Process safety engineering protects people and the environment from major hazardous process events. A replacement component may fit physically while being unsuitable for the chemical or conditions it will encounter. Preventing that kind of failure requires design evidence, effective barriers and disciplined control of changes—not just an ordinary maintenance sign-off.
This guide explains hazard analysis, process containment, safeguards, safety-instrumented functions, mechanical integrity, management of change and startup readiness, including Singapore’s Major Hazard Installation safety-case requirements. The gold standard is prevention demonstrated in the actual facility, not an incident-free slogan.
This is distinct from Engineering Risk Assessment Services and complements Chemical Engineering, Control Systems Engineering and the Engineering hub.
What credible process safety requires
- A current description of the actual process, hazardous materials and equipment.
- Assessment of credible major-accident scenarios and meaningful consequences.
- Preventive and mitigating barriers with justified functions and evidence.
- Qualified management of process changes, maintenance and startup readiness.
- A route from findings and abnormal conditions to accountable intervention and learning.
Follow hazardous-process decisions through the lifecycle
1. A component that fits may still be wrong for the process
A plant needs to replace a worn seal on equipment carrying a chemical. The replacement has the correct dimensions and the maintenance work order is signed. Before restarting, a technical reviewer notices that the substitute material was never evaluated against the actual process fluid and temperature. The component can fit perfectly yet undermine the intended containment barrier. A favourable mechanical check alone has not proved that the process is ready.
Process safety engineering focuses on preventing and mitigating major hazardous releases, fires, explosions and other process-related loss-of-control events where applicable. It joins chemical and physical design, equipment integrity, protective systems, operating limits, human responsibilities and emergency arrangements. It differs from general occupational safety because a process event can affect many people or the environment beyond the worker performing the immediate task.
The gold standard is not a plant with the longest period since a recorded accident. It is a system that knows its major hazardous scenarios, can justify the effectiveness of preventive and mitigating barriers, controls technical changes and learns before small weaknesses become connected major events.
Back to contents · Next chapter
2. Recognise the difference between process safety and everyday occupational hazards
Slips, lifting, traffic and other workplace hazards matter, but they do not fully describe a plant that handles substantial hazardous inventories or energies. Process safety asks how containment, control or critical functions could be lost and what consequences would follow. A facility can have a low rate of minor injuries yet possess poorly understood major-accident vulnerabilities.
An appropriate programme identifies whether the activity and substance inventory place it within a particular regulatory category. It then defines the relevant hazard scenarios and prevention arrangements. A warehouse storing a small quantity of one substance and a petrochemical complex can have different obligations, so generic statements about all ‘chemical facilities’ are misleading.
Singapore MOM’s Major Hazard Installation Safety Case Regime applies to workplaces meeting the relevant activities and dangerous-substance thresholds. It includes refining, petrochemical, chemical processing and certain storage or use installations. Not every site with a cleaning chemical is an MHI.
Back to contents · Next chapter
3. Start with the process and materials that actually exist
A safety case depends on a trustworthy description of the system: relevant materials, inventories, process characteristics, equipment, controls and interfaces. If the process information is outdated or incomplete, even a sophisticated hazard workshop may miss the current situation. The team needs accurate diagrams and a shared understanding of where hazardous material and energy may be present.
Changes in feedstock, operating duty or product composition can affect what the original protective arrangements were designed to handle. Engineers should distinguish design intent from as-operated condition, including temporary modifications. The correct process boundary should include supporting utilities whose failure could affect containment or control.
The U.S. OSHA 29 CFR 1910.119 identifies process safety information including materials, technology, equipment, relevant drawings and safety systems for covered processes. Its legal scope is American; in Singapore the applicable MHI and other national obligations must be established separately.
Back to contents · Next chapter
4. Process hazard analysis must ask how the scenario unfolds
A process hazard analysis considers how operating conditions, equipment faults, human actions or external disturbances could lead to dangerous deviations. Methods differ by complexity and include suitable structured reviews. The value comes from asking technically meaningful questions about the real process, not counting the number of scenarios added to a spreadsheet.
