Safety Norms: Industrial Instrumentation and Plant Engineering

1Purpose, Scope, and Safety Principles

These norms set minimum expectations for anyone who designs, installs, calibrates, tests, maintains, modifies, or decommissions process instruments, analyzers, control loops, transmitters, control valves, safety instrumented functions, and the plant engineering that connects them to process equipment. The scope includes employees, contractors, supervised students, and engineers who review field work remotely, as well as any visitor who enters an instrument or control area.

The governing principle is that process safety depends on the instrument performing as designed. A miscalibrated level transmitter, a bypassed high pressure trip, or an unlabeled impulse line can produce the same consequences as a mechanical failure. Work is planned to keep people out of harm first, then to protect equipment, product, and the surrounding environment.

• Mandatory rules use the word must and apply without exception unless an approved management of change procedure authorizes a documented deviation.
• Recommendations use the word should and reflect good practice that local management may adapt to site conditions.
• Where a law, standard, code, or manufacturer instruction applies, it takes precedence over this document and must be verified against the current version.

2Roles, Competence, and Accountability

The plant owner or operator is accountable for the overall safety management system. The instrumentation and controls lead owns the instrument register, calibration program, loop documentation, and trip settings. The process or engineering lead approves design changes. The permit issuer, usually an operations supervisor, authorizes work on live systems and confirms that isolations are complete. The permit holder directs the work crew on site and stops work when conditions change. Each role must be named in writing so that no task falls between departments.

Competence is demonstrated, not assumed. A technician who is skilled on pneumatic valves may not be competent on safety instrumented logic, radar level gauges, or energized marshalling cabinets. Authorization should be specific to equipment family, hazard level, and site procedures.

• Only persons who have completed documented training on the specific instrument family, plant hazards, isolation methods, and lockout procedures may perform work on that equipment.
• Electrical work on circuits above limits set by local rules must be performed only by licensed or qualified electrical personnel as required by local law.
• Work on safety instrumented systems must be performed only by personnel authorized by the functional safety lead, and every logic change requires independent verification.
• Anyone may stop work when conditions differ from the approved permit, and no worker may be penalized for doing so in good faith.
• Contractors must provide evidence of competence, site orientation, and insurance or other coverage required by local law before mobilization.
• Supervisors must confirm that the crew understands the hazards of the task at the pre job briefing, not only that the paperwork is signed.

3Hazards and Risk Assessment

Typical activities include field installation of transmitters and analyzers, calibration with pressure and electrical test equipment, loop checks, control valve maintenance and stroke testing, cable and junction box work, control cabinet and marshalling panel work, startup and commissioning, and tie ins to live process piping. The people involved include instrument technicians, electrical staff, operators, process engineers, contractors, and visitors. The tools include hand tools, multimeters, HART communicators, pneumatic and hydraulic pressure pumps, portable calibrators, drills, lifting slings, and portable gas detectors.

Realistic hazards include the release of toxic, flammable, corrosive, or pressurized process fluid when impulse lines, seal pots, or transmitters are removed. Other hazards include stored energy in springs, pneumatic actuators, hydraulic accumulators, and capacitors, electrical shock and arc flash in cabinets, ignition when enclosures are opened in a classified hazardous area, exposure to radiation from nuclear level gauges, falls from platforms and tubing racks, and unplanned plant trips caused by bypassed or incorrectly tested logic. Each hazard must be identified before work begins.

• High risk: work on process pressure boundaries, safety instrumented systems, or energized control power. Requires a written permit, verified isolation, lockout, and a second competent person.
• Medium risk: calibration or replacement on de-energized loops in controlled areas. Requires a written procedure, a task risk assessment, and supervisor sign off.
• Low risk: visual inspection from ground level with no process contact and no energized parts exposed. Requires a pre job briefing and a documented hazard check.
• A risk assessment must be completed before work starts using a documented method such as a job hazard analysis, and it must be reviewed whenever conditions, personnel, or equipment change.
• Radioactive source work, confined space entry, and work inside classified hazardous locations must be referred to specialist authorization and are not covered as routine tasks in this document.
• Assessors must record the likelihood and severity of each credible scenario, the controls relied upon, and the residual risk accepted by the named authority.

