Process Safety Management (OSHA PSM 1910.119)

Process Safety Management (PSM), required by OSHA under 29 CFR 1910.119, is a fourteen-element program that facilities handling highly hazardous chemicals above threshold quantities must run to prevent catastrophic releases, fires, and explosions. It targets the low-probability, high-consequence event: the runaway reaction, the vapor cloud, the vessel rupture that harms many people at once.

PSM is not general workplace safety. It is a discipline aimed squarely at processes where a single failure can level a unit and reach beyond the fence line. OSHA wrote the standard in 1992, in the wake of the 1984 Bhopal disaster and the Clean Air Act Amendments, and it is deliberately paired with EPA's Risk Management Program. This post explains who is covered, walks the fourteen elements, and shows how the pieces fit. It is educational, not legal advice.

Who is covered by the PSM standard?

Coverage turns on chemicals and quantities, not on industry. PSM applies when a process involves a listed highly hazardous chemical at or above its threshold quantity, or a flammable liquid or gas on site in one location at or above 10,000 pounds. OSHA lists roughly 137 specific highly hazardous chemicals in Appendix A of the standard, each with its own threshold quantity, from chlorine and anhydrous ammonia to hydrofluoric acid. There are exemptions, including retail facilities, certain atmospheric fuel-oil storage, and normally unoccupied remote facilities. If your process crosses a threshold, you are in; a refinery, a large cold-storage warehouse using anhydrous ammonia, and a specialty chemical processing operation can all be PSM-covered for very different reasons.

The word "process" is broad on purpose. It means any activity involving a highly hazardous chemical, including using, storing, manufacturing, handling, or moving it, and any group of interconnected vessels where a release from one could reach another. That interconnection rule matters: two tanks that seem separate can be a single process for coverage purposes if a release from one could involve the other. It is why a facility that thinks it is under the threshold sometimes is not, once the interconnected inventory is added up correctly. If you are anywhere near a threshold quantity, the coverage determination is worth doing carefully and documenting, because getting it wrong in either direction, missing coverage you owe or building a full program you do not, is expensive.

What actually triggers a management of change?

Management of change is the element that quietly holds the rest together, so it is worth being concrete about what sets it off. Any change to process chemicals, technology, equipment, or procedures, other than a replacement in kind, requires an MOC review before it happens. "Replacement in kind" is the key phrase: swapping a failed pump for the identical model is not a change, but swapping in a different pump, a different seal material, a slightly higher setpoint, or a revised procedure is. The MOC has to consider the technical basis, the impact on safety and health, changes to operating procedures, and the authorization required, and workers and contractors affected by the change have to be informed and trained before startup. Most catastrophic releases that trace to MOC did not skip the process out of malice; someone judged a real change to be a replacement in kind, and the review that would have caught the hazard never ran.

What are the 14 elements of PSM?

The standard is built from fourteen interlocking elements. They are not a menu; a facility owes all fourteen, and most catastrophic incidents trace back to a gap in one of them, an inadequate hazard analysis, a change that skipped review, a mechanical-integrity program that existed on paper but not in the field.

1. Employee participation. A written plan for involving employees in the hazard analyses and the development of the other elements.
2. Process safety information (PSI). Documented chemical hazards, process technology, and equipment data, the reference library everything else draws on.
3. Process hazard analysis (PHA). A systematic team study of what can go wrong in the process, revalidated at least every five years.
4. Operating procedures. Written, current procedures for each phase of operation, from startup to normal to emergency shutdown.
5. Training. Initial and refresher training for each employee operating a covered process, with documented understanding.
6. Contractors. Selecting, informing, and overseeing contractors who work on or near covered processes.
7. Pre-startup safety review (PSSR). A confirmation, before introducing hazardous chemicals to a new or modified process, that safety systems are in place.
8. Mechanical integrity. Inspection, testing, and maintenance of the equipment that keeps hazardous chemicals contained.
9. Hot work permit. A permit system controlling welding, cutting, and other ignition sources near covered processes, closely tied to energy control.
10. Management of change (MOC). A review of any change to process, chemicals, equipment, or procedures before it is made.
11. Incident investigation. Prompt investigation of incidents and near misses that did or could have resulted in a catastrophic release.
12. Emergency planning and response. A plan for responding to releases, coordinated with the facility emergency action plan.
13. Compliance audits. An evaluation of PSM compliance at least every three years.
14. Trade secrets. Making the information needed for the other elements available to those who need it, even when it is proprietary.

Two elements draw the most citations because they are where discipline slips over time: management of change and mechanical integrity. A change made without an MOC review is how a system quietly drifts outside the envelope the PHA studied, and a mechanical-integrity program that exists in a binder but not in the field is how a corroded line fails. OSHA also cites missed PHA revalidations frequently, since the five-year clock is easy to lose track of. A useful gut check for any covered facility: if you can show an inspector current process safety information, a clean and complete MOC log, an on-schedule mechanical-integrity record, and on-time PHA revalidations, you have already answered most of what an audit will ask.

How does PSM relate to EPA's Risk Management Program?

They are two halves of the same idea, split by who they protect. OSHA's PSM protects workers inside the fence; EPA's Risk Management Program (RMP), under 40 CFR Part 68, protects the community and environment outside it. The two rules came out of the same Clean Air Act Amendments and share much of their DNA: RMP's prevention program is built on the same kind of hazard analysis, operating procedures, mechanical integrity, and management of change. Many facilities that cross a PSM threshold also cross an RMP threshold and run both programs together, with a single set of procedures serving both audiences.

How do you keep a PSM program from decaying?

PSM programs fail slowly, through drift, not through a single bad decision. The defenses against drift are the discipline elements: an MOC that actually catches every change before it happens, a mechanical-integrity program whose inspections happen on schedule and get closed out, on-time PHA revalidations, and honest three-year compliance audits. Route every process near miss into incident investigation, and let a safety audit sample whether the field matches the paperwork. Where non-routine work touches a covered process, a documented pre-task plan and a pre-startup safety review are the last gates before hazardous chemicals move.

What do the numbers say?

The scope and stakes of PSM, from primary sources:

• The full standard, including the fourteen elements and Appendix A chemical list, is OSHA 29 CFR 1910.119.
• The companion community rule is EPA's Risk Management Program under the Clean Air Act; see EPA's Risk Management Program (RMP) and 40 CFR Part 68.
• Investigations of major chemical incidents are published by the U.S. Chemical Safety Board at csb.gov and nearly every report maps the failure back to one or more PSM elements.

The through-line in those CSB reports is rarely a mystery hazard. It is a known hazard whose control element, an MOC, a PHA action item, an integrity inspection, quietly stopped working. PSM is the system for keeping those elements alive.

That is exactly where PSM programs struggle in practice: the fourteen elements generate mountains of documents, PSI, PHAs, MOC records, integrity data, audit findings, that live in separate systems and binders, so a reviewer cannot see whether an open PHA action was ever closed. Harmony is an AI-native layer that connects machines, software, and paperwork into one operational layer, with no rip-and-replace. PSM records become structured, searchable data, and AI search returns cited answers across procedures, logs, and change records, so "which MOCs are open on this unit, and are their PHA actions closed" is a question, not a week of digging. It is the everyday shape of connected worker technology and it is not a safety-compliance product. Harmony's digital workflows move those records and handoffs into that structure; the CLS case study shows the pattern on the operations side.