An analysis should identify credible consequences and the barriers believed to prevent or mitigate them. It must also recognise assumptions and the knowledge needed to judge those barriers. A workshop can be informative yet insufficient where the data or expertise needed for a consequential decision are missing.
The AIChE Center for Chemical Process Safety Risk Based Process Safety framework describes four pillars and 20 elements covering commitment, understanding hazards, managing risk and learning. It provides a way to organise continuous responsibilities, not a one-time certificate that every hazard has been removed.
Back to contents · Next chapter
5. Preventive and mitigating barriers have different jobs
Some safeguards aim to prevent an initiating event or a release; others aim to reduce harm after an event develops. They may be physical, instrumented, procedural or organisational depending on the hazards and governing standards. Calling every measure a ‘layer’ without proving its function or dependencies creates false assurance.
An alarm does not independently prevent a major event unless a person can recognise, interpret and respond within the conditions required. Two devices powered by the same unavailable system are not necessarily independent barriers. An emergency measure may reduce consequences but does not mean the original containment can be neglected.
Singapore MOM’s safety-case preparation guidance includes instructions and references on ALARP demonstration, adequacy of barriers, safety instrumented systems and human factors for MHIs. Those specialised decisions belong to qualified teams and applicable regulatory requirements.
Back to contents · Next chapter
6. Mechanical integrity is a living record of physical condition
Pipes, vessels, pumps, valves and other equipment can be affected by deterioration, damage or changes in the process. A material certificate at purchase time does not demonstrate the actual condition several years later. The integrity programme needs a relevant understanding of how equipment can fail and the evidence that it remains suitable for its task.
Inspection plans should follow plausible damage mechanisms and applicable technical rules. A visually clean surface may conceal a local issue, while a repeated alarm may be caused by process conditions rather than a defective sensor. Serious findings need qualified assessment, prioritisation and an authorised disposition.
The Engineering Asset Integrity Services guide covers the condition-to-decision chain. Process safety adds the major-event consequences of losing containment or a necessary protective function.
Back to contents · Next chapter
7. Control systems and safety systems have distinct acceptance duties
Ordinary process control aims to maintain production within the desired operating conditions. Safety-related protective functions can have separate roles when specified hazardous conditions occur. A normal controller behaving correctly does not by itself establish that every protective system meets its independent safety obligation.
Engineering must consider the required function, relevant failure modes, independence, testing and maintenance within the proper sector framework. The IEC 61511-1:2016 with Amendment 1:2017 is a published process-industry safety-instrumented-system standard. Its application requires qualified safety engineers and the appropriate lifecycle methods rather than using its name as a replacement for an actual assessment.
The Control Systems Engineering article explains why a valid signal is not always a correct process conclusion. Process safety engineering extends this reasoning to the effectiveness of barriers with potentially serious consequences.
Back to contents · Next chapter
8. Management of change protects assumptions people can no longer see
Process facilities are continually modified. Equipment may be replaced, material changed, capacity raised or a control program revised. A change described commercially as ‘like for like’ may still alter important physical properties. The organisation must establish which differences are technically significant under its applicable rules.
Before assuming a new configuration remains acceptable, qualified reviewers need to consider the technical basis, related hazards, operating information, personnel and necessary verification. Changes can interact with each other over years, so records must allow engineers to reconstruct the system that actually exists.
OSHA 1910.119 includes management-of-change duties for covered processes, including changes to equipment, chemicals, technology and procedures beyond permitted replacement in kind. In Singapore, the MHI safety-case review framework also addresses significant modifications and cumulative changes. An approved purchase order is not equivalent to a process safety acceptance.
Back to contents · Next chapter
9. A pre-startup review should challenge what has changed
After a new process or a significant modification, pressure to restart can be intense. A project may have completed equipment installation while required procedures, design information, training or previously identified safety actions remain unfinished. This is precisely when an organised readiness decision matters.
An appropriate pre-startup review confirms that applicable requirements for the current configuration are met before normal use resumes. The U.S. OSHA process-safety rule sets particular expectations for covered processes; these must not be copied as a universal legal checklist. The actual scope and approvals follow the governing rules for the installation.
