases) and leading (number of PHAs completed, action item closure rate, training completion).

Process safety culture is assessed via surveys and interviews; common weaknesses include normalization of deviance, complacency, and poor communication.

Regulatory frameworks: OSHA PSM (29 CFR 1910.119) and EPA RMP (40 CFR 68) in the US; Seveso III Directive in Europe; COMAH in the UK.

Risk-based process safety (RBPS) by CCPS uses four pillars: commit to process safety, understand hazards and risks, manage risks, learn from experience.

Leadership must ensure process safety information (PSI) is complete and up to date, including material and energy balances, P&IDs, and equipment design data.

Hazard identification techniques: HAZOP (guide words applied to nodes), What-If analysis, FMEA, and fault tree analysis (FTA).

Risk = probability × consequence; individual risk (per person) and societal risk (F-N curves) are used for land-use planning.

HAZOP uses guide words (No, More, Less, As well as, Part of, Reverse, Other than) with process parameters to identify deviations and their causes and consequences.

Layer of protection analysis (LOPA) determines if independent protection layers (IPLs) reduce risk to tolerable levels; each IPL must be independent, specific, dependable, and auditable.

Fault tree analysis is deductive, starting from a top event and using Boolean logic gates to find contributing failures; minimal cut sets identify critical failure combinations.

Consequence modeling includes fire (pool, jet, flash), explosion (vapor cloud, BLEVE), and toxic dispersion; software like PHAST or ALOHA is used.

Tolerable risk criteria: ALARP (as low as reasonably practicable) principle; risk reduction is required unless cost is grossly disproportionate to benefit.

Safety integrity level (SIL) is determined via risk graph, LOPA, or risk matrix; SIL 1 to 4 correspond to increasing risk reduction.

Inherent safety principles: minimize, substitute, moderate, and simplify; apply early in design to reduce reliance on add-on controls.

Engineering controls include relief systems (pressure relief valves, rupture discs), detection systems (gas, fire), and emergency shutdown systems.

Management of change (MOC) process: identify change, assess hazards, approve, implement, and update documentation; temporary changes also require MOC.

Pre-startup safety review (PSSR) confirms construction and equipment meet design specifications, safety, operating, maintenance, and emergency procedures are in place, and MOC has been completed.

Process safety information (PSI) includes hazards of materials, technology, and equipment; it must be updated after any change.

Relief system design follows codes such as API 520/521; sizing considers fire exposure, blocked outlet, and control valve failure scenarios.

Safety instrumented systems (SIS) are designed per IEC 61511; SIL verification includes architectural constraints and proof-test intervals.

Human factors in design: control room ergonomics, alarm management (EEMUA 191), and console layout to reduce operator error.

Operating procedures must be written, accessible, and current; they cover startup, normal operation, shutdown, and emergency operations.

Competence assurance includes initial training, refresher training, and assessment; training records must be maintained.

Human error types: slips (attention failures), lapses (memory failures), mistakes (rule-based or knowledge-based), and violations.

Human reliability analysis (HRA) techniques include THERP, HEART, and CREAM; they estimate human error probabilities (HEPs).

Alarm management: alarm flood is more than 10 alarms per 10 minutes per operator; target is fewer than 6 alarms per hour per operator (EEMUA 191).

Fatigue risk management includes shift design, maximum work hours, and rest breaks; circadian effects increase error rates on night shifts.

Safety-critical tasks require independent verification (two-person rule) and clear communication (e.g., three-way communication).

Human factors integration in design considers workload, situation awareness, and interface usability; poor design contributes to incidents.

Emergency response plan (ERP) must include roles, communication, evacuation, and drills; it is tested through exercises (tabletop, functional, full-scale).

Incident investigation aims to find root causes, not blame; techniques include 5 Whys, Fishbone (Ishikawa), Fault Tree, and TapRooT®.

Root cause analysis (RCA) should identify management system deficiencies; findings must lead to corrective actions with tracking.

Assurance activities include audits, inspections, management reviews, and key performance indicator monitoring; they verify PSM system effectiveness.

Compliance audits (OSHA PSM) must be conducted at least every three years; findings require corrective action plans.

Emergency drills should be evaluated for effectiveness and lessons learned incorporated into the ERP.

Incident investigation reports should include timeline, sequence of events, root causes, and recommendations; they are shared for organizational learning.

Performance indicators: leading (e.g., number of near misses reported) and lagging (e.g., lost time injury rate, process safety incidents).