4Preventive Controls and Safe Work Practices

Controls follow the hierarchy of elimination, substitution, engineering controls, administrative controls, and personal protective equipment. Where practical, instruments should be calibrated on a bench, or in the field using remote impulse isolation valves, double block and bleed arrangements, or manifolds designed for the service. Field work should never depend on personal protective equipment alone. Remove the hazard first, then protect the worker from what remains.

Safe work depends on disciplined sequence. The permit identifies the isolation points, the test method, the required barriers, and the expiry time. The crew confirms each step before the next begins, and the permit holder remains present for the duration of the work. If a step cannot be verified, the work stops until the permit issuer assigns a revised method.

• Issue a written work permit for any work that disturbs process pressure boundaries, energized circuits, or safety functions. The permit names the isolation points, hazards, tests, and the time it expires.
• Isolate and verify. Close and lock block valves, use double block and bleed where designed, depressurize, drain, and prove zero energy with a calibrated test instrument before breaking any connection.
• Lock out and tag out electrical, pneumatic, hydraulic, and mechanical energy sources. Each worker applies a personal lock, and no one removes another person's lock.
• Do not bypass trips, alarms, or interlocks without a documented bypass authorization, a defined time limit, compensating measures, and a restoration check signed by operations.
• Coordinate with the control room before forcing outputs, stroking valves, or testing trip loops. Verify that valves, actuators, and final elements move to their defined safe positions.
• Confirm instrument tags, tubing, and wire numbers against current drawings before disconnecting. Mislabeled tubing and wiring are a recognized cause of incidents and must be checked, not assumed.
• Use test equipment rated for the circuit, voltage, and range. Confirm that calibrators, multimeters, leads, and fuses are within their calibration and inspection dates before use.
• Never open an instrument enclosure in a classified hazardous area unless the area has been confirmed as safe for the work, or the equipment is rated for the classification, as verified by the site authority.
• Use a second competent person for work at height, near stored energy, in confined spaces, or when the work area is remote from the control room.
• Keep the work area clear, mark exclusion zones around pressurized or energized work, and remove trip hazards from walkways and platforms.
• Handle heavy transmitters, valve actuators, and cabinet panels with lifting equipment or mechanical aids where practical, and follow the site manual handling rules.
• Changes to set points, logic, wiring, or configuration follow management of change, with a recorded risk review, an independent check, and approval before implementation.
• Hot work near instruments, cable trays, or tubing must follow the site hot work permit and atmospheric testing requirements, and it must not start until the fire watch is in place.

5Equipment, Environment, Information, and Protective Safeguards

Personal protective equipment is the last line of defense and must be selected against the documented hazard assessment. Typical equipment includes safety glasses or goggles for tubing and gauge work, face shields for pressurized or chemical service, flame resistant clothing where flash fire is credible, arc rated clothing and insulated tools for energized electrical work, chemical resistant gloves matched to the process fluid, hearing protection near venting, and fall protection on elevated work. Specific ratings for arc flash, voltage, flame resistance, and fall arrest are set by local standards and the site electrical safety program and must be verified with qualified professionals.

Environmental and information safeguards are equally important. Drained process fluid, flushing water, desiccant, mercury containing devices, and radioactive or chemical wastes must be captured and labeled. Access to instrument configuration files, network diagrams, and safety logic must be restricted to authorized staff.