The strongest review asks what the modification changes, whether the relevant barriers and interfaces were verified, what remains open and who has authority to accept the result. A team should not change an acceptance criterion merely because a production target is approaching.
Back to contents · Next chapter
10. Operating procedures must correspond to real equipment
A written procedure can be technically correct for the original design and misleading after years of changes. Operators may find instruments renamed, equipment substituted or an alarm behaving differently. Process safety therefore depends on version-controlled instructions that correspond to the actual arrangement.
Operators and maintainers should help identify mismatches between documentation and physical reality. Where a required task is difficult under real working conditions, the organisation should investigate the design and human factors rather than assume that another training reminder resolves the problem.
The Human Factors Engineering guide explores workload and interfaces. In a major-hazard process, unclear information can weaken a control that a designer thought was dependable.
Back to contents · Next chapter
11. Contractors share technical hazards even when contracts separate tasks
Maintenance, cleaning, construction and specialist testing can introduce temporary configurations and personnel unfamiliar with the normal plant. An employer and contractor may each meet their narrow contractual obligations while neither recognises an interface affecting a hazardous process. The result can be a serious communication gap.
Responsibilities should include relevant hazard information, supervision, permitted work, reporting of unusual conditions and how the plant is returned to its approved state. The legal duties depend on jurisdiction and the role of each party. Good cooperation makes the actual physical risks understandable before they become problems.
Incident reporting and near-miss findings should not stop at the contracting company that first observed them. A concern about plant condition belongs in the owner’s technical review process and may affect other equipment.
Back to contents · Next chapter
12. Emergency preparation must connect plant staff with outside responders
Even strong prevention arrangements cannot be described as eliminating every conceivable event. Emergency planning considers the consequences of credible hazardous scenarios, relevant protective actions, communication and the resources that may be needed. Site teams and external agencies can hold different responsibilities.
In Singapore, MOM describes the Major Hazards Department as a joint-government function led by MOM with NEA and SCDF participation. Its remit includes safety-case assessment, verification and incident coordination for MHIs. That coordination illustrates why major process events are not confined to one company’s internal safety department.
A credible preparedness programme identifies roles and practises appropriate arrangements under the actual statutory system. A binder of emergency phone numbers alone cannot show that the necessary decisions and communications will work.
Back to contents · Next chapter
13. Safety culture can be observed through the response to inconvenient evidence
A plant can report years without a major incident and still have open safety actions, bypassed controls or maintenance findings requiring attention. Absence of a catastrophe during the measurement period is not proof of strong process safety. Good leadership asks what could be deteriorating unnoticed and ensures important concerns can reach qualified reviewers without fear of retaliation.
AIChE CCPS places commitment to process safety and learning from experience among the foundations of its framework. These are practical expectations: allocate competent resources, address identified deficiencies, involve workers and examine how decisions are affected by production pressure.
Management should distinguish legitimate protective equipment responses from avoidable interruption. Rewarding only uninterrupted output can encourage the wrong behaviour if staff feel pressured to dismiss alarms or postpone necessary work.
Back to contents · Next chapter
14. Leading and lagging indicators must be interpreted together
Lagging measures report events that already occurred; leading indicators can describe the state of important preventive work or controls. Neither alone proves that every risk is acceptable. Counting inspections completed is useful only when those inspections were relevant and serious findings reached a decision.
The CCPS Process Safety Metrics resource includes leading- and lagging-indicator guidance, with a published Version 4.1 from June 2022. Its methods can support learning when definitions and context are transparent. An organisation should not improve its metric simply by making it harder for workers to report problems.
Useful reviews examine recurring impairments, overdue critical actions, changes to barriers and how management responded. The goal is improved control of the physical hazards, not a presentation full of agreeable numbers.
Back to contents · Next chapter
15. Learning from incidents requires a mechanism-based investigation
Following a process event, technical teams need to protect people, preserve relevant evidence within lawful arrangements and distinguish observed facts from hypotheses. A damaged component may be the last visible link in a longer chain involving process conditions, equipment, controls and organisational decisions.
An investigation should consider whether similar assets or barriers share the mechanism and whether the remedy affects the original source of risk. Replacing one part may restore operation but fail to address a process change or inadequately understood corrosion condition. The appropriate corrective measures require technical evaluation and verified closure.
The Engineering Failure Analysis Services article explains evidence before blame. Process safety integrates those lessons into major-hazard prevention, design reviews and continuing management of change.
Back to contents · Next chapter
16. Singapore safety cases are ongoing legal responsibilities
Under the Singapore MHI framework, the safety case is a structured demonstration of how major-accident risks are identified, prevented and mitigated. It is not merely an annual filing of the latest risk matrix. Relevant companies must maintain, review and revise their case according to the governing regulations and directions.
MOM’s Preparing for Safety Case guidance states that safety cases must be reviewed every five years and when new knowledge or modifications require it; significant modifications require appropriate regulator engagement. Site verification checks implementation of stated measures. The actual obligations and classifications are project-specific.
A successful safety-case programme keeps current evidence of barrier performance, qualified ownership and action on regulator findings. A polished report cannot substitute for the real plant being operated and maintained in the manner the case assumes.
Back to contents · Next chapter
17. The process safety gold standard is dependable containment and learning
Process safety engineering earns trust by combining physical design with risk understanding, reliable barriers, competent people and continuing evidence. It is strongest when it is willing to revisit old assumptions as materials, equipment and operations change.
Review the chain from process information and credible hazardous scenarios through barrier design, mechanical integrity, independent protection, management of change, startup readiness, operations, emergency preparation and learning. Every significant action should reach a responsible decision-maker and be verified within its authorised scope.
The gold standard is not a claim that industrial hazards have disappeared. It is a facility whose major risks are continually understood and reduced under the relevant framework, with transparent responsibility and technical evidence rather than reassuring slogans.
Worked scenario: the replacement seal whose dimensions matched
This is a fictional management example, not technical instructions for chemical plants. Maintenance replaces a seal on a piece of process equipment using an item that fits. During a pre-startup review, a specialist identifies that its material suitability for the actual fluid and operating condition was not established. The appropriate authorised team needs to evaluate the material and process-safety implications and the relevant management-of-change obligations before accepting the configuration.
| Stage | Apparent success | What the process safety programme must establish |
|---|---|---|
| Procurement | Replacement item fits the opening | Suitability of the exact material and component for the process |
| Maintenance | Work order closed | Current physical condition and approved installation |
| Change review | Described as ‘like for like’ | Whether important original design properties really remain equivalent |
| Protection | Alarms and barriers appear in diagrams | Whether their functions and dependencies remain valid |
| Startup | Project team wants to restart | Required professional and regulatory readiness evidence |
| Learning | No release happened | Supplier controls, technical records and future change screening improved |
Questions for a process safety design or assessment team
- Which major hazards and legal regime actually apply to this installation?
- Are the process information and as-built equipment records current?
- Were hazard scenarios and barrier functions evaluated with suitable expertise?
- Can important protective measures perform as assumed under credible faults?
- Do material substitutions and changes trigger the necessary qualified review?
- Are operating, maintenance, contractor and emergency arrangements aligned with the real plant?
- Do serious findings and safety-case obligations result in verified action?
Official Singapore, OSHA and CCPS references
- Singapore MOM — Major Hazard Installation Safety Case Regime
- Singapore MOM — Safety Case Preparation, ALARP, Barriers and Review Duties
- Singapore MOM — Major Hazards Department and Multiagency Oversight
- AIChE CCPS — Risk Based Process Safety: Four Pillars and 20 Elements
- AIChE CCPS — Leading and Lagging Process Safety Metrics
- US OSHA — 29 CFR 1910.119 Process Safety Management (US Scope)
- IEC 61511-1:2016+A1:2017 — Process Safety Instrumented Systems
- eduKate — Engineering Asset Integrity Services
- eduKate — Engineering Failure Analysis
- eduKate — Sectors and Services Directory
Process safety management can involve hazardous materials, high-consequence industrial events and legally defined obligations. This educational reference is not a process operating procedure, safety-case approval, equipment change authorisation or proof of a particular barrier’s adequacy. Qualified duty holders, engineers and regulators must make those decisions. Return to the Gold Standard master hub.