• Gas detection: test the atmosphere before opening process connections and while working near potential releases. Alarm levels and response actions follow the site procedure.
• Environmental protection: capture drained fluids in approved containers, purge lines to closed systems or flare where designed, and never discharge process fluid to drains or soil.
• Spill response: keep absorbent material, containers, and labeled waste bags at each work location, and report spills to the supervisor immediately.
• Information security: instrument configuration backups and safety system logic should be access controlled, and remote access to control systems must be authorized, time limited, and logged.
• Privacy and confidentiality: photographs of plant drawings, control screens, network addresses, or personal data collected during site work should not be shared outside approved channels.
• Hygiene: wash hands before eating or drinking, and decontaminate tools and clothing exposed to process chemicals before leaving the work area or entering canteen spaces.
• Tools and cables: inspect insulation, test leads, hoses, and tubing fittings before use, and remove damaged items from service with a clear tag.

6Incident Reporting, Emergency Response, and Escalation

Every injury, leak, spill, alarm failure, unplanned trip, and near miss must be reported to the supervisor and entered in the site incident system before the end of the shift. A near miss, such as a loose impulse fitting that did not release fluid, is a warning sign and should be investigated with the same care as an injury.

Emergency actions must be rehearsed through the site emergency plan. Emergency services and trained responders handle fires, toxic releases, electrical injuries, confined space events, and fall rescue. Workers must not attempt rescues for which they have not been trained and equipped, because a second casualty is a common result of improvised rescue.

• Stop work immediately if an unexpected release, unplanned energization, abnormal reading, or unexpected valve movement occurs. Make the area safe and move people upwind or to the assembly point.
• Activate the emergency stop or call the control room using the site designated method, and state the location and hazard clearly.
• Call site emergency services and the emergency coordinator, and provide the location, nature of the hazard, and number of casualties.
• Do not reset trips, bypass alarms, or re energize equipment until the permit holder and operations confirm that the cause is controlled.
• Notify environmental and regulatory contacts when releases exceed reporting thresholds set by local law. Thresholds vary by jurisdiction and must be verified with the competent authority.
• Preserve failed parts, tags, and data logs for investigation where it is safe to do so, and record what was changed during the response.
• Escalate any incident involving a safety instrumented function, a bypassed trip, or a suspected design fault to the functional safety lead and engineering management the same day.

7Records, Training, Inspection, and Review

Records prove that controls work and support audits, investigations, and continuous improvement. The instrument register, loop drawings, calibration certificates, bypass logs, permit records, training files, competence records, and management of change approvals should be maintained in a controlled system with version control and clear ownership.

Training must be practical and tied to the actual equipment on site. Refresher training should follow procedure changes, incidents, new equipment, and extended absence from the role. Competence checks should observe real tasks, not only written tests.

• Calibrate test instruments on the interval defined by the manufacturer and local program, and tag each item with its due date. Remove out of date instruments from service.
• Inspect permits, lockout devices, tags, and PPE before each use. Damaged items must be removed from service and recorded.
• Conduct a documented safety walkthrough of live areas at the frequency defined by site procedure, and record corrective actions with owners and due dates.
• Perform proof testing of safety instrumented functions at intervals defined by the functional safety assessment, and retain the results.
• Review all bypasses at the end of each shift, and confirm that each bypass has been restored or formally extended under the same authorization process.
• Review this norms document and the local procedures at least annually and after any major incident, audit finding, or significant change to plant technology.

Implementation checklist

• Confirm the task is covered by a written permit and that the permit holder and issuer are named.
• Verify the training and competence records for everyone assigned to the task.
• Complete a documented job hazard analysis and hold a crew briefing before work starts.
• Isolate, depressurize, drain, and prove zero energy with a calibrated test instrument.
• Apply personal locks and tags to every energy source, and confirm each lock holder is identified.
• Confirm any trip bypass is authorized, time limited, logged, and scheduled for restoration.
• Select PPE and complete gas testing that match the assessed hazard and the process fluid.
• Identify drained fluids and set up waste containment before opening any connection.
• Know the emergency stop, assembly point, and how to reach the control room and emergency services.
• Report every incident, leak, and near miss before the end of the shift.
• Restore systems and complete a documented functional check before returning equipment to service.